The following information provides you with an overview of how your personal data is processed when using the website and other services of Fulda University of Applied Sciences. This data protection declaration essentially applies to the central part of the Hochschule Fulda website. On decentralised websites, other data protection conditions apply in some cases; these are listed separately there. This information complies with the requirements of Article 13 of the European Data Protection Regulation (DS-GVO). This information also tells you what rights you have in terms of data protection. (as of April 2019)

1. name and address of the responsible persons

The responsible party within the meaning of Art. 13 Para. 1 lit. a DS-GVO is.

Hochschule Fulda
University of Applied Sciences

Leipziger Straße 123
36037 Fulda

Phone: +49 661 9640-0
Fax: +49 661 9640-1229

Fulda University of Applied Sciences is a public corporation.

It is legally represented by the President Prof. Dr. Karim Khakzar.

E-mail: praesident(at)hs-fulda.de

2. contact details of the data protection officer

The data protection officer of Fulda University of Applied Sciences can be contacted at:

Data Protection Officer of Fulda University of Applied Sciences

Leipziger Straße 123
36037 Fulda

Telephone: +49 661 9640-1051

E-mail: datenschutz(at)hs-fulda.de

3 What is personal data?

The subject of data protection is personal data. Personal data is any information relating to an identified or identifiable natural person ("data subject") (Art. 4 No. 1 DS-GVO). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

4 General information on data processing

As a matter of principle, Fulda University of Applied Sciences only processes personal data of the users of the website to the extent that this is necessary for the provision of a functional website as well as the contents and services. The processing of users' personal data is generally only carried out with the consent of the users. An exception applies in those cases in which it is not possible to obtain prior consent for actual reasons and the processing of the data is permitted by legal regulations.

5 Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 (1) lit. a DS-GVO serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b DS-GVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as processing of personal data is necessary for compliance with a legal obligation to which Fulda University of Applied Sciences is subject, Art. 6 (1) c DS-GVO serves as the legal basis.

In the event that vital interests of the data subject or another natural person make the processing of personal data necessary, Art. 6 (1) (d) DS-GVO serves as the legal basis.

If processing is necessary for the performance of a task which is in the public interest or in the exercise of official authority vested in Fulda University of Applied Sciences, Art. 6 (1) (e) DS-GVO in conjunction with a relevant, special federal or state law norm serves as the legal basis for the processing.

If the processing is necessary to protect a legitimate interest of Fulda University of Applied Sciences or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) f DS-GVO serves as the legal basis for the processing.

6 Duration of storage of personal data and deletion

The personal data of the users are only stored as long as the purpose of the storage exists. If the processing is based on the data subject's consent, the data will only be stored until the data subject withdraws his or her consent, unless there is another legal basis for the processing.

The personal data of the data subject shall be deleted or blocked as soon as the purpose of the storage ceases to apply. Storage may also take place if this is prescribed by the European or national legislator in Union regulations, laws or other provisions to which Fulda University of Applied Sciences is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or fulfilment of a contract.

7. right to correction and deletion of personal data

The data subject has the right to request that the Hochschule Fulda rectify without delay any inaccurate personal data concerning him or her. The data subject also has the right to request that personal data concerning him or her be erased without delay as soon as the purpose for storing the data no longer applies or, if the processing is based on the data subject's consent, if the data subject withdraws his or her consent and there is no other legal basis for the processing.

The data subject's personal data will further be erased if he or she objects to the processing pursuant to Article 21(1) DS-GVO and there are no overriding legitimate grounds for the processing, if the personal data have been processed unlawfully or if erasure has been provided for in order to comply with a legal obligation by the European or national legislator in regulations to which Fulda University of Applied Sciences is subject.

However, erasure will not take place in the cases described above if the processing of the personal data is necessary for Hochschule Fulda to comply with a legal obligation imposed on it by the European or national legislator, or if the processing is carried out for the performance of a task carried out by Hochschule Fulda which is in the public interest or in the exercise of official authority vested in Hochschule Fulda, or if the continued storage of the personal data is necessary for the assertion, exercise or defence of legal claims.

