Legal
Legal
As of August 2026
Data protection and data security for the customers and partners of the University of Applied Sciences for Management, as well as for prospective students and users of our website, are of the utmost importance to us. Transparency regarding the processing of your personal data, as well as the protection of your data, are particularly important to us. Below, we provide an overview of how your personal data is collected and processed when you use our websites, and what you can do yourself to better protect your data.
University of Applied Management Studies Oskar-Meixner-Str. 4-6 68163 Mannheim Phone: 0621 490 890-00 Email: info@hdwm.org
ISiCO GmbH Am Hamburger Bahnhof 4 10557 Berlin Email: datenschutz@hdwm.org
If you have any questions regarding the processing of your personal data or data protection in general, please contact our Data Protection Officer.
Personal data refers to any data that can be linked to you personally (such as your name, address, email address, IP address, or user behavior). Below, we explain what information we collect during your visit to our websites and how it is used.
Our data protection practices comply with the provisions of the Federal Data Protection Act (BDSG), the European General Data Protection Regulation (GDPR), and the Telecommunications and Digital Services Data Protection Act (TDDDG). We will collect, process, and store your personal data only to the extent necessary for the respective purpose (for example, to provide the website, to process inquiries, etc.). Your data will only be used for additional purposes—specifically defined in your prior consent—if you have separately granted your consent in advance, e.g., to receive information about offers via newsletters, etc.
Please note that data transmission over the Internet (e.g., when communicating via email) may involve security vulnerabilities. It is not possible to completely protect data from access by third parties.
Some parts of this website use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.
Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser the next time you visit.
Our cookies are also used for remarketing purposes as part of services provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter “Google”). This allows us to show you ads on the Google Partner Network that are tailored to your interests, as determined by your browsing behavior. You can disable Google’s use of cookies for these purposes by visiting https://www.google.de/settings/ads. Alternatively, you can disable the use of third-party cookies by visiting the Network Advertising Initiative’s opt-out page. Please note that Google has its own privacy policy, which is independent of ours. Please review Google’s privacy policy before using our website.
You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.
You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.
The delivery and display of content via our website technically require the collection of certain data. When you access our website, these so-called server log files are collected by us or the web hosting provider. The relevant information consists of the name of the website, the content of the request (page visited), the date and time of the request, the amount of data transferred, the web browser and its version and language, the operating system used, the domain name, the HTTP status code, the referrer URL (the page from which you navigated to our site), and the IP address of your device.
We use this data to display and deliver our content, as well as for statistical purposes. The data may be processed in pseudonymous or anonymous form to optimize and improve the website, to administer the site, and for market research purposes. Pseudonymous data is not linked to the data of the person behind the pseudonym and therefore does not allow any conclusions to be drawn about your identity. No user profiles are created. The information supports the provision and continuous improvement of our services. We also reserve the right to review the aforementioned data retrospectively should there be suspicion of unlawful use of our services. The legal basis for this processing is Article 6(1)(f) of the GDPR (protection of our legitimate interests). Our legitimate interests lie in fulfilling the purposes mentioned above.
We would also like to point out that we reserve the right to access personal data and other information collected by us and to disclose it to (investigative) authorities and public agencies, to the extent that this becomes necessary under legal or regulatory requirements (Article 6(1)(c) of the GDPR), in order to enable us to initiate investigations in cases of suspected fraud, harassment, or other violations of laws and legal provisions (including the rights of third parties), or to investigate any suspicious behavior that appears unfair to us (Art. 6(1)(f) GDPR). To the extent that the aforementioned data processing is based on Article 6(1)(f) of the GDPR, such data processing is necessary to safeguard our legitimate interests in fulfilling the purposes mentioned above.
The content on our website may also include content, services, and offerings from other providers that supplement our own offerings. Accessing these third-party services typically requires the transmission of your IP address. This enables these providers to detect your user IP address and also to store it. Depending on the service, your data may also be processed by the providers on their own responsibility. You can find more detailed information below in the description of the respective services.
If the providers are based in a country outside the European Economic Area (EEA), we will inform you of the implications of this in the description of the respective service.
When you visit our websites, our web servers temporarily store, by default and for the purpose of system security, the connection data of the requesting computer, the web pages you visit on our site, the date and duration of your visit, the identification data of the browser and operating system types used, and the website from which you are visiting us (see Section 6 for details). Additional personal information, such as your name, address, phone number, or e-mail address, is not collected unless you provide this information voluntarily, e.g., as part of an information request or when subscribing to the newsletter.
You can use the contact forms on the website to, among other things, send us general inquiries, schedule a consultation, or register for an informational event. If you use our contact form and enter personal data (such as your email address, name, phone number, or message), the provision of this data is expressly voluntary. The provision of this data is not required by law or contract. However, without this data, we may not be able to properly process your request. If you send us a message via the contact form, your personal data will be processed only to the extent necessary to respond to your message.
We use the personal data you provide exclusively for the technical administration of the websites and to fulfill your request—that is, generally to process the contract concluded with you or to respond to your inquiry. The legal basis is therefore Article 6(1)(b) of the GDPR (performance of a contract) if you have entered into a contract with us, or otherwise Article 6(1)(f) of the GDPR (legitimate interests). Our legitimate interest lies in the proper handling of your inquiry.
Only to the extent that you have previously given us your consent do we also use this data for product-related surveys or marketing purposes (for example, sending our newsletter; see Section 21) and for statistical purposes. The legal basis in such cases is Article 6(1)(a) of the GDPR. Consent that has been given may be revoked at any time with future effect.
Your personal data will not be disclosed or otherwise transferred to third parties unless this is necessary to fulfill the purposes mentioned above or you have expressly consented to it. The legal basis in such cases is Article 6(1)(a) of the GDPR. Consent that has been given may be revoked at any time with future effect. Your data will not be sold.
As a general rule, we store all information you provide to us until the respective purpose of processing has been fulfilled—for example, in the case of inquiries until they are resolved, in the case of newsletters until you unsubscribe, etc.—or until you revoke your consent. The data is then deleted immediately, unless there are legitimate grounds under applicable legal regulations that prevent this (see Section 26 for details).
HubSpot services may be used for the technical provision of the forms. To the extent that personal data is processed in this context, it is done exclusively to process your inquiry and in accordance with statutory data protection regulations.
We provide our students, all staff members, and (external) faculty members with a user account on our Campus Portal. The Campus Portal is a central administrative tool where users can, among other things, manage their personal data, view university news and office hours, access documents from the “ ” University (including lecture materials, informational materials, regulations, applications, and forms), retrieve certificates, exam results, academic transcripts, and course schedules, and exchange messages.
The Campus Portal is based on the academyFIVE campus management system and is also used to process and manage enrollment.
Applicants can also create their application profile directly in the Campus Portal. Once an application profile has been created, we can contact applicants using the contact information they provided to assist them in completing their application.
If an via HubSpot application submitted is accepted, we transfer the information and documents required for enrollment from HubSpot to academyFIVE. This may include, in particular, personal and contact information, details regarding the intended degree program, information on secondary education and eligibility for higher education, as well as the certificates and documents required for enrollment.(Section 19)
After enrollment or upon starting work as a staff member or external instructor with us, each student or staff member will receive an email containing initial login credentials (username and password) sent to the email address provided to us. The username is generated from the student’s matriculation number or the first and last names of the staff member or instructor. The initial password is randomly generated and can (and should) be changed by students, staff members, or external instructors. In the event that students forget their password—for example, at a later date—the password can be changed or reset by designated staff members from IT and administration.
The data stored in the Campus Portal user account includes personal information (in particular, title, name, address, place of birth, nationality, contact information, enrollment and, if applicable, withdrawal certificates, forms, and documents), group membership (cohort), profile picture (optional, but required for issuing a student ID card), messages, exam results, and academic transcripts, as well as course schedules. In addition to the student in question, access to the user account is generally limited to selected staff members from the Registrar’s Office, the Examinations Office, and IT Administration, to the extent necessary for their professional duties. Additionally, faculty members can enter and view exam results for their respective departments and exchange messages with students.
Additional information may be provided optionally in a profile. This includes, in particular, contact information, interests, languages, and details about educational and professional background. Students can specify in their user account settings who can view their profile information (e.g., fellow students from the same cohort, instructors, or all students). By default, the profile is not visible to other students or instructors.
The Campus Portal is provided by our service provider Simovative GmbH, Landsberger Straße 110, 80339 Munich, Germany (“Simovative”). Simovative stores the data on servers located within Germany. Simovative may access our Campus Portal and/or user accounts for the purposes of technical maintenance and troubleshooting. We have entered into a data processing agreement with Simovative, so that any transfer of data to Simovative is carried out in accordance with Article 28 of the GDPR. To the extent that Simovative processes personal data of our applicants, students, employees, or external instructors, this is done exclusively on our behalf and in accordance with our instructions.
The aforementioned data processing serves to carry out and manage the application and enrollment process, to assist with completing the application, and to organize and manage the respective degree program and communication with students. The creation and editing of the application profile, contacting applicants to assist with completing their applications, providing access to the campus portal, and processing the data required for enrollment are carried out to implement pre-contractual measures or to fulfill our contract with the respective student (Article 6(1)(b) of the GDPR) .
For employees, the processing is based on Section 26(1), sentence 1 of the German Federal Data Protection Act (BDSG). For external instructors, the processing is carried out to fulfill the respective contractual relationship based on Article 6(1)(b) of the GDPR.
With your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of our use of Google Analytics is to enable the analysis of your user interactions on our website and, through the statistics and reports obtained, to improve our offerings and make them more interesting for you as a user. To simplify the implementation and management of Google Analytics, we use Google Tag Manager (see Section 12).
Google Analytics uses cookies (see “Cookies” for more information), which are stored on your computer and enable an analysis of your use of the website. The cookies remain stored on your device for a maximum of 2 years. The information generated by the cookie regarding your use of this website (including your IP address) is transmitted to a Google server in the U.S. and stored there. For your protection, however, we naturally use the anonymization feature (“IP masking”), which means that Google truncates IP addresses by the last octet within the EU/EEA. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. Google will use this information to evaluate your use of the website, to compile reports on website activity for us, and to provide other services related to website and internet usage (such as analyzing the paths visitors take to reach our website).
Google also processes the aforementioned data collected via Google Analytics for its own purposes, to the extent specified in its own privacy policy. Google may store this data in user profiles and process it, for example, to improve products, develop new products, measure the effectiveness of certain advertisements, conduct market research, and personalize content and advertisements. If you are signed in to Google, your data will be directly associated with your user account. If you do not wish for your data to be associated with your Google user account, you must sign out before Google Analytics is activated. We have no control over this additional data processing by Google. For more information, please see Google’s Privacy Policy: https://policies.google.com/privacy Further details on data processing in connection with Google Analytics are available at https://google.com/analytics/terms/de.html and at https://support.google.com/analytics/answer/6004245?hl=de/.
Please note that the transfer of data to servers used by the Google Group in the United States may entail additional risks; for example, it may be more difficult to enforce your rights regarding this data, and certain U.S. authorities may gain access to this data. Please be aware that by granting us your consent to use Google Analytics, you are consenting to this data transfer to the United States. Google LLC is certified under the Data Privacy Framework, so the data transfer to the United States is based on Article 45(1) of the GDPR. In addition, we have also entered into the EU Commission’s Standard Data Protection Clauses with Google pursuant to Article 46(2)(c) of the GDPR. These Standard Data Protection Clauses are intended to ensure that Google maintains an adequate level of data protection in the third country (the U.S.).
We activate Google Analytics only if you consent to the processing of your data by the Google Analytics service. The legal basis for data processing in connection with the integration of Google Analytics on our website is therefore Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal.
In addition, you can prevent Google Analytics from storing cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website, as well as from processing this data, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
In addition, you can download a browser add-on from Google here. An opt-out cookie will then be set to prevent the future collection of your data when you visit this website. You may need to follow the additional instructions provided there to completely prevent the setting of cookies or their use for the aforementioned purposes.
We use Google Ads to display advertisements in search engines and on the websites of Google and its partners (“Google Advertising Network”). Google Ads is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). To simplify the implementation and management of Google Ads, we use Google Tag Manager (see Section 12).
As part of this advertising service, Google independently determines which ads are displayed to which users within the Google Advertising Network. We have no authority to issue instructions or exert any specific influence over this selection. When placing ad orders, we can only set broad restrictions in advance—using a limited number of preset options provided by Google—regarding where ads may potentially be displayed. In this regard, we have no influence over data processing at Google. Google merely provides us with statistical reports indicating which ads were clicked, how often, and at what prices. We do not receive any further data from the use of the advertising materials; in particular, we cannot identify users based on this information.
We use Google Ads with Google’s remarketing feature. This process allows personalized ads to be created based on existing information about you, enabling us to target you again as you continue browsing the internet. To do this, Google uses cookies that are stored on your computer and enable an analysis of your use of the website. The cookies set by Google enable Google to recognize your browser. Through the integration of Google Ads, Google receives the information that you have visited the corresponding section of our website or clicked on one of our ads. The cookies remain stored on your device for a maximum of 2 years. The information generated by the cookie regarding your use of this website (including your IP address) is transmitted to a Google server—which may be located in the United States—and stored there. Google then truncates the IP address by the last three digits, making it impossible to uniquely identify the IP address (anonymize_IP plugins).
