Data Protection

Privacy notice regarding the use of social media

Data protection is a key priority for Hochschule München (HM) and a legal obligation. To ensure that personal data is adequately protected during transmission, HM uses state-of-the-art encryption methods (e.g. SSL/TLS) and secure technical systems.

Here, we set out the purposes for which we process your personal data, the legal basis for doing so, the duration of such processing, and the rights you have in relation to the processing of your data, provided that you interact with us on our social media pages.

Wherever the term ‘data’ is used in the text, it refers exclusively to personal data within the meaning of Article 4(1) of the GDPR.

Data controller

HM Hochschule München University of Applied Sciences

Lothstraße 34
D-80335 München
Tel.: +49 89 12 65 - 0
Fax: +49 89 12 65 - 3000
Email: kommunikation@hm.edu
Website: www.hm.edu

HM Hochschule München University of Applied Sciences is a public-law body. It is legally represented by its President, Prof. Dr Martin Leitner.

Government Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu and by telephone on +49 9951 99990-500.

General information about the ‘Share’ buttons on HM’s social media pages:

Purposes and legal bases for processing

We maintain a presence on social media. These form part of our public image and public relations activities in accordance with Article 2(2), sentences 3 and 5 of the Bavarian Health Information Act (BayHIG) and Article 17(1) of the Bavarian Digital Information Act (BayDIG). Our aim is to provide information tailored to our target groups and to engage with interested parties. Social media enables us to establish contact quickly via electronic means and, as a result, to communicate directly via the media of your choice, as required by Section 5(1)(2) of the German Telemedia Act (TMG).

Our website features share buttons for Facebook, Instagram, Twitter, YouTube, Xing and LinkedIn. The links to these platforms are set up in such a way that your data is only sent to the respective service once you click on the share button (known as the ‘two-click’ solution).

In addition to ourselves, the following are ‘controllers’ within the meaning of Article 4(7) of the GDPR and other data protection regulations in relation to our social media presence:

  • Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland)
  • Instagram (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland)
  • Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland)
  • YouTube, a service provided by Google (Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland)
  • LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
  • Xing (New Work SE, Dammtorstraße 30, 20354 Hamburg)

The University will report any content, posts or enquiries that infringe the rights of third parties, constitute a criminal offence or an administrative offence, or fail to comply with statutory or contractual obligations, to the relevant authority or the social media platform, and will block or delete such content.

We use the statistics we receive from the providers in connection with our social media presence to compile business statistics, carry out organisational analyses and optimise the content we offer. The legal basis for this is Article 6(1) of the Bavarian Data Protection Act (BayDSG), Section 19(4) of the Telecommunications Data Protection Act (TTDSG) and Article 43(1) of the Bavarian Digitalisation Act (BayDiG). Where this does not compromise the respective purpose of processing, we anonymise or pseudonymise your data.

Recipients or categories of recipients of personal data

Where users make use of Hochschule München’s social media channels and pages, the providers of these platforms also process users’ personal data.

Communication

If you contact Hochschule München to raise a matter or share your views by email, post, telephone, fax or social media, the information you provide will be processed for the purpose of dealing with your enquiry, as well as for any follow-up questions and to facilitate an exchange of views.

Retention period

We will only retain your data for as long as is necessary to fulfil our obligations, in accordance with statutory retention periods. Once the retention period has expired, your data will be deleted

We regularly review all direct messages not sent to us publicly – at the latest, after two years have elapsed – to determine whether it is still necessary to retain the enquiries for the purpose of follow-up questions. If there is no longer any need to retain the data, its processing will be restricted.

If you communicate with us via the public comment features on our profiles and channels, you can decide for yourself how long your comment remains visible or ask us to delete it.

Things to bear in mind when using social media:

Hochschule München recognises the communication opportunities offered by social media. However, it points out that simply clicking on links to these services results in data being transmitted.

This applies regardless of whether or not you are a member of the social network in question. This data could be used by the relevant platform providers to create a personalised profile.

We have no control over what data is transmitted to Facebook, Instagram, Twitter, YouTube, Xing and LinkedIn when you click on these links. You use these platforms and their features at your own risk. This applies in particular to the use of interactive features such as commenting on, sharing or rating our posts, as well as ‘liking’ our page. We therefore expressly draw your attention to the fact that by clicking on these links, you will leave the area controlled by Hochschule München. Please ensure that you observe the data protection policies and settings of the respective providers.

Further information is provided, amongst other things, under the following headings.

Your rights:

You have the following rights regarding the processing of your data: the right of access; the right to rectification; the right to erasure; the right to restriction of processing; the right to object; the right to data portability; and the right to lodge a complaint with the relevant data protection authority regarding the unlawful processing of your personal data.

