Privacy Policy

01 Who we are

Tugende is an EU-hosted operations platform. The data controller for this website and for your Tugende account is:

If your organisation runs Tugende as a customer, that organisation is the controller of the people data it manages in the platform (for example participants, drivers, students, internship mentors and scholarship applicants) — see section 02.

02 Controller & processor

Tugende plays two roles, depending on the data:

• As controller: for the accounts of coordinators and administrators, for billing, and for our website. We decide why and how this data is processed.
• As processor: for the people data your organisation manages inside the platform: participants, drivers, volunteers, students and their internship mentors, scholarship applicants and scholars, reviewers, quiz players and anyone else your organisation adds. Your organisation is the controller; we process it only on your documented instructions under a Data Processing Agreement.

The organisation that runs an internship programme or a scholarship call decides what it asks for, who may see it and how long it is kept. It is also responsible for giving you its own privacy notice; a scholarship application form links to that notice where the organisation has set one.

If you are a participant, driver, student, mentor or applicant and want to exercise your rights, please contact the organisation running your event, internship or scholarship first. We will support them in responding.

03 Data we collect

Account & organisation data

• Name, work email, role and workspace (tenant) you belong to.
• Authentication data: short-lived sign-in codes sent by email and, where used, a password or single sign-on identifiers. We do not store plaintext passwords.
• Account preferences such as language and how often you receive email digests.
• Organisation details and, for paid plans, billing contact information.

Contact form

When you write to us through the contact form on tugende.eu, we receive your name, email address, organisation (if you give one), the topic you chose and your message. It is sent to our team mailbox by email and is not stored in the platform. We use it only to answer you.

People your organisation adds

Every module works from the same people records: names, contact details, roles and the fields your organisation chooses to add. Someone who appears in several modules keeps one record.

Events

• Session enrolments, attendance and check-ins at the door, including badge scans and when they happened.
• Badges and each participant's programme.
• Messages sent to participants, and event photos and media your organisation shares.

Transport

• Drivers and the vehicles they are assigned to.
• Trips: who travels when, from where to where, and their live status.
• Arrival and departure details, and hotel rooming lists, which your organisation can share with a hotel through a private link.

Internships

When your organisation runs an internship programme in Tugende, it can record:

• Students: name, contact details, student number and the placement (company, work location, dates, task description).
• Work and assessment: weekly logbooks (tasks, reflection, hours), feedback, self-evaluations, final evaluations, scores, grades and internal comments by the supervising staff.
• Mentors at the host company: name, job title, email and phone, and the name and date they sign an evaluation with.
• Host companies and agreements: company details, the company's representative, and uploaded internship agreements and annexes.

Scholarships

When your organisation runs a scholarship call in Tugende, it can record:

• Applications: identity and contact details, date of birth, nationality, country of residence, education history, essays and the supporting documents the call asks for (for example diplomas, transcripts or proof of income).
• Vulnerability information the applicant chooses to declare, with an explanation. Depending on the call this can include ethnicity or health-related circumstances, which are special categories of personal data under GDPR Article 9 (see section 05).
• Selection: eligibility checks, reviewer scores and comments, staff notes, interview dates, ranking and the final decision.
• Scholars who are awarded: passport name, number and expiry, date of birth, nationality, mobile number, visa and administrative steps, study progress (enrolment and credits), flights and tickets, insurance policies, and scholarship payments.

Other modules

• Bookmarks: the links, notes and dashboards you save. To show icons and flag broken links, Tugende fetches the bookmarked web addresses from its own servers.
• BandBase: client contacts, performance requests, offers, contracts and venue addresses. Addresses are sent to an EU route-planning service to calculate travel distance.
• Inventory: items, photos and who picked or returned them.
• Quizzes: player names or nicknames, answers, points and rankings.
• Surveys: optional feedback you give about an event or the platform.

Technical data

• Device, browser and IP information, and basic security logs needed to run the service reliably.
• An audit log of sensitive actions (who did what, when, and from which IP address), so that access to people data can be reviewed.
• Strictly necessary cookies (see section 10). We do not run third-party advertising trackers.

04 How we use it

• To provide the platform: timelines, attendance, badges, departure boards and the driver and participant apps.
• To let your organisation follow and assess internships: collect logbooks, involve the company mentor, and record evaluations and grades.
• To let your organisation run a scholarship call: receive applications, check eligibility, have them reviewed and ranked, inform applicants of the outcome, and follow up awarded scholars (travel, insurance, payments, study progress).
• To authenticate users and keep accounts and tenants secure and separated.
• To send service communications (for example a sign-in code, an event notification, a logbook reminder or a status update on an application).
• To provide support, and to maintain, debug and improve the service.
• To meet legal, accounting and security obligations.

We do not sell personal data, and we do not use participant data for advertising.

05 Legal bases (GDPR Art. 6)

• Contract: to deliver the service to you or your organisation.
• Legitimate interests: to secure, maintain and improve the platform, and to answer questions sent through our contact form, balanced against your rights.
• Legal obligation: for accounting, tax and lawful requests.
• Consent: where required, for example optional communications; you can withdraw it at any time.

For data processed on behalf of your organisation, the legal basis is determined by that organisation as controller. For a school or university running internships or scholarships this is often a task carried out in the public interest, or the steps needed before entering into a contract with an applicant.

