Data Protection Declaration of the Fachhochschule St. Pölten GmbH

Contact Data of the Data Processor

Fachhochschule St. Pölten GmbH
Campus-Platz 1
3100 St. Pölten
Email: datenschutz@fhstp.ac.at

Contact Data of the Data Protection Office

Urbanek/Lind/Schmied/Reisch/Rechtsanwälte OG
Domgasse 2
3100 St. Pölten
Email: office.st.poelten@ulsr.at

Scope

As a matter of principle, the Fachhochschule St. Pölten GmbH collects and processes personal data only to the extent and for the duration required to fulfil the concrete purpose of data processing (principle of data minimisation). Data processing is carried out

• specifically for the provision of the information we offer
• for the execution of contracts or services (e.g., Study Contract, implementation of events)
• for answering your questions or
• for the fulfilment of our legal obligations - but also for maintaining our ongoing operations and improving our websites and applications

Any processing of personal data is performed only if there is an appropriate legal basis pursuant to Art. 6 GDPR, which will be briefly explained in the following. There is no data processing beyond the intended purpose and the applicable legal basis.

Personal data is processed only by staff members of the Fachhochschule St. Pölten GmbH. In case of any external data processing (transmission of data to third parties, use of a data processing contractors, data exchange with shared responsibility), we will inform you thereof for each individual processing activity.

Legal Basis and Duration of Storage

The Fachhochschule St. Pölten GmbH is entitled to process data on the following legal bases. We will inform you on the applicable legal basis for every individual processing activity.

Consent (Art. 6 para 1 lit a)

Any personal data that we process based on your consent is stored until your revocation of consent or, at the latest, until the purpose for which the data was collected has been achieved. Beyond this extent, we store only urgently necessary personal data (name, date of consent, proof of consent such as signature) for the purpose of proving your consent or revocation thereof and for the duration of 3 years from the revocation date.

Fulfilment of a Contract (Art. 6 para 1 lit b GDPR)

Personal data that we process for the performance of a contract or for the implementation of precontractual measures is stored for as long as necessary for proper contract performance (or implementation of precontractual measures).

Fulfilment of a Legal Obligation (Art. 6 para 1 lit c GDPR)

Personal data that we process based on a legal obligation is processed and stored for as long as compliance with the legal obligation requires it.

Legitimate Interest (Art. 6 para 1 lit f GDPR)

Personal data that we process based on a legitimate interest is processed and stored for as long as necessary for the safeguarding of this legitimate interest pursued by the St. Pölten UAS or by a third party, except in the case of a (justified) objection. In this event, the interests, fundamental rights, and freedoms of the affected party override the legitimate data processing interest of the Fachhochschule St. Pölten GmbH.

Beyond the indicated storage periods, we will store data only in case of statutory retention periods, or in case there are any open limitation periods for potential legal claims. This applies to all processing activities. When it comes to special characteristics in terms of storage periods, we will inform you separately for the individual processing activities.

Moreover, we would like to point out that the Fachhochschule St. Pölten GmbH reserves the right to make reference to appropriate legal bases from the "Forschungsorganisationsgesetz” (research organisation act, FOG) in addition to the aforementioned bases when it comes to data processing in science and research. This also applies in the context of a declaration of consent (“broad consent”) regarding the special provisions pursuant to § 2d para 3 FOG.

Data Security

All data is stored on servers that are operated with high security standards and are protected against access by unauthorised persons and abuse.

In case any data is transferred to third parties, the St. Pölten UAS makes sure that these also comply with the applicable national and European data protection regulations.

The St. Pölten UAS selects its data processing contractors with the greatest care and ensures within the framework of a data processing agreement that any forwarded personal data is processed by the contractor only in compliance with the assignment.

As a person affected by data processing, you have the following rights pursuant to Art. 12-23 GDPR:

• The right of access to your personal data
• The right to rectification and erasure
• The right to object to the data’s use
• The right of data portability
• The right to restriction of processing
• If the processing is based on your consent, the right to withdraw this consent, which does, however, not affect the legality of processing up to this withdrawal

Data subjects can assert these rights by contacting the Fachhochschule St. Pölten GmbH as the responsible data processor (datenschutz@fhstp.ac.at).

• The right to lodge a complaint,

which is to be filed with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, email: dsb@dsb.gv.at, as the responsible supervisory authority.

If you have any further questions or suggestions, please do not hesitate to contact us at any time at datenschutz@fhstp.ac.at.

