Fulda University of Applied Sciences Privacy Notice

The following information describes how your personal data is processed in connection with use of the website and other services offered by Fulda University of Applied Sciences. This privacy notice essentially applies to the central Fulda University of Applied Sciences website. Other data privacy terms may apply on decentralised websites, where they will be presented separately. The information complies with the requirements of Art. 13 of the European General Data Protection Regulation (GDPR). This information also explains your rights in relation to data protection. (April 2019)

1. Name and address of the data controller

The controller within the meaning of Art. 13(1)(a) GDPR is

Hochschule Fulda
University of Applied Sciences

Leipziger Straße 123
36037 Fulda

Telefon: +49 661 9640-0
Fax: +49 661 9640-199

Fulda University of Applied Sciences is a public body.

Its legal representative is the president of the University, Prof. Dr. Karim Khakzar.

E-Mail: praesident(at)hs-fulda.de

 

2. Contact details of the data protection officer

The Fulda University of Applied Sciences data protection officer can be contacted here:

Datenschutzbeauftragter der Hochschule Fulda 

Leipziger Straße 123
36037 Fulda

Telefon: +49 661 9640-1051

E-Mail: datenschutz(at)hs-fulda.de

 

3. What is personal data? 

Data protection relates to personal data. Personal data means any information concerning an identified or identifiable natural person (“data subject”) (Art. 4(1) GDPR). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

 

4. General information on data processing

Fulda University of Applied Sciences processes personal data belonging to the users of its website only to the extent that this is necessary in order to provide a functional website and deliver its content and services. Users’ personal data is usually processed only after the users have given their consent. An exception applies in cases in which it is not possible for factual reasons to obtain prior consent and processing of the data is permitted by law.

 

5. Legal basis for processing personal data

In so far as we obtain the data subject’s consent to the processing of personal data, the legal basis for doing so is Art. 6(1)(a) GDPR.

Where the processing of personal data is necessary for performance of a contract to which the data subject is a contractual party, the legal basis is Art. 6(1)(b) GDPR. This also applies to processing procedures that are necessary in order to take steps prior to entering into a contract.

Where processing of personal data is necessary for compliance with a legal obligation to which Fulda University of Applied Sciences is subject, the legal basis is Art. 6(1)(c) GDPR.

In the event that vital interests of the data subject or of another natural person make processing of personal data necessary, the legal basis is Art. 6(1)(d) GDPR.

If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Fulda University of Applied Sciences, the legal basis for processing is Art. 6(1)(e) GDPR in combination with a relevant specific legal norm under federal or Land law.

If processing is necessary for the purposes of a legitimate interest pursued by Fulda University of Applied Sciences or by a third party, except where such interest is overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis for processing is Art. 6(1)(f) GDPR.

 

6. Retention period for personal data and erasure

Users’ personal data is only stored for as long as the purpose for which it is stored still exists. If processing is based on the data subject’s consent, the data is only stored until the data subject withdraws their consent, unless there is another legal basis for processing the data.

The data subject’s personal data is erased or blocked as soon as the purpose for which it is stored no longer exists. Retention beyond this is possible if it is prescribed by the European or national legislator in regulations, acts or other provisions under Union law to which Fulda University of Applied Sciences is subject. The data will also be blocked or erased if a retention period prescribed by the stated standards expires, unless continued storage of the data is a necessary requirement for entering into or performance of a contract.

 

7. Right to rectification and erasure of personal data

The data subject has the right to obtain from Fulda University of Applied Sciences without undue delay the rectification of inaccurate personal data concerning him or her. The data subject further has the right to obtain without undue delay the erasure of personal data concerning him or her as soon as the purpose of retaining the data no longer exists or, where processing is subject to the consent of the data subject, when the data subject withdraws his or her consent and there is no other legal basis for processing the data.

The data subject’s personal data will further be erased if the data subject pursuant to Art. 21(1) GDPR objects to the processing and there are no overriding legitimate grounds for the processing, if the personal data was processed unlawfully or if erasure was required in order to comply with a legal obligation imposed by the European or national legislator in regulations to which Fulda University of Applied Sciences is subject.

However, data will not be erased in the aforementioned cases if processing of the personal data is necessary to enable Fulda University of Applied Sciences to comply with a legal obligation imposed upon it by the European or national legislator or if processing is necessary for the performance of a task carried out by Fulda University of Applied Sciences in the public interest or in the exercise of official authority vested in Fulda University of Applied Sciences or if continued storage of the personal data is necessary for the establishment, exercise or defence of legal claims.

 

8. Right to withdraw consent

Where the processing of personal data is based on the data subject’s consent, the data subject may withdraw his or her consent at any time. Processing of personal data performed prior to withdrawal of consent remains lawful in spite of the withdrawal of consent.

 

9. Right of access

Data subjects have the right to obtain from Fulda University of Applied Sciences pursuant to Art. 15 GDPR confirmation of whether it is processing personal data concerning them. 

