Privacy statement
a) Name and address of the controller
The controller in accordance with the General Data Protection Regulation and other national Member States data protection laws, as well as other data protection regulations is the:
Freie Hochschule der Christengemeinschaft e.V.
an independent organisation without state recognition
Spittlerstraße 15
70190 Stuttgart
Germany
Telephone +49 (0)711 166830
Fax +49 (0)711 1668324
info@priesterseminar-stuttgart.de
www.priesterseminar-stuttgart.de
b) General remarks on data processing
Scope of personal data processing
We collect and use personal data from our users only to the extent necessary for the provision of a functioning website and of our content and services. The collection and use of our user’s personal data regularly takes place only upon obtaining the users’ consent. An exception applies in cases where the obtaining of a prior consent it is not possible due to factual reasons, and where the processing of such data is permitted by statutory provisions.
c) Legal basis for processing personal data
Provided we obtain a consent from the data subject for the processing of personal data, Art. 6 (1) point a General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Where processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6 (1) point b GDPR serves as the legal basis. This also applies for processing operations necessary in order to take steps prior to entering a contract.
Where processing is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) point c GDPR serves as the legal basis.
In cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6 (1) point d GDPR serves as the legal basis.
Where processing is necessary for the purpose of pursuing a legitimate interest by our company or by a third party, and where the interests, fundamental rights and freedoms of the data subject do not override such interests, Art. 6 (1) point f GDPR serves as the legal basis.
d) Erasure and storage duration
The personal data of the data subjects shall be erased or locked as soon as the purpose of their storage lapses. Moreover, storage can be carried out if required to do so by European or national legislators by EU regulations, laws or other provisions to which the controller is subject. Blocking or erasure of data is also carried out if the storage period, imposed by the aforementioned regulation expires, unless there is a need for further storage of data for the conclusion of a contract or for the purpose of contract performance.
e) Provision of website and creation of log files
Description and scope of data processing
With every visit of our website our system automatically collects data and information from the computer system of the calling computer.
The following data are thereby collected:
(1) Information about the browser type and the used version
(2) The operating system of the user
(3) The user Internet-Service-Provider
(4) The IP-address of the user
(5) Date and time of access
(6) Websites from which the system of the user gets to our website
The data is also stored in the log files of our system. A storage of such data along with the other personal data of the user does not take place.
f) Legal basis for data processing
Art. 6 (1) point f GDPR serves as the legal basis for the temporary storage of data and log files.
g) Purpose of data processing
The temporary storage of the IP address by the system is necessary to allow for the delivery of the website to the user’s computer. This requires the user’s IP-address to be stored for the duration of the session. The storage in log files is carried out to ensure the functionality of the website. Furthermore, we use the data to optimise the website and to ensure the safety of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
In such purposes lie our legitimate interests of data processing as per Art. 6 (1) point f GDPR.
h) Duration of storage
The data shall be erased as soon as it is no longer required for the achievement of the purpose of its collection. In the case of data collection for the provision of the website, this shall be the ending of each session. In the case of storing data in log files, this shall be after no longer than seven days. Further storage is possible. In such case the user IP-addresses are erased or distorted so that an attribution to the calling client is no longer possible.
i) Right to objection and erasure
The collection of data for the provision of the website and data storage in log files is mandatory for the operation of the website. Thus there is no possibility of objection on the part of the user.
j) Use of cookies
a) Description and scope of data processing
Our website uses session cookies. Cookies are text files that are stored in the internet browser, or stored by the internet browser on the computer system of the user. When a user calls on a website, a cookie can be stored on the operating system of the user. This cookie contains a characteristic string, enabling a unique identification of the browser during the revisit of the website.
We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be identified even after a page change. The session ID allocated at the time of the website access is thereby stored and transmitted in the cookies.
b) Legal basis for data processing
6 (1) point f GDPR serves as the legal basis for the processing of personal data when using cookies.
c) Purpose of data processing
The use of cookies is technically necessary in order to simplify the use of the website for the users. The user data, collected by the technically necessary cookies, will not be used to create user profiles.
In these purposes lie our legitimate interests for processing personal data as per Art. 6 (1) point f GDPR.
k) Duration of storage, objection and erasure
The transient cookies used by us are automatically deleted when you close your browser. In particular, these include session cookies. These store a so-called session ID, which allows for an allocation of various requests from your browser to the joint meeting. This allows your computer to be recognized when you return to our site. Session cookies are deleted when you log out or close your browser.
l) Google Analytics
In addition, our websites use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Provider is the Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Here Google uses so called cookies, i.e. text files that are stored on your computer, allowing for an analysis of your website use. The information generated by the cookie about your website use
Browser type/version,
used operating system,
Referrer URL (the page previously visited),
Host name of the accessing computer (IP address),
Time of the server request,
are generally transferred to a Google server in the USA and stored there. The website also uses Google Analytics with the extension "_anonymizeIp()" so that data can only be processed anonymously. The IP address is thereby shortened by the last three digits, so that a clear allocation of the IP address is no longer possible. Only in exceptional cases will the full IP address be transferred to a Google server in the USA where it will be shortened.
