In this Privacy Notice, we explain how we process your personal data when you contact us or submit a request to us. This applies regardless of the communication channel used to contact us, including, but not limited to, by phone, email, in writing, via a contact form, or through other available communication channels. The processing is intended to receive, assign, review, and handle your inquiry, as well as to communicate with you. For further information on how we handle your personal data, please see the general privacy notice on our website:https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data controller within the meaning of Art. 4(7) of the GDPR:
Ravensburg-Weingarten University of Applied Sciences
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
We process personal data in the context of general contact and communication when you reach out to us or submit a request. This may occur, in particular, by phone, email, in writing, via a contact form on our website, or through other communication channels provided.
The processing serves to receive, assign, review the content of, and handle your inquiry, as well as to communicate with you. Depending on the reason for contacting us, the processing may serve different purposes. These include, in particular, responding to general inquiries, handling matters related to studies, teaching, research, continuing education, events, or other offerings of the university; clarifying organizational or subject-specific inquiries; handling press, collaboration, or project inquiries; and addressing other matters related to the university’s responsibilities.
To the extent that specific follow-up steps result from the initial contact, the processing of personal data may also be necessary for the internal forwarding of the inquiry, for coordination with the relevant faculties, institutions, departments, or administrative offices, and for preparing further measures. This may involve, for example, forwarding the inquiry to the Student Advising Office, the Admissions Office, the Registrar’s Office, the University Communications Office, the relevant project managers, or other responsible departments at the university.
The personal data processed in connection with your contact will be used exclusively to address the specific matter at hand. Further processing for other purposes will only take place if there is a corresponding legal basis for doing so or if you have been separately informed of this.
Categories of Data
In the context of general contact and communication, we process—depending on the nature, content, and purpose of the inquiry—the following categories of personal data in particular:
- Identity and contact data: First and last name, organization, institution, company, or university (if applicable), email address, phone number, mailing address, and any other contact information you provide.
- Content and communication data: Information and content that you provide to us as part of your inquiry or message, including the specific matter at hand, follow-up questions, supplementary information, attached documents, and other communication content.
- Organizational and assignment-related data: Information required for the internal assignment, forwarding, processing, and response to the inquiry, such as the responsible organizational units, faculties, institutions, departments, or administrative offices; processing notes; case references; or the communication history.
- Technical metadata: To the extent that contact is made via electronic communication channels, technical information may be generated that is necessary for processing the communication, such as the times of contact, email header data, technical identifiers, or information about the communication channel used.
Legal Basis
The processing of personal data in the context of general contact and communication is based on the following legal grounds:
Performance of a task in the public interest (Art. 6(1)(e) GDPR in conjunction with § 4 LDSG BW): To the extent that contact is made in connection with the university’s tasks, the processing of personal data is carried out for the purpose of performing a task in the public interest. This applies in particular to the processing of general inquiries and matters raised by prospective students, current students, employees, cooperation partners, media representatives, and other individuals who contact the university. The processing serves the purposes of effective communication, the assignment and handling of inquiries, and the fulfillment of the university’s legal and organizational duties.
Pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR): To the extent that your inquiry relates to the conclusion or performance of a contract, the processing of personal data is carried out for the purpose of taking pre-contractual measures or fulfilling a contract. This may, in particular, concern inquiries related to collaborations, services, events, continuing education programs, or other contractual relationships.
Legal Obligations (Art. 6(1)(c) GDPR): To the extent that the university is required by law to process personal data in connection with an inquiry, such processing is based on Art. 6(1)(c) GDPR. This may pertain, in particular, to documentation, verification, disclosure, retention, or other legal obligations.
Consent (Art. 6(1)(a) GDPR): If you voluntarily provide us with personal data for specific purposes or expressly consent to such processing, the processing is based on your consent. Consent that has been given may be revoked at any time with future effect. Please direct your revocation to the contact information provided for the data controller or the data protection officer.
Recipients and Transfers to Third Countries
To process inquiries in the context of general contact and communication, personal data may be disclosed to internal departments of the university to the extent necessary for the proper assignment, review, processing, and response to the respective matter. This applies in particular to the relevant faculties, institutions, departments, administrative offices, the Student Advising Office, the Admissions Office, the Registrar’s Office, University Communications, project managers, or other relevant organizational units of the university.
In addition, external service providers may be engaged to process personal data on behalf of the university. These include, in particular, IT service providers, providers of communication, email, form, or ticketing systems, as well as other service providers who provide support services in connection with the receipt, forwarding, processing, and response to inquiries. To the extent that these service providers process personal data on behalf of the university, such processing is based on data processing agreements in accordance with Article 28 of the GDPR.
Furthermore, personal data is transferred to third parties only to the extent that this is necessary to handle the specific matter, there is a legal obligation to do so, or there is another legal basis for such a transfer.
The processing of personal data outside the European Union (EU) or the European Economic Area (EEA) may occur in individual cases, particularly when external service providers or communication systems are used whose processing takes place wholly or partially in third countries. In such cases, the transfer of personal data takes place exclusively in compliance with the requirements of Articles 44 et seq. of the GDPR, in particular on the basis of an adequacy decision by the European Commission or through appropriate safeguards such as the adoption of EU Standard Contractual Clauses.
Retention Period
We process and store personal data in the context of general contact and communication only for as long as is necessary to handle the respective matter.
Personal data processed in connection with an initial contact is generally deleted as soon as the matter has been conclusively resolved and there are no further retention, documentation, or proof requirements.
If the initial contact leads to a further process—such as a job application, admission, academic studies, examinations, events, cooperation, contractual, or other administrative process—the further processing of personal data will be carried out in accordance with the relevant privacy notices and legal requirements applicable to each such process.
Data processed exclusively for organizational or communication purposes in connection with the initial contact and which is no longer required for further processing will be deleted as soon as the respective purpose no longer applies.
Consequences of Non-Disclosure
The provision of personal data in the context of general contact and communication is generally voluntary. However, without the information necessary to process a request, it may not be possible to properly review the inquiry, assign it internally, respond to it, or communicate with you.
If the contact relates to a further process, such as an application, admission, academic, examination, event, cooperation, contractual, or other administrative process, failure to provide the necessary personal data may result in the respective matter not being processed at all or not being processed in full.
Automated Decision-Making
No automated decision-making within the meaning of Article 22 of the GDPR takes place. Should we nevertheless use such a process in individual cases in the future, we will inform you separately, provided this is required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may request that inaccurate data be corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided that the legal requirements for doing so are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object at any time to the processing of your data for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) of the GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the Data Protection Officer or the data controller.
Timeframes for Complying with Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right in question or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15