Privacy Policy

On this page, you will find information about how THA handles personal data—specifically, what data is collected and processed when you use the website or contact us, for what purposes this is done, and how long the data is stored.
In addition, this page explains the cookies, analytics, and third-party services used, as well as your rights regarding data protection.

Data Controller and Scope of Application

The data controller within the meaning of the EU General Data Protection Regulation (hereinafter: GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:

Technical University of Applied Sciences Augsburg
, a public-law corporation pursuant to Art. 11(1), sentence 1, of the Bavarian Higher Education Act (BayHSchG),
represented by its President, Prof. Dr. Gordon T. Rohrmair

An der Hochschule 1
, 86161 Augsburg

Phone: +49 (0)821-5586-0

info@tha.de

This Privacy Policy applies to the following websites:

And, in addition, to the extent that we process personal data on our own behalf, for:

Name and Address of the Data Protection Officer

Internal Data Protection Contact: Tamara Will (Department V – Legal Affairs)

External Data Protection Officer for Technical University of Applied Sciences Augsburg:

Attorney Dr. Karsten Kinast, LL.M.
, KINAST Rechtsanwaltsgesellschaft mbH
, Nordstraße 17a
, 50733 Cologne
, Germany

. Phone: +49 221 222183-0
. Email: mail@kinast.eu
Website: www.kinast.eu

Handling of Personal Data

This Privacy Policy informs users about the nature, scope, and purposes of the processing of personal data by the Technical University of Applied Sciences Augsburg. The legal basis for data protection is set forth in the GDPR.

Since changes in the law or changes to our internal university processes may require adjustments to this Privacy Policy, we ask that you review this Privacy Policy regularly.

Personal data, as defined in Article 4 of the GDPR, is any information relating to an identified or identifiable natural person (“data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier or one or more specific characteristics. Personal data therefore includes, for example, your name, email address, phone number, or IP address.

Information for which we cannot establish a connection to your person—for example, by anonymizing the information—or for which doing so would require a disproportionate amount of effort, does not constitute personal data. Processed personal data is deleted as soon as the purpose of the processing has been fulfilled and there are no longer any legally required retention obligations to be observed.

The Technical University of Applied Sciences Augsburg processes personal data only when permitted by law or when users consent to the collection of such data. If we process your personal data, we will inform you below about the specific processes, the scope and purpose of the data processing, the legal basis for the processing, and the respective retention period.

Access Data/Server Log Files

Technical University of Applied Sciences Augsburg collects data on every visit to the website (so-called server log files). The access data includes: domain, IP address, name of the accessed webpage, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and the requesting provider.

Technical University of Applied Sciences Augsburg uses the log data solely for statistical analysis for the purposes of operating, securing, and optimizing the website. However, the Technical University of Applied Sciences Augsburg reserves the right to review the log data retrospectively if there are concrete indications giving rise to a legitimate suspicion of unlawful use.

Article 6(1)(f) of the GDPR serves as the legal basis for the aforementioned data processing. The processing of the aforementioned data is necessary for the provision of a website and thus serves to safeguard a legitimate interest of our university.

The collection of data for the purpose of providing the website and the storage of this data in log files is absolutely necessary for the operation of the website. Consequently, users have no right to object. Your personal data will be deleted as soon as it is no longer necessary for the aforementioned purpose. When your personal data is stored in log files, it is deleted after three days. Further storage may occur in individual cases if required by law.

Website in General: Purposes and Legal Bases for Processing

In accordance with Article 6(1)(c) of the GDPR, in conjunction with Article 2(6) of the Bavarian School Act (BayHSchG) and Article 4(1), sentences 1 and 2, of the Bavarian E-Government Act (BayEGovG), we offer our services and administrative support on our websites, as well as information for the public about our activities. We use cookies, statistics, log files, Google Custom Search, and the web analytics tool Matomo to compile business statistics, to conduct organizational analyses, to test or maintain our web service, and to ensure network and information security in accordance with Article 6(1)(c) and (e) of the GDPR in conjunction with Article 6(1) of the Bavarian Data Protection Act (BayDSG), Section 13(7) of the German Telemedia Act (TMG), Article 11(1) of the Bavarian E-Government Act (BayEGovG), and Section 100 of the Telecommunications Act (TKG). To the extent that the purpose of processing is not compromised, we anonymize or pseudonymize personal data.

