Privacy Policy

Last updated: 2 November 2026

This is an English translation provided for convenience. Only the German version at https://thethingswelearn.com/datenschutzerklaerung is legally binding.

This privacy policy applies to thethingswelearn.com and the Bildungslandkarte Österreich (Education Map of Austria) at bildungslandkarte.thethingswelearn.com. It explains which personal data we process, for what purposes and on what legal basis, and what rights you have.

1. Controller

Adib Reyhani, trading as The Things We Learn e.U.

Vivenotgasse 3, 1120 Vienna, Austria

Email: [email protected]

For data protection questions and to exercise your rights, you can reach us at [email protected].

2. General information

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). We do not sell personal data.

You can visit our websites without registering. Technical data is processed when you do so, in particular your IP address. In forms, mandatory fields are marked as such. Without the required information, we cannot process the respective request or registration; additional information is voluntary.

3. Hosting and technical logs

Both websites and the form functions of the Bildungslandkarte are provided via Cloudflare. For service providers and international data transfers, see section 11.

When you access the websites, technical connection data is processed, in particular IP address, time, requested page, browser and device information and, where applicable, the previously visited page. This is necessary for delivering, troubleshooting and securing the websites. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functioning web presence.

Cloudflare processes connection data for both websites and provides us with zone and security statistics on requests and countries of origin. These server-side functions are to be distinguished from the visitor measurement in section 5; further retention by the provider is governed by its technical and contractual terms.

4. Cookies, local storage and withdrawal

We use cookies and local browser storage, among other things to store your consent decision. Where storage or access is strictly necessary for transmitting a message or for a service you have expressly requested, no consent is required under § 165(3) TKG 2021. Other storage and access that require consent need your prior consent.

On both websites, Google Analytics is only activated after you consent. Fonts are loaded from our own server. Your choice is stored in the cookie “ttwl-consent” as “necessary” or “all” for twelve months. The cookie applies to both websites so that we only need to ask you once.

You can change or withdraw your consent at any time with effect for the future: on thethingswelearn.com or on bildungslandkarte.thethingswelearn.com, open “Cookie settings” (“Cookie-Einstellungen” on the German pages) in the footer and choose “Necessary only” (“Nur notwendige”).

This does not affect the lawfulness of processing carried out before the withdrawal. Your choice is specific to your browser; on other devices or in other browsers, a separate choice may be needed. After you clear your browser storage, you may be asked again.

After consent, Google Analytics sets “_ga” and “_ga_2RP02BNLQC”. They apply to thethingswelearn.com including the Bildungslandkarte; the observed lifetime was about 13 months and may vary depending on the browser. These cookies are deleted when you withdraw consent. Cloudflare Web Analytics is no longer used on either website.

If you switch between light and dark mode on the Bildungslandkarte, this choice is stored in your browser’s local storage under “blk-theme”. This only serves the display you have chosen; the value is not transmitted to us.

5. Statistics

5.1 Google Analytics

On both websites, with your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us understand how our websites are used. For this purpose, page views, interactions and device and browser information in particular are processed, and cookies are used for recognition. Your IP address is processed during the connection. Processing by Google LLC in the USA is possible; see section 11. The legal basis is your consent under Art. 6(1)(a) GDPR and, for access to your device that requires consent, § 165(3) TKG 2021. You will find how to withdraw consent in section 4.

For our Google Analytics property, the retention of user- and event-level data is set to two months; this period is reset with new activity. Google Signals, the collection of granular location and device data, and data sharing with Google are disabled.

5.2 Visitor counting without cookies

On both websites, we also count page views with our own simple counter. It sets no cookies, stores nothing in the browser and assigns no identifier; individual visitors are not recognised across several pages or several days. With each page view, your browser transmits the page visited, the name of the previously visited website (e.g. “google.at”, without the exact address) and, where applicable, a campaign identifier from the link (“utm_source”). Our form function at Cloudflare adds the country that Cloudflare derives from the IP address and the device class (smartphone, tablet or computer) from the browser identifier. IP address and browser identifier are only evaluated at the moment of the page view for this purpose and are not stored. Only daily totals are stored, separated by page, origin, country and device class. These values are not linked to one another and do not allow conclusions about individual persons. The totals are kept in our Cloudflare account. The legal basis is our legitimate interest in measuring reach without user profiles (Art. 6(1)(f) GDPR). Since nothing is stored on or read from your device, no consent under § 165(3) TKG 2021 is required. You can object to the counting under Art. 21 GDPR, for example by blocking JavaScript for our websites or using a tracking blocker; the websites will continue to work.

6. Fonts

Both websites load their fonts from our own domains. No separate connection to a font provider is made.

7. Contact by email and telephone

If you contact us, we process the contact and content data you provide in order to handle your request. If it concerns a contract with you or pre-contractual measures taken at your request, the legal basis is Art. 6(1)(b) GDPR. We handle other requests, in particular from contact persons of an organisation, on the basis of our legitimate interest in communicating and responding to requests under Art. 6(1)(f) GDPR.

