Privacy Policy

This translation is for information purposes only. The German version is the legally binding one.

We are glad you are visiting our website. Reutlingen University and its institutions place great importance on the security of users’ data and on compliance with data protection regulations. Below, we would like to inform you about the processing of your personal data on our website.

Constituted Student Body of
Reutlingen University
Alteburgstraße 150
D-72762 Reutlingen
Germany

Contact details:

Tel.: 07121 271 1099
Email: datenschutz.asta@reutlingen-university.de

Definitions

The technical terms used in this privacy policy are to be understood as legally defined in Art. 4 GDPR (DSGVO).
The terms “user” and “website visitor” are used synonymously in our privacy policy.

Recipients

Recipients of data are named within our privacy policy under the respective category / heading.

Note: General Equal Treatment Act (AGG)

For ease of reading, our privacy policy does not differentiate by gender. In the interest of equal treatment, the corresponding terms apply to all genders.

General information on data processing

Automated data processing (log files etc.)

Our site can be visited without users actively providing any personal information. However, every time the website is accessed, we automatically store access data (server log files), such as the name of the internet service provider, the operating system used, the website from which the user visits us, the date and duration of the visit or the name of the requested file, as well as, for security reasons, e.g. to detect attacks on our website, the IP address of the device used, for a period of 7 days. This data is not merged with other data sources. We process and use the data for the following purposes: providing the website, preventing and detecting errors/malfunctions, and preventing and detecting misuse of the website.

Legal basis: performance of a task carried out in the public interest pursuant to Art. 6 (1) lit. e) GDPR
Legitimate interests: fraud prevention to detect misuse of the website

Necessary cookies (functionality, opt-out links etc.)

To enable the use of individual functions on our website, we use so-called cookies on our website. Cookies are a standard internet technology for storing and retrieving login and other usage information for all users of the website. Cookies are small text fragments that are stored as files on the user’s device. With classic cookie technology, the user’s browser is instructed to store a certain piece of information on the user’s device when a particular website is accessed.

Strictly necessary cookies are used to provide a telemedia service expressly requested by the user, e.g.:

Cookies for error analysis and security purposes
Cookies for storing logins
Cookies for storing sessions
Cookies for storing settings (including language settings)
Cookies for storing consent or its withdrawal (opt-in, opt-out)

Some of the cookies used (so-called session cookies) are deleted again at the end of the browser session, i.e. after the browser is closed.

Users can delete cookies afterwards in order to remove data that the website has stored on the user’s computer.

The data processing described may also relate to information that is not personal data but constitutes information within the meaning of the TDDDG (Telecommunications Digital Services Data Protection Act). In these cases, too, this information may be necessary for the use of an expressly requested service and is therefore stored in accordance with § 25 TDDDG.

Opt-out:
Firefox:
https://support.mozilla.org/de/kb/wie-verhindere-ich-dass-websites-mich-verfolgen

Google Chrome:
https://support.google.com/chrome/answer/95647?hl=de

Microsoft Edge:
https://support.microsoft.com/de-de/microsoft-edge/inprivate-browsen-in-microsoft-edge-cd2c9a48-0bc4-b98e-5e46-ac40c84e27e2

Opera:
https://help.opera.com/en/latest/security-and-privacy/

Safari:
https://support.apple.com/de-de/HT201265

Legal bases: performance of a task carried out in the public interest pursuant to Art. 6 (1) lit. e) GDPR, consent (Art. 6 (1) lit. a) GDPR in conjunction with § 25 (1) TDDDG)

Legitimate interests: storing opt-in preferences, ensuring the functionality of the website, retaining the user status across the entire web presence

Storage and processing of non-necessary information and data

Beyond what is necessary, users’ data may be processed by means of cookies, similar technologies or application-related technologies, e.g. for the purpose of cross-website tracking or personalized advertising, etc. Data may be transmitted to third-party providers in the process. The storage and further processing of user data is then based on consent within the meaning of Art. 6 (1) lit. a) GDPR (if applicable in conjunction with § 25 (1) sentence 2 TDDDG).

Consent management platforms

We use a consent management procedure in order to be able to store and manage, in a verifiable way and in line with data protection requirements, the consent given by website visitors. The consent management platform we use helps us to identify all cookies and tracking technologies and to control them based on the consent status. At the same time, visitors to our online offering can use the consent management service we have integrated to manage the consents and preferences they have given (optional setting of cookies and other technologies that are not necessary) or to withdraw their consent at any time via the button.

The consent status is stored server-side and/or in a cookie (so-called opt-in cookie) or a comparable technology in order to be able to assign the consent to a user or their device. In addition, the time at which consent was given is recorded.

Categories of data: consent data (consent ID, consent number, time of giving consent, opt-in or opt-out, banner language), meta and communication data (e.g. device information, anonymized IP addresses)
Purposes of processing: fulfilling accountability obligations, consent management
Legal bases: legal obligation (Art. 6 (1) lit. c) GDPR in conjunction with Art. 7 (1), Art. 5 (2) GDPR.

Hosting

The website is not hosted by any external service provider. Visitors’ personal data, in particular so-called log files, are stored on our internal server. We have commissioned an agency for support and advice in connection with hosting.

The university has concluded a so-called data processing agreement with this agency in accordance with the requirements and content of Art. 28 (3) GDPR. Data processing by the service provider (processor) takes place exclusively on the documented instructions of the university within the meaning of Art. 29 GDPR, which is likewise part of the contract.

Categories of data: user data (e.g. websites visited, interest in content, access times), meta and communication data (e.g. device information, IP addresses)
Purposes of processing: proper design of our online offering
Legal bases: performance of a task carried out in the public interest pursuant to Art. 6 (1) lit. e) GDPR
Public interest: proper presentation and optimization of the university website, faster accessibility of the website, avoidance of downtime, high scalability

Web analytics and optimization

To measure reach, we use two tools, both of which work without cookies and store nothing on your device: Matomo and Plausible Analytics. They only show us which pages are viewed and how often, not who views them. Users are not recognized across several days, and no profiles are created.

Matomo (without cookies)

Matomo is open-source web analytics software. Counting runs via our own domain (stupa.reutlingen.university/zaehler) and is forwarded from there to a self-hosted Matomo instance on a server in Germany, which is operated by a member of the Constituted Student Body. Your IP address is not passed on in the process: Matomo only sees the address of our web server. No other third parties receive the data, and no transfer to third countries takes place. If your browser has “Do Not Track” enabled, you will not be counted.

Categories of data: pages viewed, time of access, referral source, browser and operating system, device type, screen resolution, language setting; no IP address, no identifier
Purposes of processing: reach measurement, checking the load on the website, improving our content and offerings
Storage period: Since Matomo receives neither your IP address nor an identifier, the stored data does not relate to any person.
Legal bases: performance of a task carried out in the public interest, pursuant to Art. 6 (1) lit. e) GDPR
Objection: Enable “Do Not Track” in your browser or block scripts; you can also object to the processing at any time, informally by email.

Plausible Analytics

In addition, we use Plausible Analytics, which is also self-hosted (plausible.reutlingen.university) and works without cookies. Plausible does not store IP addresses: a random value is generated from the IP address and browser identifier, which changes daily and cannot be traced back to you.

Categories of data: pages viewed, referral source, browser and operating system, device type, country
Purposes of processing: reach measurement and improvement of the offering
Storage period: only aggregated statistics that do not relate to any person
Legal bases: performance of a task carried out in the public interest, pursuant to Art. 6 (1) lit. e) GDPR

Google Search Console

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy?hl=en-US
Safeguard for transfers to an unsafe third country: standard contractual clauses, transfer impact assessment

Social media presences

The university makes offerings (e.g. fan pages) available online on various social media platforms, which contain a range of information.

Social media channels are used to increase visibility among prospective students and to make the university visible to the public. Social networks have proven effective in increasing reach and actively promoting interaction and communication with students.

University communications, press and public relations fall within the original remit of the state’s universities. Activity and communication on social media are very important for attracting new students. Via social media and the website, relevant information about degree programs can be shared, events can be publicized, and important short-notice announcements and job postings can be communicated.

Based on the usage behavior of users of the social network, for example the interests they state, user profiles can be created and used to tailor advertisements to the interests of target groups. For this purpose, cookies are regularly stored on users’ devices, in part regardless of whether they are registered users of the social network.

In connection with the use of social media, associated messenger services are used to get in touch with users easily.

Communication via social media channels is an important and essential part of the university’s public relations work. You can find the university’s detailed social media usage concept here.

Please note that the security of individual services may depend on the user’s account settings. Even with end-to-end encryption, the platform operator can draw conclusions that and when users communicate with the university and, where applicable, collect location data.

Depending on where the social network is operated, user data may be processed outside the European Union or outside the European Economic Area. This can pose risks for users because, for example, it makes it harder to enforce their rights.

Users are informed that the university has no further influence on the processing of personal data on these platforms. Only the respective platform operator has full knowledge of the content of the transmitted data and its use.

Categories of data: user names (e.g. name, address), contact data (e.g. email address, phone number), content data (e.g. text entries, posts, photos, videos), usage and interaction data (e.g. websites visited, interests, access times), meta and communication data (e.g. device information, IP address and, where applicable, location data)
Purposes of processing: expanding reach, networking with students, promoting interaction and communication, press and public relations
Legal bases: performance of tasks pursuant to Art. 6 (1) lit. e) GDPR in conjunction with Art. 6 (3) GDPR and § 4 of the Baden-Württemberg State Data Protection Act (LDSG) in the version applicable from 21 June 2018, and on the basis of § 65 (2), (3) of the Baden-Württemberg State Higher Education Act (LHG).
Consent to data processing pursuant to Art. 6 (1) lit. a) GDPR may also be a legal basis if users have given it via the platform operator.
Goals & interests: ensuring the university’s visibility in society, improving and spreading its external presentation, interaction and communication on social media presences, insights into target groups, press and public relations

Alternative ways to get information and communicate:

As an alternative way of getting information and communicating with us, feel free to use our postal address given above or our email address: asta@reutlingen-university.de

Facebook

Recipient: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Privacy: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0Opt-
As well as https://www.facebook.com/legal/EU_data_transfer_addendum/update
Opt-out link: https://www.facebook.com/policies/cookies/

Instagram

Recipient: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Privacy: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect As well as https://www.facebook.com/legal/EU_data_transfer_addendum/update
Opt-out link: https://www.instagram.com/accounts/login/?next=/accounts/privacy_and_security/

Mastodon

Recipient: Mastodon gGmbH, Mühlenstraße 8a, 14167 Berlin, Germany
Privacy: https://mastodon.social/terms

YouTube

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy?hl=de&gl=de
Opt-out link: https://tools.google.com/dlpage/gaoptout?hl=de

Social media marketing

Through our social media channels, we use the opportunity to promote our university, individual events, etc. Our goal is to reach a broad community that we cannot reach via classic advertising channels.

Categories of data: usage and interaction data (e.g. websites visited, interests, access times), meta and communication data (e.g. device information, IP address, where applicable location data)
Purposes of processing: expanding reach, reach analysis and statistical evaluations
Legal bases: consent (Art. 6 (1) lit. a) GDPR)

Plug-ins and embedded third-party content

Our website embeds functions and content obtained from third-party providers. These are, for example, videos, graphics, buttons, map services (Maps) or posts (hereinafter referred to as content).

When website visitors access this third-party content (e.g. click, play, etc.), information and data are collected and stored in the form of cookies or other technologies (e.g. pixels or web beacons) on the device of the website visitor and user of the third-party content, and transmitted to the third-party provider’s server. The third-party provider thereby receives usage and interaction data of the website visitor and makes it available to us in the form of statistics via a dashboard. The statistics we receive contain dimensions and metrics and no plain data of the users.

Without this processing operation, loading and displaying this third-party content is not possible.

To protect the personal data of website visitors, we have put safeguards in place to prevent the automatic transmission of this data to the third-party provider. This data is only transmitted once users actively use the buttons and click on the third-party content.

Categories of data: usage and interaction data (e.g. websites visited, interests, access time), meta and communication data (e.g. device information, IP address)
Purposes of processing: design of our online offering, increasing the reach of advertisements on social media, sharing of posts and content, interest- and behavior-based marketing, cross-device tracking
Legal bases: consent (Art. 6 (1) lit. a) GDPR)

Google Custom Search

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy?hl=en-US
Opt-out link: https://tools.google.com/dlpage/gaoptout?hl=de
Legal basis: consent (Art. 6 (1) lit. a) GDPR)

Google Maps

Vimeo video plug-in

Recipient: Vimeo Inc., 555 West 18th Street New York, New York 10011, USA
Privacy: https://vimeo.com/privacy
Legal basis: consent (Art. 6 (1) lit. a) GDPR)

YouTube video plug-in

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy: https://policies.google.com/privacy?hl=de&gl=de
Opt-out link: https://tools.google.com/dlpage/gaoptout?hl=de
Legal basis: consent (Art. 6 (1) lit. a) GDPR)

Surveys

Via our website, we occasionally conduct surveys through an external provider. The survey link is shared with participants, e.g. in online sessions, and ideally answered by them right away. For this, it is not necessary to be able to trace whether we can attribute feedback to a specific person. Before the survey is evaluated, the data we process to provide and technically carry out our surveys is anonymized. Participation in the survey is voluntary.

Categories of data: feedback on the subjects of the survey (e.g. participation in an info session), meta and communication data (e.g. device information, IP address), usage data (e.g. access times)

Purposes of processing: Data processing takes place for the purposes of the university’s press and public relations work, e.g. to generate insights about target groups, evaluate communication channels, general university marketing, and improve and optimize the range of courses offered.

Legal bases: consent within the meaning of Art. 6 (1) lit. a) GDPR. In addition, data processing may take place for the performance of a task carried out in the public interest pursuant to Art. 6 (1) lit. e) GDPR, (3) GDPR in conjunction with §§ 2, 12 (1) sentence 1 LHG. Further specific statutory provisions can be found in the university’s individual examination regulations.

Microsoft Teams

Recipient: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

Third-country transfer: takes place on the basis of an adequacy decision of the European Commission for the USA together with Data Privacy Framework certification

Newsletter (with tracking)

On the website, users have the option to subscribe to a newsletter or any notifications via various channels (hereinafter newsletter). Within the scope of statutory provisions, newsletters are only sent to recipients who have consented to receiving the newsletter. A selected service provider (recipient of the data) is used to send the newsletter.

An email address is required to subscribe to a newsletter. Where applicable, additional data, such as last name and first name, are collected in order to address the newsletter personally.

The newsletter is only sent after the so-called double opt-in procedure has been fully completed. If visitors decide to receive a newsletter, they receive a confirmation email that must be confirmed. It serves in particular to prevent the misuse of false email addresses and to rule out that a simple, possibly accidental click triggers the sending of the newsletter. Subscription to any newsletter can be ended at any time with effect for the future.

An unsubscribe link (opt-out link) is included at the end of every newsletter (option to withdraw consent).

In addition, the controller (university) is obliged under Art. 7 (1) GDPR in conjunction with Art. 5 (2) GDPR to keep proof that subscribers actually wanted to receive the newsletter and gave their consent. For this reason, the IP address and the time of subscription to and unsubscription from a newsletter are collected and processed.

The general newsletters are designed in such a way that it is possible to gain insights into target groups or the reading behavior of subscribers. This is made possible by a so-called web beacon or tracking pixel within the newsletter, which responds to interactions with the newsletter, for example whether links in the newsletter were clicked, whether the newsletter was opened at all, or at what time the newsletter is most likely to be read. Technically, this information can be assigned to individual subscribers.

Digital services and getting in touch

General contact

On the website, it is possible to contact the controller directly or to obtain information about various ways of getting in touch. If contact is made, the data of the person making the inquiry is processed to the extent necessary to answer or handle the inquiry. Depending on how contact is made, the data processed may vary.

Categories of data subjects: persons making inquiries
Categories of data: master data (e.g. name, address), contact data (e.g. email address, phone number), content data (e.g. text entries), usage data (e.g. interests, access times), meta and communication data (e.g. device information, IP address).
Purposes of processing: handling inquiries
Legal bases: consent (Art. 6 (1) lit. a) GDPR), performance or initiation of a contract (Art. 6 (1) lit. b) GDPR), performance of tasks pursuant to Art. 6 (1) lit. e) GDPR in conjunction with Art. 6 (3) GDPR and § 4 of the Baden-Württemberg State Data Protection Act (LDSG)

Categories of data: master data (e.g. last name, first name), contact data (e.g. email address), meta and communication data (e.g. device information, IP address), usage and newsletter interaction data (e.g. interest in content, open and click rates)
Purposes of processing: press and public relations, analysis and evaluation of the success of a campaign
Legal basis: consent (Art. 6 (1) lit. a) GDPR) for subscribing to the newsletter.

Otherwise, data processing takes place for the purpose of performing tasks pursuant to Art. 6 (1) lit. e) GDPR in conjunction with Art. 6 (3) GDPR and § 4 of the Baden-Württemberg State Data Protection Act (LDSG) in the version applicable from 21 June 2018, and on the basis of § 65 (2), (3) of the Baden-Württemberg State Higher Education Act (LHG).

Feedback on translations

On the English, Spanish and Chinese pages, you can send feedback on the translations using a form. We process the text you enter, an optional quoted passage, the address and language of the page and, only if you provide it, your email address for follow-up questions. The data is stored on the website and forwarded by email to the AStA mailbox. To prevent abuse, a non-reversible checksum (hash) of the IP address is kept for one hour; the IP address itself is not stored. Entries are deleted automatically after twelve months.

Categories of data subjects: People who give feedback
Categories of data: Content data (feedback text, quoted passage), usage data (page, language), optional contact data (email address), meta and communication data (hashed IP address, one hour)
Purposes of processing: Improving the translations, follow-up questions, preventing abuse
Legal bases: Performance of a task pursuant to Art. 6(1)(e) GDPR in conjunction with § 4 LDSG; for the voluntary email address, consent (Art. 6(1)(a) GDPR).

Further mandatory information on data processing

Data transfer

To perform contracts or to fulfill a legal obligation, it may be necessary for us to pass on personal data. If the data required for this are not provided to us, it may be that the contract with the data subject cannot be concluded.

If your data is processed outside the EU/EEA, in so-called third countries (e.g. USA), we ensure that this is done in accordance with the requirements of Art. 44 et seq. GDPR. In doing so, we take additional measures to ensure the highest possible protection of the personal data of data subjects. The safeguard applicable to the respective third-country transfer is named with the respective recipients.

Commissioned data processing

The recipients we use may act for us as so-called processors. We have concluded so-called “data processing agreements” with them pursuant to Art. 28 (3) GDPR. This means that the processors may only process your personal data in a way that we have explicitly instructed them to. Processors take technical and organizational measures to process your data securely and in line with our instructions.

Storage period

Data of website visitors is generally stored for as long as is necessary to provide the service or as provided for by the European legislator or another legislator in laws or regulations to which the controller is subject. In all other cases, personal data is deleted once the purpose has been fulfilled, with the exception of data that must continue to be stored to fulfill legal obligations (e.g. obligations arising from tax and commercial law retention periods, documents such as contracts and invoices).

Automated decision-making (including profiling)

No automated decision-making or profiling pursuant to Art. 22 GDPR takes place.

Legal bases

The relevant legal bases arise primarily from the GDPR. They are supplemented by national laws of the member states and, where applicable, apply together with or in addition to the GDPR.
Consent: Art. 6 (1) lit. a) GDPR serves as the legal basis for processing operations for which we have obtained consent for a specific processing purpose.
Performance of a contract: Art. 6 (1) lit. b) GDPR serves as the legal basis for processing that is necessary for the performance of a contract to which the data subject is a party or for taking steps prior to entering into a contract at the request of the data subject.
Legal obligation: Art. 6 (1) lit. c) GDPR serves as the legal basis for processing that is necessary for compliance with a legal obligation.
Vital interests: Art. 6 (1) lit. d) GDPR serves as the legal basis where processing is necessary to protect the vital interests of the data subject or of another natural person.
Public interest: Art. 6 (1) lit. e) GDPR serves as the legal basis for processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Legitimate interest: Art. 6 (1) lit. f) GDPR serves as the legal basis for processing that is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Rights of data subjects

Right of access: Under Art. 15 GDPR, data subjects have the right to request confirmation as to whether we process data concerning them. They can request access to this data as well as the further information listed in Art. 15 (1) GDPR and a copy of their data.
Right to rectification: Under Art. 16 GDPR, data subjects have the right to request the rectification or completion of data concerning them that we process.
Right to erasure: Under Art. 17 GDPR, data subjects have the right to request the immediate erasure of data concerning them. Alternatively, under Art. 18 GDPR, they can request that we restrict the processing of their data.
Right to data portability: Under Art. 20 GDPR, data subjects have the right to request that the data they have provided to us be made available and to request its transmission to another controller.
Right to lodge a complaint: Data subjects also have the right to lodge a complaint with the supervisory authority responsible for them in accordance with Art. 77 GDPR.
Right to object: Where personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f) GDPR, data subjects have the right, under Art. 21 GDPR, to object to the processing of their personal data, provided there are grounds relating to their particular situation or the objection is directed against direct marketing. In the latter case, data subjects have a general right to object, which we will implement without a particular situation having to be stated.

Withdrawal of consent

Some data processing operations are only possible with the express consent of the data subjects. You have the option to withdraw consent you have already given at any time without giving reasons. An informal message or email to us at info@reutlingen-university.de is sufficient for this. Consent to data processing operations on our online offering can be adjusted or withdrawn directly in our consent manager Cookiebot by Usercentrics.

Giving consent is voluntary.

The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

External links

Our website contains links to the online offerings of other providers. We hereby point out that we have no influence on the content of the linked online offerings or on whether their providers comply with data protection provisions.

Changes

The controller reserves the right to adapt this privacy notice at any time in the event of changes to the website and its subpages and in compliance with the applicable data protection regulations, so that it meets the legal requirements.