Data Privacy Statement

Effective: January 7, 2026

1) Preamble

Welcome to our website! In the following, we want to detail which data we process when and to what purpose and on which legal basis. This is to explain how the services we offer work and how the protection of your personal data is guaranteed in doing so.

According to article 4(1) of the General Data Protection Regulation (GDPR), personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. For more information see GDPR art. 4(1), among others.

To view, save and print this Data Privacy Statement at any time go to https://www.munich-business-school.de/en/mbs/university/legal/privacy-policy

In each chapter, we will specifically refer to the right of objection again (e.g. by stating: “You have the right of objection”), provided there is such a right. There, you will also find additional information with regard to exercising your right of objection.

In order to help clarify the following Data Privacy Statement, we will include various links to information and data protection notes on external websites (see also chapter titled “External Links” in this Data Privacy Statement). We aim to diligently update the links included in this Data Privacy Statement as necessary. Nevertheless, it is possible that links might not work properly due to periodic updating of the cited websites. If you encounter a dead or broken link, we ask that you inform us so we can replace it with an updated link.

2) Controller

For the purpose of GDPR art. 4(7) relating to the processing of personal data, Controller is:

Munich Business School GmbH
Elsenheimerstraße 61
80687 München

Tel.: +49 (0)89 547678-0
Fax: +49 (0)89 547678-29
Email: info(at)munich-business-school.de

Data Protection Officer

For any questions relating to the processing of your personal data as well as to your rights concerning data protection please contact:

In-house:

Gudrun Walser
Hauptstraße 23
63811 Stockstadt am Main
Phone: +49 (0)6027 4188-0
Fax: +49 (0)6027 4188-20
Email: datenschutz(at)eso.de

Off-site:

Marc Althaus (Data Protection Controller (off-site))

Contact: https://www.dsextern.de/anfragen
DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Frapanweg 22
D-22589 Hamburg
Email: datenschutz(at)eso.de

4) Internet sites (log files)

Any time you access our website, we automatically gather data and information from your device’s system and store it in so-called server logfiles. This data concerns information relating to an identified or identifiable natural person (in this case, the website visitor). The data is automatically transferred by your personal browser when you access our website. Specifically, the following data is gathered:

• the time our website was viewed (request to server of host provider),
• the URL of the website from which you accessed our website,
• the IP address of your computer.

We process this data in order to enable your device to access our website and enable the correct display of our website on your device and in your browser. In addition, the data serves to optimize our website and to ensure the security of our systems. Interpretation of these data is not used for the purpose of marketing.

The legal basis for our processing of this data is GDPR art. 6(1)(f). We have a legitimate interest in providing you a website, which is optimized for your browser, and in allowing communication between our server and your terminal device. For the latter, the processing of your IP address is necessary in particular.

The processed information will be stored only as long as this is necessary for the intended purpose or as is required by law.

The recipient of the data is our server host which operates on our behalf in the context of a commissioned data processing agreement.

6) Information Material Form

On our website you will find a form which you can use to request information material about training, studies and / or further education. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• program
• start date of the program
• preferred location (only on general pages)
• delivery method (digital or postal)

If you want to receive the information material digitally, the required details (marked with an “*”) include the following additional data:

• form of address
• first name
• last name
• phone number/mobile number
• email address
• Country

If you want to receive the information material by post, the required details (marked with an “*”) include the following data:

• form of address
• first name
• last name
• street
• house number
• zip code
• place
• country
• phone number / mobile number
• email address

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and to guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old.

The purpose of processing your personal data is to deal with your request for information material, answer your inquiry or other queries, contact the inquirer, provide professional and consistent advice during the decision-making process, invite you to information sessions, for example to an Open House, study taster, or the like, or to prepare customized offers.

Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6(1)(f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

For internal statistical evaluations, we process your contact details entered via the forms in conjunction with information about how you arrived at our site. This is done on the legal basis of legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Our legitimate interest is to be able to evaluate the effectiveness of our advertising measures. The data is only processed internally for this purpose and is not passed on to third parties. No profiling takes place. The processed data is only stored for as long as is necessary for the intended purpose. You have the option to opt out at datenschutz@eso.de.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent with regard to and/or have seen the Data Privacy Statement as well as proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. The legal basis for processing this data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of your request for brochures in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes. The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

7) Contact Form

On our website you will find a contact form which you can use to contact us electronically. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• email address
• favored location (only on general pages)
• form of address
• first name
• last name
• phone number/mobile number
• Country
• the information contained in your message

Please note that the amount of personal data collected in the context of the contact form also depends on the details you provide in the message part of the contact form.

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old.

The purpose of processing your personal data, in terms of the required as well as the voluntary details, is to deal with contact inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your inquiries.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent to and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the contact form in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes. The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

8) Consultation Form

On our website you will find a form which you can use to contact us electronically in order to make an appointment for a no-obligation consultation about our educational offers. When you contact us using this consultation form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• form of address
• last name
• first name
• email address
• phone number/mobile number
• Country
• the information contained in your message

Please note that the amount of personal data collected in the context of the consultation form also depends on the details you reveal in the message of the consultation form.

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to our best knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.?

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old or have the consent of a parent or legal guardian.

The purpose of processing your personal data in terms of the required as well as the voluntary details, is to deal with consultation inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time in order to make an appointment for a consultation so that we can answer your queries.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes.  The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

9) Application Form

On our website you will find a form which you can use to contact us electronically in order to submit your application for the training, studies or further education offered.

When you contact us using this contact form, we will process the data you enter in the input fields.

The following data will be collected in this context:

• master data
• applicant’s data
• information contained in the application documents you send

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, process the application in its entirety, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old or have the consent of a parent or legal guardian.

Please note that the amount of personal data collected in the context of the application form also depends on the details you reveal in the message included in the form or in the application documents.

The purpose of processing your personal data is to process the application and to enable us to contact the inquirer in order to answer his or her queries. The purpose of processing your personal data resulting from the application documents is to identify suitable applicants.

All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for our processing of your master data is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries. The legal basis for our processing of your personal data resulting from the application is GDPR art. 6(1)(b) and art. 88(1) as well as §26(1) of the new Federal Data Protection Act.

Additional personal data processed at the time of sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as to document the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.

Your personal data will be processed only as long as this is necessary for the purpose. The application email and the documents you send us will be retained until a decision is made as to whether to accept the applicant or not, and it will be deleted afterwards.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes.  The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

10) "Welcome to Munich Business School" Form

When you visit our locations or when we visit your company or when you meet us at exhibitions or any other event, you have the option to fill in a form (“Welcome to Munich Business School!”) which you can use to request information material about training, studies, further education and/or other educational opportunities or to ask for individual consultation. The location indicated on the form you filled in is the Controller with regard to the processing of personal data resulting from the utilization of the form (see Chapter 2) Controller). When you contact us using this “Welcome to Munich Business School!” form, the data you enter will be processed exclusively by the location you selected.

The comprises the following information:

• form of address
• last name
• first name
• street
• house number
• zip code
• place
• phone number/mobile number
• email address
• start date
• the data you entered as part of the field education program / remarks
• if applicable, any other data you entered in the form.

The purpose of processing your personal data is to deal with your request for information material, answer your inquiry or other queries, contact the inquirer, provide professional and consistent advice during the decision-making process, invite you to information sessions, for example to an Open House, study taster, or the like, or to prepare customized offers.

Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6 (1) (f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6 (1) (f). We have a legitimate interest in processing the data you entered as part of this form in order to send you information about our products and services.

The completed form which you hand in at your selected location will be scanned by the location and is recorded in our CRM.

The processed data will be stored only as long as this is necessary for the intended purpose or is required by law.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes.  The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

11) Form "Refer a Friend to MBS!"