Our email communication runs via Google Workspace. There are no contact forms on thethingswelearn.com. Links such as “Send suggestion” (“Vorschlag senden”) or “Get in touch” (“Kontakt aufnehmen”) only open your own email program with a prepared message; we only receive it once you send the email.

Contact requests remain in our mailbox for handling and for any specific follow-up questions. No fixed automatic deletion period has currently been set up for this mailbox content. We keep documents subject to statutory retention for the applicable period; the seven-year period under § 132 BAO (Austrian Federal Fiscal Code) does not automatically apply to every contact request.

8. Contacting the child protection team

You can reach our child protection team by email at [email protected] or by telephone at the number given on the “Child Protection” page. For this, we process your email address or telephone number and the content of your message. A name is not required.

Please do not include a description of an incident or any names or other details about children or other persons involved in your first message. Details can be discussed in the personal exchange that follows. Making contact without giving a name is not the same as technical anonymity; the technical data described in this policy is generated when you visit the website.

Your contact data is processed to handle your concern. The legal basis is our legitimate interest in providing an accessible point of contact for child protection concerns, under Art. 6(1)(f) GDPR. Your concern is handled by the persons responsible for it; the technical service providers used are listed in sections 3, 7 and 11.

Messages to the child protection team and any subsequent communications are handled exclusively by the persons responsible. For existing cases and later case handling, the necessary protective measures and statutory retention obligations apply. These messages in mailboxes are currently not covered by the automatic deletion run for the Bildungslandkarte.

9. Bildungslandkarte Österreich (Education Map of Austria)

9.1 Public entries

The Bildungslandkarte shows educational programmes from Austrian organisations. The information comes from the organisations themselves or from publicly accessible sources, in particular their websites. Descriptions of the programmes, organisation details and contact options are published. The entries are publicly accessible on the internet.

Where the information relates to a person, for example contact persons named or personal business contact details, we base the processing on Art. 6(1)(f) GDPR. Our legitimate interest and that of the users lies in making suitable educational programmes findable and contact possible. The interests and reasonable expectations of the persons concerned are taken into account.

You can report incorrect information via “Eintrag korrigieren” (correct entry) on the listing or by email to [email protected]. You can object to processing based on legitimate interests on grounds relating to your particular situation. More on your rights is in section 13.

Some of the information comes from publicly accessible sources; other information was provided by organisations or by the persons concerned. Where personal business contact details are concerned, you can ask us at [email protected] to correct or remove them.

9.2 Submissions and corrections

For a submission, correction or removal, we process information about the educational programme, the organisation and the intended public contact options, and for a removal also the reason given. We use additional data about the person submitting for follow-up questions and to check their authority to represent the organisation. We do not publish this separate information; information entered as public contact details, on the other hand, may appear in the profile.

The legal basis for handling, checking and quality assurance is Art. 6(1)(f) GDPR. Our legitimate interest lies in a reliable Bildungslandkarte and in protection against unauthorised changes.

To protect against automated submissions, a hidden form field and a time value are used. This information is transmitted to our form function together with the submission; no external CAPTCHA service is integrated in the form reviewed for this purpose. Processing by our hosting and other service providers remains unaffected.

Mandatory fields are marked in the form. After submitting, you receive an email with a confirmation link. If, for a correction or removal, your email address does not match the organisation’s website, we send the confirmation link instead to the organisation’s contact address we hold for this listing. This email states your name, your email address and the listing concerned so that the organisation can confirm the change. Only after confirmation do we review the submission. Submissions and corrections are stored in a spreadsheet in Google Workspace. Access is limited to team members authorised to look after the Bildungslandkarte and a technical service account for the form function.

Entries, corrections or removal requests that reach us by email are also recorded in this spreadsheet, together with an excerpt of the message and a reference to the email in our mailbox.

The following rules apply to submissions: for unconfirmed submissions, the name and email of the person submitting, the copied school contact details, the confirmation code, the information on whom the confirmation was sent to, the excerpt of and reference to a message received by email, removal reasons and internal notes are automatically removed from the submissions spreadsheet after 30 days. For rejected submissions, this happens six months after the documented completion. For accepted submissions, this information remains as long as the listing is on the map and is removed after it is archived. The other data on the listing and the status of the submission may be kept for maintaining the map. Further copies and version histories are described in section 12.

9.3 Newsletter

If you sign up for news about the Bildungslandkarte, we process your email address and your consent to sign up. Consent is requested via a separate checkbox that is not pre-ticked. The legal basis for sending the newsletter is Art. 6(1)(a) GDPR in conjunction with § 174 TKG 2021. The actual sending of news has not yet been set up.

