Buddyhere Privacy Policy

This Privacy Policy explains how Buddyhere collects, uses, shares, stores and protects personal data when you use our website, platform, accounts, matching, messaging, university-linked programme features, support, safety and any AI-assisted or automated features that are made available. This Privacy Policy should be read together with our Terms of Service, Cookie Policy and Safety Centre. Where a specific university-linked Programme or feature requires additional privacy information, we will provide a Programme-specific or feature-specific privacy notice.

1. Who we are

Buddyhere is operated by Sergey, Ilia & Abdelrahman GbR, Luisenstraße 53, 10117 Berlin, Germany. The partners are Sergey, Ilia, and Abdelrahman. Sergey, Ilia & Abdelrahman GbR provides a digital platform for university-linked buddy, mentoring, orientation, alumni, research, and peer-support programmes.

Address: Luisenstraße 53, 10117 Berlin, Germany.
General and privacy contact: info@buddyhere.de
Support and safety: help@buddyhere.de
Privacy enquiries and data-protection rights requests: info@buddyhere.de

Full company details are set out in our Impressum.

2. Who this Privacy Policy applies to

This Privacy Policy applies to people who use or interact with Buddyhere, including Buddies, Mentees, university coordinators, programme administrators, researchers, staff users, website visitors, support contacts and people mentioned in messages, reports or safety concerns.

Buddyhere is intended only for users aged 18 or over. If you are under 18, you must not create an account or use the platform.

3. Our role and university responsibilities

Buddyhere acts as a controller for processing activities for which it determines the purposes and essential means, including the operation and security of the Buddyhere platform and other processing activities identified in this Privacy Policy.

For university-linked Programmes, the data-protection roles of Buddyhere and the participating university depend on the specific Programme arrangement and on which party determines the purposes and essential means of the relevant processing activity.

Depending on the Programme and processing activity:

• Buddyhere and the university may act as separate controllers for their respective processing activities;
• Buddyhere and the university may act as joint controllers under Article 26 GDPR where they jointly determine the purposes and essential means of processing; or
• Buddyhere may act as a processor on documented instructions from the university under Article 28 GDPR.

Where Buddyhere acts solely as a processor, the participating university is responsible for determining the applicable legal basis and providing the information required from the controller.

Where joint controllership applies, the parties will define their respective responsibilities in an arrangement under Article 26 GDPR. The essence of the relevant arrangement and the identity of the responsible controllers will be made available to affected participants.

Where necessary, participants will receive a Programme-specific privacy notice identifying the relevant university, the applicable controller arrangements, purposes, legal bases, recipients and any Programme-specific retention periods.

4. Key privacy principles

We aim to process personal data lawfully, fairly and transparently; collect only what is reasonably necessary; use data only for stated purposes; protect it with appropriate technical and organisational measures; and delete or anonymise it when it is no longer needed, unless a longer period is required or permitted for legal, safety, security, complaint-handling or compliance reasons.

5. Key definitions

Personal data means information relating to an identified or identifiable person, such as a name, email address, user ID, university, profile, messages, device data or logs.

Processing means any operation performed on personal data, including collection, storage, use, sharing, review, deletion or anonymisation.

Controller means an organisation that determines why and how personal data is processed.

Processor means an organisation that processes personal data on behalf of a controller under documented instructions.

Special-category data includes sensitive data protected by Article 9 GDPR, such as health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification data, sex life or sexual orientation.

Anonymised data is data that can no longer reasonably identify a person. Properly anonymised data is no longer personal data.

Pseudonymised data is data where direct identifiers are replaced or separated but can still be reconnected using additional information. It remains personal data.

Safety/legal hold means restricted preservation of relevant data connected to a report, complaint, safety concern, misuse issue, authority request, legal obligation or legal claim.

6. What personal data we process

Required and optional information

Some personal data is required in order to create an account, verify eligibility or provide a requested Buddyhere or university-linked Programme function. Required fields are identified during registration, onboarding or the relevant Programme workflow.

If required account, authentication or eligibility information is not provided, Buddyhere may be unable to create or maintain the account or provide the requested Programme or platform functionality.

Other information, such as certain profile fields, interests, preferences, or biography information, may be provided voluntarily. The relevant interface will indicate which fields are optional.

7. Special categories of personal data and free-text fields

Buddyhere processes special-category data only where both a legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR are present. Depending on the specific circumstances, this may include explicit consent under Article 9(2)(a), protection of vital interests where the person is physically or legally incapable of giving consent under Article 9(2)(c), or processing necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f).

Article 9(2)(e) GDPR will be relied upon only where the data subject has manifestly made the relevant information public. Providing special-category information in a private message, restricted profile, support request, Report or other non-public Buddyhere communication does not by itself mean that the information has been manifestly made public.

Acceptance of the Terms of Service is not treated as explicit consent to process special-category data. Where no valid Article 9 condition applies, Buddyhere will not use the information for an additional purpose and may delete, restrict or redact it where appropriate.

