Data protection
declaration

Our website contains contact forms. You are welcome to use these forms to contact us electronically. The data you enter into the contact forms (e.g. first name, last name, e-mail address, your message) are transferred to and stored by us. In addition, the following data are stored when you send your message to us:

• date and time of sending the message

Alternatively, you can use the e-mail addresses provided to contact us. In this case, the user's personal data transmitted in the e-mail are stored.

No data are forwarded to third parties in this context. The data are only used for processing the conversation.

The legal basis for processing the data is Art. 6 paragraph 1 (e) GDPR in conjunction with section 2 LHG. In individual cases, data are processed after the user has given their consent in accordance with Art. 6 paragraph 1 (a) GDPR. The legal basis for processing data that are transmitted while sending an e-mail or submitting a contact form is Art. 6 paragraph 1 (f) GDPR if processing the data is required for ensuring network security and information security. This also constitutes the legitimate interest of the higher education institution in processing the data.

The data will be deleted once they are no longer necessary to achieve the purposes for which they were collected. The personal data from the contact form that are sent via e-mail will be deleted as soon as the conversation with the user has ended. The conversation has ended if the circumstances indicate that the matter in question has been conclusively clarified.

The additional personal data that are sent when the contact form is submitted will be deleted after 14 days.

On our website, there are various options to subscribe to our newsletter. We use a two-step subscription process. After we receive an e-mail address, we send a confirmation link to this e-mail address. In order to subscribe to our newsletter, you need to click on this link. The legal basis for this data processing is your consent in accordance with Art. 6 paragraph 1 (a) GDPR. The data processed in connection with the subscription are specified in the respective form (e.g. your e-mail address or name). In order to be able to provide proof, we store the date and time of your subscription/confirmation as well as your IP address when you subscribe to our newsletter. The legal basis for storing these data is Art. 6 paragraph 1 (f) GDPR. Our legitimate interest is to be able to provide proof of the subscriptions. You may unsubscribe from our newsletter at any time.

For sending out newsletters, we also work with contractors.

If you register for an event at Esslingen University of Applied Sciences, we process your data for the purpose of organising and conducting the respective event. The data that are transmitted to and stored by us are specified in the contact form / registration form (e.g. first name, last name, e-mail address, phone number, function). In addition, the following data are stored when you send your message to us:

• date and time of the registration

During the sending process, you may be asked to consent to the processing of your data and are made aware of this data protection declaration.

You may also register by using the e-mail addresses provided. In this case, the user's personal data transmitted in the e-mail are stored.

The legal basis for processing your registration data is Art. 6 paragraph 1 (e) GDPR in conjunction with section 2 LHG. The legal basis for processing your data, once the consent of the user has been obtained, is Art. 6 paragraph 1 (a) GDPR. The legal basis for processing the data transmitted when an e-mail is sent or a registration form is submitted is, besides the user’s consent, Art. 6 paragraph 1 (f) GDPR if processing the data is required for ensuring network security and information security. This also constitutes the legitimate interest of the higher education institution in processing the data.

After your registration has been submitted, the persons organising the event at Esslingen University of Applied Sciences will process your data. If applicable, we also transmit the required data to service providers, but only to the extent required to conduct the event. We have concluded agreements on data processing on behalf of the controller or confidentiality agreements with these service providers.

If the event is held via our video conference system, the information on our video conference system is also relevant.

Your personal data will be deleted once they are no longer necessary to achieve the purposes for which they were collected. We do not intend to store the data after the event has taken place.

Below, we would like to inform you about the personal data we process when you use the UCC Cloud Powered by Cisco-Webex (video conference system used at Esslingen University of Applied Sciences) and about your rights under data protection law.

The controller processing your data is Esslingen University of Applied Sciences (for its address for service, see above).

If you visit the Cisco-Webex website, the controller is the service provider. However, visiting the Cisco-Webex website is only required in order to download the software required to use the service. You can also use Cisco-Webex via the Cisco-Webex app. The basic features are also available in the browser version.