8. right of revocation

If the processing of personal data is based on the consent of the data subject, he or she may withdraw his or her consent at any time. The processing of personal data carried out until the revocation remains lawful despite the revocation.

9 Right of access

Pursuant to Art. 15 DS-GVO, data subjects may request confirmation from Hochschule Fulda as to whether personal data concerning them are being processed by Hochschule Fulda.

If such processing is taking place, data subjects may request information from Hochschule Fulda on the following:

• the purposes for which the personal data are processed;
• the categories of personal data which are processed;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
• the planned duration of the storage of the personal data or, if concrete information on this is not possible, criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data, a right to restriction of processing by the controller or a right to object to such processing;
• the existence of a right of appeal to a supervisory authority;
• any available information on the origin of the data if the personal data are not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

Data subjects have the right to request information on whether personal data concerning them are transferred to a third country or to an international organisation. In this context, the data subject may request to be informed about the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer. 10.

10. right to complain to a supervisory authority

Data protection law grants you the following rights: the right to information (Art. 15 DS-GVO), the right to rectification (Art. 16 DS-GVO), the right to erasure (Art. 17 DS-GVO), the right to restriction of processing (Art. 18 DS-GVO), the right to object to processing (Art. 21 DS- GVO) as well as a right to data portability (Art 20 DS-GVO).

Without prejudice to any other administrative or judicial remedy, the data subject has, in addition to the aforementioned rights, the right to lodge a complaint with the supervisory authority for data protection if he or she is of the opinion that the processing of the data subject's personal data by Fulda University of Applied Sciences violates the GDPR. The supervisory authority to which the complaint has been lodged shall inform complainants of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

The supervisory authority for data protection responsible for Fulda University of Applied Sciences is the

Hessian Commissioner for Data Protection and Freedom of Information

Gustav-Stresemann-Ring 1
65189 Wiesbaden

E-mail: poststelle(at)datenschutz.hessen.de

11. provision of the website and creation of log files

Scope of data processing

Each time the website is accessed, the system automatically collects data and information from the system of the accessing computer.

The following data is collected:

• Information about the type of browser and the version used.
• The user's operating system
• The Internet service provider of the users
• The IP address of the user
• Date and time of access
• Websites from which the user's system accesses our website
• Websites that are accessed by the user's system via our website.

This data is also stored in the system's log files. This data is not stored together with other personal data of the users.

Legal basis for the processing

The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f DS-GVO.

Purpose of the processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session.

The storage in log files is done to ensure the functionality of the website. The data is also used to optimise the website and to ensure the security of the information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes are also our legitimate interest in data processing according to Art. 6 Para. 1 lit. f DS-GVO.

Duration of storage of personal data

The data is deleted when the respective session has ended.

In the case of storage in log files, these are deleted after 14 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that it is no longer possible to assign the calling client.

12. use of cookies

Scope of data processing

The website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is called up again.

Cookies are used to make the website more user-friendly. Some elements of the offer require that the calling browser can be identified even after a page change. The following data is stored and transmitted in the cookies:

• Log-in information
• Session settings

Legal basis for processing

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 (1) lit. f DS-GVO. The legal basis for the processing of personal data using cookies for other purposes is Art. 6 (1) lit. a DS-GVO if the users have given their consent in this regard.

Purpose of the processing

The purpose of the use of technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change. These purposes are also our legitimate interest in processing personal data according to Art. 6 Para. 1 lit. f DS-GVO.

The user data collected through technically necessary cookies are not used to create user profiles.

Duration of storage, objection and removal options

Cookies are stored on the user's computer and transmitted from it to our website. Therefore, users have full control over the use of cookies. The transmission of cookies can be deactivated or restricted by changing the settings in the internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for the Fulda University of Applied Sciences website, it may no longer be possible to use all of the website's functions to their full extent.