8. Photos, files and documents

Buddyhere does not currently enable general profile-photo uploads or general file/PDF attachments in user messages. This supports data minimisation and reduces risks relating to identity documents, visas, passports, medical information, malware, private screenshots and third-party personal data.

9. How we collect personal data

• Directly from you when you create an account, complete onboarding, edit your profile, send messages, join events, submit Reports, contact support or use AI-assisted features.
• Automatically when you use the website or platform, including technical, security, log, session and cookie data.
• From universities or Programme coordinators where necessary for access, eligibility, verification, support, Programme administration or complaint handling.
• From other users where they mention you in a message, Report, complaint or safety concern.
• From service providers where they return technical, security, delivery, authentication or support information needed to operate the platform.

Where Buddyhere receives personal data about a person from a participating university or Programme coordinator before that person provides the data directly to Buddyhere, Buddyhere or the responsible university will provide the information required under Article 14 GDPR in accordance with the applicable controller arrangement and legal requirements.

Where appropriate, this information may be provided in a Programme invitation, onboarding communication or Programme-specific privacy notice.

10. Why we process personal data and our legal bases

11. Profile visibility and matching

Profile information is shown only to the user groups and Programme participants for whom it is configured and reasonably necessary for matching, Programme participation or community functions. Depending on the feature, this may include a user's name, role, university or Programme, languages, interests, availability, profile text and generated avatar. Buddyhere does not make profile information public unless the relevant feature expressly states this.

Buddyhere's matching functionality compares selected information associated with participating users, such as role, university or Programme, study-related information, languages, interests, availability and stated preferences, in order to suggest or display potentially suitable Buddy or Mentee contacts.

The matching functionality is intended to assist users and Programme participants in finding relevant contacts. Buddyhere does not currently use solely automated processing to make decisions that produce legal effects concerning a user or similarly significantly affect a user within the meaning of Article 22 GDPR.

Where matching preferences are offered, neutral options such as "Not specified" or "No preference" should be available where appropriate.

Authorised university coordinators may access participant information relating to the Programmes for which they are responsible where this is necessary for Programme administration. Depending on the Programme and the permissions granted, this may include participant information, Match information, meeting or attendance records, certificate status, Programme-related feedback and support information.

Certain Programme data may be exported by authorised coordinators where necessary for Programme administration, reporting or other purposes identified in the applicable Programme arrangement. Access is subject to role-based permissions and should be limited to the relevant university or Programme.

12. Messages, support and safety review

Buddyhere does not routinely read all private messages. Message content may be accessed only where reasonably necessary for support, safety, complaint handling, technical investigation, misuse prevention, platform security, legal compliance or protection from serious harm.

Where a conversation is connected to a complaint, safeguarding concern, university escalation, authority request or legal claim, Buddyhere may preserve the relevant messages and associated records separately and restrict access to authorised persons. Only information that is reasonably necessary for the relevant purpose will be retained, and the need for continued preservation will be reviewed.

Private message content is not made generally available to university coordinators or other users. Access by Buddyhere personnel or other authorised persons is limited to cases in which such access is reasonably necessary for an identified support, safety, complaint, technical, security or legal purpose and is subject to the applicable access permissions.

Where message content is preserved in connection with a Report, complaint, security incident, legal claim or other legal hold, access will be restricted and the information will be retained only for the period justified by that purpose.

13. Future AI-assisted and automated features

Buddyhere does not currently use an external AI provider to process personal data as part of the core Buddyhere service.

Buddyhere may introduce AI-assisted or automated features in the future. Before personal data is processed for such a feature, Buddyhere will assess the feature's purpose, categories of data, provider arrangements, legal basis, international transfers, retention periods, risks and appropriate safeguards.

Where required, this Privacy Policy will be updated or a feature-specific privacy notice will be provided before or when the feature is introduced.

Buddyhere will not introduce solely automated decision-making that produces legal effects concerning users or similarly significantly affects users unless a valid legal basis and all safeguards required under applicable data-protection law are in place.

14. Who we share personal data with

Buddyhere may disclose or make personal data available to the following categories of recipients where this is necessary for the purposes described in this Privacy Policy:

• Contabo GmbH — hosting and infrastructure provider used to host Buddyhere's application and database infrastructure. Depending on the relevant service and system, hosted information may include account, profile, Programme, Match, messaging, support and technical data.
• Cloudflare, Inc. — provider of DNS, proxy, traffic-delivery and security services. Cloudflare may process IP addresses, request and connection information, security-event information and other technical traffic data when users access Buddyhere.
• Google Workspace (Google) — where used for Buddyhere business or transactional email, Google may process recipient email addresses, email content and related delivery or message metadata.
• Participating universities, international offices and authorised Programme coordinators — where necessary for Programme administration, eligibility, matching, participant support, meetings, attendance, certificates, complaints, safeguarding or other purposes identified in the relevant Programme arrangement.
• Authorities, courts, regulators, emergency services or law-enforcement bodies — where disclosure is required by applicable law or is necessary and proportionate for legal compliance, protection of vital interests, legal claims, user safety or investigation of serious misuse.
• Professional advisers, auditors, insurers or transaction counterparties — where necessary for legal advice, auditing, insurance, corporate transactions or business-continuity purposes and subject to appropriate confidentiality obligations.