Special categories (GDPR Art. 9)

Scholarship calls can ask applicants about circumstances such as ethnicity or health. Where they do, the organisation running the call must rely on a condition in Article 9(2), usually the applicant's explicit consent, and explain this in its own privacy notice. Tugende processes this data only on the organisation's instructions, shows it only to the staff and reviewers who need it, and keeps it out of error reports.

06 Hosting & data residency

If any transfer outside the EU were ever necessary, it would only happen with appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses.

07 Sharing & sub-processors

We share personal data only with the people and providers needed to run the service:

• Within your tenant: coordinators and administrators of your organisation, according to their role.
• People your organisation invites: a company mentor sees the logbook and evaluations of the student they mentor; a scholarship reviewer sees the applications assigned to them; a student, applicant or scholar sees their own file. Nobody sees more than their role allows.
• Services your organisation links to: where an organisation adds its own tools, for example an interview scheduling page for scholarship applicants, what you enter there is governed by that organisation and that service, not by Tugende.
• EU sub-processors: vetted infrastructure, file storage, email, route-planning and support providers acting under contract. Error reports sent to our error-monitoring provider are stripped of request contents, cookies and personal fields before they leave the platform. A current list is available on request at privacy@tugende.eu.
• Legal: where required by law or to protect rights, safety and the integrity of the service.

Every sub-processor is bound by data-protection terms and processes data only on our instructions.

08 Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

• Account data is kept while your account or workspace is active.
• People and operational data is kept for as long as your organisation needs it, with a maximum of 5 years after the last event, then deleted or anonymised on their instruction.
• Internship files are kept for the period the programme sets, typically five years after the student graduates.
• Scholarship applications are kept for the period the organisation sets for each call, separately for awarded and non-awarded applications, and can be deleted automatically when that period ends.
• Scholar files are reduced in two steps after the scholarship ends: passport details and other sensitive fields are removed first, and the remaining file is deleted later, each after a period the organisation sets.
• Contact form messages are kept in our mailbox for as long as we need them to follow up, and at most two years after our last exchange, unless they lead to an agreement.
• Billing records are retained for up to 10 years where required by Belgian tax legislation.
• Security logs are generally retained for up to 12 months unless a longer period is required for security investigations or legal obligations.

When a workspace is closed, data is deleted or returned within a defined window set out in the Data Processing Agreement.

09 Your rights

Under the GDPR you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data, or complete incomplete data.
• Erase data, where applicable.
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent at any time, without affecting prior processing.

Your organisation can erase or anonymise a person across every module at once. Erasing a student removes their internship file, grades included, even within the programme's usual retention period. A mentor's signature on a student's evaluation is kept, because it is the evidence that the form was co-signed.

To exercise these rights, email privacy@tugende.eu. You also have the right to lodge a complaint with your local supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit).

10 Cookies

We use a small number of strictly necessary cookies and similar storage to keep you signed in, remember your workspace and language, and keep the service secure. We do not use advertising or cross-site tracking cookies.

Because they are essential to the service, these do not require consent under the ePrivacy rules. Any optional analytics, if introduced, would be privacy-friendly and EU-based, and described here first.

11 Security

• We apply appropriate technical and organisational measures, including encryption in transit and, where applicable, encryption at rest.
• Strict tenant separation so one organisation's data is never visible to another.
• Passwordless sign-in with a one-time email code by default, with optional single sign-on or password-based sign-in.
• Uploaded documents (internship agreements, scholarship documents, tickets, insurance papers) are served only to signed-in users whose role allows it, never from a public link.
• Role-based access, audit logging and least-privilege access for our team.

12 Data breaches

Despite our security measures, no system is 100% secure. In the event of a personal data breach (for example unauthorised access, loss, or disclosure), we will:

• Investigate immediately to assess the scope and impact.
• Notify the affected controller without undue delay (within 72 hours where feasible).
• Report to the supervisory authority (Belgian Data Protection Authority) within 72 hours where the breach poses a risk to individuals' rights and freedoms.
• Assist the controller in notifying affected individuals where required by law (for example high-risk breaches under GDPR Article 34).

Your role as a controller: if you are a Tugende customer, you are responsible for notifying your own users if a breach affects their data. We will provide you with all the details you need to fulfill this obligation.

13 Automated processing

Tugende does not use automated decision-making (for example profiling) that produces legal effects or similarly significant impacts on individuals.

• Automated assignments: some operational tasks (for example trip assignments and badge scans) are automated for efficiency, but they are not based on personal data beyond what is strictly necessary (such as role and availability).
• Scholarship eligibility: Tugende can check an application against the call's published criteria (for example age, nationality, residence and required documents). The result is only a proposal: a staff member reviews and confirms it before any status changes or any mail is sent.
• Scores, rankings and grades: totals and rankings for scholarship applications, and internship grades, are calculated from scores that people enter. The calculation adds them up; people make the assessment and the decision.
• Human oversight: all automated processes can be manually reviewed or overridden by administrators.

If you believe you have been subject to an automated decision and wish to request human review, contact privacy@tugende.eu.

14 Children's data

Our services are not directed at children under 16. If your organisation uses Tugende to process the data of minors (for example students under 16), you must:

• Obtain parental consent where required by GDPR Article 8.
• Ensure transparency by informing parents and guardians about the data collected and their rights.

Tugende does not knowingly collect data from children under 16 without such consent.

15 Changes & contact

We may update this policy as the service evolves or the law changes. Material changes will be highlighted here, with the date and version updated at the top. For anything privacy-related, reach us at: