In this privacy notice, we explain how we process your personal data in connection with the organization and conduct of events. For additional information regarding the handling of your personal data, please refer to the general privacy notice on our website:https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data controller within the meaning of Article 4(7) of the GDPR:
Ravensburg-Weingarten University of Applied Sciences
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
As part of its legal mandate, the university regularly holds public and internal events (e.g., conferences, workshops, informational and continuing education events, symposia, or university events). The processing of personal data is necessary for the planning, organization, and execution of these events. This includes, in particular:
- the registration and administration of participants,
- the creation of participant lists or name tags,
- communication before, during, and after the event (e.g., sending program details, organizational information, documents, results, or feedback forms),
- documenting the event and, if applicable, follow-up activities,
- for events subject to a fee, processing the event registration fee.
To the extent that additional information is required in individual cases for organizational purposes (e.g., dietary needs, workshop selection, room allocations, special accessibility needs), this information will be processed exclusively for the purpose of carrying out the respective event.
Data Categories
In connection with the registration, organization, and conduct of events, the following data in particular may be processed:
- Master data: First name, last name, title (if applicable), employer/institution, position
- Communication data: Email address, phone number (if applicable)
- Organizational information: Registration details, selection of program items, special organizational requirements (e.g., accessibility), license plate number (if applicable) for parking permits
- Optional information: e.g., basic dietary needs (no specific categories)
- Paid events: Billing address, payment details (IBAN, BIC)
- Documentation data: Shipping confirmations, attendance confirmations, feedback
Additional information may be required on a case-by-case basis, provided it is directly necessary for the conduct of the respective event.
Legal Basis
The processing of personal data is carried out to fulfill the tasks entrusted to the university in the public interest or in the exercise of official authority (Art. 6(1)(e) GDPR in conjunction with § 4 LDSG BW and the relevant provisions of higher education law). For events subject to a fee, processing is carried out for the purpose of preparing and performing the contract (Art. 6(1)(b) GDPR).
Recipients and Transfers to Third Countries
Recipients of the data may include technical service providers (e.g., providers of event or registration tools) who act on behalf of the university within the framework of data processing on behalf of the university pursuant to Art. 28 of the GDPR. Depending on the tool used, personal data may, in individual cases, be transferred to a third country outside the European Union. In such cases, the university ensures that an adequate level of protection is guaranteed in accordance with Art. 44 et seq. of the GDPR. This is achieved in particular through:
- the use of EU Standard Data Protection Clauses pursuant to Article 46(2)(c) and (d) of the GDPR,
- supplementary technical and organizational measures as part of a Transfer Impact Assessment (TIA),
- or—where applicable—relying on an adequacy decision pursuant to Article 45 of the GDPR.
Retention Period
Personal data is stored only for as long as is necessary for the planning, execution, and follow-up of the respective event. For free events, data is typically deleted no later than one year after the event concludes, at the end of the year. For paid events, certain data (e.g., documents relevant to billing) may be stored for up to 6 or 10 years, in accordance with statutory retention periods.
Aggregated or fully anonymized evaluation and documentation data may also be retained permanently, as it can no longer be linked to any specific individual.
Consequences of Non-Disclosure
Providing personal data when registering for an event is generally voluntary. However, certain data may be required for participation, without which it would not be possible to organize or conduct the event. If this required information is not provided, participation may be denied on a case-by-case basis.
For events that require payment, you must provide the data necessary for the preparation and fulfillment of the contract or as required by law. Without this data, a contract cannot be concluded. The provision of optional information is always voluntary.
Automated Decision-Making
No automated decision-making within the meaning of Article 22 of the GDPR takes place. Should we nevertheless use such a process in individual cases in the future, we will inform you separately, provided this is required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may have incorrect data corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided that the legal requirements are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object to the processing of your data at any time for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) of the GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the Data Protection Officer or the Data Controller.
Timeframes for Complying with Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right of the data subject or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15