Sign-up uses a double opt-in procedure: after signing up, you receive an email with a confirmation link that is valid for seven days. Before you confirm, we do not create an entry in our newsletter spreadsheet. Your email address, sign-up time and source are contained in encrypted form in the confirmation link. To send the confirmation email, your address is transmitted to Resend; message and delivery data is also processed and stored according to the periods applicable to this service.

Only after you confirm do we add your address to the newsletter spreadsheet. We also store the time of sign-up and confirmation, the consent text used at sign-up with its version, the source, the sign-up status and a personal unsubscribe code. Confirming the same link repeatedly does not create an additional entry.

You can withdraw your consent at any time with effect for the future by sending a message to [email protected]. A personal unsubscribe link is also available: it leads to a page where you confirm unsubscribing. As soon as we send a newsletter, every message will contain such a link. This does not affect the lawfulness of processing carried out before the withdrawal.

When you unsubscribe, we set the status to “unsubscribed” and store the time. The email address and proof of consent remain stored for three years after unsubscribing in order to respect the withdrawal and to be able to prove any earlier consent to sending (Art. 6(1)(f) GDPR). After that, the email address, consent text, source and unsubscribe code are removed from the spreadsheet. Times and status remain without direct attribution to a person.

A dedicated newsletter sending service has not yet been chosen. Confirmation emails are sent via Resend; the provider periods named in section 11 apply to its message and delivery logs. Open and click tracking is currently not set up for the Resend domain used.

9.4 Technical service providers

We use the following service providers for the Bildungslandkarte:

AI-supported tools from Anthropic (Claude) are also used for the internal maintenance of the Bildungslandkarte. Information from submissions and our correspondence may be processed in the process. The legal basis is our legitimate interest in handling and quality-assuring the entries (Art. 6(1)(f) GDPR). Information on processing by Anthropic can be found in section 11.

Our websites contain links to other websites and social networks. If you follow such a link, the target website processes data according to its own privacy notices. A simple link is to be distinguished from embedded content, which may already connect to another provider when our website is opened.

11. Service providers and international data transfers

Depending on the website and function used, data is transmitted to the service providers named below. Where they process data on our behalf, agreements under Art. 28 GDPR apply. Individual processing operations, for example of account or operating data, may take place under the provider’s own responsibility.

The EU-US Data Privacy Framework is an adequacy mechanism under Art. 45 GDPR for covered transfers to participating US companies. Standard contractual clauses are a safeguard under Art. 46(2)(c) GDPR. US processing may also take place under a contract with a European company. Information on the safeguards used for our processing and, where applicable, copies of the relevant standard contractual clauses are available from [email protected].

Anthropic (Claude): personal information may be transmitted to Anthropic during the internal maintenance of entries and correspondence. Processing is governed by the product actually used and the terms applicable to it; processing in the USA is possible. Information: https://www.anthropic.com/legal/privacy. If you have questions about the safeguards applicable to a specific transfer, you can contact us at [email protected].

12. Storage period and deletion

We store personal data for specific purposes. The technical rules described below apply to submissions, newsletter data and archived listings. Other holdings, in particular mailboxes, working copies, version histories and backups, are not covered by this automatic deletion run.

Unconfirmed submissions are cleaned of the fields named in section 9.2 after 30 days. For rejected submissions, this happens six months after the documented completion; for accepted submissions, after the listing is archived. Archived listings are reduced to organisation name, link ID, reason and date after twelve months. Confirmed newsletter sign-ups remain stored until unsubscribing; three years after that, the personal fields named in section 9.3 are removed from the spreadsheet. According to its own information, Resend retains messages and logs on the plan used for 30 days and backups for seven days.

Older versions may still exist in the version history of Google Sheets, in email mailboxes, working copies and at service providers. No uniform technical deletion period has yet been implemented for these holdings. We handle deletion requests taking statutory obligations into account. Records subject to statutory retention remain stored for the respective mandatory period; longer storage to secure specific legal claims is limited to the data required.

13. Your rights

Subject to the statutory requirements, you have in particular the following rights:

Right to object: You can object at any time, on grounds relating to your particular situation, to processing under Art. 6(1)(f) GDPR. We will then no longer process the data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing at any time without giving such grounds.

Write to us at [email protected]. We generally respond to your request within one month. If the legally permitted extension is necessary, we will inform you of the reasons within that month.

You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the suspected infringement. In Austria: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, email: [email protected], website: https://dsb.gv.at.

14. Automated decisions

We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. The statistics and spam protection functions described remain unaffected by this.

15. Data security

The connection to our websites is encrypted using TLS. This is not end-to-end encryption of all subsequent processing steps. Please only include information in emails and forms that is necessary for your request. The special notes in section 8 apply to messages to the child protection team.

16. Changes

We update this privacy policy when our processing or the legal requirements change. The current version is made available on our website. Changes to this policy do not replace any new consent that may be required.