Data Privacy Notice
of Freie Hochschule Stuttgart

§ 1 Information concerning the collection of personal data

1. We care about protecting your data. This is where we tell you how we use your personal data on our website and in our legal relationship with you. Personal data means any data that can be attributed to you personally, e.g. name, address, email address, user behaviour.

2. The Controller according to Art. 4 (7) of the EU General Data Protection Act (hereinafter abbreviated as: GDPR) is the Friends’ Association "Verein zur Förderung der Freien Hochschule Stuttgart e. V."; the Board Members are shown under Company Information, Haussmannstr. 44A, 70188 Stuttgart, +49 (0)711 / 21094-0, info@freie-hochschule-stuttgart.de, www.freie-hochschule-stuttgart.de.

3. You can contact our Data Protection Officer at datenschutz@freie-hochschule-stuttgart.de or by post at our postal address with the addition "FAO Data Protection Officer".

4. What are personal data?
   Any information relating to an identified or identifiable natural person (‘data subject’) (Art. 4 (1) GDPR).

5. What does data processing mean?
   Processing means any operation or process which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

§ 2 Collecting personal data on our website

When you use our website for information purposes only, i.e. if you do not register via one of our forms (see § 6) or send us information in any other way, we only collect the personal data that your browser transfers to our server. If you visit our website, we collect the following data, which we require for technical reasons in order to display our website to you and to ensure its stability and security (legal basis: Art. 6 (1) p. 1 lit. f) GDPR).

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• The transferred data volume
• The website sending the request
• Browser
• Operating system and interface
• Browser software language and version.

Our users’ personal data is generally only processed after the user’s has given his or her consent. An exception applies in cases in which it is not possible to obtain prior consent for practical reasons and data may be processed according to the legal provisions.

§ 3 Processing of personal data, legal basis

1. Our legal basis for processing personal data is Art. 6 (1) lit. a) GDPR.

2. Our legal basis for processing personal data required for contract performance is Art. 6 (1) lit. b) GDPR. This also applies to processing procedures required to implement measures prior to entering into a contract.

3. If processing of personal data is required to meet a legal obligation, to which our institution is subject, Art. 6 (1) lit. c) GDPR serves as the legal basis.

4. If processing is required to protect a legitimate interest of our company or a third parties, and this is not overridden by your interests or your fundamental rights and freedoms, Art. 6 (1) lit. f) GDPR serves as the legal basis for the processing.

5. Data deletion and storage period
   Your personal data are deleted or blocked as soon as the purpose of the storage ceases to apply. In addition, the personal data may be stored if this is required under the ordinances, laws, and other regulations issued by the European or national legislators, to which the Controller is subject. The data are also blocked or deleted if a storage period stipulated by the mentioned standards expires, except where the data are required to be stored further to conclude a contract or for contract performance.

§ 4 Which of your personal data do we process?

Title (Mr, Ms), first name, surname, date of birth, place of birth, nationality, street, no., postcode, town, country, phone number, email address, bank details, highest qualification/professional training, degree.

§ 5 Use of cookies on the website

1. In addition to the data mentioned above, when you use our website, cookies are saved on your computer. Cookies are small text files that are saved on your hard drive and allocated to the browser used by you, and which provide the site setting the cookie (in this case us) with specific information. Cookies cannot execute programs or transfer viruses to your computer. They serve the purpose of making the overall online offer more user-friendly and effective.

   This website uses the following types of cookies whose scope and functionality are explained below:

   • Transient cookies (see a))

   • Persistent cookies (see b).

   1. Transient cookies are deleted automatically when you close your browser. In particular, this includes session cookies. These save a so-called session ID that can be used to allocate different requests from your browser to the joint session. In this way, your computer is recognised when you return to our website. The session cookies are deleted when you log out or close your browser.

   2. Persistent cookies are automatically deleted after a specified duration, which can vary depending on the cookie. You can delete the cookies at any time in your browser’s security settings.

   3. You can configure your browser settings as required and e.g. reject third-party cookies or all cookies. We need to point out that this might mean that you can no longer use all the functions of this website.

§ 6 Forms and email contact

1. Description and scope of data processing
   We offer you different forms on our website for establishing contact (contact form, application form for different training offers), which can be used to contact us electronically. If you make use of this opportunity, the data that you enter in the screen are sent to us and saved.

   These data are:
   Title (Mr, Ms), first name, surname, date of birth, place of birth, nationality, street, no., postcode, town, country, phone number, email address, subject, highest qualification/professional training, degree, your application documents sent to us (pdf files), your message to us.

   When you send your message, the data listed in § 2 of this Notice will also be saved.

   As regards the contact form, your consent for the processing of your data is obtained during the sending process and reference is made to this Data Privacy Notice. As regards the applicant forms, your acceptance of this Data Privacy Statement is obtained during the sending process.

2. Our website contains an application form for the degree programmes for teaching training as Form Teacher or Subject Teacher at Steiner Schools, which you can use to establish contact with us electronically. If you make use of this opportunity, the data that you enter in the screen are sent to us and saved.

   These data are:
   Title (Mr, Ms), first name, surname, date of birth, place of birth, street, no., postcode, town, country, nationality, phone number, highest school leaving qualification, email address, your application documents sent to us (pdf files), your message to us.

   When you send your message, the data listed in § 2 of this Notice will also be saved.

   As regards the applicant form, your acceptance of this Data Privacy Statement is obtained during the sending process.
   Alternatively, you can contact us using the email address provided. In this case, the user’s personal data transferred with the email are saved.

   In this context, the data are not transferred to third parties. The data are exclusively used to process your request or handle your query. SSL or TSL technology is used between your web browser and our website server to prevent unauthorised third parties from accessing your data.

3. Legal basis for data processing

   If the user has given his or her consent, the legal basis for processing the data from the contact form is Art. 6 (1) lit. a) GDPR.

   The legal basis for processing the data from the contact form is Art. 6 (1) lit. b) GDPR.

   The legal basis for processing the data transferred when an email is sent is Art. 6 (1) lit. f) GDPR. If the email contact is aimed at concluding a contract, Art. 6 (1) lit. b) GDPR is a further legal basis for the processing.

4. Purpose of data processing
   The purpose of processing the personal data from the input screen serves us solely for the processing of the contact and/or application. Where contact is established by email, this also constitutes the required legitimate interest in the processing of the data.

   The other personal data processed during the sending process serve the purpose of preventing misuse of the contact form and ensuring the security of our IT systems.

5. Storage period
   The data are deleted once they are no longer required to fulfil the purpose of the collection. This is the case for the personal data from the input screen of the contact form and for the personal data send by email when the relevant conversation with you ends. The conversation is deemed to have ended if the circumstances indicate that the relevant case has been conclusively resolved.

6. Opportunity to object and eliminate
   You may revoke your consent for processing your personal data at any time. If you contact us by email, you may object to storage of your personal data at any time. In such a case, the conversation cannot continue.

   You can contact us to revoke your consent or object to storage in writing at the postal address of "Freie Hochschule Stuttgart" or by email to info@freie-hochschule-stuttgart.de.

   In this case, all personal data, which were saved in the context of the contact, will be deleted.

§ 7 Your rights as the data subject

1. You have the following rights in relation to us concerning your personal data:

   • Right to access and information concerning the saved data (Art. 15 GDPR),

   • Right to rectification of inaccurate data (Art. 16 GDPR),

   • Right to deletion of data (Art. 17 GDPR),

   • Right to restriction of data processing (Art. 18 GDPR),

   • Right to object to inappropriate data processing (Art. 21 GDPR),

   • Right to portability of data (Art. 20 GDPR).

2. Right to revoke your granting of consent under data protection law
   Under Art. 7 (3) GDPR, you have the right to revoke your granting of consent under data protection law in writing at any time, including using the contact form / by email. If you revoke your consent, this does not affect the lawfulness of the processing before you revoked your consent.

3. Right to lodge a complaint with the supervisory authority
   Moreover, according to Art. 77 (1) GDPR, you have the right to lodge a complaint with a supervisory authority regarding processing of your personal data by us, if you are of the opinion that processing of the personal data concerning you is in violation of the GDPR.

   The competent supervisory authority for us is the Federal State Commissioner for Data Protection and Freedom of Information for Baden-Württemberg with offices in 70173 Stuttgart, Königstr. 10a, Tel.: +49 (0)711/61 55 41 – 0, Fax: +49 (0)711/61 55 41 – 15, poststelle@lfdi.bwl.de. If you lodge a complaint, this authority will inform us of the status and findings relating to the complaints, including the option of judicial remedy under Art. 78 GDPR.

   For more information about data protection, please see the website of the Federal State Commissioner for Data Protection and Freedom of Information www.baden-wuerttemberg.datenschutz.de/der-landesbeauftragte-fuer-den-datenschutz-und-die-informationsfreiheit-baden-wuerttemberg/. This is also where you can lodge your complaint online.

§ 8 Web analytics - Use of Google Analytics

1. This website uses Google Analytics, a web analysis service by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files saved on your computer, which enable an analysis of your use of the website. The information regarding your use of this website, which is created by the cookie, is normally sent to the Google server in the USA and saved there. If IP anonymisation is enabled on this website, Google first abbreviates your IP address in countries that are Member States of the European Union or Contracting Parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to the Google server in the USA and abbreviated there. Commissioned by the operator of this website, Google will use this information in order to analyse your use of the website, to compile website activity reports and to provide other services related to website or internet use for the website operator.

2. The IP address transmitted by your browser as part of Google Analytics is not combined with the other Google data.

3. You can prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that in such a case, you will be unable to fully use all functions of this website. In addition, you can prevent Google from collecting the data generated by the cookie and relating to your use of the website (incl. your IP-address) and from processing this data by downloading and installing the browser plug-in available under the following link: tools.google.com/dlpage/gaoptout.

4. This website uses Google Analytics with the extension "_anonymizeIp()". This shortens IP addresses before processing them further in order to prevent them from being attributable to a person. If data collected about you are attributable to you as a person, such data are excluded immediately and the personal data are deleted instantly.

5. We use Google Analytics in order to analyse use of our website and to improve it regularly. The obtained statistics help us to improve our offer and make it more interesting for you as a user. In the exceptional cases in which personal data are transferred to the USA, Google is subject to the EU-US Privacy Shield. www.privacyshield.gov/EU-US-Framework . The legal basis for using Google Analytics is Art. 6 (1) p. 1 lit. f) GDPR.

6. Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: policies.google.com/terms, Overview of data protection: policies.google.com, and Data Privacy Notice: policies.google.com/privacy.

§ 9 Integration of YouTube videos

1. We have integrated YouTube videos into our online offer, which are stored on www.YouTube.com and can be played directly from our website. These are integrated in "extended data protection mode", i.e. no data about you as the user are transferred to YouTube if you do not play the videos. The data listed in Section 2 are only transferred if you play the videos. We cannot influence this data transfer.

2. If you visit the website, YouTube receives the information that you accessed the relevant page on our website. In addition, the data listed under § 2 of this Notice are transferred. This occurs regardless of whether YouTube provides a user account that you are logged in or whether there is no such user account. If you are logged into Google, your data are allocated directly to your account. If you do not wish the data to be allocated to your YouTube profile, you must log out before activating the button. YouTube saves your data as user profiles and uses these for purposes of advertising, market research and/or to tailor its website to user needs. Such analyses are performed particularly (including for users who are not logged in) in order to tailor advertising to user needs and to inform other users of the social networks of your activities on our website. You have the right to object to the creation of such user profiles, whereby you must contact YouTube to exercise this right.

3. You can find out more about the scope and purpose of the data collection and how the data are processed by YouTube in its Data Privacy Notice. This also provides additional information about your rights and settings options to protect your privacy: www.google.de/intl/de/policies/privacy . Google also processes your personal data in the USA and in this context is subject to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.

§ 10 Online advertising - Use of Google Adwords Conversion

1. We use the offer of Google AdWords in order to draw attention to our attractive offers on third-party websites using advertising (so-called Google AdWords). We can determine the success of the individual advertising measures based on the advertising campaign data. With this, we pursue the interest of displaying advertisements that are of interest to you, of making our website more interesting to you and of achieving a fair calculation of advertising costs.

2. Google delivers these advertising materials using so-called "ad servers". To this end, we use ad server cookies, which can measure specific parameters to measure success, such as ad display or user clicks. If you visit our website via a Google ad, Google AdWords saves a cookie on your PC. These cookies cease to be valid after 30 days and are aimed at identifying you personally. Normally, e.g. the following analysis information is recorded in relation to this cookie: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (flag that the user no longer wants to be addressed).

3. These cookies enable Google to recognise your web browser. If a user visits specific pages on an Adwords customer’s website and the cookie saved on his or her computer has not yet expired, Google and the customer can identify that the user clicked on the ad and was forwarded to this page. A different cookie is assigned to each Adwords customer. Cookies thus cannot be tracked across the websites of Adwords customers. We do not ourselves collect or process personal data as part of the mentioned advertising measures. We merely receive statistical analyses from Google. These analyses enable us to determine which of the advertising measures used are particularly effective. We do not receive any further data from the use of advertising materials, and in particular, we cannot identify the users based on this information.

4. Your browser automatically establishes a direct connection to a Google server based on the marketing tools used. We cannot influence the scope and further user of the data, which Google collects with the help of this tool, and therefore provide you with information based on our level of knowledge: Since our website uses Adwords Conversion, Google receives the information that you have accessed the relevant part of our website or have clicked on one of our ads. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or are not logged in, the provider might still obtain and save your IP address.

5. You can prevent your participation in this tracking process in different ways: a) by choosing the relevant settings in your browser software, in particular by suppressing third-party cookies, which will result in no ads from third parties being displayed; b) by disabling cookies for conversion tracking by setting your browser so that cookies from the domain "www.googleadservices.com" are blocked, adssettings.google.de - this setting is deleted when you delete your cookies; c) by disabling interest-based ads from providers who have joined the self-regulation campaign "About Ads", using the link www.aboutads.info/choices this setting is deleted if you delete your cookies; d) by permanently disabling ad plug-ins in your browsers Firefox, Internet Explorer or Google Chrome using the link support.google.com/ads/answer/7395996 . We need to point out that this might mean that you can no longer use all the functions of this offer in full.

6. The legal basis for processing of your data is Art. 6 (1) p. 1 lit. f) GDPR. For more information about data protection at Google, please see: www.google.com/intl/de/policies/privacy and services.google.com/sitestats/de.html . Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at www.networkadvertising.org. Google is subject to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.

§ 11 Social Networks

We use the social media platform Facebook. However, we do not use so-called social media plug-ins on our website that output social media contents on this page or allow users to log in. We merely link to our page in the mentioned social network. In the same way as for each external link, this merely transmits your IP address but no personal data.

§ 12 Google Tag Manager

We use the Google Tag Manager service on our website. The provider is Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland.

The Google Tag Manager is a solution by means of which the seller can administer website tags on an interface. The tool tag manager itself (this implements the tags) is a cookie-free domain. The tool ensures the activation of other tags, which record data under certain circumstances. Google Tag Manager does not access this data. Should de-activation have been carried out on a domain or cookie level, this remains in place for all tracking tags which are implemented with Google Tag Manager.

Third-party provider information: Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland.

Further information concerning data protection can be obtained from the following websites of Google:

• Data protection declaration: http://www.google.de/intl/de/policies/privacy
• FAQ Google Tag Manager: https://www.google.com/intl/de/tagmanager/faq.html Terms and conditions of use of Google Tag

Manager: https://www.google.com/intl/de/tagmanager/use-policy.html
 

§ 13 Ströer Campaign Tracking

We use the advertising services of RegioHelden GmbH, a company of Ströer Media Deutschland GmbH. RegioHelden collects certain information relating to our interactions with you. RegioHelden provides us with aggregated information that we use in accordance with our privacy policy and applicable data protection laws.
 
If a corresponding consent has been given, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
 
Call measurement
Each telephone number provided on our website may be a so-called call tracking number, in which the date, time, call acceptance, duration of the call and the telephone number of both participants are recorded, stored and forwarded to RegioHelden GmbH and to us for the purpose of determining the effectiveness of advertising. The telephone number placed individually for the customer and displayed in the advertisement is not linked to the tracking of the user's individual usage behaviour, but is only dependent on certain or several keywords that were used in the search.
 
Contact form
The data entered in the contact form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time. All you need to do is send us an informal email. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.
 
The individually accessed contact form is not linked to the tracking of the user's individual usage behaviour, but is only dependent on certain or several keywords that were used in the search.
 
If the user fills out the contact form, they must give their clear and voluntary consent by means of an opt-in before sending their data and thus before data processing begins. Only then will the data entered in the contact form be transmitted to the controller with the source.
 
Server log files
RegioHelden automatically collects and stores information in so-called server log files, which your browser automatically transmits to RegioHelden. These are

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server enquiry
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. RegioHelden has a legitimate interest in the technically error-free and optimised provision of its services - the server log files must be recorded for this purpose.