URBANWaters Consulting GmbH

Privacy Notice (EU/EA conform)

What we collect and why

• Account details:
  When you register, we process your name to create and manage your account, provide access to the website, and communicate with you. (category: required, without providing this information you would not be able to open an account and use our learning platform that is mandatory for the training courses).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR).
• Website data:
  • Server logs / IP addresses for security. Legal base: legitimate interest in operating a secure service, in particular network & information security, under Art. 6(1)(f) GDPR.
  • Essential cookies / strictly necessary storage (e.g., session cookie, load-balancing, authentication). Legal base: perform the service the user requested (Art. 6(1)(b) GDPR)
  • Analytics/marketing cookies or other non-essential tracking. We will only collect and store upon prior consent (Art. 6(1)(a) GDPR).
• User uploads (materials you choose to upload):
  We store the content you upload (which may include personal data). We process this to host and display your content and to keep the service functioning (category: optional, you are not obliged to do any uploads).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Where you choose to make content public, that disclosure is based on your actions and settings.
• Data you provide in the course of establishing a contractual relation with us for using our training services (training contracts):
  We are legally obliged to keep the contracts for a 10-year period, afterwards these documents will be destroyed. (category: required, without providing this information we are not able to conclude a training contract with you and you will not be able to participate in any training course).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR),  legal obligation (Art. 6(1)(c) GDPR (and German provisions under AO §147 / HGB §257), and our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR).
• Training attendance records and training certificates:
  As these are linked to our fulfilment of the training contracts, we are legally obliged to keep the contracts for a 10-year period, afterwards these documents will be destroyed (category: required, as data about your attendance is needed to establish whether you have fulfilled the criteria for obtaining a course certificate, if you object you cannot obtain a certificate).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating a secure service and defending claims (Art. 6(1)(f) GDPR). 
• Material you produce with fellow participants in our trainings (photo documentation):
  We store this material in order to support the learning process of the course participants (category: required, as the material produced during exercises are needed for the ongoing learning process). Photographs displaying identifiable persons will only be taken and stored upon prior written consent (category: optional, though images of participants performing exercises support the learning process).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR).
• Your CV: if you submit it to us, e.g. for a tender and the execution of the project in case our bid is retained and a contract awarded. We will ask you whether you consent to you CV being kept after the execution of the contract, if you don’t consent the document will be destroyed/deleted. (Category: required in an ongoing bidding process, you cannot be part of a project team if your CV isn’t included in the bidding documents. However, consent to storage beyond a particular bidding process is optional, declining our request would only mean that your chances of being contacted for future bids diminish).
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating a secure service (Art. 6(1)(f) GDPR).

Please avoid uploading special categories of data (e.g., health, political opinions, refer also to the rules explained in the “About OD-Practitioners Network” section) or others’ personal data unless you have a lawful basis and permission.

Do we share your data?

We use trusted service providers (of the following categories: web hosting, security, backup, e-mail, analytics, payment, learning platform). They act as processors under contracts that protect your data. We do not sell your data. As for CV, apart from being submitted to the organisation calling for bids, they will be shared with other members of a bidding consortium if UWC is bidding as part of a consortium.

International transfers

If we transfer data outside the EU/EEA, we use approved safeguards Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF).

How long we keep data.

• Account data: for as long as your account is active.
• Uploaded materials: until you delete them or your account is deleted.
• Material produced in trainings (documentation), training contracts, attendance records, training certificates: 10 years
• CVs : only kept for the duration of a tender/of the project execution (if contract is awarded), for up to three years if you consent, after that the original file will be deleted and you will receive a renewed request to submit an up-to-date CV and allow it to be stored. You can withdraw your consent at any time
• Backups and logs: kept for limited periods for security and recovery ([e.g., up to 30–90 days]).

Is provision of data required?

Contract and invoicing data are necessary to provide our services; without them we cannot deliver or certify trainings. CV data is required for specific tenders but otherwise optional. Where data is legally required, we will tell you—if you do not provide it, we may be unable to provide services or issue documentation (see also the “What we collect and why” section above).

Your rights:

You can request access, rectification, erasure, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You may withdraw your consent for the storage and processing of your personal data, and you may object to direct marketing. You also have the right to lodge a complaint with the competent data protection authority which is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/ULD (https://www.datenschutzzentrum.de).

Security:

We apply appropriate technical and organizational measures to protect your data.

Contact:
For privacy questions or to exercise your rights:  office@urb-waters.com. 

Updates to this notice:

We may update this notice from time to time. Last updated: 15 October 2025.