You can disable the use of cookies by Google by visiting the page to opt out of Google ads (https://www.google.com/settings/ads).
Google processes the aforementioned collected data for its own purposes to the extent specified in its own privacy policy. The data may be stored by Google in user profiles, based on which Google or third-party providers display personalized ads, for example on thirdparty websites. In addition, Google may process the data, for example, to improve products, develop new products, measure the effectiveness of certain ads, and conduct market research. If you are signed in to Google, your data will be directly associated with your user account. If you do not wish for your data to be associated with your Google user account, you must sign out before activating Google Ads. We have no influence over this additional data processing by Google. For more information, please see Google’s Privacy Policy: https://policies.google.com/privacy
Further information on the transfer of data to third countries, including the United States, can be found in Section 10 above of this Privacy Notice.
We activate Google Ads only if you consent to the processing of your data by the Google Ads service. The legal basis for data processing in connection with the integration of Google Ads on our website is therefore Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal. Further information regarding the processing of your personal data by Google in connection with Google Ads, contact information through which you can exercise your related rights as a data subject vis-à-vis Google, and Google’s applicable privacy policies can be found at https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/ads.
We use “Google Tag Manager,” a service provided by Google, to simplify the implementation and management of Google Analytics and Google Ads on our website. Google Tag Manager allows us to manage website tags through a single interface. Google Tag Manager, which implements the tags, is a cookie-free domain and does not itself collect any personal data. Google Tag Manager triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If the integrated service is deactivated, this setting is also applied to Google Tag Manager. As a result, Google Tag Manager is only activated after you have consented to the use of Google Analytics and/or Google Ads. For more information on data protection, please visit the following Google websites:
We activate Google Tag Manager only if you consent to the processing of your data by Google Analytics or Google Ads (each using Google Tag Manager). The legal basis for data processing in connection with the integration of Google Tag Manager on our website is therefore Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal.
This website uses Facebook’s visitor action pixels to measure conversions. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the United States and other third countries.
This allows the behavior of website visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook ad. This enables the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and helps optimize future advertising campaigns.
The collected data is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, allowing a link to the respective user profile and enabling Facebook to use the data for its own advertising purposes in accordance with the Facebook Data Use Policy. This enables Facebook to display ads on Facebook pages as well as outside of Facebook. As the website operator, we have no influence over this use of the data.
Use of this service is based on your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You may revoke your consent at any time.
Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
To the extent that personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook after the transfer is not part of the joint responsibility. The obligations incumbent upon us jointly have been set forth in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum.
According to this agreement, we are responsible for providing privacy notices when using the Facebook tool and for ensuring the tool is implemented on our website in compliance with data protection laws. Facebook is responsible for the data security of Facebook products. You can exercise your data subject rights (e.g., requests for information) regarding the data processed by Facebook directly with Facebook. If you exercise your data subject rights with us, we are obligated to forward these requests to Facebook.
You can find further information on the protection of your privacy in Facebook’s Privacy Policy: https://de-de.facebook.com/about/privacy/.
You can also disable the “Custom Audiences” remarketing feature in the ad settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do so, you must be logged in to Facebook.
If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.
This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St. Julians Business Center, 3 Elia Zammit Street, St. Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).
Hotjar is a tool for analyzing your user behavior on this website. With Hotjar, we can, among other things, record your mouse and scroll movements as well as your clicks. Hotjar can also determine how long you hovered your mouse pointer over a specific area. From this information, Hotjar creates so-called heatmaps, which allow us to determine which areas of the website visitors prefer to view.
Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine at which point you abandoned your entries in a contact form (so-called conversion funnels).
In addition, Hotjar can be used to collect direct feedback from website visitors. This feature is used to improve the website operator’s online offerings. Hotjar uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting).
Hotjar is used only with your consent. The legal basis for storing information on your device or accessing information already stored is Section 25(1) of the TDDDG; the subsequent processing of personal data is based on Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect via the cookie settings.