Google will use this information on our behalf to evaluate your use of the website, to compile reports on the website activities and to provide other services related to website and internet usage. Google may also transfer this information to third parties where required by law, or where third parties process these data on behalf of Google. Google will not associate your IP address with other data from Google. In these purposes lie our legitimate interests for processing personal data as per Art. 6 (1) point f GDPR.
The data processing is based on Art. 6 (1) point f GDPR. The data will be automatically deleted after statistical evaluation, however no later than within 14 months.
You can prevent the installation and storage of cookies by selecting the appropriate setting in your browser software. However, we would like to point out that in this case you may not be able to use the entire functionality of this website.
Furthermore, you can prevent Google from collecting the data related to your use of the website generated by the cookie (incl. your IP address), as well as the processing of such data by Google by downloading and installing the browser-plugin available at the following link:
http://tools.google.com/dlpage/gaoptout?hl=en
As an alternative to the browser-add-on, in particularly with browsers on mobile devices, you can also prevent Google Analytics from collecting by setting an opt-out-cookie in your browser which will prevent the future collection of your data upon visiting this website. The opt-out cookie is valid only in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you will have to set the opt-out cookie again.
Set Google Analytics Opt-Out Cookie
By using the website, you agree to the processing of data collected about you by Google in the manner described above and for the purposes set out above. More information about Google Analytics can be found on the internet at the following link of the manufacturer Google:
https://support.google.com/analytics/answer/6004245?hl=en
m) Google Maps
Our website uses the map service Google Maps via an API. Provider is the Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use the Google Maps feature, it is necessary to store your IP address. This information is generally transferred to a Google server in the USA and stored there. The provider of this page has no influence on this data transmission.
Google Maps is used in order to provide an appealing presentation of our online-offers and to allow for an easy detection of the locations specified by us on the website. This constitutes a legitimate interest in the sense of Art. 6 (1) point f GDPR.
For more information on handling user data, please refer to the privacy statement of Google: https://www.google.com/intl/en/policies/privacy/.
n) Contact form and email contact
Description and scope of data processing
On our website there is a contact form, which can be used for the electronic contact. If a user chooses this option, the data entered into the input screen will be transmitted to us and stored. At the time of the message transmission, the following data is also stored:
(1) The IP-address of the user
(2) Date and time of registration
Your consent will be requested for the purpose of data processing and you will be referred to this privacy statement within the scope of the transmission process. Alternatively, you can contact us via the provided email address. In this case the user’s personal data transmitted with the email are stored. Data is not transmitted to third parties in this context. The data will be used exclusively for the processing of the conversation.
o) Legal basis for processing
Where processing is based on a consent of the user, Art. 6 (1) point a GDPR serves as the legal basis for the data processing. Legal basis for the processing of data communicated in the course of an email transmission, is Art. 6 (1) point f GDPR. Where the email contact is necessary for the conclusion of a contract, Art. 6 (1) point b GDPR serves as an additional legal basis.
p) Purpose of data processing
The processing of personal data from the input screen serves solely for the purpose of contact establishment. In case of establishing email contact, herein also lies the required legitimate interest for the data processing.
The other personal data processed during the transmission process is intended to prevent the misuse of the contact form and to ensure the safety of our information technology systems.
q) Duration of storage
The data shall be erased as soon as it is no longer required for the achievement of the purpose of its collection. With regard to the personal data from the contact form input screen and such data sent via e-mail, this is the case when the respective conversation with the user is ended. The conversation is ended, when it is clear from the circumstances that the concerned facts have been conclusively clarified.
The personal additional data collected during the transmission process will be deleted after a period of no longer than seven days.
r) Right to object and erasure
The user shall have the right to revoke his or her consent to processing of personal data at any time. If the user contacts us per email, he or she shall have the right to object to the storage of his or her personal data at any time. In such case the conversation cannot be continued. All personal data stored in the course of the contact establishment will be deleted in such case.
s) Rights of the data subject
If your personal data is processes you are a data subject as per GDPR and you have the following rights vis-à-vis the controller:
Right to information
You may request a confirmation from the controller whether personal data concerning you are processed by us.