Where that is the case, data subjects have the right to obtain from Fulda University of Applied Sciences access to the following information:

  • the purposes for which the personal data is processed;
  • the categories of personal data that are processed;
  • the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
  • the envisaged period for which the personal data will be retained, or, if specific detail is not possible, the criteria used to determine that period;
  • the existence of the right to rectification or erasure of personal data, the right to restriction of processing by the controller or the right to object to such processing;
  • the existence of the right to lodge a complaint with a supervisory authority;
  • any available information as to the source of the personal data where it is not collected from the data subject;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Data subjects have the right to obtain information as to whether the personal data concerning them is transferred to a third country or to an international organisation. In this context, the data subject has the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer of personal data.

 

10. Right to lodge a complaint with a supervisory authority

You have the following rights under data protection law: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to object to processing (Art. 21 GDPR), and right to data portability (Art. 20 GDPR).

Without prejudice to any other administrative or judicial remedy, the data subject has, in addition to the rights stated, the right to lodge a complaint with a supervisory authority for data protection if the data subject considers that the processing of personal data concerning him or her by Fulda University of Applied Sciences infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

The following supervisory authority for data protection is responsible for Fulda University of Applied Sciences:

Hessische Beauftragte für Datenschutz und Informationsfreiheit

Gustav-Stresemann-Ring 1
65189 Wiesbaden

E-Mail: poststelle(at)datenschutz.hessen.de

 

11. Provision of the website and creation of log files

Extent of data processing

Each time our website is visited, the system automatically collects data and information from the computer system accessing it.

The following data ist collected:

  • Information about the type of browser and the version used
  • The user's operating system
  • The user's internet service provider
  • The user's IP address
  • The date and time of access
  • Websites from which the user's system accesses our website
  • Websites that the user's system accesses via our website

The data is also stored in the system’s log files. This data is not stored together with other personal data relating to the user.

Legal basis for processing

The legal basis for temporary storage of the data and log files is Art. 6(1)(f) GDPR.

Purpose of processing

Temporary storage of the IP address by the system is necessary to permit delivery of the website to the user’s computer. The user’s IP address must be stored for the duration of the session for this purpose.

The data is stored in log files to ensure the functionality of the website. The data is also used to optimise the website and to safeguard the security of the IT systems. The data is not analysed for marketing purposes in this context.

These purposes also constitute our legitimate interest in processing the data pursuant to Art. 6(1)(f) GDPR.

Retention period for personal data

The data is deleted when the corresponding session ends.

Any data stored in log files is deleted at the latest after 14 days. It may be stored for longer. In this case, users’ IP addresses are erased or anonymised so that they can no longer be attributed to the client accessing the website.

 

12. Use of cookies

Extent of data processing

The website uses cookies. Cookies are text files that are stored in the internet browser and/or by the internet browser on the user's computer system.  When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a distinctive character string that facilitates clear identification of the browser when the website is revisited.

Cookies are used to make the website more user-friendly. Some elements of the website make it necessary to also be able to identify the visiting browser after a page change. The following data is stored and transmitted in the cookies:

  • Log-in-informationen
  • Session settings

Legal basis for processing

The legal basis for processing personal data using technically necessary cookies is Art. 6(1)(f) GDPR. The legal basis for processing personal data using cookies for other purposes with the user’s consent to do so is Art.(6)(1)(a) GDPR.

Purpose of processing

The purpose of using technically necessary cookies is to make websites easier to use. Some of the functions of our website would not be available without the use of cookies. For these functions, it must also be possible to recognise the browser after a page change. These purposes also constitute our legitimate interest in the processing of personal data pursuant to Art. 6(1)(f) GDPR.

The user data collected by technically necessary cookies is not used to create user profiles.

Retention period, objections and removal options

Cookies are stored on the user’s computer and sent from that computer to our website. Users therefore have full control over the use of cookies. By altering the settings in their internet browser, users can deactivate or restrict cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies for the Fulda University of Applied Sciences website are deactivated, it is possible that not all functions of the website will still be available to use in full.

 

13. Matomo web analytics

Extent of processing of personal data

The website uses the Matomo (formerly PIWIK) open-source software tool to analyse users’ surfing behaviour. The software sets a cookie on the user’s computer (see above for more about cookies). When a user visits a page on our website, the following data is stored:

  • Two bytes of the IP address of the user’s system
  • Page visited by the user
  • Website from which the user reached the visited page (referrer)
  • Sub-pages that are accessed from the visited page
  • Length of time spent on the page
  • Frequency of visits to the page

The software runs exclusively on the website’s servers. Users’ personal data is stored there only. The data is not shared with third parties.

The software is set so that the IP addresses are not stored in full but with two bytes of the IP address masked. This makes it impossible to attribute the shortened IP address to the visitor’s computer.

Users who do not agree to the storage and analysis of this data can click to withdraw their consent to storage and usage at any time. In this case, a so-called opt-out cookie is set in the browser, which prevents Matomo from collecting any session data. Please note that deleting cookies also causes the opt-out cookie to be deleted, which means that it may need to be reactivated.