We do not have full access to your personal data. You should therefore contact the provider of the relevant platform directly if you wish to exercise your rights. The provider has access to its users’ personal data and can take the appropriate measures and provide information. We will be happy to assist you if you still require help. Please contact datenschutzbeauftragter@hm.edu for this purpose.

Cancellation on Xing:

For a detailed explanation of the respective processing activities and the options for withdrawing consent, please refer to the information linked below:

When you visit our Facebook fan page, we are jointly responsible with Meta Platforms Ireland Ltd. for the processing of your data, in accordance with the case law of the European Court of Justice (ECJ). Below, we provide information about the associated data processing on our fan page; this does not affect Facebook’s Terms of Service.

Contact details of the data controllers / joint controllership under Article 26 of the GDPR

We, Hochschule München (see the information about us mentioned at the beginning), and Meta Platforms Ireland Ltd., with its place of business at Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers.

We have entered into an agreement with Meta Platforms Ireland Ltd. regarding joint controllership under Article 26 of the GDPR, in which we have agreed, amongst other things, that the key provisions of the agreement will be made available to you.

Description, nature and scope of the processing

Facebook is a social network, or rather an online social hub, an online community that enables its registered users to communicate with one another and interact in a virtual space. It is a platform that can be used to exchange opinions and experiences, and enables the online community to share personal and university-related information. Among other things, Facebook allows its registered users to create private profiles, upload photos and connect with others via friend requests.

We create content for you on Facebook and monitor the posts and interactions of the community on this page, including the associated profiles.

We therefore process your data on our Facebook fan page, for example, when

  • if you post something on our noticeboard in your own name;
  • if you ask us questions about our services via the available communication channels;
  • if we block or, where necessary, delete posts and enquiries that infringe the rights of third parties or that even constitute a criminal offence or an administrative offence;
  • if you comment on and/or like our posts.

Furthermore, we receive analytics on the use of our page from Facebook via Page Insights. We have also reached an arrangement with Meta Platforms Ireland Ltd. regarding our joint responsibility in this regard, as set out in the agreement. Meta Platforms will provide you with the key details of the agreement.

As mentioned at the outset, use of our Facebook page is subject to Facebook’s Termsof Service. The rules set out by Facebook in its Privacy Policy and the associated cookie notices also apply to the use of our Facebook page. It cannot be ruled out that Meta Platforms Ireland Ltd. may also transfer your data to its parent company in the USA. In this context, Meta Platforms Ireland Ltd. is responsible under data protection law, as the data exporter, for the transfer of data to Meta Platforms Inc. Any transfer of your data to the parent company in the USA takes place on the basis of the EU Standard Contractual Clauses we have concluded with Meta Platforms Ireland Ltd. We would like to expressly draw your attention here to the risk that you may not be able to enforce your rights as a data subject – which may arise as a result of disproportionate access to your data by government authorities – as you can generally only seek legal redress against any data recipients under the national law of the United States of America.

Objection on Facebook and Instagram (a Meta service)

For a detailed explanation of the respective processing activities and the options for objecting (opt-out), please refer to the information linked below:

Contact details of the data controllers / joint controllership under Article 26 of the GDPR

We, Hochschule München (see the information about us mentioned at the beginning), and Instagram are joint controllers. Instagram is a service provided by Meta Platforms Ireland Limited, with its place of business at Merrion Road, Dublin 4, D04 X2K5, Ireland.

We have entered into a joint controller agreement with Meta pursuant to Article 26 of the GDPR, in which we have agreed, amongst other things, that Meta will provide you with the key provisions of the agreement.

Data processing

The use of Instagram is subject to Instagram’s Termsof Use. The rules set out in the Privacy Policy and the associated cookie notices also apply to the use of our Instagram page.

In the event of any data transfer to the parent company, Meta Platforms Inc., in the USA, Meta Platforms Ireland Ltd is responsible under data protection law as the data exporter.

Any transfer of your data to our parent company in the USA is carried out on the basis of the EU Standard Contractual Clauses we have entered into with Meta. We would like to expressly draw your attention here to the risk that you may not be able to enforce your rights as a data subject – which may arise as a result of disproportionate access to your data by government authorities – as you can generally only seek legal redress against any data recipients under the national law of the United States of America.

Objection on Facebook and Instagram (a Meta service)

For a detailed explanation of the respective processing activities and the options for objecting (opt-out), please refer to the information linked below:

Responsible person

We, Hochschule München (see the information about us mentioned at the beginning), are the operators of the Hochschule München Twitter account.