Disabling Hotjar
If you wish to disable data collection by Hotjar, click on the following link and follow the instructions provided there:www.hotjar.com/policies/do-not-track/
Please note that Hotjar must be disabled separately for each browser and each device. For more information about Hotjar and the data it collects, please refer to Hotjar’s privacy policy at the following link: www.hotjar.com/privacy
We have entered into a data processing agreement with Hotjar in accordance with Article 28 of the GDPR. Hotjar processes personal data in connection with the provision of the service in accordance with our instructions and in compliance with applicable data protection regulations.
This site uses so-called Google Fonts, provided by Google, to ensure consistent font display. The Google Fonts are installed locally. No connection to Google’s servers is established. For more information about Google Fonts, visitdevelopers.google.com/fonts/faq and see Google’s Privacy Policy: policies.google.com/privacy.
Our website uses plugins from YouTube (“YouTube”), a service operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). When you visit one of our pages equipped with a YouTube plugin and activate the plugin, a connection is established to YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.
We integrate YouTube plugins in a way that generally prevents cookies from being set when you view videos on our website (so-called “enhanced privacy mode”).
Furthermore, YouTube videos are not loaded or played until you have enabled video playback on our pages. If you then start a YouTube video, YouTube may receive your IP address, along with information about the specific video and your use of the playback features.
Google may also process the data collected via YouTube for its own purposes to the extent specified in its own privacy policy. Google may store this data in user profiles and process it, for example, to improve products, develop new products, measure the effectiveness of certain advertisements, conduct market research, and personalize content and advertisements. We have no influence over this further data processing by Google. For more information, please see Google’s Privacy Policy: https://policies.google.com/privacy
The aforementioned data may also be transferred by Google to servers in the United States. This may give rise to additional risks; for example, it may be more difficult to exercise your rights regarding this data, and certain U.S. authorities may gain access to it. Please be aware that by granting us your consent to use YouTube, you are consenting to this data transfer to the United States. Google LLC is certified under the Data Privacy Framework, meaning that the data transfer to the United States is based on Article 45(1) of the GDPR. To the best of our knowledge, Google has also secured the data transfer to the U.S. with Standard Data Protection Clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR . Further information can be found here: https://policies.google.com/privacy/frameworks
We use YouTube content to enhance the user experience when visiting our website. The legal basis for embedding YouTube content and the associated transfer of your data to Google is Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect in the cookie policy above by unchecking the corresponding checkbox to adjust your consent (consent for the “Statistics” category).
As part of our press and public relations activities, we have embedded a newsroom provided by MyNewsdesk AB, Rosenlundsgatan 40, 11853 Stockholm, Sweden (“MyNewsdesk”) on our website to provide our users with the latest news and information and to measure the success of our public relations efforts using statistical reports. We also use MyNewsdesk on our Facebook page (see Section 23).
When you access the newsroom, your browser automatically transmits the server log file data technically required for this purpose (including your device’s IP address, the date and time of the request, and information about your web browser and operating system; see Section 6 for details) to MyNewsdesk. The data is processed to provide the newsroom and to generate statistical reports that allow us to determine how often a particular article was clicked. This enables us to draw conclusions about which topics were of particular interest to our users and how we can improve our public relations efforts. However, we only receive statistical reports from MyNewsdesk regarding click-through rates, which do not allow us to identify you personally. No user profiles are created.
We have entered into a data processing agreement with MyNewsdesk in accordance with Article 28 of the GDPR (see https://www.mynewsdesk.com/about/terms-andconditions/data_protection_terms). Please note that MyNewsdesk may also process data in accordance with its own privacy policy, for example, to provide and improve its service. We cannot rule out the possibility that MyNewsdesk may transfer data to third countries outside the EEA, such as the United States, which do not have an equivalent level of data protection. For more information on data processing by MyNewsdesk, including any data transfers to third countries, please visit: https://www.mynewsdesk.com/about/terms-andconditions/privacy_policy
The legal basis for the above processing is Article 6(1)(f) of the GDPR (protection of our legitimate interests). Our legitimate interests lie in fulfilling the purposes mentioned above.
We embed an interactive map based on OpenStreetMap on our website to show you our location and make it easier for you to find us. When the map is loaded, technically necessary connection data—in particular the IP address, browser and device information, as well as the time and requested map content—is transmitted to the service used to display the map.
The map is embedded only if the necessary consent has been granted. The legal basis for storing information on your device or accessing information already stored is Section 25(1) of the TDDDG; the subsequent processing of personal data is based on Article 6(1)(a) of the GDPR. Consent may be revoked at any time with future effect via the cookie settings.