Service providers processing personal data on behalf of Buddyhere are required to process the data only in accordance with applicable contractual and data-protection requirements.

Buddyhere does not sell personal data.

Buddyhere does not provide personal data to universities or other third parties for unrelated advertising purposes.

15. International transfers

Buddyhere's primary application and database infrastructure is hosted in the European Union.

Some service providers used by Buddyhere are established outside the European Economic Area ("EEA") or may permit processing of or access to personal data from countries outside the EEA.

Cloudflare, Inc. is established in the United States and operates a global network. Where personal data is transferred outside the EEA, applicable transfer safeguards may include an adequacy mechanism such as the EU-U.S. Data Privacy Framework where applicable and/or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.

Where Google Workspace is used, processing may involve Google entities or subprocessors located outside the EEA. Applicable international transfers are governed by Google's applicable data-processing terms and transfer safeguards, including Standard Contractual Clauses where required.

Where another provider involves an international transfer, Buddyhere will use a transfer mechanism permitted under Chapter V GDPR and will implement additional safeguards where required.

Further information about relevant transfer safeguards may be requested at info@buddyhere.de.

16. How long we keep personal data

Buddyhere retains personal data only for as long as necessary for the purposes for which it was collected and processed. We define retention periods by data category and processing purpose. Data may be retained for a longer period where this is necessary to comply with a legal obligation, investigate a security or safety incident, handle a complaint, respond to a lawful authority request or establish, exercise or defend legal claims.

The applicable standard retention periods are set out below.

When a retention period expires, personal data is deleted or irreversibly anonymised unless continued retention is justified by another applicable legal basis.

If a user requests erasure, Buddyhere will assess the request under Article 17 GDPR. Personal data may be retained where continued processing is permitted or required by applicable law, including where necessary for an active complaint, security investigation, legal obligation, authority request or the establishment, exercise or defence of legal claims.

17. Your data-protection rights

Subject to the conditions and limitations provided by applicable data-protection law, you have the right to:

• request access to personal data concerning you;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• receive personal data in a portable format where the requirements for data portability are met;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data-protection supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right to object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the relevant processing.

If you object, Buddyhere will no longer process the relevant personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing purposes.

We may need to verify your identity before processing a rights request.

Where a participating university is the controller for a specific processing activity, Buddyhere may forward your request to the university or coordinate the response in accordance with the relevant controller or processor arrangement.

Privacy enquiries and data-protection rights requests may be submitted to: info@buddyhere.de

18. Security

Buddyhere uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration, destruction or disclosure.

Depending on the relevant system and processing activity, these measures include encryption of data in transit, audit logs for message access, backups, authentication and session-security measures, role-based access controls, restrictions on administrator and coordinator permissions, infrastructure and application security controls, security logging and procedures for responding to security incidents.

Access to personal data is limited according to role and operational need.

Buddyhere regularly reviews its security measures and adapts them where appropriate in light of technical development, identified risks and changes to the platform.

No information system can provide absolute security. Users should protect their account credentials and contact help@buddyhere.de if they believe their account or another user's safety may be at risk.

19. Cookies and similar technologies

Buddyhere currently uses cookies and similar technologies that are necessary to provide, authenticate and secure the website and platform.

Where strictly necessary information is stored on or accessed from a user's terminal equipment in order to provide a digital service expressly requested by the user, this occurs in accordance with Section 25(2) no. 2 TDDDG.

Where the related information constitutes personal data, it is processed under the applicable GDPR legal basis described in this Privacy Policy, including Article 6(1)(b) GDPR where objectively necessary to provide the requested service and Article 6(1)(f) GDPR for proportionate security and misuse-prevention purposes.

Buddyhere does not currently use advertising trackers or optional analytics cookies.

If Buddyhere introduces non-essential analytics, advertising or other technologies requiring consent in the future, they will not be activated until the required consent has been obtained. Users will be able to withdraw or change their consent through the relevant cookie or privacy settings.

The Cookie Policy provides information about the specific technologies currently used, their purposes, providers and storage durations.

20. Supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority. For Buddyhere's establishment in Berlin, the supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany; email: mailbox@datenschutz-berlin.de.

21. Changes to this Privacy Policy

Buddyhere may update this Privacy Policy where necessary to reflect changes to the platform, processing activities, service providers, university Programme arrangements, legal requirements or other relevant circumstances.

The current version will be published with a revised "Last updated" date.

Where a change materially affects the processing of personal data, Buddyhere will provide additional notice where required. Where a new processing activity requires consent, the processing will not be based on previously given consent unless that consent validly covers the new purpose.

22. Contact

For general privacy questions and requests to exercise data-protection rights: info@buddyhere.de
For platform support, technical problems and safety concerns: help@buddyhere.de

Postal address:
Sergey, Ilia & Abdelrahman GbR
Luisenstraße 53
10117 Berlin
Germany