In this privacy notice, we explain how we process your personal data in connection with the management of school contacts. For additional information regarding the handling of your personal data, please refer to the general privacy notice on our website: https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data controller within the meaning of Article 4(7) of the GDPR:
Ravensburg-Weingarten University of Applied Sciences
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
The university processes personal data for the structured management and maintenance of contacts with schools and their representatives (e.g., teachers, counseling centers, school administrators). This includes, in particular, the collection, storage, and ongoing updating of contact information, as well as the documentation of communication and interaction histories (e.g., email correspondence, telephone contacts, participation in events, inquiries, or coordination). The processing also serves to provide schools with targeted information about academic programs. This includes, in particular, information on degree programs, application deadlines, academic orientation services, information sessions, projects, opportunities for collaboration, and other offerings designed to support students’ academic and career orientation.
The purpose of the processing is to ensure needs-based and ongoing communication with schools, to promote academic orientation, and to establish and further develop a sustainable partnership between the university and school institutions.
Data Categories
The following categories of personal data, in particular, may be processed:
- Contact and identification data: last name, first name, title, position/role, work address, school or organizational unit.
- Communication data: work phone numbers, work email addresses, and other work-related contact information.
- Organizational and Assignment Data: Type of school, department, area of responsibility, regional assignment, subject areas supervised, or other information regarding the contact person’s organizational placement.
- Communication and Interaction History: Communication threads, meeting notes, feedback, inquiries, coordination, scheduling of appointments, documented interests, event participation, and details regarding planned or completed school visits.
- Cooperation and Agreement Data: Information regarding existing or planned collaborations, joint projects, coordination efforts, agreements, or offers of support between the school and the university.
- Administrative and Record-Keeping Data: Information regarding consents, objections, opt-outs, revocations, or other data protection-related preferences in connection with establishing contact.
Legal Basis
The processing of personal data is carried out to fulfill the tasks entrusted to the university in the public interest pursuant to Article 6(1)(e) of the GDPR in conjunction with Section 4 of the Baden-Württemberg State Data Protection Act (LDSG BW).
These include, in particular, tasks related to academic orientation, academic advising, public relations, recruitment of prospective students, maintaining contact with schools, and the initiation, implementation, and maintenance of school partnerships.
Recipients and Transfers to Third Countries
Personal data is generally processed only within the university by the departments responsible for this and by authorized users.
Recipients of personal data may include technical service providers engaged on behalf of the university, in particular providers of hosting, database, authentication, CRM, or other IT services. To the extent that these service providers process personal data on behalf of the university, their involvement is based on a data processing agreement in accordance with Article 28 of the GDPR.
The processing of personal data outside the European Union (EU) or the European Economic Area (EEA) may occur in individual cases, particularly in connection with the use of IT systems, cloud services, or group-wide applications. In such cases, a transfer will only take place if the specific requirements of Articles 44 et seq. of the GDPR are met.
This means that either an adequacy decision by the European Commission exists for the country in question (e.g., for the United Kingdom, Switzerland, or Canada), or an adequate level of data protection is ensured through the conclusion of EU Standard Contractual Clauses and, if necessary, supplementary safeguards.
Retention Period
Personal data of school contacts is retained for as long as it is necessary for maintaining contact, communication, academic advising, collaboration, or the implementation of school-related programs.
If a contact person steps down from their role or a new contact person is appointed, the personal data of the previous contact person will generally be deleted no later than 6 months after the change becomes known, provided there is no further need for it.
If the collaboration with a school ends completely, the associated personal data will generally be deleted no later than 6 months after the end of the collaboration, provided that no legal retention obligations or other legitimate documentation purposes preclude this.
Documented objections, opt-outs, or similar data protection preferences may be stored for a longer period, to the extent necessary to appropriately manage future contact and to permanently respect the rights of the data subjects.
Consequences of Non-Provision
Providing the data from schools and their contact persons required for maintaining contact is necessary to enable targeted information sharing, coordination, and communication between the school and the university.
If the data required for this purpose is not provided or cannot be processed, this may result in study-related information, notices regarding application deadlines, invitations to information events, study orientation offers, or other university-related communications not being transmitted at all or only to a limited extent. Similarly, processing individual inquiries, planning school visits, coordinating joint projects, or maintaining existing cooperative relationships may be hindered or impossible.
Failure to provide the data does not result in any immediate legal disadvantages for the individuals concerned. However, it may limit communication and collaboration between the school and the university.
Automated Decision-Making
Automated decision-making within the meaning of Article 22 of the GDPR does not take place. Should we use automated decision-making procedures in individual cases in the future, we will provide separate notice of this to the extent required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may have inaccurate data corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided the legal requirements are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object at any time to the processing of your data for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the Data Protection Officer or the data controller.
Timeframes for Complying with Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right of the data subject or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15