Privacy notice for admission candidates, students and alumni

Data controller

HM Hochschule München University of Applied Sciences

Lothstraße 34
D-80335 München
Tel.: +49 89 12 65 - 0
Fax: +49 89 12 65 - 3000
Email: kommunikation@hm.edu
Website: www.hm.edu

HM Hochschule München University of Applied Sciences is a public-law body. It is legally represented by its President, Prof. Dr Martin Leitner.

Government Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu and by telephone on +49 9951 99990-500.

Purposes and legal bases for processing

Purposes

Hochschule München uses the personal data collected to process applications for study places and the subsequent enrolment procedure following a successful application, in accordance with statutory requirements. Upon enrolment at Hochschule München, personal data is subsequently processed for student and examination administration, to support the handling of international matters such as semesters abroad, for scholarship matters, as a basis for talent development, or for the evaluation of the effectiveness of teaching methods and measures. The personal data collected during the application process is processed on the basis of the documents uploaded by admission candidates to the application portal and the information provided in the application form. The purpose of the processing is to carry out the application procedure, in particular to verify the information contained in the documents and forms, to inform admission candidates of the status of their application, and to make decisions on admissions.

Application and enrolment procedures

During the application process, personal data is used solely for the purposes of contacting applicants and processing their applications. Once an application for a place at university has been successful, the data provided will be processed for the subsequent enrolment procedure in accordance with the relevant legal requirements.

Management of system access

HM uses the data provided to control and manage system access (network, online portals, learning platforms, library use, room bookings).

Student and Examination Administration

The Student and Examination Administration system uses the data for contact purposes, for managing applications (leaves of absence, deadlines, recognition, etc.) and for managing internships, fees and examinations, in accordance with the relevant legal requirements.

Scholarship matters / Student exchange

As part of its scholarship administration, the HM records scholarship applications to be processed via the university (e.g. the Deutschlandstipendium (Germany scholarship)) and uses the available data to provide targeted information on scholarship programmes, talent development and the awarding of prizes to students and graduates. In some external funding programmes, universities have the right to nominate students who meet the relevant criteria. This may include arithmetic average examination marks from PRIMUSS. The HM identifies, via the systems, the students who best meet the criteria of the funding programmes; a nomination involving the transfer of personal data to external scholarship providers is only made with the student’s consent.

The Hochschule München (HM) also uses personal data to support applications for places at partner universities abroad: these applications are recorded and processed in the university’s ‘MoveOn’ mobility management system. Where there are more applications than places available, current arithmetic average exam marks are retrieved from PRIMUSS for the allocation of places based on ranking lists.

Applicants and enrolled students are each provided by the HM with password-protected system access to complete applications, submit requests and carry out procedures digitally via the PRIMUSS portals for applicants and students: The university logs access and activity in order to be able to verify the legitimacy of access and provide evidence of activity at any time. The log data is not used for any other purpose.

Alumni

In accordance with Article 2(3), third sentence, of the Bavarian Higher Education Act (BayHIG), the university is required to maintain links with its former students. If students wish to remain in contact with the university after graduating or leaving, a separate declaration or registration is generally required.

Any use of personal data relating to registered or unregistered alumni by Hochschule München shall only take place in accordance with statutory provisions or with separate, explicit consent.

Consent may be withdrawn by sending an email to alumni@hm.edu (for the central alumni database) or to the person responsible for alumni management at the relevant department, if graduates have registered as alumni with their department. For this purpose, the secretariats of the respective departments may be contacted if the person concerned is unaware, in individual cases, of a specific contact person or a dedicated email address for alumni administration at the relevant department.

Research

On occasion, the personal data of students and alumni, which is lawfully processed by HM, is processed for research purposes. In doing so, appropriate safeguards are put in place to protect your rights and freedoms, in particular through the pseudonymisation of the data. Processing takes place only to the extent necessary for research purposes and in accordance with the principle of data minimisation. The data collected is analysed in accordance with recognised scientific methods, and the results are anonymised and published in accordance with the rules of good scientific practice.

Legal basis

The legal basis for data processing in connection with admission candidates, enrolment, leave of absence, re-enrolment and de-registration is Article 6(1)(e) in conjunction with Article 6(3)(b) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG), Article 2 and Article 87 of the Bavarian Higher Education Innovation Act (BayHIG), the Bavarian Higher Education Admissions Act (BayHZG) and the statutes on the Pre-registration, Enrolment, Leave of Absence, Re-registration and Withdrawal Procedures at the University of Applied Sciences München in their latest version, as well as the Higher Education Statistics Act (HStatG). Furthermore, processing is carried out to fulfil the public tasks assigned to the university by the BayHIG. The legal basis for this is Article 6(1)(e) and (3)(b) of the GDPR in conjunction with Article 4(1) of the BayDSG and Article 2 of the BayHIG.

The storage of private email addresses and private telephone contact details is carried out on the basis of Article 6(1)(e) and (3)(b) of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG): Private contact details enable data subjects and the Hochschule München to handle urgent matters – such as exam scheduling, consultations on applications and decisions, and similar issues – efficiently, which, as experience has shown, is not possible via the Munich email accounts. Data processing is therefore necessary for the performance of a task entrusted to the controller. As private contact details are used solely for internal purposes, shared internally only with authorised service units and not disclosed externally, there are no overriding interests in the protection of privacy and personal data that would preclude this.

The legal basis for the use of the data for the purposes of scientific research is Article 6(2)(3)(c), Article 25 of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 6(1)(e) of the GDPR and Article 89 of the GDPR.

The processing of personal data in connection with an alumni database maintained by HM or the relevant department is carried out in accordance with Article 6(1)(a) of the GDPR (consent).

Recipients or categories of recipients of personal data

Hochschule München only discloses data on the basis of statutory authorisation or with the data subject’s consent: no data is disclosed beyond this.

The Admit Check AI application from Compounder GmbH is being used on a trial basis to verify the candidate data provided during the application process. The GDPR-compliant provider undertakes to process the data transmitted exclusively for the purposes specified in the contract. A data processing agreement (DPA) in accordance with Article 28 of the GDPR has been concluded between HM and the service provider, ensuring compliance with all data protection requirements. The applicant data transmitted to the AI application will be deleted from the system immediately upon completion of the verification process and will not be used for AI training purposes.

For degree programmes participating in the nationwide admissions matching scheme, known as the ‘dialogue-oriented service procedure’ (DoSV), application data is submitted to the Foundation for University Admissions, which is responsible for the DoSV (see www.hochschulstart.de) for the nationwide application and admissions coordination process, and are cross-checked against the data held there (legal basis: Section 2(1) and (4) of the Bavarian Higher Education Admissions Ordinance).

As part of the admission process and the course of study, personal data is cross-checked with the health insurance provider (legal basis: Section 199a of the Social Code, Book V (SGB V)) and, where applicable, data is transferred to the Munich Student Services Organisation in connection with BAföG applications submitted there (legal basis: Sections 47 and 48 of the Federal Students Assistance Act – BAFöG).

The Hochschule München’s library system is hosted at the Leibniz Computing Centre, an institute of the Bavarian Academy of Sciences and Humanities. Technical support is provided by the Central Co-ordination Office of the Bavarian State Library and by the Hochschule München Library.

The university has the right to nominate potential candidates from among its students for many scholarship programmes: the university will only ever disclose contact and academic performance data with the consent of the individuals concerned. The disclosure of data without the individuals’ knowledge is permitted under Article 27 of the Bavarian Data Protection Act (BayDSG) for the purpose of preparing for and awarding state or local honours or distinctions.

Hochschule München operates PRIMUSS as its examination, enrolment and student administration software in collaboration with nine other universities. The systems, including the online portals, are hosted centrally at the Erlangen-Nuremberg regional data centre and administered by the PRIMUSS consortium. The PRIMUSS consortium’s centres of expertise are responsible for its operations: the PRIMUSS team at Coburg University of Applied Sciences is responsible for central administration and second-level support for the online services, whilst Ingolstadt University of Technology is responsible for second-level support for the administrative programmes. The relevant contact persons can be reached at techadmin@primuss.de or info@primuss.de .

Students can make payments to the Free State of Bavaria using the so-called ePayment procedure via the application portal and the buttons provided in PRIMUSS. In doing so, the following student data, in some cases in abbreviated form, is transmitted to the ‘ePayBayern’ platform – an electronic payment service operated by the Bavarian State Office for Finance (BayLfF), the service provider for the authorities of the Free State of Bavaria: student ID number, surname, street/house number, postcode, town, product descriptions/costs. The State Office for Finance is responsible for the further processing of this data. The privacy notice regarding the BayLfF’s ePayment procedure can be found here: https://epay.bayern.de/eps-payplatform/platformprivacypolicy.action

Hochschule München analyses anonymised data on students’ academic progress in order to optimise its advisory services and support measures (see the project ‘Longitudinal Analysis of Student Data’ ).

Planned retention period for personal data

Personal data is stored by Hochschule München only for as long as is necessary for the intended purpose or as required by law.

Applicants’ data is used exclusively for the purpose of processing applications. Where applications are unsuccessful, this data is deleted six months after the end of the application process (Article 17(1)(a) of the GDPR). Where the data is subject to archiving requirements, it will only be deleted once it has been transferred to the archive (Article 89 of the GDPR in conjunction with Article 26(6) of the Bavarian Data Protection Act (BayDSG), as amended).

Hochschule München stores the personal data of enrolled students for the duration of their studies, in accordance with statutory requirements:

• Applications and other correspondence are retained for the duration of the studies and for a further six months thereafter, in order to be able to track the course of studies and, where necessary, issue the relevant certificates, etc.
• In accordance with Section 12 of the Framework Study Regulations for Universities of Applied Sciences in Bavaria (RaPO), examination records must be retained for two years, commencing at the end of the calendar year in which the result of the relevant module examination was notified. Notwithstanding this, examination records that are the subject of an appeal or legal proceedings shall be retained until the proceedings have been finally concluded.
• An abridged examination record is retained for a period of 50 years and contains information on the duration of enrolment, examination results, withdrawal from the university and the award of the academic degree. The retention period begins at the end of the calendar year in which the student withdrew from the university.
• Personal data relating to financial transactions (Student Services fees, tuition fees for extra-occupational bachelor's degree and master's degree programmes) is retained for a period of ten years in accordance with budgetary and tax legislation.
• Data in the library systems is deleted once a student has withdrawn from the university. If an account still has outstanding loans or fees, the data will be retained until the account has been settled and deleted immediately thereafter.

Obligation to provide personal data and the possible consequences of failure to do so

In accordance with Article 87(2) of the Bavarian Higher Education Innovation Act (BayHIG), students are obliged to provide all personal data relevant to the processing of their application and their studies. Should any data requested that is relevant to the decision-making process not have been provided, any entitlements based on such data (e.g. admission to studies, enrolment, examinations, leave of absence, deadline extensions and access, etc.) may be forfeited.

Automated decision-making / profiling

In the area of talent development at Hochschule München, for scholarship nominations (see above) and for information on job vacancies for research staff members, the university evaluates students’ data in accordance with the relevant sets of criteria for positions, scholarships and talent development. On this basis, students may be informed accordingly, invited to submit an application where appropriate, or contacted directly by the university. Irrespective of this, general information on talent development, scholarship programmes and advertised vacancies is available to all students on the usual portals.

When applying for a semester abroad at partner universities overseas, current arithmetic average marks must be provided for processing in the ‘MoveOn’ mobility management system as the basis for deciding on the allocation of places, provided there are more applications than places available. Student data is retrieved from the PRIMUSS system to the extent that it is necessary for the application. The data will not be passed on or used for analysis without consent.

Rights of those affected

Under the General Data Protection Regulation, you have the following rights:

• Where personal data is processed, data subjects have the right to obtain information about the data held about them (Article 15 of the GDPR).
• If inaccurate personal data is processed, you have the right to have it rectified (Article 16 of the GDPR).
• Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR).
• Where consent has been given for data processing, or where a contract for data processing exists and the data processing is carried out using automated means, data subjects may have a right to data portability (Article 20 of the GDPR).
• Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR).
• Data subjects have the right to request information as to whether automated decision-making, including profiling, is taking place (Article 22 of the GDPR).
• Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is carried out solely on the basis of Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

Should the rights set out above be exercised, the public authority will check whether the legal requirements for doing so have been met.

Furthermore, you have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection.

You can contact them using the following contact details:

Postal address:
Postfach 22 12 19
80502 München

Address:
18 Wagmüllerstraße
80538 München

Tel.: +49 89 212672 - 0
Fax: +49 89 212672 - 50

Email: poststelle@datenschutz-bayern.de
Website: https://www.datenschutz-bayern.de/

Further information regarding our Privacy Policy

Hochschule München reserves the right to amend the Privacy Policy from time to time to ensure that it always complies with the latest legal requirements or to reflect changes to the services described in the Privacy Policy, for example when new services are introduced. The new Privacy Policy will then apply to any subsequent visits to the website.

If you have any questions, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu) or send an email to: kommunikation@hm.edu.

Further information on data protection can be found here: www.hm.edu/datenschutz .

The information on this page was translated into English for your convenience. In case of any discrepancies between the English and German versions, the German version shall prevail.