Twitter International Company, with its registered office at One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, is the data controller designated by Twitter for the processing of your data within the meaning of Article 4(1) of the GDPR. Twitter is a service provided by Twitter Inc., with its registered office at 1355 Market Street, Suite 900, San Francisco, CA 94103 in the USA.

Twitter is solely responsible for data processing and for any transfer of data to third countries.

Description, nature and scope of the processing

Twitter is a multilingual, publicly accessible microblogging service on which users can publish and share so-called tweets – short messages limited to 280 characters. These short messages are accessible to everyone, including people who are not registered with Twitter. However, the tweets are also displayed to the user’s so-called followers. Followers are other Twitter users who follow a user’s tweets. Furthermore, Twitter enables users to reach a wide audience via hashtags, links (known as tagging) or retweets.

We create content for you on Twitter and we view the posts, interactions and profiles of the community on this page. We reserve the right to disclose posts and enquiries that infringe the rights of third parties or that constitute a criminal offence or an administrative offence by forwarding them to the relevant authority or the aggrieved third party, and to block or delete them where necessary.

Data processing

The use of Twitter is subject to Twitter’s Termsof Service. The rules set out in the Data Policy and the Cookie Notice also apply to its use. Twitter Ireland is responsible under data protection law, as the data exporter, for the transfer of data to its parent company, Twitter Inc., in the USA.

Insofar as Twitter Ireland is the data exporter and therefore responsible under data protection law, the legally adequate level of data protection is guaranteed by the provider’s EU Standard Contractual Clauses.

We would like to take this opportunity to expressly draw your attention to the risk that you may, under certain circumstances, be unable to enforce your rights as a data subject – rights which may arise as a result of disproportionate access to your data by state authorities – as you can generally only seek legal redress against any recipients of your data under the national law of the United States of America.

Objection on Twitter

For a detailed explanation of the respective processing activities and the options for objecting (opt-out), please refer to the information linked below:

Responsible person

The websites that form part of Hochschule München’s online presence occasionally include links to videos from the US video-sharing platform YouTube.

We, Hochschule München, create content for you on YouTube and monitor the posts, interactions and profiles of the community on our YouTube channel. We use the YouTube platform to upload our own videos and make them publicly available.

In this context, we process your personal data when you interact with us on the platform and your personal data is identifiable to us. YouTube is responsible under data protection law for any further processing of your data.

YouTube is a service provided by Google Ireland Limited, whose registered office is at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).

Data processing

With the help of the consent management platform used by Hochschule München, automatic connections to YouTube servers and the setting of YouTube cookies are generally prevented when visiting HM websites that contain embedded YouTube videos.

Only once you have consented to the setting of YouTube cookies via the HM cookie banner or the cookie configuration box, or clicked the ‘Reload external content’ button on the embedded video, will a connection be established with YouTube’s servers.

As a result, YouTube may store further cookies on your device or, in some cases, implement other methods to identify you. In addition, certain data is transmitted to YouTube (including your IP address and the referring website).

If you follow us on YouTube, please note that YouTube processes users’ data (e.g. account details, IP address, etc.) in accordance with its own data usage policies and uses it for its own business purposes. Further information on data processing by YouTube can be found here.

Hochschule München has no influence over the nature, scope and duration of the data processed by YouTube, the manner in which it is processed and used, or the disclosure of this data to third parties.

There is a possibility that your data may also be processed outside the European Union. Google Ireland Ltd., as the data exporter, is responsible under data protection law for the lawfulness of any transfers to third countries.

We would like to take this opportunity to expressly draw your attention to the risk that you may not be able to enforce your rights as a data subject – rights which may arise as a result of disproportionate access to your data by US government authorities – as you can generally only seek legal redress against any recipients of your data under the national law of the United States of America.

Legal basis for data processing

Data processing in the context of interaction with YouTube users is carried out for the purpose of performing a public task and in the public interest in accordance with Article 6(1)(e) and (3) of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG), and serves to fulfil public relations obligations (Article 2(2), sentences 3 and 5 of the Bavarian Higher Education Act (BayHIG)).

For information on the legal basis for data processing by YouTube, please refer to Google’s privacy policy.

Options for lodging an objection

Automatic loading of YouTube videos can be disabled again in the cookie settings box.

Withdrawal on YouTube (a Google service)

If you wish to object to the processing of your data by Google or withdraw your consent given to Google, please contact Google. You can prevent Google from processing your data, for example, by downloading and installing the browser plug-in.

Miscellaneous

We reserve the right to disclose and block, or where necessary delete, any posts or enquiries that infringe the rights of third parties or that constitute a criminal offence or an administrative offence, by forwarding them to the relevant authority or the third party whose rights have been infringed.

Use of YouTube is subject to YouTube’s Termsof Service and Google’s Termsof Service and Privacy Policy.