To the extent that services provided by the OpenStreetMap Foundation are used for map display, the OpenStreetMap Foundation processes the data generated during retrieval on its own responsibility. For more information on data processing, please refer to the OpenStreetMap Foundation’s Privacy Policy.
We use the HubSpot for Marketers and Sales Hub Professional modules provided by HubSpot Ireland Limited, Dublin, Ireland (“HubSpot”). HubSpot serves as our CRM, marketing, and sales platform. In particular, we use these services to provide and evaluate forms, to process and manage inquiries and applications for our study programs—including the application documents submitted in connection therewith—to manage contacts with prospective students and customers, to manage and document newsletter consents, to document communication processes and sales activities, and to plan, execute, and evaluate marketing campaigns. To the extent that the relevant features are enabled, we also use HubSpot to send and automate marketing communications, as well as to analyze website, form, and email interactions.
In particular, thisinvolve the processing of as well as information about your intended degree program and the application process. This may include, in particular, details regarding your educational background, nationality, place and date of birth, application documents such as resumes, applications, and transcripts, interview transcripts, and information regarding consent given for newsletters In addition,may may master and contact data, company and professional data, the form and communication content you submit, information regarding inquiries and sales processes, . technical usage, device, and connection data be processed. If analytics and tracking functions are enabled, information about visited pages, form interactions, as well as the opening of emails and clicks on links contained therein may also be processed and assigned to a contact profile. In particular, HubSpot enables the collection of personal data regarding email opens and link clicks in marketing and sales emails. If your application is accepted, the information and documents required for enrollment will be to our campus management system, academyFIVE transferred . (Section 9)
To the extent that processing is necessary for the implementation of pre-contractual measures or for the performance of a contract—,—in particular for processing your application for a place in a degree programit is based on Article 6(1)(b) of the GDPR. In all other respects, the administration and documentation of inquiries, contacts, and sales processes are carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the efficient organization of our communication with prospective and current clients, as well as our sales processes, and in the documentation of consents granted for newsletters.
The sending of consent-based marketing communications, as well as personal analyses of usage or communication behavior, is based on your consent pursuant to Article 6(1)(a) of the GDPR. To the extent that cookies or similar technologies are used in this process to store or retrieve information on your device, this is additionally based on Section 25(1) of the German Telemedia Act (TDDDG). You may revoke your consent at any time with future effect.
We generally store the data for as long as is necessary for the respective processing purposes. The data is then deleted unless there are statutory retention requirements or other legitimate reasons for further storage.
To the extent that HubSpot processes personal data on our behalf, we have entered into a data processing agreement with HubSpot in accordance with Article 28 of the GDPR.
HubSpot may process personal data worldwide, in particular through HubSpot, Inc. in the United States and through other subprocessors. The transfer to HubSpot, Inc. is based on the European Commission’s Adequacy Decision regarding the EU-U.S. Data Privacy Framework. For other third countries deemed inadequate, the Data Processing Agreement specifically provides for the European Commission’s Standard Contractual Clauses.
For more information, please see HubSpot’s Privacy Policy at: https://legal.hubspot.com/de/privacy-policy.
We provide an AI-powered digital academic advisor (“KAI”) on our website. The chatbot is designed to answer visitors’ general questions about our academic programs and our university. Before the interaction begins, a notice appears indicating that this is an AI system. KAI is designed as a voice assistant. To use the voice function, you must grant access to your device’s microphone. Voice inputs are processed during the conversation and converted into text. The audio data is not permanently stored. Microphone access can be disabled during the conversation.
When using the chatbot, the content you enter or provide, as well as technically necessary usage and connection data, may be processed. This includes, in particular, the complete conversation history as text, the responses generated by KAI, a technical session ID, the times and duration of the conversation, the language used, a country code derived from the IP address, the assigned test variant and,—if provided by you—your email address and a rating. A summary, an interest score, potentially suitable degree programs, and topic tags may also be automatically generated from the conversation.KAI is not designed to process such information. Please do not submit any special categories of personal data as defined in Article 9 of the GDPR or any other confidential information via the chatbot.
The processing is carried out to provide the chatbot and to handle your inquiry. To the extent that your inquiry relates to a potential degree program or a contractual relationship with us, the processing is carried out to implement pre-contractual measures based on Article 6(1)(b) of the GDPR. For general questions about our academic programs, processing is based on our legitimate interest in providing digital academic advising pursuant to Article 6(1)(f) of the GDPR.
