Information concerning the processing of personal data at Magdeburg-Stendal University of Applied Sciences

In order to comply with our duty to inform in accordance with Article 12 et seq. of the General Data Protection Regulation (GDPR), the following document contains information on the way we in which deal with personal data.

Who is responsible for data processing?

The responsible body as defined by Article 4, no. 7 of the GDPR is

Magdeburg-Stendal University of Applied Sciences
Breitscheidstrasse 2
D-39114 Magdeburg 

The university is represented by a number of different employees, whose contact details will be communicated to you in connection with the collection of your data. Please get in touch with these contact persons should you have any questions or wish to assert your rights.

In addition, our Data Protection Officer can support you in exercising your rights. 

Which data are processed by us and for which purposes?

If we collect data from you in person via questionnaires, forms, by email etc., we will notify you of the reason for processing that data. Your data will only be used by us for the purposes stated. 

If we receive your data from a third party, you will also be notified of the type of data collected by us. 

If we process data within the context of a visit to a website for which we are responsible, you will be able to find comprehensive information in the relevant privacy declaration. You can find the corresponding Privacy link right at the bottom of this web page.

Furthermore, at any time you are entitled to request information about whether, and if so, which of your details are saved and processed by us (Art. 15 GDPR). Where necessary, we will first need to obtain proof from you that you are indeed the person named in your enquiry.

Lawfulness of the data processing

When we collect your data we will notify you of the legal norm on the basis of which we may process your data. If there is no explicit rule in a law, we will only process your data if you have first agreed to us doing so (Art. 6, para. 1 GDPR). Any such consent may be retracted with effect for the future at any time. 

For how long will your data be stored? 

The duration of storage depends on the stated purpose of the data processing. As soon as this no longer applies or you retract any consent that you may have given, your data will be deleted. If statutory obligations to retain the data apply - such as under taxation law - or if the university has documentation obligations in the context of a legal dispute, the data will initially continue to be stored, but only used in this connection.

Who has access to your data?

Within the university, only those employees who need them to fulfil the processing purpose of which you have been informed will be granted access to your details. All these employees have been informed of the statutory regulations governing the handling of personal data.

If we involve external companies who support us with the processing of your data, you will be notified about these contract processors. In this case we will also ensure that a suitable contract is concluded so that your data will be protected in line with the GDPR.

Any other transmission of your data to third parties requires your consent unless a legal provision requires us to do so.

Your rights as the party concerned 

The rights of parties concerned by the processing of personal data are governed by chapter 3 of the GDPR. In addition to the right to information previously mentioned, the following applies:

• You have the right, where necessary, to request the correction and completion of your data (Art. 16 GDPR).
• You have the right to request the deletion of your data if a reason as set out in Art. 17 of the GDPR applies, e.g. if the data are no longer required for the purposes pursued.
• You have the right to request that the processing of your data be restricted, if a condition as set out in Art. 18 of the GDPR applies, e.g. during the investigation of an objection or whilst the correctness of saved data is investigated.
• According to Art. 21 of the GDPR, you have the right to object to the processing of data pertaining to you on grounds relating to your particular situation. The data will no longer be processed if there is no compelling need to do so.
• You have the right to complain to a supervisory authority if you believe that your personal data have been processed in contravention of the relevant legislation (Art. 77 of the GDPR). In Saxony-Anhalt, the responsible supervisory authority is the  State Representative for Data Protection.