Contact details of the data controllers / joint controllership under Article 26 of the GDPR

We, Hochschule München (see the information about us mentioned at the beginning), and LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, are joint controllers.

We run our page on LinkedIn to raise our profile, in particular to provide users (who are registered on LinkedIn) with information about Hochschule München and what it has to offer, as well as any job vacancies, whilst also giving them the opportunity to interact with us directly and in a targeted manner.

In connection with the operation of our LinkedIn page, we use the Page Insights feature to obtain statistical data on users and the use of our page. In order to carry out these statistical analyses, LinkedIn stores a cookie on the user’s device. Each cookie contains a unique user ID. The information stored in the cookie is processed by LinkedIn, in particular when the user visits LinkedIn services and services provided by other companies that use LinkedIn services. The visitor statistics generated are transmitted to us by LinkedIn exclusively in aggregated form. We do not have access to the data collected by LinkedIn. LinkedIn does not provide us with any data that could be used to identify individual persons. Further information on LinkedIn’s use of cookies can be found in its Cookie Policy.

The main implications of the joint liability agreement are that you can exercise your data subject rights directly with LinkedIn and that no personal data relating to LinkedIn members is transferred to us. We only receive aggregated statistical data from LinkedIn. However, should you require our assistance in exercising your data subject rights, please feel free to contact us at any time. Further information on data protection can be found in LinkedIn’s Privacy Policy.

It is possible that your data may also be processed outside the European Union by LinkedIn Ireland Unlimited Company, acting as a data exporter, in the USA. LinkedIn Ireland Unlimited Company is solely responsible for this. Insofar as LinkedIn Ireland Unlimited Company is the data controller under data protection law, the legally appropriate level of data protection is guaranteed, amongst other things, by the provider’s standard contractual clauses.

Purposes of processing

The purpose of data processing in connection with our LinkedIn page is, firstly, to compile statistics on visitor traffic. This enables us to better understand how users interact with our page and the services featured on it. It allows us to improve the design of our page and tailor it to users’ needs. Secondly, we process your data so that we can communicate with you directly via the channels of your choice.

Legal basis for data processing

We operate this LinkedIn page to present ourselves publicly to LinkedIn users who visit our page and to communicate directly with them. Data processing is carried out as part of our statutory duties relating to public relations and the maintenance of direct communication. The legal basis for data processing is Article 6(1)(e) of the GDPR.

Options for objection and rectification

In accordance with Article 21 of the GDPR, you have the right at any time to object to the processing of your data on grounds relating to your particular situation. You can exercise your right to object via your LinkedIn settings or by using the form for objecting to LinkedIn’s data processing. As a LinkedIn user, you can adjust your advertising preferences and thereby specify the extent to which your user behaviour may be tracked when you visit our LinkedIn page. Further information on the right to object can be found here.

Retention period

As the operators of a LinkedIn page, we do not receive any personal data; therefore, the criteria set by LinkedIn apply to the retention period.

Withdrawal on LinkedIn

For a detailed explanation of the respective processing activities and the options for withdrawing consent, please refer to the information linked below:

Rights of those affected

Under the General Data Protection Regulation, you have the following rights:

  • Where personal data is processed, data subjects have the right to obtain information about the data held about them (Article 15 of the GDPR).
  • If inaccurate personal data is processed, you have the right to have it rectified (Article 16 of the GDPR).
  • Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR).
  • Where consent has been given for data processing, or where a contract for data processing exists and the data processing is carried out using automated means, data subjects may have a right to data portability (Article 20 of the GDPR).
  • Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR).
  • Data subjects have the right to request information as to whether automated decision-making, including profiling, is taking place (Article 22 of the GDPR).
  • Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is carried out solely on the basis of Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

Should the rights set out above be exercised, the public authority will check whether the legal requirements for doing so have been met.

Furthermore, you have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection.

You can contact them using the following contact details:

Postal address:
Postfach 22 12 19
80502 München

Address:
18 Wagmüllerstraße
80538 München

Tel.: +49 89 212672 - 0
Fax: +49 89 212672 - 50

Email: poststelle@datenschutz-bayern.de
Website: https://www.datenschutz-bayern.de/

Further information regarding our Privacy Policy

Hochschule München reserves the right to amend the Privacy Policy from time to time to ensure that it always complies with the latest legal requirements or to reflect changes to the services described in the Privacy Policy, for example when new services are introduced. The new Privacy Policy will then apply to any subsequent visits to the website.

If you have any questions, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu) or send an email to: kommunikation@hm.edu.

Last updated: 6 February 2023

The information on this page was translated into English for your convenience. In case of any discrepancies between the English and German versions, the German version shall prevail.