Goodwall Data
Protection Notice

We – Goodwall SA – provide you with this Data Protection Notice to inform you, our website visitors and platform users, about how and when we process your personal data. This notice covers the processing of your personal data as part of your visit to our website https://www.goodwall.io/, your registration for and the use of our platform, and your communication with us via e-mail, telephone or social media.

If you want information on how we process personal data via cookies, social plug-ins, pixels and other types of tracking technology, you are kindly referred to our Cookie Policy.

Your personal data are processed by Goodwall SA, Avenue de Sécheron 15, 1202 Genève, Switzerland. You can contact us via e-mail at dpo@goodwall.io.

Where we refer to certain laws or regulations, such reference shall also include any change, replacement or annulment of said laws or regulations, including any related executive decisions.

We might have to modify, change or amend our Data Protection Notice. We can do this from time to time and at our own discretion. You can always consult the last version of this notice on our website or on our platform.

Whenever you use our website or platform, we collect:

• Technical information associated with the device you use, such as the device type and model, system language, browser type, geographical location and operating system;
• Technical identifiers that identify the device you use, such as IP address, IDFA (identifier for advertisers) and other unique identifiers;
• Information concerning your browsing behaviour and engagement information, such as how long you visit, what links you click on, what pages you visit, how many times you visit a page and how long it takes for you to come back.

When you contact us via e-mail, telephone, or any other way, we collect the information you provide us with. In most cases this is:

• Your contact information, such as your name, e-mail address, phone number, and postal address;
• Your student or professional characteristics, such as the school or university you go to or your organisation and your function;
• The content of your communication and the technical details of the communication itself, such as with whom you correspond at our end, and the date and time;
• Publicly available information about you;
• Any other personal data you choose to provide to us.

When you use our platform, we collect:

• The basic identity information we require to build your profile are your first name, family name, e-mail address or phone number, country of residence, birthday, and educational background and situation;
• Your profile details you provide us with, such as details pertaining to your school or university, your grades and your achievements, gender, age, hometown, interests, grades, preferred subjects, university matches;
• Your profile picture;
• Your posts on our platform;
• Your location;
• Your contact list;
• Other profile information reported by other users or by the system due to violation of Terms and Conditions such as, but not limited to, your profile, messages sent in the platform, posts, and comments;
• The information we require to allow you access to our platform, namely your name, your contact details, such as e-mail address, and details pertaining to your organisation and your function within the organisation;
• Transaction information and payment methods preferences;
• Other personal data you provide us with.

All of the personal data listed above, we receive directly from you. It may happen that we receive additional information about your preferences and surfing behaviour from partners such as Google, LinkedIn and Facebook. If you require more information about the personal data these parties process about you and make available to others, you are kindly requested to consult their respective privacy policies:

• Google: https://www.google.com/intl/en/policies/privacy/;
• LinkedIn: https://www.linkedin.com/legal/privacy-policy;
• Facebook: https://www.facebook.com/about/privacy;

We process your personal data in order to provide you the services you request from us in a personalised and efficient way. This includes personalised content on the Community Feed based on your location, your graduation year and your interests. If you are about to graduate or if you are a university student, these services include matchmaking between you and potential universities or future employers.

When your profile preferences indicate that you want to hear from universities and companies, we process your personal data for matchmaking and recruitment purposes. This means that we will send you relevant communications, promotions and offerings from us and from the universities and companies that we selected for you.

When you are a business partner we hope to send you relevant communications, promotions and offerings about our new products and services.

We process your personal data to comply with our legal obligations or to comply with any reasonable request from competent law enforcement agents or representatives, judicial authorities, governmental agencies or bodies, including competent data protection authorities. In the same way, we may transfer your personal data upon our own initiative to the police or the judicial authorities as evidence or if there are justified suspicions of an unlawful act or crime committed by you through your registration with or use of our website, our platform or other interaction with us.

Especially when you are a business partner, we might be required to collect and transfer your personal data to our financial institution or payment service provider to allow your financial institution and the payment service provider to comply with their legal obligations, such as obligations under applicable anti-money laundering and counter-terrorism financing legislation.