The chat histories and the analyses derived from them may also be used for quality assurance and to improve KAI, as well as for statistical analysis. The long-term storage and analysis of the chat history, as well as a personalized analysis of your academic interests, are carried out—to the extent provided for— based on your consent pursuant to Article 6(1)(a) of the GDPR. The analyses generated in this process have no influence on an application, admission to a degree program, or other decisions with legal or similarly significant effects. No decision is made exclusively by automated means within the meaning of Article 22 of the GDPR.
If you would like to receive a summary of the conversation, you may voluntarily provide your email address. In this case, we will use your email address to prepare and send you the requested summary. This processing is based on Article 6(1)(b) of the GDPR.
Provided you have given separate consent for this purpose, we may also use your email address and the academic interests we have identified to contact you via email regarding relevant degree programs, information sessions, and application opportunities. The legal basis in this case is Article 6(1)(a) of the GDPR.
External service providers are used for the technical operation of the chatbot. These include, in particular alpha-test GmbH,, Dynamostraße 15, 68165 Mannheim (“alpha-test”). alpha-test OpenAI’s API services for the transcription, generation, and voice output of responses, as well as for the creation of the summary and evaluation metricsusesas a subprocessor . OpenAI receives the conversation content, but not the email address provided separately for sending the summary. However, if you provide contact information during the conversation itself, this may be included in the conversation content transmitted to OpenAI. The content processed via the API services used is not used to train OpenAI models, in accordance with the applicable settings.
To the extent that these service providers process personal data on our behalf, such processing is carried out in accordance with Article 28 of the GDPR.
Any transfers of personal data to third countries are carried out only in compliance with the requirements of Articles 44 et seq. of the GDPR.
The audio data is not stored permanently. The text transcripts and the analysis data derived from them are currently stored for a period of up to 24 months and are subsequently deleted, unless deleted earlier. You may revoke any consent you have given at any time with future effect and request the deletion of your conversation data.
We appreciate your interest in our newsletter. With your consent, we will keep you informed, in particular, about the latest news, introductory lectures, and (online) events at the University of Business and Management. For more information on and the newsletter’s content, please refer to the consent form or the registration form.
We use HubSpot to register, manage, and document your consent, as well as to send and analyze the newsletter. Further information about HubSpot—including details on the data processed, the provider, potential transfers to third countries, and data processing on behalf of others—can be found in the “HubSpot” section (Section 19).
When you subscribe to our newsletter, we process, in particular, your email address as well as, if applicable, your name and any other data you voluntarily provide in the registration form. In addition, we store information about your subscription and confirmation, specifically the time of subscription and confirmation, the IP address used during the process, and your consent status. This information is used to send you the newsletter and to verify your subscription and consent.
We generally use the so-called double opt-in procedure for registration. After submitting the registration form, you will receive an email asking you to confirm your registration by clicking on a confirmation link. You will only receive our newsletter after this confirmation. If confirmation is not provided, the registration will not be completed.
We also track, on a personal basis, whether and when our newsletters are opened and which links contained therein are clicked. The information collected in this process may be associated with your contact profile in HubSpot. We use this information to evaluate the usage and reach of our newsletters, to better understand the interests of our recipients, and to adapt and further develop the content of our newsletters accordingly. For more information on the collection of personal data regarding newsletter opens and link clicks, please see the “HubSpot” section.
The distribution of the newsletter and the processing of your personal data regarding your usage and communication behavior are based on your consent pursuant to Article 6(1)(a) of the GDPR. To the extent that information is stored on or retrieved from your device in connection with tracking opens and clicks, this is additionally based on Section 25(1) of the TDDDG. The technical provision and security of the registration process, as well as the documentation of your consent, are based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure execution of the registration process and in the ability to verify that consent has been properly granted.
You may revoke your consent at any time with future effect. To do so, you may, in particular, use the unsubscribe link included in every newsletter or send a message to the contact information provided in this privacy notice. Revocation does not affect the lawfulness of processing that took place prior to the revocation.
We generally store your data for as long as your newsletter subscription remains active. After you revoke your consent or unsubscribe, your data will no longer be used for sending the newsletter or for its personalized analysis. We may retain information necessary to verify your consent to the extent required. Otherwise, the data will be deleted unless there are legal retention obligations or other legitimate reasons for further storage.