An opt-out is not necessary if the “Do not track” setting is activated in the browser.
 
For more information on the privacy settings of the Matomo software, please follow this link: matomo.org/docs/privacy/.
 
Here users can choose to allow a unique web analytics cookie to be set in their browser so that the website operator can collect and analyse various statistical data.
 
If you choose not to allow this, please uncheck the box to set the Matomo disable cookie in your browser.

Your visit to this website is currently being tracked by Matomo web analytics. Click here if you would like to stop tracking of your visit.

Legal basis for processing

The legal basis for the processing of users’ personal data is Art. 6(1)(f) GDPR.

Purpose of processing

The processing of users’ personal data enables Fulda University of Applied Sciences to analyse the surfing behaviour of website users. Analysis of the collected data enables Fulda University of Applied Sciences to collate information on the use of the individual components of the website. This helps to constantly enhance the website and the user experience. It also constitutes the legitimate interest within the meaning of Art. 6(1)(f) GDPR.

Retention period for personal data

The data is erased as soon as it is no longer necessary for tracking purposes.

Your Matomo Tracking Status

14. Newsletter

Extent of data processing

The website offers users the opportunity to sign up for free newsletters. When a user registers for the newsletter, the following data is transferred from the sign-up form:

  • User’s email address
  • Choice of language
  • Choice of delivery
  • Number of detected delivery errors

The following data is also collected during registration:

  1. IP address of the visiting computer
  2. Date and time of registration

Consent to processing of the data is obtained during registration in a double-opt-in process and the user is directed to this privacy notice.

Data is not shared with third parties in connection with the processing of data for newsletter delivery. The data is used exclusively for the purposes of distributing the newsletter.

Legal basis for processing

The legal basis for the processing of data after registration for the newsletter and after consent has been given during the registration process is Art. 6(1)(a) GDPR.

Purpose of processing

Users’ email addresses are collected for the purpose of delivering the newsletter. Other personal data collected during the registration process is for the purpose of preventing abuse of the services or the used email address.

Retention period for personal data

The email addresses are stored for as long as the subscription to the newsletter is active. The other personal data collected during the registration process is generally deleted again after a period of seven days.

The user can unsubscribe from the newsletter at any time. Each newsletter contains a link to do this. When they unsubscribe from the newsletter, users can simultaneously withdraw their consent to retention of the personal data collected during the registration process.

 

15. Email contact

Extent of data processing

Users can contact us at any time using the email address provided on the website. In this case, the users’ personal data that is transmitted with the email is stored.

The data is not shared with third parties in this context. The data is used exclusively for the purpose of managing contacts.

Legal basis for data processing

The legal basis for processing the data transferred with an email is Art. 6(1)(f) GDPR.

Purpose of data processing

Processing of the personal data is solely for contact purposes. This also constitutes the necessary legitimate interest in processing the data.

Retention period for personal data

Personal data that has been sent by email is deleted when the conversation ends. The end of the conversation is when it is clear from the circumstances that the matter has been dealt with conclusively.

 

16. Maps / Google Maps

Extent of data processing

The website uses Google Maps API, a mapping service of Google Inc. (“Google”), to display an interactive map. The use of Google Maps means that information about your use of this website (including your IP address) can be sent to and stored on a Google server in the USA.

Please refer to Google Terms and Google Privacy Policy.

Google may share the collected data with third parties if this is prescribed by law or if third parties are commissioned by Google to process this data.

It would be technically possible for Google to identify at least individual users based on the data it receives. It would be possible for personal data and personality profiles of website users to be processed by Google for other purposes over which Fulda University of Applied Sciences has no influence.

Legal basis for data processing

The legal basis for processing the data is Art. 6(1)(a) GDPR.

Purpose of processing

Google Maps is used to make it easier for users to locate the places referred to on our website.

 

17. YouTube videos

Fulda University of Applied Sciences offers website users the opportunity to watch YouTube videos directly on the page. To protect the user data, users must first click on a link to connect with YouTube and start the video. Data is not sent to the provider up to this point. If you do not click on the link, no data is exchanged between the user and YouTube. Information on how YouTube collects and uses your data is available here: policies.google.com/privacy

Legal basis for data processing

The legal basis for processing the data is Art. 6(1)(a) GDPR.

 

18. Social media plugins

Extent of data processing

Fulda University of Applied Sciences does not directly include social media plugins such as Facebook “Like” buttons in its website. Users can only reach e.g. the University’s Facebook page by following a link. They are only redirected to the services of the relevant provider when they click on the link. Data is not sent to the provider up to this point. If the user does not click on the link, no data is exchanged between the user and the social media service providers. Information on how social networks collect and use personal data is available in the terms of use of the relevant provider:

Facebook Terms of Service

Facebook Data Policy

Twitter of Service

Twitter Privacy Policy

Youtube Terms of Service

Youtube/Google Privacy Policy