Privacy Policy

The data controller responsible for My Cybersteps is:

Cybersteps GmbH
Schloßstraße 50
12165 Berlin
Deutschland
Email: [email protected]

We collect and store the following personal data:

• Your name and email address, provided via your invitation.
• Your account credentials. Your password is stored as a secure hash and never in plain text.
• Your progress through course modules and sessions, the badges you earn, your top-3 places on the weekly leaderboard, and the days on which you handed in work or answered a quiz (your day streak).
• Login timestamps and activity logs for security purposes.
• Learning-activity signals: your submissions, review outcomes and quiz participation with their timestamps (kept as part of your course records, as described in this policy), and - when this collection is active - when you first open a course material and which areas of the platform you visit on a given day (deleted from the platform after 24 months; the school-operations system applies its own retention to data already shared with it). We use these solely to support your learning (e.g. so your tutor can reach out early) and to improve the course - never for grading or disciplinary decisions. These signals are shared, keyed by your student id, with our internal school-operations system for the same purposes.
• Information you voluntarily add to your student profile, such as your CV, professional experience, education, skills, certifications, LinkedIn profile, portfolio, and project information.
• Your consent preference regarding the sharing of your profile with selected employers and industry partners.
• Sick notes you hand in: the period you were unwell, the document you upload (with its file name, type and size), an optional comment, and when you submitted the note and when it was acknowledged. A sick note contains health data.

We process personal data as necessary to provide access to My Cybersteps and related educational services under Article 6(1)(b) GDPR, and to ensure the security, integrity, and operation of My Cybersteps under Article 6(1)(f) GDPR.

Sick notes are processed to perform your training contract and to meet our reporting duties towards a funding body (Article 6(1)(b) and (c) GDPR). Because a sick note contains health data, Article 9(2)(b) GDPR applies as well. Handing in a sick note is required by your training contract. Without one, the absence counts as unexcused.

We ask for two separate consents under Article 6(1)(a) GDPR, and each one is optional and independent of the other:

• Sharing your profile with selected employers and industry partners for internship and job opportunities.
• Sharing your career achievements and success stories through Cybersteps community and public channels.

You may give one without the other, and you may withdraw either one at any time without affecting the other. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

Your data is used exclusively to:

• Provide access to My Cybersteps and course content.
• Track your learning progress.
• Send you essential communications about your account or cohort.
• Ensure platform security and investigate unauthorized access.
• Create and maintain your student profile.
• Record and excuse your absence when you hand in a sick note. Only the student team in our school-operations system sees your sick notes, which it receives with your email address to match them to your student record. Where your training is funded by the Agentur für Arbeit or a Jobcenter, we report your absence days to them, as the funding rules require.
• Where you have provided that consent, share your profile with selected employers and industry partners for internship, employment, networking, and other career opportunities.
• Where you have provided that consent, share your career achievements and success stories through Cybersteps community and public channels. This may include an open audience, for example a public post or a newsletter.

Both consents are voluntary and separate. Choosing not to provide either of them, or withdrawing either later, will not affect your participation in the Cybersteps program.

The leaderboards show other students and staff the top 3 students of a cohort for the week and for the module, the top 10 students of the school for the week, and the top 30 students of the school of all time, and each student also sees their own row; a row shows the student by first name and the first letter of their last name, with their position, cohort and rank, their Cyberpoints (in total, this week, or as a share of their current module), and the number of their accepted projects and passed certificates, and our test accounts are never shown. A student can turn "Show me on the CyberSteps leaderboard" off in My Account under Settings, Privacy. They are then left out of every list other people see, and see their own row marked as only visible to them.

Personal data used to operate My Cybersteps is stored on servers located within the European Union. We use DigitalOcean as a data processor for hosting and database infrastructure under a data processing agreement, using the Frankfurt region.

The file of a sick note is stored in the storage of our school-operations system, in the Frankfurt region of DigitalOcean, the data processor named above.

Where you have provided consent, information included in your student profile may be shared with selected employers, internship providers, recruitment partners, and other Cybersteps industry partners.

These partners may process your information independently for recruitment and career-opportunity purposes.

Where you have provided the separate consent for achievements and success stories, that material is published by Cybersteps on its own community and public channels. This is publication to an open audience rather than a transfer to a named partner, so it can be seen, copied, and shared by anyone who reaches it.

Connecting your Discord account is optional. If you connect it on My Account, we store your Discord user id and Discord username. When automatic server joining is enabled, connecting also adds you to the Cybersteps Discord server. The Cybersteps Discord bot, run by our team, then receives your My Cybersteps user id, your Discord user id, your cohort and current module, the certificates you passed as Cybersteps records them (verified in the certification preparation app, recorded on your student record, or confirmed by the academic team), your Cyberpoints per module and in total, your rank and its tier, and whether you chose to show yourself on the CyberSteps leaderboard, so it can give you Discord roles. It receives no email address and no name. When you disconnect, we delete the link and the bot no longer receives your data.

We do not sell or share your personal data with third parties for unrelated marketing purposes. Where third-party tools are used, such as video conferencing for live sessions, only data strictly necessary for that service is shared.

We retain your personal data for as long as your account is active.

Sick notes are kept as long as we need them to document your attendance and as long as the law requires, and are then deleted. You can delete a note yourself until it is acknowledged.

If you withdraw your consent to profile sharing, Cybersteps will stop sharing your profile in the future. Withdrawal does not automatically delete information that was already lawfully shared with a partner.

If you withdraw your consent to sharing achievements and success stories, Cybersteps will not publish further material about you, and on request will remove material it still controls on its own channels. Cybersteps cannot recall material that others have already copied, reshared, or archived.

If you request account deletion, we will delete or anonymize your personal data within 30 days, except where we are required to retain it by law.

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data, also known as the right to be forgotten.
• Object to or restrict processing of your data.
• Receive your data in a portable format.
• Where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at [email protected]. We will respond without undue delay and within the time periods required by applicable data-protection law.

We use only essential cookies required for authentication and platform functionality. We do not use tracking, advertising, or analytics cookies.

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your local data-protection authority.