What is the legal basis for processing my data?

When processing your personal data, we comply with the provisions of the General Data Protection Regulation (GDPR), the data protection act of the Land of Baden-Württemberg (LDSG) and the act on the higher education institutions in the Land of Baden-Württemberg (LHG BW).

In accordance with Art. 6 paragraph 1 (e) GDPR in conjunction with section 2 LHG, your data are processed in order to fulfil the tasks of the higher education institution. If personal data of employees are processed, the requirements set forth in section 15 subsection 1 LDSG have to be fulfilled (data processing is required for the implementation of the employment relationship). If the meetings are held as part of a contractual relationship and you are a party to the contract, the legal basis for processing is Art. 6 paragraph 1 (b) GDPR. To a certain extent, we also process your data on the basis of consent given in accordance with Art. 6 paragraph 1 (a) GDPR.

What is the purpose of processing my data?

Your personal data are processed for the purpose of online communication and collaboration, in particular online teaching, as well as holding meetings and events (e.g. presentations). The scope of data processing also depends on the information you provide us with before or while you participate in an online meeting and on the settings you choose. We collect and store the following data:

Registration data:

• user details (name, e-mail address)
• password
• browser
• IP address

Hosting and usage data:

• meeting meta data (topic, IP addresses of the participants, device information)
• phone number when participating via phone, start time and end time, country name
• configuration and communication data (device name, geographical data, IP address, user agent identifier, operating system type and version, client version, endpoint MAC addresses, time zone, domain name, activity protocols, hardware type)

• conference information (title, date, time, duration, number of meetings, number of participants, name of the host, display resolution, dial-in method, diagnosis information)
• support services / support (name, e-mail address, phone number, authentication information, system information, error log files)
• access and administration rights for online self-service products
• feedback on user evaluation during the conference for quality and surveillance purposes
• records of all incoming and outgoing contacts for monitoring, training, coaching, and quality purposes

User-generated data:

• video and sound data of participants, if applicable (only if the camera / microphone is activated)
• chat messages, shared documents, presentation material
• meeting recordings, if applicable
• transcriptions of sound recordings, if applicable
• uploaded files containing personal data
• surveys, polls
• personal data disclosed during the meeting or collaboration

What are the data sources?

We process the personal data we receive in connection with the use and the data we collect from you within the scope of your application/enrolment/registration or a contractual relationship.

Who will receive my data?

Some of the user-generated data will be shared with other users of the Webex services if this is required for collaboration or communication purposes. The computing centre of Esslingen University of Applied Sciences will receive name, e-mail and password to create Cisco-Webex accounts. The computing centre will also receive the hosting and usage data for failure analysis purposes.

In order to provide the entire communication and collaboration services, Esslingen University of Applied Sciences uses the processor T-Systems International GmbH, Hahnstr. 43, 60528 Frankfurt.

Are my data transmitted to a third country?

Our processor T-Systems International GmbH, Hahnstr. 43, 60528 Frankfurt has engaged the subcontractor Cisco International Ltd, UK, which transfers individual data (pseudonymised host name, Webex meeting site address (URL), start and end time of the Webex Meetings) to the US. This transfer by our processor is covered by an adequate level of data protection by standard data protection clauses (Art. 46 paragraph 2 (c) and (d) GDPR). For the United Kingdom, the EU Commission has adopted an adequacy decision, which confirms an equivalent level of data protection to that under EU law.

How long will my data be stored?

We will process and store your personal data only as long as this is required to achieve the above-stated purpose. User-generated data will be deleted 60 days after a user account is deactivated at the latest. The processor will delete the registration, hosting and usage data seven years after the contract has been terminated.

What are my rights under data protection law?

For information on your rights as data subject, please see the section Rights of the data subject.