Log Files

When you visit the main websites of Augsburg University of Applied Sciences, you transmit data to our web server via your Internet browser. The following data is recorded during an active connection for communication between your Internet browser and our web server and is stored for a period of 3 days:

  • Name or IP address of the requesting computer
  • Name of your Internet service provider
  • Date and time of access
  • Name and URL of the file accessed
  • Amount of data transferred
  • Notification indicating whether the request was successful

Matomo Web Analytics

This website uses the web analytics tool Matomo to tailor the site to user needs, analyze usage, and plan resource requirements in accordance with Section 15(3) of the German Telemedia Act (TMG) and Article 6(1)(e) of the GDPR in conjunction with Article 6(1) of the Bavarian Data Protection Act (BayDSG) as well as Article 7(1) of the Bavarian Public Finance Act (BayHO). The following usage information is collected and stored when you visit our website using so-called cookies (small text files):

  • Name of the file accessed
  • Date and time of access
  • Amount of data transferred
  • Indication of whether the request was successful
  • Anonymized IP address
  • The website visited immediately prior
  • Browser identification

As a user, you remain anonymous to us due to anonymization, and no personal usage profiles are created. 

The standard retention period for usage information collected via Matomo is 12 months.

Contact Us

When you contact the Technical University of Applied Sciences Augsburg via email, your information is stored for the purpose of processing your inquiry and in case follow-up questions arise. Providing your email address allows us to assign your inquiry and respond to you. The legal basis for the processing of your personal data in this context is Article 6(1)(f) of the GDPR.

We will delete the personal data collected in this context once storage is no longer necessary, or restrict its processing if statutory retention requirements prevent its deletion. You have the right to object at any time, with future effect, to the processing of your personal data in connection with contacting us via email.

The basis for communication and the selection of the communication service provider is based on your consent pursuant to Article 6(1)(a) of the GDPR, on the performance of a contract pursuant to Article 6(1)(b) of the GDPR, in the context of service of process pursuant to Article 6(1)(c) of the GDPR in conjunction with the administrative regulations governing service of process. The legal basis for storing and responding to communications is Article 6(1)(e) of the GDPR in conjunction with the respective statutory duty. Many of these duties are listed in Art. 2 of the Bavarian School Act (BayHSchG).

If you submit a request, application, or opinion to us via email, mail, phone, fax, e-government portal solutions, in person, or via social media, the information you provide or our notes from conversations will be processed for the purpose of handling your inquiry, addressing any follow-up questions, and exchanging views, and will be forwarded to the appropriate personnel as needed. When we respond to you, we will use the same communication channel whenever possible, unless you request a different one.

Mail, emails, and social media posts and messages that you have not sent to us publicly are generally reviewed every two years, starting at the end of the year in which they were received, to determine whether it is still necessary to retain your inquiries for follow-up questions. If your data is no longer necessary for processing, its processing will be restricted, and it will continue to be retained in accordance with statutory retention obligations and archiving laws.

Mandatory Notices

Obligation to Provide Information

If you do not provide us with the necessary data in the course of our communication regarding the performance of the contract, we will be unable to fulfill the contract.

Right of Withdrawal

If the processing of your data is based on your consent, you may revoke that consent at any time by simply notifying us, without this affecting the lawfulness of the processing carried out on the basis of your consent up until the time of revocation.

Right to Object

You have the right to object at any time, pursuant to Article 21 of the GDPR, to the processing of personal data concerning you that is based, among other things, on Article 6(1)(e) of the GDPR, for reasons arising from your particular situation. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

Integration of Third-Party Services and Content

This website may include third-party content, such as maps from Google Maps, Google Web Fonts, RSS feeds, or graphics from other websites. This always requires that the providers of this content (hereinafter referred to as “third-party providers”) collect the user’s IP address. Without the IP address, they would not be able to send the content to the user’s browser. The IP address is therefore necessary for displaying this content. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. However, we have no control over whether third-party providers store the IP address, for example, for statistical purposes. To the extent we are aware of this, we inform users accordingly.

For more information about data processing by Google Maps, please refer to Google's Privacy Policy: https://www.google.com/intl/de_de/help/terms_maps.html.