14 Newsletter

Scope of data processing

The website offers the possibility to subscribe to free newsletters. In doing so, the data from the input mask are transmitted when subscribing to the newsletter. The following data is transmitted in this way:

• E-mail address of the user
• Desired language
• Desired form of delivery
• Number of detected delivery errors

In addition, the following further data is collected during registration:

1. IP address of the calling computer
2. Date and time of registration

For the processing of data, consent is obtained as part of the registration process using the double-opt-in method and reference is made to this data protection declaration.

No data will be passed on to third parties in connection with the processing of data for the dispatch of newsletters. The data is used exclusively for sending the newsletter.

Legal basis for processing

The legal basis for the processing of data after registration for the newsletter and granting of consent as part of the registration process is Art. 6 (1) lit. a DS-GVO.

Purpose of the processing

The collection of the user's email address serves to deliver the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used.

Duration of storage of personal data

The e-mail addresses are stored as long as the subscription to the newsletter is active. The other personal data collected during the registration process is usually deleted after a period of seven days.

The subscription to the newsletter can be cancelled by the respective user at any time. For this purpose, there is a corresponding link in each newsletter. Cancellation of the newsletter simultaneously enables the revocation of consent to the storage of the personal data collected during the registration process.

15. e-mail contact

Scope of data processing

It is possible to contact us via the web offer using the e-mail address provided in each case. In this case, the personal data of the user transmitted by e-mail will be stored.

In this context, the data is not passed on to third parties. The data is used exclusively for the purpose of maintaining contact.

Legal basis for data processing

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f DS-GVO.

Purpose of data processing

The processing of personal data is solely for the purpose of processing the contact. This also constitutes the necessary legitimate interest in processing the data.

Duration of the storage of personal data

The personal data sent by e-mail will be deleted when the respective conversation has ended. The conversation is deemed to have ended when it is clear from the circumstances that the relevant matter has been conclusively clarified.

16 Site plans / Google Maps

Scope of data processing

The website uses the Google Maps API, a map service provided by Google Inc ("Google") to display an interactive map. By using Google Maps, information about your use of this website (including your IP address) may be transmitted to and stored by Google on servers in the United States.

Please note Google's terms of use as well as Google's privacy policy.

Google may transfer the collected data to third parties where required to do so by law, or where such third parties process the data on Google's behalf.

It would be technically possible for Google to identify at least individual users on the basis of the data received. It is possible that personal data and personality profiles of users of the website could be processed by Google for other purposes over which Fulda University of Applied Sciences has no control.

Legal basis for data processing

The legal basis for the processing of data is Art. 6 Para. 1 lit. a DSGVO.

Purpose of processing

Google Maps is used for the purpose of making it easier to find the places indicated on our website.

17 Use of YouTube videos

Fulda University of Applied Sciences offers users the opportunity to view selected videos from YouTube directly on the website. In order to protect user data, a connection to YouTube is only established by clicking on a link and the video is started. Only then is data sent to the provider. If you do not click on the link, no exchange takes place between the user and YouTube. Information on the collection and use of your data by YouTube can be found here: policies.google.com/privacy

Legal basis for data processing

The legal basis for the processing of data is Art. 6 para. 1 lit. a DSGVO.

18. use of social media plugins

Scope of data processing

Fulda University of Applied Sciences does not have any direct integration of social media plugins such as Facebook "Like buttons" on its website. Users can only access the University's Facebook page via a link. Only by clicking on the link are users redirected to the services of the respective provider. Only then is data sent to the respective providers. If the link is not clicked, there is no exchange of information between the user and the providers of the social media services. Information on the collection and use of personal data in the social networks can be found in the respective terms of use of the corresponding providers:

- Terms of use of Facebook

- Facebook privacy policy

- Twitterterms of use

- Privacy policy of Twitter

- Terms of use of Youtube

- Privacy Policy of Youtube/Google