you are here: KU.de  University  Management and administration  Administration  Student Office  Processing of your personal data

Information on the processing of your personal data



Information on the processing of your personal data

1. PRELIMINARY REMARK

The following points shall give you some information on the processing/storage of your personal data. The legislature has stipulated which information is necessary in this respect.Your personal data is processed on the basis of the Law on Data Protection in the Catholic Church in Germany (Gesetz über den kirchlichen Datenschutz, KDG).

2. WHAT IS PERSONAL DATA?

All information concerning a specific or identifiable person. A person is deemed to be identifiable if such person
can be identified directly or indirectly. This may be effected by allocating such person an identifier such as a name, an ID number, location data, online identification data or one or several distinctive characteristics.

3. BASIC INFORMATION

3.1 Who is responsible for the processing of my personal data?

The following entity is responsible for the processing of personal data:

Catholic University of Eichstätt-Ingolstadt (KU),
Ostenstraße 26, 85072 Eichstätt, Germany

Phone +49 8421-93-0

E-mail: info(at)ku.de

 

3.2 How can i contact the University´s data protection officer?

You can contact the data protection officer at the following address:

Georg Möller, SK-Consulting Group GmbH
Osterweg 2 32549 Bad Oeynhausen, Germany

E-mail: datenschutz(at)SK-consulting.com.

 

4. FURTHER IMPORTANT INFORMATION

4.1 Data processing (Why?)

We process your data for the fulfillment of the mutual obligations in the context of your (future) studies, your doctoral studies and/or for the fulfillment of statutory obligations, e.g. as resulting from the Higher Education Act and the Higher Education Statistics Act.

4.2 Why is the KU allowed to do this?

Data protection law allows the KU to process personal data which is necessary for the fulfillment of an agreement or for the implementation of pre-contractual measures in accordance with Section 6 para. 1 lit. c. If you voluntarily provide the KU with information on your person beyond the necessary scope (e.g. cell phone number, e-mail address), the KU is entitled to receive and process such information subject to your approval in accordance with data protection law (Section 6 para. 1 lit. c KDG). Furthermore, data protection law also allows the KU to process your data if there is a statutory obligation to do so (e.g. Bavarian Higher Education Act) in accordance with Section 6 para. 1 sentence 1 lit. a KDG.

4.3 Who can get my personal data?

In the context of the processing, your personal data can be transferred to:

> Service providers bound by contract and obliged to maintain secrecy

> If required: authorities

4.4 Will you transfer any of my personal data to cuntries outside the European Union?

This is currently not planned. An exception might occur, however, if you initiate such transfer or if such transfer becomes necessary in the context of your studies.

4.5 How long will you store my personal data?

The KU will store your personal data for the period of time required to fulfill the purposes as stipulated in 4.1. However, there are statutory provisions (e.g. German Fiscal Code Section 147) dictating that the KU stores certain documents for six or ten years respectively. After expiry of the storage period, the KU will delete all data which is no longer required.

4.6 Do I have to provide my personal data?

In order to fulfill the reasons stipulated in 4.1, it is necessary that you provide the KU with your personal data. For enrollment purposes, the collection of data is required in accordance with Article 42 para. 4 Bavarian Higher Education Act (BayHSchG) to the extent as stipulated therein. Article 64 para. 3 BayHSchG regulates the collection of data for doctoral candidates.

 

4.7 Automated devision making/profiling

There will be no automated decision making/profiling.

5. WHAT ARE MY RIGHTS?

5.1 Information on your rights

As a data subject, you have amongst others the following rights in accordance with the KDG (in the following also referred to as “Data Subject Rights”):

 

5.2 Information rights (in accordance with Section § 17 KDG)

You have the right to request information as to whether or not the KU processes your personal data. If the KU processes your personal data, you have the right to know

§   why the KU process your data (also see 4.1);

§   which type of your data the KU processes;

§   which recipients receive or shall receive your personal data (also see 4.3);

§   for how long the KU will store your data; if it is not possible to specify the storage period, the KU must provide information on how the storage period is determined (e.g. after expiry of statutory storage periods) (also see 4.5);

§   that you have the right to have your personal data corrected or deleted at any time including the right to restrict processing and/or the possibility to object (in this respect, also see 5.2 and 5.3 et seqq. below);

§   that you have the right to complain to the data protection supervisory authority;

§   where your personal data was collected, if you did not provide the KU with the information directly;

§   whether your personal data is used for an automated decision and if so, to be informed of the logic behind such decision and which consequences and scope such automated decision can have for you;

§   that you are entitled to be informed whether, and if so, on the basis of which guarantees, your data is adequately protected by the data recipient in case of a transfer of your personal data to a country outside the European Union;

§   that you have the right to request a copy of your personal data. Data copies are generally provided in electronic form.

The first copy is issued free of charge; an appropriate fee may be charged for any further copies. A copy can only be provided if this does not adversely affect another person’s rights.

 

5.3 Right to correction of personal data (in accordance with Section § 18 KDG)

You have the right to request correction of your personal data in case it is incorrect and/or incomplete. This right also includes the right to completion by additional statements or notifications. Any corrections and/or additions must be made without undue delay.

5.4 Right to deletion of personal data (in accordance with Section § 19 KDG)

You have the right to request deletion of your personal data if

§   such personal data is no longer required for the purposes for which it was collected and processed;

§   processing of your personal data is effected on the basis of your consent and you have withdrawn such consent; however, this shall not apply if such data processing is otherwise permitted by a statutory authorization;

§   you have filed an objection to the processing of your personal data which is permitted by law on the basis of the so-called “legitimate interest”; however, a deletion must not be effected if legitimate reasons for a continued processing have priority;

§   your personal data has been unlawfully processed;

§   the deletion is necessary for fulfillment of a legal obligation in accordance with state or church law by which the responsible party is governed;

You shall not be entitled to a right of deletion of personal data if

§   the right to freedom of expression and information is opposed to the deletion request;

§   the processing of personal data is necessary

o    for the fulfillment of a legal obligation (e.g. statutory storage obligations),

o    for the purposes of public tasks or interests in accordance with applicable law (this also includes “public health”) or

o    for archiving or research purposes;

for asserting, exercising or defending legal claims. Deletion must be effected immediately (without undue delay). If we have publicly disclosed personal data (e.g. on the internet), it is our responsibility to ensure, to the extent technically possible and reasonable, that other data processors are informed of the deletion request including the deletion of links, copies and/or other duplicates.

 

5.5 Right to restrictions of data processing (in accordance with Section § 15 KDG)

You have the right to request restrictions in the processing of your personal data in the following cases:

§   If you have contested the accuracy of your personal data, you can request that the KU does not use your data for other purposes during the period in which its accuracy is verified, thus request a restriction of processing of such data.

§   In case of unlawful processing of your personal data, you can request restriction of processing instead of deletion of the data.

§   If you require your personal data for the assertion, exercise or defense of legal claims, but the KU no longer requires your personal data, you can request that the KU imposes restrictions on the processing for prosecution purposes.

§   If you have filed an objection against data processing (also see 5.7) and if it is still unclear whether our interests in a processing take precedence over your interests, you can request that your data is not used for other purposes for the duration of the verification and thus request a restriction of processing.

§   Any personal data, the processing of which was restricted upon your request, may, subject to storage, only be processed for the following purposes subject to your consent:

o    Asserting, exercising or defending legal claims,

o    For the protection of the rights of other natural persons or legal entities or

o    For reasons of an important public interest.

You will be informed in advance if a processing restriction is to be lifted.

5.6 Right to data portability (in accordance with Section § 22 KDG)

You have the right to request that the KU provides you with the data you have provided to us in a common electronic format (e.g. PDF or excel file).You can also request that we directly transfer such data to another company (as named by you) as far as technically possible for us.The prerequisite for your right to such request is that the processing is effected on the basis of a consent or for the implementation of an agreement and by using automated processes.

Exercising the right to data portability must not adversely affect the rights and freedoms of other persons.

If you make use of your right to data portability, your right to deletion of data shall remain unaffected.

5.7 Right to file an objection to certain data processing (in accordance with Section § 23 KDG)

If your data is processed for the performance of tasks in the public interest or for the performance of legitimate interests, you may object to this processing. In doing so, you must state the reasons for your objection arising from your particular situation, such as e.g. special family circumstances or interests in confidentiality worthy of protection. In case of an objection, the KU shall be obliged to refrain from processing your personal data for the purposes as specified, unless

§   there are compelling and legitimate grounds for a processing which take precedence over your interests, rights and freedoms, or

§   the processing is necessary for asserting, exercising or defending legal claims.

You have the right to object to a use of your personal data for direct marketing purposes at any time; this shall also apply to profiling, insofar as such profiling is connected to direct marketing. In case of an objection, the KU will no longer be authorized to use your personal data for direct marketing purposes.

5.8 Prohibition of automated decisions/ profiling (in accordance with §24 KDG)

Decisions taken by the KU, which have legal consequences or a significant adverse effect for you, must not exclusively be based on automated processing of personal data. The same shall apply to profiling. This prohibition shall not apply insofar as the automated decision

§   is necessary for conclusion or implementation of an agreement with you,

§   is permissible in accordance with legal provisions, if such legal provisions include appropriate measures for the protection of your rights and freedoms as well as your legitimate interests, or

§   is effected with your explicit consent.

Decisions which are exclusively based on automated processing of special types of personal data (=sensitive data), are only permissible in cases when

§   they are taken on the basis of your explicit consent or

§   there is considerable public interest in the processing,

and if appropriate measures were taken for the protection of your rights and freedoms as well as your legitimate interests.

 

5.9 Exercise of Data Subject Rights

If you wish to exercise your Data Subject Rights, please contact the responsible entity named in 3.1 above. Requests which are submitted electronically are generally answered electronically. In general, all information which is to be provided in accordance with the KDG as well as all notifications and measures including exercise of the Data Subject Rights are provided free of charge. Only in case of manifestly unfounded or excessive requests, the KU shall have the right to charge an appropriate fee for the processing of the request or to take no action.

If there is reasonable doubt about your identity, the KU shall be entitled to request additional information from you for identification purposes. If the KU is unable to identify you, it shall be entitled to refuse processing of your request. To the extent possible, the KU shall inform you separately if it does not have sufficient possibility for identification.In general, any requests for information are processed immediately within one month from receipt of the request. Such period can be extended by a further two months if an extension is necessary in view of the complexity and/or number of requests; in case of a deadline extension the KU shall inform you within one month after receipt of your request and state reasons for the delay. If the KU will not get active with regard to a request, the KU shall inform you immediately within one month after receipt of the request and state reasons for this. It shall also inform you of your possibility to file a complaint with a supervisory authority or seek judicial remedy before a court. Please note that you can only exercise your Data Subject Rights by taking into account the restrictions and limitations of the European Union or the member states