Privacy Policy

1. General Information and Mandatory Disclosures

ESA (E-Commerce Services Agency) GmbH operates the independent platform and search engine https://mba.de. We provide all prospective students, current students and university graduates with information about MBA and Master's programs matching their search criteria, as well as the opportunity to contact the business schools presented on https://mba.de.

Ensuring data protection is our highest priority. This privacy policy informs you about the type, scope and purpose of the processing of personal data on our website. All employees of ESA GmbH are informed about the requirements of the General Data Protection Regulation (GDPR) and are obliged to comply with all legal regulations.

2. Name and Contact Details of the Data Controller

3. Legal Bases for Data Processing

The processing of your personal data is based on the following legal bases:

4. Data Collection on Our Website

4.1 Hosting and Content Delivery

Our website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data and other data generated via a website.

The use of the hoster is for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR).

4.2 Server Log Files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing device
• IP address
• Date and time of the server request

The data is also stored in the log files of our system. These data are not stored together with other personal data of the user. The legal basis for the temporary storage of data is Art. 6 (1) (f) GDPR.

5. Cookies and Tracking Technologies

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. We distinguish between the following cookie categories:

5.1 Technically Necessary Cookies

These cookies are essential for the operation of the website. They enable basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the functionality of the website).

Examples: Session cookies, cookie consent status, language settings

5.2 Functional Cookies

These cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we use on our pages. Legal basis: Art. 6 (1) (a) GDPR (consent).

5.3 Analytics Cookies

These cookies help us count visits and traffic sources to measure and improve the performance of our website. They help us answer questions about which pages are most popular and how visitors navigate the website. Legal basis: Art. 6 (1) (a) GDPR (consent).

You can adjust or withdraw your consent to the use of cookies at any time via our cookie settings. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notification always appears before a new cookie is created.

6. SSL/TLS Encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as contact requests or personal data that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock icon in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

7. Contact Form and Email Contact

If you send us inquiries via the contact form or contact us by email, your details from the inquiry form or your email, including the contact details you provide, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

The processing of this data is based on Art. 6 (1) (b) GDPR, insofar as your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this was requested.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory legal provisions – in particular retention periods – remain unaffected.

8. Sharing Data with Business Schools

https://mba.de is an independent platform and search engine that enables users to find suitable MBA and Master's programs. When you contact a business school through our platform, the contact details you provide (name, email, phone number, your message) will be forwarded to the respective school.

This sharing is based on your explicit consent (Art. 6 (1) (a) GDPR) or for the implementation of pre-contractual measures at your request (Art. 6 (1) (b) GDPR). The business schools are independent controllers for the further processing of your data. Please refer to the respective privacy policies of the institutions you contact.

9. Data Processing When Using the Platform

9.1 School and Program Search

When you use our search function, your search criteria (e.g., study format, location, subject area) are temporarily processed to display matching results. This data is not permanently stored and is not linked to personal data unless you are logged in.

9.2 AI-Powered Study Counseling

To answer your questions, we transmit your inputs, current conversation context and, if supplied, CV contents to the AI service. This processing is separate from quality analysis. Please do not include sensitive or unnecessary personal information.

Standard quality analysis immediately converts fixed categories into separate monthly counters: topic, language, technical response status, source indication, knowledge-base version and voluntary star ratings. Counters contain no original texts, answer excerpts, CVs, names, contact details, employers, session or browser identifiers, locations or exact timestamps. Rare groups are not displayed; only completed monthly groups with at least ten contributions are shown, rounded down to tens. Categories cannot be combined. In addition, we keep a simple usage statistic: we count how many chats are started per day and per month and how many questions are asked in them. A chat counts once, as soon as its first question is asked. Only these totals are stored — no texts, identifiers, topics or times of day. Our administrators see the exact figures, including for the current day and month. The totals do not allow conclusions about individuals. The legal basis for quality analysis and usage counting is our legitimate interest in operating, planning and improving the advisory service (Art. 6(1)(f) GDPR). You may object at any time, on grounds relating to your particular situation, via the contact details of the controller (Art. 21 GDPR). Because the stored counters cannot be linked to any person, contributions already counted cannot be removed individually (Art. 11 GDPR).