When you visit and use our website, we will collect and store the following data:

• IP address
• Date and time of the query
• Subpage opened on our website
• Browser type and version
• Terminal device used
• Operating system
• Referrer URL

This data is collected in order to maintain our web presence, especially to localise and rectify errors faster, to monitor the website’s utilisation and, if necessary, to implement adjustments or improvements. In case the data is of a personal nature, the obligation to guarantee data security and the maintenance of our online presence constitute our legitimate interests within the meaning of Art. 6 para 1 lit f GDPR and thus the legal basis. The data (with the exception of the IP address) is stored only for a limited period, and no relation to persons can be established from it because the corresponding IP address is deleted or at least made anonymous. Your computer’s IP address is also stored only for the duration of your use of our website and is subsequently deleted or made anonymous by means of abbreviation. Only in case of incidents such as cyberattacks, it may be necessary to store your data for a longer period in order to ensure the functionality and security of our web presence. Your data will never be passed on to third parties.

Cookies are small files which enable us to store specific information relating to you, the user, on your PC while you visit one of our websites. Cookies help us to find out how many users visit our websites and to determine the frequency of their visits. They also help us to make our services more user-friendly and efficient. The content of the cookies we use is limited to an identification number which does not allow users to be specifically identified.

It is possible to use our website without cookies. You can deactivate cookies in your browser, restrict them to certain websites, or adjust your browser settings to notify you as soon as a cookie is sent. You can also delete cookies from your PC’s hard drive at any time. However, please note that if you do this, the display of the website may be restricted, and certain features may not be available.

This website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”) and Google remarketing campaigns.

Google Analytics uses so-called “cookies”, text files which are stored on your computer, and which allow for the analysis of your use of the website. The information generated by the cookie regarding your use of the website (including your IP address) is transmitted to a Google server in the USA where it is stored. In addition, Google remarketing campaigns also set cookies which are used for the purpose of targeting website users with online advertisements in the Google network at a later time. To this end, Google Analytics uses reports on demographic characteristics which make use of data from interest-based advertisements of Google and user data from third-party providers (such as age, gender, and interests). However, those data sets cannot be traced back to individuals.

Google will use this information to analyse your use of the website, to compile reports on website activities for website owners, and to provide other services related to the use of websites and the Internet. Google may also transfer this information to third parties if required by law or if they process those data on behalf of Google. Google will never associate your IP address with other Google data. You can prevent the installation of cookies by adjusting your browser software settings accordingly. Please note, however, that this may prevent you from being able to use all the features of the website. By using the website, you agree to your data being processed by Google in the manner and for the purpose described above.

On our behalf, Google uses this information to evaluate your use of the website, to provide reports on website activities for website owners, and to provide other services related to the use of websites and the Internet. The IP address provided by your browser within the framework of Google Analytics will not be merged with other data provided by Google. The storage of the cookies required by Google Analytics can be prevented by adjusting your browser software settings accordingly. Please note, however, that in this case, you may not be able to use all the features of the website. You can prevent the collection of data (including IP address) pertaining to the use of the website, which is generated by the cookie, as well as its transmission and processing by Google by downloading and installing the browser plugin.

We operate a fan page of the social network Facebook which is operated by Facebook Inc., 16091 S. California Avenue, Palo Alto, CA 94394, USA.

Fan pages are user accounts that private persons and companies can create on Facebook. After registration on Facebook, the providers of the fan page can use this platform in order to present themselves to the users of this social network and to persons visiting the fan page. They can also use the fan page to contribute all kinds of statements and expressions to the media and opinion discourse. By using the feature Facebook Insight, which Facebook offers free of charge as a non-alterable part of the contractual relationship, operators of fan pages can receive anonymised statistical data pertaining to the users of the page. This data is collected using cookies, each of which contains a unique user code that is active for two years and that Facebook stores on the computer’s hard drive or another data carrier of the fan page’s users. The user code can be linked to the login data of users registered on Facebook and is collected and processed when users visit fan pages.

Within the range of our online services, we make use of “Facebook Pixels” offered by the social network Facebook, which is operated by

• Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
• or – in case you are in the EU – by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

This feature allows Facebook to identify users of our services as a target group for the display of Facebook ads. We therefore use the Facebook Pixel in order to make our Facebook ads visible only to those Facebook users who have shown an interest in our Internet services. In other words, we use the Facebook Pixel to make sure that our Facebook ads match the potential interest of the users and are not perceived as a nuisance by them. Furthermore, the Facebook Pixel makes it possible for us to assess the Facebook ads’ effectiveness for statistical purposes and market research by showing whether users were redirected to our website after clicking on a Facebook ad.

When a user opens our websites, Facebook automatically integrates the Facebook Pixel which then stores a cookie (a small file) on the user’s device. If the user then logs into Facebook or visits Facebook while logged in, the system notes the use of our service in the user’s profile. The collected user data is anonymous to us, thus no conclusions with regard to the user’s identity can be derived from it. Facebook does, however, store and process the data, which means that a connection to the respective user profile can be made. Facebook processes the data within the framework of its data policy. Therefore, further information on the functions of the Remarketing Pixel and the display of Facebook ads in general can be found in Facebook’s data policy.

You can object to the use of the Facebook Pixel and to the processing of your data to display Facebook ads. To do this, you can either visit the site specifically set up by Facebook and follow the instructions for usage-based advertising via the US website or the EU website. The settings are independent of the platform, which means that they are applied to all devices such as desktop computers and mobile devices.

Within our range of online services, we use the LinkedIn Insight Tag of the social network LinkedIn operated by the

• LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, United States
• or – if you are in the EU – by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”)

This feature allows LinkedIn to identify users of our services as a target group for the display of “LinkedIn Ads”. We therefore use the LinkedIn Insight Tag in order to make our LinkedIn Ads visible only to those LinkedIn users who have shown an interest in our Internet services. In other words, we use the LinkedIn Insight Tag to make sure that our LinkedIn Ads match the potential interest of the users and are not perceived as a nuisance by them. Furthermore, the LinkedIn Insight Tag makes it possible for us to assess the LinkedIn Ads’ effectiveness for statistical purposes and market research by showing whether users were redirected to our website after clicking on a LinkedIn Ad.

When a user opens our websites, LinkedIn automatically integrates the LinkedIn Insight Tag which then stores a cookie (a small file) on the user’s device. If the user then logs into LinkedIn or visits LinkedIn while logged in, the system notes the use of our service in the user’s profile. The collected user data is anonymous to us, thus no conclusions with regard to the user’s identity can be drawn from it. LinkedIn does, however, store and process the data, which means that a connection to the respective user profile can be made. LinkedIn processes the data within the framework of its data policy. Therefore, further information on the functions of the Remarketing Tag and the display of LinkedIn Ads in general can be found in LinkedIn’s data policy. 

You can object to the use of the LinkedIn Insight Tag and to the processing of your data to display LinkedIn Ads. To do this, you can either visit the sites specifically set up by LinkedIn and follow the instructions for usage-based advertising (or via this Link), or declare your objection via the US website. 

We use “Google reCAPTCHA” on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google reCAPTCHA is designed to establish whether data entries on our websites (e.g., in the contact form) are carried out by a human being or an automated programme. To do so, Google reCAPTCHA analyses the behaviour of the website user on the basis of various characteristics. The analysis starts immediately once the website user accesses the website. For the analysis, Google reCAPTCHA evaluates various types of information (e.g., IP address, duration of the user’s visit to the website, or user-generated clicks). The data collected in the course of the analysis is forwarded to Google.

Google reCAPTCHA analyses are carried out entirely in the background. Website visitors are not made aware of the analysis.

Data processing is based on Art. 6 para 1 lit f GDPR. The website operator has a legitimate interest in protecting its web presence from abusive automated spying and SPAM.

Further information: Google reCAPTCHA as well as Google's privacy policy.

The data processing takes place for the purpose of processing the registration for your desired event. This registration constitutes the conclusion of a civil law contract for participation in the event. The Fachhochschule St. Pölten GmbH automatically processes all personal data provided by yourself in the course of the registration. Your registration can be processed only by means of the available online application and through provision of the requested information (fields marked with * are compulsory). Non-provision of the necessary data prevents the processing of your request.

Furthermore, your data will be used for direct marketing purposes for similar products and services of the Fachhochschule St. Pölten GmbH (events hosted by the institution which are similar to the one you registered for). We will send you this information by email. This use of your data is justified as a legitimate interest of the Fachhochschule St. Pölten GmbH. You can object to the processing of your data for direct marketing purposes at any time by sending an email to datenschutz@fhstp.ac.at or by writing to the postal address of the St. Pölten UAS.

By participating in this event, the participant acknowledges that photo/video and/or audio recordings of the participants are produced in the course of the event. This use is justified as a legitimate interest of the Fachhochschule St. Pölten GmbH. You can object to the processing of your data for direct marketing purposes at any time by sending an email to datenschutz@fhstp.ac.at or by contacting a staff member directly at the event.

The Fachhochschule St. Pölten GmbH reserves the right, free of charge, to use the produced photo, video, and/or audio recordings – with no restrictions regarding time, space, and content – for the following purposes in particular:

• Publication and dissemination on the own public website of the Fachhochschule St. Pölten GmbH
• Publication on social media platforms
• For internal purposes such as film screenings within the framework of in-house events as well as on the intranet and in internal communication systems
• Use in various types of print materials

In addition, the St. Pölten UAS reserves the exclusive and transferable right to use or let third parties use all works and results as well as parts of these (such as videos, photos, etc.) either based on photo/video/audio recordings produced by the data subject in this context or arising from this shooting process and after editing the photo/video/audio material. The participant ensures that any introduced materials are free from third-party property rights, and they shall indemnify and hold the Fachhochschule St. Pölten GmbH harmless in this respect.

The transferred rights particularly include the rights of reproduction, publication and dissemination, of public display, broadcasting and performance, the rental and lending right, and the right to make the content available. They also include the right of unrestricted or partial retransmission and/or licensing of the transferred rights of use, or the granting of authorisations of use to third parties.

Also explicitly transferred is the right to process the aforementioned photo/video/audio recordings as well as the works and results (including the right of translation or synchronisation to other languages) produced during the shooting process or after editing the photo/video/audio material, and the right to combine them with other, third-party works.

Which data is stored?

We store the information that you enter into the registration form and submit to us. This includes your form of address, first and last names, email, street, house number, postcode, and city.

For how long is the data stored?

Your data which is used for direct marketing purposes will be deleted 3 years after back contact (at the latest) unless you have agreed to longer storage. In case that any payments were made, e.g., in the form of participation fees, or any other cash flows were carried out, tax law requires the Fachhochschule St. Pölten GmbH to store this data for 7 years. Your photo/video data will be stored for as long as the purpose of data processing requires storage. This depends on the following criteria in particular:

• Type of picture
• Framework of the recordings
• Suitability for portraying the company history
• Suitability for use at anniversaries and in commemorative publications
• Degree of invasion of the subject’s privacy interests

Automated data processing is carried out for the purpose of subscription to the newsletter. Such processing is based on your consent in accordance with data protection law. The Fachhochschule St. Pölten GmbH automatically processes all personal data provided by yourself when subscribing.

Subscription is possible only by entering the required information (obligatory fields are marked with *) in the online application provided. Your subscription request cannot be accepted if you do not provide the required data.

Which data is stored?

The Fachhochschule GmbH stores the information that you provide, in particular your email address.

For how long is the data stored?

Your data is deleted 3 years after the last date on which you contacted us, at the latest, unless you consent to a longer retention period.

Data Recipients

Data generated as a result of processing in connection with “sending of newsletters” is transferred to a contract processor within the EU for the purpose of handling the sending of the newsletter. Data is transferred on the basis of a processing agreement with Microsoft Ireland Operations Limited.

The computer-assisted data processing takes place for the purpose of processing your expression of interest in the desired study programme or continuing education programme. This processing is based on your consent in terms of data protection laws. The Fachhochschule St. Pölten GmbH processes all personal data provided by yourself within the framework of the registration. Your expression of interest can be processed only by means of the available online application and through provision of the requested information (fields marked with * are compulsory). Non-provision of the necessary data prevents the processing of your request.

Furthermore, your data will be used for direct marketing purposes in the form of emails for similar products and services of the Fachhochschule St. Pölten GmbH (educational programmes offered by the institution that are similar to the one you have shown an interest in). This use of your data is justified as a legitimate interest of the Fachhochschule St. Pölten GmbH. You can object to the processing of your data for direct marketing purposes at any time by sending an email to datenschutz@fhstp.ac.at or writing a letter to the postal address of the St. Pölten UAS indicated in the legal notice.

Which data is stored?

We store the information provided by yourself. This includes your title, name, email address, and selected educational programme in particular.

For how long is the data stored?

Your data will be deleted 3 years after first contact (at the latest) unless you have agreed to longer storage.

Data Recipients

Access to your personal data is granted to persons working at the St. Pölten UAS who are responsible for carrying out activities related to the processing of your expression of interest. For the administrative handling of the above-mentioned purposes, it is possible that data is passed on to Hochschulen St. Pölten Holding GmbH, Campus-Platz 1, 3100 St. Pölten, datenschutz@fhstp.ac.at, and Bertha von Suttner Private University GmbH, datenschutz@suttneruni.at.

In case you are interested in a study programme or continuing education programme that is held in cooperation with another company (WIFI, ZAM, etc.), it is possible that data is passed on to the cooperation partner for administrative processing.

Data generated as a result of processing in connection with “Direct Marketing” is transferred to a contract processor within the EU for the purpose of handling direct marketing mails. Data is transferred on the basis of a processing agreement with eyepin GmbH.