We maintain pages (so-called “fan pages”) on the following social media platforms and providers:
To operate our respective fan pages, we rely on the technical platforms and services provided by these providers. Please note that you use our fan pages on social networks and their features at your own risk. This applies in particular to the use of interactive features (e.g., commenting, sharing, rating). When you visit our fan pages, the social media providers collect certain technical data (including the IP address of your device) as well as other information stored on your device in the form of cookies. This information is used to provide us, as the operators of the fan pages, with statistical data regarding interactions with us.
We have no influence over and no precise knowledge of how the providers process the data from visits to our fan page and from interactions with our posts for their own purposes, how long this data is stored, or whether the data is shared with third parties. Data processing may vary depending on whether you are registered and logged in to the social network or are visiting the page as an unregistered and/or logged-out user. When you access the fan page or a post, the IP address assigned to your device is transmitted to the provider of the respective social network. If you are currently logged in to the social network, a cookie on can be used to track your activity on the network via your device. Through buttons embedded in websites, the platforms are able to track your visits to these websites and associate them with your respective profile. Based on this data, content or advertising can be tailored to you. If you wish to avoid this, you should log out or disable the “stay logged in” feature, delete the cookies stored on your device, and restart your browser. Please also note that the data collected about you in this context may be transferred by the respective social network provider to countries outside the European Economic Area (EEA)—in particular the United States—and processed there.
For more information on data processing by social media providers, including any data transfers to third countries, please refer to the privacy policies of the respective providers linked above. There you will also find information on how to contact them and on settings for managing advertisements.
We operate our fan page on the respective social network to communicate with users active there and to provide the latest news. We process the data resulting from your use of the fan page that you provide to us and that is necessary for interaction. For example, if you ask us a question via a fan page, we process your information to respond to the inquiry appropriately. When you visit our fan pages on Facebook and LinkedIn, the respective social media providers also process personal data to provide us with statistics and insights into the use of our fan pages. We use these statistics to tailor our fan pages to user needs and thereby continuously optimize them, which may also be done for market research and advertising purposes. In this context, we receive only statistical reports that do not allow us to identify individual users of the social network or draw conclusions about them. The processing of data for statistical purposes is carried out by us and the social network providers under joint responsibility in accordance with Article 26 of the GDPR. We have set forth the terms and obligations as joint controllers with the respective providers in an agreement, which is available at https://dede.facebook.com/legal/terms/page_controller_addendum (Facebook) and https://legal.linkedin.com/pages-joint-controller-addendum (LinkedIn).
The aforementioned data processing activities by us serve to protect our legitimate interests in operating a fan page on the respective social network, communicating and interacting with users of that social network, and analyzing user interactions to improve the fan page. The data processing is therefore based in each case on Article 6(1)(f) of the GDPR.
To exercise your rights as a data subject, you may contact either us or the provider of the respective social network. If one party is not responsible for responding or must obtain the information from the other party, we or the provider will then forward your request to the respective partner. Please contact the respective social network provider directly with any questions regarding the profiling and processing of your data when using the fan page. If you have questions regarding the processing of your interactions with us on our fan page, please contact us using the contact information provided above.
We do not engage in automated decision-making pursuant to Article 22(1) and (4) of the GDPR; that is, we do not use web-based systems to create user profiles or, based on such profiles, make automated decisions that have legal effects or similarly adversely affect you.
You are not contractually or legally obligated to provide personal data on our website. However, without providing the necessary data in each case, you will not be able to use the website and its features. For example, the website cannot be accessed without the collection of server log files, a request cannot be answered without contact information, and a newsletter cannot be sent without providing an email address.
We process your personal data only for as long as is necessary to achieve the purpose of the processing. As soon as the purpose of the processing no longer applies, we will delete your data without delay, unless there are legitimate grounds within the meaning of the applicable legal provisions (for example, Article 17(3) of the GDPR)— such as, in particular, legally mandated retention periods—that preclude deletion. In this case, the data will be deleted immediately after the legitimate reason ceases to exist—that is, in particular, after the retention period expires.
Data that we process based on your consent will generally be deleted immediately after you revoke your consent, unless legal provisions preclude such deletion (see above).
As a data subject, you are entitled to the following rights—in each case subject to the statutory requirements and to the extent permitted by law. You have the right to
The rapid development of the Internet makes it necessary to update our Privacy Policy from time to time. We therefore reserve the right to amend this Privacy Policy at any time, while always complying with the legal requirements for data protection. We therefore recommend that you review the currently applicable Privacy Policy on a regular basis. We will inform you in advance here of any further data processing activities.