For more information about Google Web Fonts, please visit: https://developers.google.com/fonts/faq and see Google’s Privacy Policy: https://www.google.com/policies/privacy.

To use our library’s services, we collect only the data necessary for this purpose via the registration forms available there (e.g., InfoGuide). The legal basis is Article 6(1), first sentence, letter d of the GDPR in conjunction with Section 3 of the ABOB, which permits the processing of personal data for the purpose of fulfilling the library’s tasks.

At our events, we create content as part of our public relations efforts and in accordance with our freedom in research, teaching, and the arts, and we take into account the community’s contributions and interactions regarding this content. Our goal is to provide information tailored to our target audience and to engage in dialogue with you.

We disclose content, posts, and inquiries that infringe on the rights of third parties, constitute a criminal offense or administrative violation, or fail to comply with statutory or contractual obligations by forwarding them to the relevant authority or social media provider and by blocking or deleting them.

The legal basis for data processing on our social media platforms and features is your consent pursuant to Art. 6(1)(a) of the GDPR, the contract with the respective provider pursuant to Article 6(1)(b) of the GDPR, and pursuant to Article 6(1)(e) of the DSGVI in conjunction with Article 2(6) of the Bavarian Higher Education Act (BayHSchG), Article 3 of the Bavarian Higher Education Act (BayHSchG), Art. 4(1), sentences 1 and 2, of the Bavarian Electronic Government Act (BayEGovG), and § 5(1), no. 2, of the German Telemedia Act (TMG).

Social media posts and messages that you have not sent to us publicly are reviewed every two years to determine whether it is still necessary to retain your inquiries for follow-up purposes. If storage is no longer necessary, the processing of your data will be restricted, and your data will be stored in accordance with the statutory retention periods and in compliance with archiving laws.

If you have communicated with us via social media in full view of the public or parts thereof, you may decide for yourself how long the data should remain published, or ask us to delete it. We delete this data in accordance with archiving laws within our jurisdiction. If we still have copies of the data after deletion, their processing will be restricted, and they will be stored in accordance with statutory retention periods and in compliance with archiving laws.
 

Required Information

Obligation to Provide Information

If you do not provide the provider with the personal data necessary for the fulfillment of the contract, the provider cannot process the contract.

Right to Withdraw Consent

If the processing of your data is based on your consent, you may withdraw your consent at any time without prior notice, without affecting the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out, among other things, pursuant to Article 6(1)(e) of the GDPR. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Social media providers often create comprehensive profiles of their members and of those who interact with their online media offerings (e.g., by clicking a “Like” button or visiting a website). These profiles are used, among other things, for advertising purposes. So when you use our services through these providers, they know that you have a relationship with us.

You can partially limit the scope of this data processing through general browser settings or browser extensions. You can find recommended information on this topic at https://www.privacy-handbuch.de/handbuch_21.html. The providers also offer individual settings to control advertising and tracking. This sometimes requires accounts with the respective providers. We have compiled important information for you here.

Facebook

Google

Instagram


Recipients or Categories of Recipients of Personal Data

When you use our social media channels and pages, we expressly note that their providers also process your personal data. The operators are based in the U.S. or Ireland.

The social media providers Facebook, Twitter, and YouTube are certified under the EU-U.S. Privacy Shield and are publicly verifiable, ensuring an adequate level of protection for personal data:

Facebook, Inc.

Twitter Inc.

YouTube (YouTube LLC) and Google+ under Google LLC

One exception is Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA. This protection does not apply there. We therefore note that personal data in the United States of America does not enjoy the same level of protection as it does throughout the European Economic Area without these safeguards.

Our IT service providers may also be recipients of your personal data under the data processing agreements we have entered into. However, to ensure the security of our data processing systems, we do not disclose the identities of our service providers.

If our IT service providers, who are bound by our instructions, are based outside the European Economic Area, in addition to our data processing agreements, we ensure that the European Commission has determined, through certification procedures, that an adequate level of data protection exists for the provider or for the country in which the provider is based, or we use standard data protection clauses. Information on these safeguards can be found at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de.

Retention Period for Personal Data

Subject to appropriate retention periods, personal data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected or the legal basis for its processing no longer exists (e.g., due to the withdrawal of consent).

If you have communicated with us via social media in a manner visible to the public or parts thereof, you may decide for yourself how long the data should remain published, or ask us to delete it. We delete this data within the scope of our authority in accordance with archiving laws. Should we still have copies of the data after deletion, their processing will be restricted, and they will be stored in accordance with statutory retention periods and archiving laws.

We use a so-called widget on our website provided by Startnext Crowdfunding GmbH, Grundstraße 1, 01326 Dresden (hereinafter referred to as “Startnext”). The widget serves as a link to the respective project page on Startnext. When you click the hyperlink, you will be redirected directly from our website to the other provider’s website. You can tell this is happening, among other things, by the change in the URL. We cannot assume any responsibility for the confidential handling of your data on third-party websites, as we have no control over whether these companies comply with data protection regulations. Please visit www.startnext.com directly to learn how Startnext handles your personal data.

Our website features virtual tours of properties integrated via the my.matterport.com portal. The operator of this portal is Matterport, Inc., 352 E. Java Dr., Sunnyvale, CA 94089, USA.

When you visit one of our pages that contains such a virtual tour, a connection is established to the Matterport servers. The Matterport server is notified of which of our pages you have visited. Matterport also receives your IP address. This also applies if you are not logged in to Matterport or do not have a Matterport account. The information collected by Matterport is transferred to the Matterport server in the United States.

If you have a Matterport account and are logged in, you allow Matterport to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your Matterport account.

Matterport is used to ensure an engaging presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

For more information on how Matterport implements the GDPR and handles user data, please visit https://support.matterport.com/hc/en-us/articles/360000904267-Matterport-s-Plan-for-GDPR

and in Matterport’s Privacy Policy at https://matterport.com/legal/privacy-policy/.

 

 

Purpose of Processing

The purpose of the processing is to operate a chatbot as a service on the Augsburg University of Applied Sciences website. The chatbot is designed to help interested users find information on the website regarding studying at the university more easily and quickly. If the chatbot recognizes the question, it displays the information available on the website. If the chatbot cannot answer the question, it forwards the question to a staff member in the relevant department.

Of course, all of this information can also be found on the website without using the chatbot.

Please note: As part of its operation, the chatbot collects only your IP address as personal data. It is generally not designed to answer individual, personal questions. For such questions, please use other communication channels, such as email or phone, and contact the relevant department directly.

Legal Basis

The legal basis for the processing of your personal data is your consent to the Privacy Policy pursuant to Art. 6(1)(a) of the GDPR.

Recipients

The text of the question you type into the chatbot is stored by us in anonymized form to optimize the chatbot and our website. In addition, the relevant department receives the text of the question to answer it as part of the chat history.

Third Parties

Where applicable, IT service providers may be recipients of your personal data under the data processing agreements we have entered into. However, to ensure the security of our data processing systems, we do not disclose the identities of our service providers.

Retention Period

Subject to statutory retention periods, personal data will be deleted when it is no longer needed for the purpose for which it was collected.

Active Components

Cookies are used for dynamic content on the website, but they do not store any personal data.

JavaScript applications are used here solely to provide enhanced navigation options. Users can disable this functionality by adjusting their browser settings.

Cookies

Cookies are small files that allow specific, device-related information to be stored on the user’s device (PC, smartphone, etc.). They serve, on the one hand, to enhance the user-friendliness of websites and thus benefit users. Some features of our website cannot be provided without the use of technically necessary cookies. They also serve to collect statistical data on website usage and to analyze this data for the purpose of improving the website. Users can control the use of cookies.

Here you can find more detailed information about the use of cookies on our website and configure your individual cookie settings.

Direct Marketing by Mail

For marketing purposes, we process your personal data in connection with direct marketing by mail. This purpose constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR. This also serves as the legal basis for the processing of your personal data in this context. Your personal data will be deleted as soon as it is no longer necessary for the purpose for which it was collected; this applies in particular if you object to our processing of your personal data. As a rule, we have collected the personal data directly from you. In addition, we process data that we are permitted to obtain and process from publicly available sources.