We process your personal data to perform statistical analyses so that we may improve our website, and platform or to develop new products and services.

We may process your personal data for informing any third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the European Union and Switzerland.

We may process your personal data for the preservation of our legitimate interests or the legitimate interests of our partners or of a third party if and when your registration with or use of our website or platform can be considered (a) a violation of any applicable terms of use or intellectual property rights or any other right of a third party, (b) a threat to the security or integrity of our website or platform, (c) a danger to our website or platform or any of our, or our subcontractors’ underlying systems due to viruses, Trojan horses, spyware, malware or any other form of malicious code, or (d) in any way hateful, obscene, discriminating, racist, slanderous, spiteful, hurtful or in some other way inappropriate or illegal.

We may process your personal data to ensure the safety of all parties in the platform. This includes the review of reported profiles, posts, comments and messages that are deemed inappropriate by the system or as reported by other users in violation of Terms and Conditions.

We process your personal data to provide you the service your requested as set out in clause 3.1, as far as this is necessary for performing the agreement between you and Goodwall. This includes the review of your posts and the Community Feed by our community team. Providing requested services for graduate students includes also matchmaking with and recruitment by universities and future employers.

You can opt-in for the communications referred to in clauses 3.2 and 3.3. By opting-in you give us your consent for this processing activity. However, if you did not reach the age of 16 years, we ask you to opt-in for specific services together with your parents. If you are 13 years or older and you live in a country such as Belgium where by law you are allowed to provide your own valid consent, you can choose to opt-in for specific services yourself.

When you first use our mobile application, we ask you for consent for processing your location data under the conditions outlined in clause 3.1. You can always change your preference in the settings on your mobile device.

The processing of your personal data for the purposes outlined in clauses 3.4 and 3.5 is necessary to allow us to comply with our legal obligations.

The processing of your personal data for the purposes outlined in clauses 3.1, 3.6, 3.7, 3.8 and 3.9 is necessary for the purpose of the legitimate interests of Goodwall, which are:

• Continuous improvements of our website, platform, products and services to ensure that you have the best experience possible;
• Keeping our website and platform safe from misuse and illegal activity;
• Marketing and promotion of our products, services, and overall successful commercialisation of our products and services.

You understand that if you use our website or platform, your personal details also processed by third parties that process your data on our behalf in order to provide you our tools and services and to improve them. For example, we rely on third parties for keeping you informed about new opportunities and to invite you to participate in live sessions. We also use a third party to safely store your personal data within the European Union. Moreover, we rely on third parties to follow certain of your actions on our website or platform in order to better understand how Goodwall is used. In order to manage the involvement of our third-party service providers we also rely on a specific third- party service provider that is devoted to organising these data flows in a comprehensible and efficient manner. If you purchase anything via our platform, a financial institution or payment service provider may also receive your personal data in order to provide their services.

Our third-party processors are only allowed to process your personal data on behalf of Goodwall upon our explicit written instruction. We warrant that all of our third-party processors are selected with due care and are contractually obliged to observe the safety and integrity of your personal data.

Goodwall shares your personal data within the Goodwall Group, with Goodwall Inc. We need to share your personal data with Goodwall Inc. when you are looking for interesting opportunities outside of Europe, in order to provide you with our personalised services around the world. However, we ensure that Goodwall Inc. will take due care that all processing of your personal data is in line with what is set out in this Data Protection Notice.

Goodwall processes your personal data first and foremost within the European Economic Area (EEA) and Switzerland. However, in order to process your personal data for the purposes outlined in clause 3 above, we may also transfer your personal data within the Goodwall Group or to third parties who process on our behalf as set out in clause 5 which are located outside the EEA and Switzerland. Each entity outside the EEA and Switzerland that processes your personal data shall be bound to observe appropriate safeguards with regard to the processing of your personal data. Such safeguards are the consequence of:

• The recipient country having legislation in place which is considered equivalent to the protection offered within the EEA and Switzerland. The European Commission (EC) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) maintain and publish a list of such countries; or
• A contractual arrangement being in place between Goodwall and the third party such as an arrangement based on the European Commission’s Standard Contractual Clauses (controller- to-controller) (Commission decision C(2004)5721) or other standard contractual clauses acknowledged by the EC or the FDPIC, depending on the country from where the data are transferred; or
• Self-certification under the EU-US and/or the Swiss-US Privacy Shield regime, depending on the country from where the data are transferred (www.privacyshield.gov).