For the recruitment of new students by students, we use a card "Refer a Friend to MBS" on which both the advertiser and the person to be recruited give their data and must sign in each case. The person responsible for the personal data processed as a result of the use of the form is the location indicated on the form you use (see section "2) Responsible person"). If you contact us by means of this form, the data provided in the contact form will be processed exclusively by the site you have chosen.

This includes the following data:

• last name
• first Name
• street
• house number
• zip Code
• place
• phone number/mobile number
• email address
• course of studies
• statement of recommendation
• payment details
• signature

The purpose of the processing of personal data is to recruit new students through already registered students and alumni and to provide the advertisers with a bonus for this.

The legal basis for the processing of the personal data provided by you within the scope of this campaign is, on the one hand, the initiation of a contract in accordance with Art. 6 Para. 1 lit. b) DSGVO, as well as our legitimate interest in accordance with Art. 6 Para. 1 lit. f) DSGVO through this incentive for registered students to advertise our educational offers and thus attract new students. As a further legal basis we use the consent according to Art. 6 para. 1 lit. a) DSGVO of the person to be advertised in order to provide him/her with the necessary offers.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement.

The processed data will only be stored for as long as necessary for the intended purpose or as required by law. In the event of successful placement, the data will be stored for 10 years. If the mediation was not successful, the data will be deleted after the first quarter of the following year.

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes.  The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

12) Mathematics Intensive Course Form

On our website you will find a form which you can use to register for the Mathematics Intensive Course. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• last Name
• first Name
• date and place of birth 
• citizenship street
• zip Code
• place
• country 
• phone number/mobile number
• email address

The purpose of processing personal data is to process the registration for the course, to be able to contact the inquirer to answer the request and to subsequently carry out the course offer.
The legal basis for the processing of personal data described here is Art. 6 Para. 1 lit. b) GDPR.

The processed data will only be stored as long as it is necessary for the intended purpose or as is required by law. A statutory retention period of 10 years exists for the contract data after the end of the contract.
You are not obliged to provide the personal data, but the provision of the personal data is necessary for the registration for the course and thus for the conclusion of the contract. Failure to do so would result in the contract not being concluded.

13) Social Networks

Facebook

We maintain a presence on the social network “Facebook” at www.facebook.com/Munich.Business.School.

As we are jointly responsible with Facebook for the processing of your data on our Facebook presence, we have concluded an agreement with Facebook, the contents of which you can view here: https://www.facebook.com/legal/terms/page_controller_addendum

As a data subject, you are entitled to the rights listed under “Data Subject Rights” in this privacy policy. You may exercise these rights at your discretion either vis-à-vis us (see section 2 above) or directly vis-à-vis Facebook at https://www.facebook.com/help/contact/540977946302970.
If you assert your rights vis-à-vis us, we will forward your request to Facebook in accordance with our agreement with Facebook.

Instagram

We maintain a presence at www.instagram.com/munich.business.school/ on the platform “Instagram.com”, which is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The Instagram privacy policy can be found here:
https://help.instagram.com/519522125107875/

Accessing and any interaction with our Instagram presence results in the processing of personal data, regardless of whether you have an Instagram or Facebook account. If you are logged into your Facebook account while accessing our Instagram presence, Facebook, as the operator of Instagram and/or its affiliated companies, may link the information about your visit to our Instagram presence with your account information and may use this, among other things, to create profiles. If you do not wish such profiling to take place, please log out of your Facebook account before accessing our Instagram presence.

Facebook provides us with statistical data on the use of our Instagram presence via the “Instagram Insights” function. These data include, for example, gender, age range, location, page views, interactions, information on paid activities, reach, accounts reached, impressions, and impressions per day. It is important to note that we cannot draw conclusions about individual visitors to our Instagram presence from these data. Our use of the data generated by “Instagram Insights” is based on Art. 6(1)(f) GDPR, as our legitimate interest lies in making our Instagram presence more attractive and providing interest-based content.

As we are jointly responsible with Facebook for the processing of your data on our Instagram presence, we have concluded an agreement with Facebook, the contents of which you can view here:
https://www.facebook.com/legal/terms/page_controller_addendum.

As a data subject, you are entitled to the rights listed under “Data Subject Rights” in this privacy policy. You may exercise these rights at your discretion either vis-à-vis us (see “Data Subject Rights”) or directly vis-à-vis Facebook at
https://help.instagram.com/contact/186020218683230.
If you assert your rights vis-à-vis us, we will forward your request to Facebook in accordance with our agreement with Facebook.

LinkedIn

We maintain a presence at https://www.linkedin.com/school/munich-business-school/ on the social network LinkedIn. This platform is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Information on which personal data are processed by LinkedIn and for what purposes when visiting our presence can be found at:
https://de.linkedin.com/legal/privacy-policy

Accessing and any interaction with our LinkedIn presence results in the processing of personal data, regardless of whether you have a LinkedIn account or not. If you are logged into your LinkedIn account while accessing our LinkedIn presence, LinkedIn, as the operator, may link the information about your visit to our LinkedIn presence with your account information and may use this, among other things, to create profiles. If you do not wish such profiling to take place, please log out of your LinkedIn account before accessing our LinkedIn presence.

TikTok

We maintain a presence at www.tiktok.com/@munich.business.school on the social network TikTok in order to draw attention to our products/services and to interact with you as a visitor and user of these products/services.

The entities jointly responsible for operating TikTok in the European Economic Area (“EEA”) are TikTok Technology Limited (“TikTok Ireland”), 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited (“TikTok UK”), WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom. Information on which personal data are processed by TikTok and for what purposes when visiting our presence can be found at: https://www.tiktok.com/legal/privacy-policy-eea?lang=de

If you have a TikTok user account, you can subscribe to our page. In this case, we process the personal data contained in your profile name and profile picture for as long as you are subscribed to our page. We process the same data if you mark one of our posts with a “like”, comment on it, link it by using hashtags, or share it, even if you are no longer subscribed to our page. Furthermore, we process your personal data from your profile if you send us a message via the contact function. In doing so, we also process the data that you voluntarily provide to us in your messages. The legal basis for this processing by us in the aforementioned cases is our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR.

You are not obliged to provide us with your personal data. However, providing your personal data is associated with the full use of the respective functions of the TikTok service and cannot be achieved without such provision. In addition, TikTok provides us with aggregated statistical data on all visitors to our pages, regardless of whether they are members of TikTok or not. The legal basis for this processing by us in the aforementioned cases is our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR.

14) Form for Registration of a Business Project

The "Business Project" is designed to give students the opportunity to implement a concrete business project in cooperation with a company. To register a business project, we use the form "Register your company's business project".

The person responsible for the personal data processed as a result of the use of the form is Munich Business School (see section "2) Responsible person"). If you contact us via this form, the data provided in the form will be processed exclusively by the location indicated.

This includes the following data:

• Company name
• Department
• Name of contact person
• Contact details
• Location address
• The language in which the business project is to be implemented
• The project description

The purpose of processing personal data is to carry out business projects and to be able to contact the contact person for coordination purposes.

The legal basis for the processing of the personal data provided by you in the context of this action is the implementation of the student projects with companies according to art. 6 paragraph 1 letter b) DSGVO, as well as our legitimate interest according to art. 6 paragraph 1 letter f) DSGVO. As a further legal basis we use the consent according to art. 6 para. 1 lit. a) DSGVO of the contact persons to provide her with the necessary offers.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH, which provides the CRM and works for us within the scope of order processing, and the server host, which works for us within the scope of an order data agreement.

The processed data is only stored for as long as necessary for the intended purpose or as required by law. 

If you have given us your consent for advertising measures, including analysis, we will also process the data for these purposes.  The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

15) Making Contact

You have the choice to contact us by mail, phone, fax, or email.