Direct Marketing via Electronic Newsletter

If you subscribe to the THA_akademie newsletter, we collect only the data necessary for sending the newsletter via the registration form. The legal basis is your consent pursuant to Art. 6(1), sentence 1, subparagraph (a) of the GDPR. You may revoke your consent at any time with future effect by sending an informal email to tha-akademie@tha.de. We will delete your personal data if we discontinue the newsletter, if you unsubscribe from the newsletter, or if you revoke your consent.

Asserting, exercising, or defending legal claims

The processing of your personal data in connection with the assertion, exercise, or defense of legal claims is carried out for the purpose of defending against unjustified claims and for the legal enforcement of claims and rights. This constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR. The legal basis for processing your personal data in connection with the assertion, exercise, or defense of legal claims is Article 6(1)(f) of the GDPR. Your personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Since the processing of your personal data in this context is strictly necessary, you do not have the right to object.

Recipient Categories

Within Augsburg University of Applied Sciences, your personal data is shared with those departments that need it to fulfill the purposes mentioned above. In addition, we use the services of various service providers (e.g., IT service providers) and transfer your personal data to these trusted recipients. We have carefully selected and commissioned these providers; they are bound by our instructions and are regularly monitored.

How to Apply for Job Openings

We process personal data from applicants in order to carry out the application process. You can also apply to us electronically. You can do so through our application portal:

The data you provide to us as part of the application process will be used exclusively to conduct the application process and will only be made available to those directly involved in the process. The data will not be disclosed to third parties. The legal basis for processing is Article 6(1)(b) in conjunction with Article 88 of the GDPR. The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and stored, provided that no statutory retention periods preclude this and it is not required in connection with the assertion and defense of potential legal claims. Applicants may withdraw their application at any time. Their application documents will then no longer be considered in the application process and will be deleted, provided that no statutory retention periods preclude this.

Rights of Affected Individuals

When we process your personal data, you are the data subject and have the following rights with respect to the personal data concerning you:

  • Pursuant to Article 15 of the GDPR, you may request access to the personal data we process about you. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, any transfers to third countries or to international organizations, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
  • Pursuant to Article 16 of the GDPR, you may request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us.
  • Pursuant to Article 17 of the GDPR, you may request the erasure of your personal data stored by us, provided that the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
  • Pursuant to Article 18 of the GDPR, you may request the restriction of the processing of your personal data to the extent that you contest the accuracy of the data, the processing is unlawful, or we no longer need the data and you refuse its erasure because you require it to assert, exercise, or defend legal claims. You are also entitled to the right under Article 18 of the GDPR if you have objected to the processing pursuant to Article 21 of the GDPR.
  • Pursuant to Article 20 of the GDPR, you may request to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or you may request that it be transmitted to another controller.
  • Pursuant to Article 7(3) of the GDPR, you may withdraw your consent at any time by notifying us. As a result, we may no longer continue processing your data based on this consent in the future.
  • Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority in your usual place of residence, your place of work, or the location of our company headquarters.

The data protection supervisory authority responsible for us is:

Right to Object


When we process your personal data on the basis of legitimate interests pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection is directed against direct marketing. In the case of direct marketing, you have a general right to object, which we will honor without requiring you to specify a particular situation. Augsburg University will then no longer process this personal data, unless Augsburg University can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Data Security and Backup Procedures

We are committed to protecting your privacy and treating your personal data confidentially. To prevent the manipulation, loss, or misuse of the data we store, we implement comprehensive technical and organizational security measures that are regularly reviewed and adapted to technological advancements. This includes, among other things, the use of recognized encryption methods (SSL or TLS).


However, we would like to point out that, due to the nature of the Internet, it is possible that data protection rules and the aforementioned security measures may not be observed by other individuals or institutions outside our sphere of responsibility. In particular, data disclosed in unencrypted form—for example, via email—may be read by third parties. We have no technical control over this. It is the user’s responsibility to protect the data they provide against misuse through encryption or other means.

Links to Websites from Other Providers

Our websites contain links to sites operated by other providers. Please note that this privacy policy applies exclusively to the main website of Augsburg University of Applied Sciences. We have no influence over these sites and do not verify whether other providers comply with applicable data protection regulations.

Additional Information Regarding Our Privacy Policy

We reserve the right to update this Privacy Policy from time to time to ensure that it always complies with current legal requirements or to reflect changes to our services in the Privacy Policy, such as when we introduce new services. The updated Privacy Policy will then apply to your next visit.