If such processing takes place, you can ask the controller to inform you about the following:
(1) purposes for which the personal data are processed;
(2) categories of personal data which are processed;
(3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
(4) the planned period for which the personal data concerning you will be stored, or if precise information is not available, the criteria determining the storage period;
(5) the existence of the right to rectification or erasure of personal data concerning you, the right to restriction of processing by the controller or the right to object to such processing;
(6) right to lodge a complaint with a supervisory authority;
(7) all available information on the origin of the data, where the personal data have not been obtained from the data subject;
(8) the existence of automated decision-making including profiling as per Art. 22 (1) and (4) GDPR and at least in those cases, significant information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to demand information as to whether or not personal data concerning you have been transmitted to a third country or to an international organization. In this context, you may request to be informed about the appropriate guarantees pursuant Art. 46 GDPR associated with the transmission.
t) Right to rectification
You have the right to obtain rectification and/or completion from the controller if the processed personal data concerning you are inaccurate or incomplete. The controller shall carry out the rectification without undue delay.
u) Right to restriction of processing
You have the right to demand from the controller a restriction of processing of personal data concerning you where the following applies:
(1) if the accuracy of the personal data is contested by you, for a period enabling the controller to verify the accuracy of the personal data;
(2) if the processing is unlawful and you object to the erasure of the personal data and request the restriction of use of the personal data instead;
(3) the controller no longer needs the personal data for the purpose of the processing, but they are required by you for the establishment, exercise or defence of legal claims, or
(4) if you have objected to the processing as per Art 21(1) GDPR pending verification whether the legitimate grounds of the controller override your legitimate grounds.
Where processing of personal data concerning you has been restricted, such data shall, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another legal person or for reasons of important public interest of the Union or of a Member State.
Where a restriction of processing was obtained pursuant to the aforementioned conditions, you shall be informed by the controller before the restriction of processing is lifted.
v) Right to erasure
a) obligation to erase
You have the right to demand from the controller the erasure of personal data concerning you without undue delay, and the controller shall have the obligation to erase such data without undue delay if one of the following grounds applies:
(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing was based as per Art. 6 (1) a or Art. 9 (2) a, and where there is no other legal ground for the processing.
(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
(4) The personal data concerning you have been processed unlawfully.
(5) The personal data concerning you have to be erased for the purpose of compliance with a legal obligation in Union or Member State law to which the controller is subject.
(6) The personal data concerning you have been collected in relation to the services of information society services as per Art. 8 (1) GDPR.
w) Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase such data in accordance with Art. 17 (1) GDPR, he shall take reasonable steps, including technical measures, and taking account of the available technology and the implementation cost, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such third parties of any links to, or copy or replication of such personal data.
x) Exceptions
The right to erasure shall not apply to the extent that processing is necessary
(1) to exercise the right of freedom of expression and information;
(2) to comply with a legal obligation which requires processing by Union or Member State law to which the controller is subject, for the performance of a task of public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health as per Art. 9 (2) points h and i, as well as Art. 9 (3) GDPR;
(4) for archiving purposes of public interest, scientific or historical research or for statistical purposes in compliance with Art. 89 (1) GDPR, in so far as the right stated in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of the processing; or
(5) for the establishment, exercise or defence of legal claims.
y) Right to information
If you have claimed your rights to erasure or restriction of processing against the controller, he is obliged to inform all recipients to whom the personal data concerning you has been disclosed, of this correction or deletion or of the restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right vis-à-vis the controller, to be informed about these recipients.
z) Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit the data to another controller without hindrance from the controller to which the personal data have been provided, if
(1) the processing is based on a consent as per Art. 6 (1) point a GDPR or Art. 9 (2) point a GDPR or on a contract in compliance with Art. 6 (1) point b and
(2) the processing is carried out by automated means.
In exercising this right you shall also have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. The rights and freedoms of others must not be adversely affected hereby.
The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in public interest or in the exercise of official authority vested in the controller.
aa) Right to object
You have the right, on grounds of your particular situation, to object at any time to the processing of personal data concerning you, carried out as per Art. 6 (1) point e or f GDPR, including profiling based on those provisions.
The controller shall no longer process the personal data unless he can demonstrate legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise of defence of legal claims.
Were personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.
You may exercise your right to object by automated means using technical specifications in the context of the use of information society services, and notwithstanding Directive 2002/58/EC.
ab)Right to withdrawal of consent under the Data Protection Law
You have the right to withdraw your consent under the Data Protection Law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
ac) Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for entering into, or performance of a contract between you and the controller,
(2) is permissible by Union or Member State law to which the controller is subject, and which also include suitable measures to safeguard your rights and freedoms and legitimate interests, or
(3) is based on your explicit consent.
However, these decisions must not be based on special categories of personal data as per Art. 9 (1) GDPR, unless Art. 9 (2) point a or g applies and suitable measures to safeguard your rights, freedoms and legitimate interests are taken.
In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express the own point of view and to contest the decision.
ad) Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the option of a judicial remedy pursuant to Art. 78. GDPR.