In order to initiate and engage in business collaborations, Esslingen University of Applied Sciences processes the personal data required for these purposes. The business contact details of the individuals named as persons of contact as well as the contents of the correspondence and other data that are the basis of the contractual relationship are subject of the data processing. The legal basis for this data processing is Art. 6 paragraph 1 (b) GDPR.

The data will be deleted once they are no longer necessary to achieve the purposes for which they were collected and after the respective retention period has ended.

We at Esslingen University of Applied Sciences are delighted that you are interested in working with us. We know that you entrust us with some very personal information when sending us your application materials. Therefore, transparency is very important to us. Below, we want to explain in a comprehensible way which data we process and on which legal basis, who has access to these data and how long we store your data.

A) Controller and data protection officer

The controller processing your data is Esslingen University of Applied Sciences (for its address for service, see above).

B) Purposes and legal basis of data processing

During the application procedure, we only process data which you send or otherwise disclose to us. We use an application management software to process these data. We may contact you via phone if we have any questions regarding your application. If you do not wish to be contacted via phone, please let us know. In this case, we will use another communication channel to contact you and ask that you call us.

During the application process, personal data such as your name, address, phone number and e-mail address will be stored in the application database. In addition, we store your application materials (e.g. cover letter, CV, certificates) in our software.

During the application process, your application materials may also be printed. The materials will only be stored in the application management software. We will digitise any documents that we receive in paper form.

We only process your data to evaluate if you have the required aptitude and qualifications for the position you are applying for and to contact you if we have any questions regarding your application or to inform you about the application process. The legal basis for processing applicants’ data in application processes is Art. 6 paragraph 1 (b) GDPR, section 15 LDSG in conjunction with sections 83 to 85 of the civil service act of the Land of Baden-Württemberg (LBG).

If your application materials contain special categories of personal data, e.g. health data, data revealing religious beliefs or ethnic origin, the data processing is also covered by Art. 9 paragraph 2 (b) GDPR, due to our statutory obligations as employer and the resulting protection of your basic rights.

You may object to the processing of your personal data at any time. In particular, you always have the option to withdraw your application. You may revoke any consent given to us at any time. For more information on your rights, please refer to E.

C) Recipients

After we have received your application, the human resources department at Esslingen University of Applied Sciences as well as the person responsible for the position you applied for will look through your application. Applications which meet the criteria will be forwarded to the employees of Esslingen University of Applied Sciences who are involved in the application process. The staff council and, if required, the representatives for disabled persons will also receive the personal data contained in the application materials.

We use a software provided by Haufe-Lexware Services GmbH & Co. KG, Fraunhoferstr. 5, D-82152 Planegg for the application process. Haufe-Lexware Services GmbH & Co. KG is our service provider. We cannot rule out that the service provider may also see your personal data while maintaining and operating the systems. We have therefore concluded a contract on data processing on behalf of the controller with this service provider to ensure that the data are processed in a reliable manner. The employees of our service provider as well as our employees have committed themselves to confidentiality.

D) Storage period

Your personal data will be deleted once they are no longer necessary to achieve the purposes for which they were collected. In case the application process results in an employment relationship of any kind, your data are stored for the time being and transferred to the personnel file. Otherwise, the application process ends when you receive a rejection letter or e-mail.

In the latter case, your personal data will be deleted six months after you received the rejection letter or e-mail, unless a longer storage period is required for the defence of legal claims. This also applies to application data received in paper form. We explicitly inform employees and departments involved in the application process that they must destroy any prints and notes they may have made after the application process has ended to comply with data protection laws.

E) Your rights

For information on your rights as data subject, please refer to the section Rights of the data subject.

F) Important information

Applicants who fail to provide relevant personal data might not be considered for the position in question.

If you object to the processing of your data in the application management software used by us, we are not able to consider your application. We might consider your application if you provide reasons relating to your particular situation due to which you cannot be expected to have your application materials digitised and stored in the application management software used by us.

The selection of suitable candidates is not automated and we do not use any automated processing (“profiling”) within the meaning of Art. 4 number 4 GDPR.