Information on data protection

So that you keep the overview

This data protection notice informs you about how we handle your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The Studentenwerk Schleswig-Holstein Anstalt des öffentlichen Rechts (hereinafter referred to as "Studentenwerk Schleswig-Holstein", "we" or "us") is responsible for data processing.

Our data protection information consists of two parts. Part A provides you with general information on data protection at Studentenwerk Schleswig-Holstein and explains, among other things, what rights you have and where you can assert them. Part B is dedicated to the various groups of data subjects and explains in detail what data we collect and process about you. We address you in your role as:

• a. Visitors to our websites,
• b. Residence applicants who wish to live in our residences,
• c. People looking for and offering accommodation who would like to take part in the "Housing for Help" project,
• d. Relatives of those offering accommodation who would like to take part in the "Housing for Help" project,
• e. Participants in our events, workshops and courses,
• f. Clients of our psychological counselling services,
• g. Contact persons at service providers, suppliers and business partners with whom we interact in our daily business,
• h. Applicants who would like to join our team,
• i. Newsletter subscribers who we keep up to date on a regular basis, and
• j. social media visitors who are interested in us.

A. General information

1. our contact details

If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your enquiry to

Studentenwerk Schleswig-Holstein
Anstalt des öffentlichen Rechts
Westring 385
24118 Kiel
Phone: +49 431 8816-0
Email: geschaeftsstelle.ki@studentenwerk.sh

If you have any questions about data protection with us or wish to assert your rights, please send your enquiry to datenschutz@studentenwerk.sh.

2 On what basis do we process your data?

The data protection term "personal data" refers to all information relating to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR, the BDSG and the LDSG (SH). We only process data on the basis of legal authorisation. We only process personal data with your consent (Art. 6 para. 1 letter a GDPR), to fulfil a contract to which you are a party or at your request to carry out pre-contractual measures (Art. 6 para. 1 letter b GDPR), to fulfil a legal obligation (Art. 6 para. 1 letter c GDPR), to perform a task carried out in the public interest or in the exercise of official authority (Art. 6 para. 1 letter e GDPR in conjunction with Section 3 para. 1 LDSG (SH)). § Section 3 (1) LDSG (SH) in conjunction with. § Section 3 (1) StudWG (SH)), or if the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 (1) (f) GDPR).

If you apply for an open position with us, we will also process your personal data to decide on the establishment of an employment relationship (Art. 6 (1) (b) GDPR in conjunction with Section 15 (1) LDSG). § Section 15 (1) LDSG (SH) in conjunction with. §§ 85 ff. LBG (SH)).

3. your rights

As a data subject, you have the right to assert your data subject rights against us. You have the following rights under the data protection laws applicable to you:

• In accordance with Art. 15 GDPR and Section 34 BDSG and Section 9 LDSG (SH), you have the right to request information as to whether or not we process personal data relating to you and, if so, to what extent.
• You have the right to request that we rectify your data in accordance with Art. 16 GDPR.
• You have the right to demand that we erase your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
• You have the right to have the processing of your personal data restricted in accordance with Art. 18 GDPR.
• In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller.
• If you have given us separate consent to data processing, you can revoke this consent at any time in accordance with Art. 7 para. 3 GDPR. Such a revocation does not affect the legality of the processing that was carried out on the basis of the consent until the revocation.
• If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

In accordance with Art. 21 (1) GDPR and Section 11 LDSG (SH), you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we process the personal data transmitted for the purpose of implementing these rights by us and to be able to provide proof of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction with. Art. 15 to 22 GDPR and § 34 para. 2 BDSG.

4 Where do we process your data?

In principle, we process your data on European servers with the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. This applies to all transfers to countries in this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the requirements of Art. 49 GDPR is met.

If there is no adequacy decision and nothing else is specified below, we use the EU standard data protection clauses as suitable guarantees for the transfer of personal data from the scope of the GDPR to third countries. You have the option of obtaining or viewing a copy of these EU standard data protection clauses. Please contact us at the address given under Contact.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 para. 1 letter a GDPR.

5 To whom and why do we pass on your personal data?

In order to fulfil our tasks, we use various external companies to which we transfer personal data in some cases. If other specific recipients contain personal data for some groups of data subjects, we will inform you about this in Part B.

6 How long do we store your data?

Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting data for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof and with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

7 How do we use "cookies" and other tracking technologies?

We use cookies and similar technologies on our websites and in the provision of our services. We have summarised more information about how we use these technologies in our cookie banners. The banners can be accessed via the footer of the websites. There you will also find a list of other companies that place cookies on our websites, a list of cookies that we place and an explanation of how you can refuse certain types of cookies.

8. how can you contact our data protection officer?

You can reach our Data Protection Officer using the following contact details

Email: datenschutzbeauftragter@studentenwerk.sh
Herting Oberbeck Datenschutz GmbH
Hallerstraße 76, 20146 Hamburg
https://www.datenschutzkanzlei.de

B. Special section - How and why we process your data

With your express consent, we will forward your personal data to external bodies, e.g. to specialist staff at other counselling/treatment centres.

In absolutely exceptional cases, we are legally obliged to pass on personal data to public authorities contrary to our duty of confidentiality. This applies to cases in which we consider you to be an acute danger to yourself or others. The data processing is then based on Art. 9 para. 2 lit. g GDPR in conjunction with. § Section 34 StGB.

If we are unable to offer you employment, we will retain the application documents submitted by you for up to six months after any rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage.