In this privacy notice, we explain how we process your personal data in connection with the subscription, distribution, administration, and performance tracking of the university’s newsletters. The newsletters are primarily intended to provide information on topics related to academic studies, teaching, research, continuing education, knowledge transfer, events, university communications, and other university-related content. Performance tracking is used to statistically analyze the use of the newsletters and to further develop their content and distribution to meet user needs. For additional information on how we handle your personal data, please refer to the general privacy policy on our website:https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data Controller as defined in Art. 4(7) of the GDPR:
Ravensburg-Weingarten University
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
In connection with the distribution of newsletters, including performance tracking, we process personal data to regularly inform subscribers about topics, offers, and developments at the university. This may include the university’s main newsletters as well as newsletters from individual organizational units of the university that are related to specific topics, projects, events, faculties, departments, or offerings. In particular, the newsletters may contain information on academic programs, teaching, research, continuing education, knowledge transfer, events, university communications, campus life, projects, degree programs, or other university-related content.
Newsletter Subscription and Distribution
A valid email address is required to subscribe to a newsletter. Optionally, additional information—such as the subscriber’s name or details regarding specific interests, subject areas, or recipient groups—may be provided to enable personalized communication or the selection of relevant newsletter content. Subscription generally follows a double opt-in process. After registration, a confirmation email is sent to verify ownership of the provided email address and confirm subscription to the respective newsletter. As part of the newsletter registration process, technical data is also processed, in particular the IP address as well as the date and time of registration and confirmation. This processing is carried out for the purpose of documenting consent and preventing misuse, in order to be able to trace and prevent unauthorized use of email addresses. The personal data collected as part of the newsletter registration process is used exclusively for sending the respective newsletter, managing the newsletter subscription, and related purposes.
Performance Measurement and Optimization
The newsletters sent out may be subject to performance measurement. To this end, technical methods are used to determine whether a newsletter was opened and which links contained therein were clicked. The data collected in this process is used to statistically analyze newsletter distribution, optimize content, and better tailor future newsletters to the recipients’ information interests. No further profiling or automated decision-making takes place.
Data Categories
In connection with the distribution of newsletters, including performance measurement, we process—depending on the specific newsletter, the subscription process, and the distribution functions used—the following categories of personal data in particular:
- Master data: Email address and, if applicable, name or other information for personalized communication.
- Subscription and verification data: Information related to the newsletter subscription, specifically the time of subscription and confirmation via the double opt-in process, as well as the IP address used during this process.
- Communication and usage data: Information regarding whether a newsletter was opened and which contents or links contained therein were clicked.
- Technical data: Technical metadata generated in connection with the sending and use of newsletters, e.g., timestamps, device or connection information, to the extent that this is necessary for sending the newsletter or measuring its effectiveness.
Legal Basis
The processing of personal data in connection with the distribution of newsletters, including performance measurement, is based on the following legal grounds:
Consent (Art. 6(1)(a) GDPR): If you actively subscribe to a university newsletter, the newsletter is sent based on your voluntarily given consent. This also applies to performance tracking associated with newsletter distribution, to the extent that personal usage data—in particular, opens or clicks—is analyzed. Consent is obtained and documented as part of a double opt-in process. It may be revoked at any time with future effect. Revocation can be effected, in particular, by using the unsubscribe link contained in the respective newsletter. If unsubscribing in this manner is not possible, revocation may also be made in writing—e.g., via email—to the contact information provided for the data controller or the data protection officer.
Performance of a task carried out in the public interest (Art. 6(1)(e) GDPR in conjunction with § 4 LDSG BW): To the extent that the university processes personal data to provide information about university-related topics, events, and study, continuing education, research, technology transfer, or informational offerings, such processing may also serve the performance of a task carried out in the public interest. This applies in particular to the university’s public relations, provision of information, and communication activities within the scope of its statutory duties. However, newsletters are generally sent to individual recipients only if they have subscribed or given their consent, or if there is another relevant legal basis.
Documentation and Proof of Consent (Art. 6(1)(c) GDPR): The processing of registration and verification data—in particular, the time of registration, the time of confirmation, the IP address used, and proof of the double opt-in procedure—is also carried out to fulfill legal obligations regarding evidence and documentation. The legal basis for this is Art. 6(1)(c) of the GDPR.
No further profiling or automated decision-making takes place.
Recipients and Transfers to Third Countries
External service providers acting as data processors may be used for sending newsletters, including the management of recipient lists and the measurement of performance. These service providers primarily provide technical services related to newsletter distribution, the management of subscriptions and unsubscriptions, the maintenance of distribution lists, and the analysis of distribution and usage data.
Processing is carried out on the basis of data processing agreements in accordance with Article 28 of the GDPR. The service providers used are contractually obligated to process personal data exclusively in accordance with the university’s instructions and in compliance with appropriate technical and organizational measures.
Within the university, personal data may be disclosed to or processed by the organizational units responsible for the respective newsletter, to the extent necessary for the administration, editorial management, distribution, or analysis of that newsletter. This may specifically involve the university’s communications department, faculties, departments, project managers, continuing education divisions, or other units responsible for the respective newsletter.
Newsletters are generally sent using service providers based in or processing data within the European Union or the European Economic Area. However, the processing of personal data outside the European Union (EU) or the European Economic Area (EEA) may still occur in individual cases, depending on the additional newsletter distribution service providers used, their technical configuration, or any subcontractors involved. In such cases, personal data is transferred to a third country only if the specific requirements of Articles 44 et seq. of the GDPR are met. This is particularly the case if an adequacy decision by the European Commission exists for the third country in question or if an adequate level of data protection is ensured through appropriate safeguards, in particular the conclusion of EU Standard Contractual Clauses and, where applicable, supplementary technical and organizational protective measures.
Retention Period
We process and store personal data in connection with the distribution of the newsletter, including performance measurement, only for as long as is necessary for the respective purposes. Personal data processed in connection with a newsletter subscription based on consent is generally stored until such consent is revoked. After consent is revoked, the data processed for newsletter distribution will be deleted, provided that no legal retention, documentation, or proof requirements preclude this. Information required to document the consent granted—in particular, the time of registration, the time of confirmation, the IP address, and proof of the double opt-in process—may also be stored for the duration of the applicable statutory limitation periods.
Data collected for performance measurement purposes is stored only as long as necessary for the statistical analysis and optimization of newsletter distribution. It is subsequently deleted or anonymized. After unsubscribing from the newsletter, personal data will no longer be used for newsletter distribution or performance tracking. Further storage may only occur to the extent necessary to document the unsubscription, to comply with record-keeping obligations, or to prevent further mailings.
Consequences of Non-Provision
The provision of personal data in connection with the distribution of the newsletter, including performance measurement, is generally voluntary. A valid email address is required to subscribe to a newsletter. Without this information, it is not possible to subscribe to the respective newsletter or receive it. The provision of additional personal data—particularly for personalized communication—is generally voluntary and is not always required for newsletter distribution. However, if certain newsletters are provided exclusively for specific subject areas, recipient groups, events, or study, continuing education, project, or informational offerings, additional information may be required for the selection, assignment, or management of the respective newsletter subscription. If this information is not provided, it may result in an inability to subscribe to the respective newsletter, either in whole or in part. Performance tracking is an integral part of the respective newsletter distribution, provided it is used for the newsletter in question. Separate use of the newsletter without performance tracking is generally not technically supported. If you do not want personal usage data to be processed as part of performance tracking, you cannot subscribe to the respective newsletter or may cancel an existing subscription at any time.
Automated Decision-Making
No automated decision-making within the meaning of Article 22 of the GDPR takes place. Should we nevertheless use such a procedure in individual cases in the future, we will inform you separately, provided this is required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may request that inaccurate data be corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided the legal requirements are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object to the processing of your data at any time for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) of the GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the Data Protection Officer or the data controller.
Timeframes for Fulfilling Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right of the data subject or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15