If you contact us by mail we may process in particular your address details (e.g. name, first name, street, place of residence, zip code), the date and time of reception of your mail as well as information gathered from the content of your letter.

If you contact us by phone, we can process in particular your phone number as well as information requested during the conversation such as your name, your email address, the time of your call and details of your query.

If you contact us by fax, we can process in particular the fax number and/or the source identifier as well as other details contained in your fax.

If you contact us by email, we will process in particular your email address, the time of emailing as well as data contained in the email (including attachments if any).

The purpose of processing the above data is to deal with the contact inquiry and to enable us to contact the inquirer in order to answer his or her queries.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries.

The personal data will be deleted as soon as it is no longer required for the intended purpose for which it was collected.

16) WhatsApp / Superchat

We use Superchat to communicate with prospective customers via WhatsApp. Superchat uses the WhatsApp Business API provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”). Personal data such as your phone number and message content are processed when you contact us via WhatsApp. Communication is initiated exclusively by you. The legal basis for processing is Art. 6(1)(b) GDPR (handling your request) and, where applicable, Art. 6(1)(a) GDPR (consent).

Please note that Meta processes personal data as an independent data controller. Further information can be found in Meta’s WhatsApp privacy policy. The use of WhatsApp is voluntary; you may contact us via alternative channels (e.g. email or phone) at any time.

17) External Links

We would like to point out that our website contains further links to external third-party websites, whereby we have no influence on the processing of data on these third-party websites.

18) Data processing during your stay in our buildings

A) Logging of IT usage

If you connect to our network or the Internet on our premises via access points provided by us, we log the data generated during use (in particular IP address, URL accessed and time of access, browser data) in so-called log files. This logging serves to ensure the security of our systems and to investigate violations of our terms of use or criminal offenses. This data is not evaluated for marketing purposes. The legal basis for this processing is Art. 6 (1) (f) GDPR, whereby our legitimate interests correspond to the above-mentioned purposes. The log files are typically deleted or made unrecognizable after 6 months. We transfer this data to our internal IT administration. The data is not transferred to recipients outside the EU.

B) Video surveillance

Whenever video surveillance is used in our buildings, we indicate this with signs. Video surveillance serves the purpose of ensuring our domiciliary rights, preventing vandalism, protecting our property, and prosecuting criminal offenses. The legal basis for this processing is Art. 6 (1) (f) GDPR, whereby our legitimate interests correspond to the above-mentioned purposes. The video recordings are stored for 72 hours and then deleted, unless further storage is necessary for the preservation of evidence. In case of suspicion, the data collected during video surveillance can be viewed and secured locally by authorized MBS employees. No data is transferred to third parties or recipients outside the EU.

C) Logging the use of our access cards

The locking system in our buildings logs which access cards were used to open and close which locks. The ID of the access cards and the time of opening and closing are stored locally on the respective lock. This is done to investigate criminal offenses or violations of our house rules. The legal basis for this processing is Art. 6 (1) (f) GDPR, whereby our legitimate interests correspond to the above-mentioned purposes. In case of suspicion, this log data can be read out from the respective locks by the campus manager or IT administration. No data is transferred to third parties or recipients outside the EU.

19) Rights of the Data Subject

As a general rule, you have the following rights:

• Right of access (GDPR art. 15)
• Right to rectification (GDPR art. 16)
• Right to object (GDPR art. 21)
• Right of withdrawal for consent (Art. 7(3) GDPR)
• Right to erasure (GDPR art. 17)
• Right to restriction of processing (GDPR art. 18f.)
• Right to data portability (GDPR art. 20)

Please send any inquiries concerning the above to datenschutz(at)eso.de. Please note that when we receive such inquiries, we have to make sure that they have actually been sent by the person concerned.

Without prejudice to other legal redress in terms of administrative law or judicial remedies, you have the right to file a complaint with a supervisory authority for data protection.

Our website does not include any automatized decision-making.