Individual review requires your separate voluntary consent (Art. 6(1)(a) GDPR). Only future question/answer pairs, consent evidence and an expiry date are stored separately for up to 30 days. Turns with CV context are excluded. These texts remain personal data and are not described as anonymous. Access is restricted to authorised administrators. Unchecking consent deletes pairs stored under this review token; you can also request deletion through the controller’s contact details. Chat use does not require review consent.

No chat transcripts or free-text ratings are sent by email. You can download your conversation locally to your own device. Consultation application logs do not include chat texts. Actual retention and deletion conditions for external AI, hosting and email services and existing backups require separate verification; we do not claim complete deletion at those services. Following a restore, expired or withdrawn reviews must not be reopened for analysis.

Separate chatbot origin analysis (currently disabled)

New origin collection is disabled pending documented privacy approval and verification of hosting terms and the location source. It is designed to require separate, unchecked consent under Art. 6(1)(a) GDPR. Only after activation and consent will the country and, where available, city estimated by the hosting provider from the connection be converted directly into separate monthly counters. No additional geolocation services or GPS requests; counters store no chat texts, IP addresses, coordinates or session identifiers. This processing is separate from advice, quality evaluation and individual review. Hosting providers technically process connection data; their actual log retention and transfers must be verified and recipient information completed before activation.

The design provides administrator-only reports for completed UTC months with at least ten requests per group, rounded down to tens, retained for at most twelve months and deleted automatically. There is no link to chat texts, topics or ratings. VPNs may make locations inaccurate; request counts are not distinct people and minimum groups alone do not guarantee anonymity. Consent stays only in memory and is independent of individual review consent. Unchecking stops future contributions; existing aggregate figures cannot be attributed to a person or individually deleted. Advice remains available without consent. The contact and supervisory authority information above applies to privacy rights and complaints. Remaining historical location data is still displayed only within its existing 30-day retention period, without importing it into new counters.

9.3 Website Analysis and Statistics

We collect anonymized usage statistics (page views, time spent, click paths) to improve the quality of our website. The collection is non-personal and serves exclusively statistical purposes. The legal basis is our legitimate interest in optimizing our website (Art. 6 (1) (f) GDPR).

10. Storage Duration and Data Deletion

We store personal data only as long as it is necessary for the respective purposes or legal retention obligations exist. The following storage periods apply in detail:

• Contact inquiries: Until the final processing of your inquiry, after which the data is deleted unless legal retention obligations exist
• Server log files: The actual hosting-service retention period requires separate confirmation
• Cookies: Depending on the cookie type, between end of browser session and 12 months
• Account data (School Admins): Until the account is deleted or consent is withdrawn

After the storage periods expire, data is routinely deleted unless it is still required for contract fulfillment or contract initiation and/or we have no legitimate interest in continued storage.

11. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right to information (Art. 15 GDPR): You can request information about your personal data processed by us
• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate data
• Right to erasure (Art. 17 GDPR): You can request the deletion of your data, provided no legal retention obligations exist
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your data
• Right to data portability (Art. 20 GDPR): You can request that we provide your data in a structured, commonly used format
• Right to object (Art. 21 GDPR): You can object to the processing of your data insofar as it is based on legitimate interests
• Withdrawal of consent (Art. 7 (3) GDPR): You can withdraw any consent given at any time with effect for the future

To exercise your rights, please contact: office@mba.de

12. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent supervisory authority in Austria is:

13. Currency and Changes to This Privacy Policy

This privacy policy is currently valid as of: 11 November 2026.

Due to the further development of our website and offerings, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version of the privacy policy can be accessed on this page at any time.

14. Disclaimer for AI-Powered Study Counseling