Recipients of your data outside the EEA include the recipients described in clause 5. The transfer is limited to the purposes set out in clause 3.

Goodwall does its utmost to process only those personal data which are necessary to achieve the purposes listed under clause 3.

Your personal data are only processed for as long as needed to achieve the purposes listed under clause 3 of this Data Protection Notice or up until such time where you withdraw your consent for processing them. Note that withdrawal of consent may imply that you can no longer use the whole or part of the website or platform. Goodwall will de-identify your personal data when they are no longer necessary for the purposes outlined in clause 3, unless there is:

• An overriding interest of Goodwall or any other third party in keeping your personal data identifiable;
• A legal or regulatory obligation or a judicial or administrative order that prevents Goodwall from de-identifying them.

You understand that an essential aspect of Goodwall pertains to making our services more relevant to you. This means that we will use your profile preferences and your characteristics as outlined in clause 2 to select personalised content for you. You can choose to receive information about universities and future employers matches when you get close to graduation.

We want you to feel confident about using our platform, so we make our best effort to ensure that any personal data we collect is safely kept. Goodwall will take the appropriate technical and organisational measures to keep your personal data safe from unauthorised access or theft as well as accidental loss, tampering or destruction. Access by personnel of Goodwall or our third-party processors will only be on a need-to-know basis and subject to strict confidentiality obligations. You understand, however, that safety and security are best efforts obligations only which can never be guaranteed.

If you are registered to receive communications, offerings and other advertisements via e-mail or other person-to-person electronic communications channels, you can change your preferences for receiving such communications in your profile settings, by clicking the ‘unsubscribe’ link in our communication or by sending us your request by e-mail to dpo@goodwall.io.

If you do not receive push notifications from us in the Goodwall mobile application, you can turn these on in your device settings. The other way around, if you receive push notifications and you want to turn them off, this can also be done in your device settings.

You have the right to request access to all personal data processed by us pertaining to you. We reserve the right to charge an administrative fee for multiple subsequent requests for access that are clearly submitted for causing nuisance or harm to us.

You have the right to ask that any personal data pertaining to you that are inaccurate, are corrected free of charge. Your request for correction must be accompanied with proof of the flawed nature of the data for which you ask the correction.

You have the right to withdraw your earlier given consent for processing your personal data, in which case clause 8.4 will apply.

You have the right to request that your personal data pertaining will be deleted if they are no longer required in light of the purposes outlined in clause 3 or if you withdraw your consent. This request will be evaluated by Goodwall against:

• Overriding interests of the Goodwall or any other third party;
• Legal or regulatory obligations or administrative or judicial orders which may contradict such deletion.

You have the right to object to the processing on grounds relating to your particular situation. However, you can always object to processing for direct marketing purposes free of charge and without justification.

When we process your personal data based on your consent or in order to perform a contract, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller.

You have the right not to be subject to a decision solely based on automated processing, which produces legal effects concerning you or when this decision similarly significantly affects you, unless these decisions are made as a consequence of our agreement in order to provide you with the services requested by you or when we asked your explicit consent for this.

If you wish to submit a request to exercise one or more of the rights listed above or you want to receive more information about how we protect your personal data, you can send an e-mail to dpo@goodwall.io. This e-mail in which you request to exercise a data subject right shall not be construed as consent with the processing of your personal data beyond what is required for handling your request. Such request should clearly state which right you wish to exercise and, if required, the reasons or proof for it. It should also be dated and signed, and accompanied by a digitally scanned copy of your valid identity card proving your identity.

We will promptly inform you of having received this request. If the request proves valid, we will honour it as soon as reasonably possible and at the latest one month after we received your request.

If you are unhappy with any aspect of our handling of your personal data, you may always contact us at dpo@goodwall.io. If you remain unsatisfied with our response, you are free to file a complaint with the competent supervisory authority.