Privacy policy

We only process personal data of our users to the extent necessary to provide a functional website and our content and services. The processing of personal data of our users is regularly only carried out with the consent of the users. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require processing and there is no legal basis for processing under Art. 6 para. 1 lit. f GDPR, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:

• Information about the browser type and version used
• The operating system of the user
• The IP address of the user
• Date and time of access
• Websites from which the user's system accesses our website
• Websites accessed by the user's system via our website

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

The legal basis for the temporary storage of data and log files is Article 6(1)(f) GDPR.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session.

Storage in log files is carried out to ensure the security of our information technology systems and to ensure the functionality of the website. In addition, the data is used to optimise the website. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f GDPR.

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.

In the case of data storage in log files, this is the case after 14 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the user are deleted or anonymised so that it is no longer possible to identify the client accessing the site.

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no right to object on the part of the user.

Our website contains online forms that can be used to contact us electronically and to register. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.
Your consent is obtained during the sending process for the processing of the data.

Alternatively, you can contact us or register using the email addresses provided. In this case, the personal data transmitted with the email will be stored.

In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation or registration.

The legal basis for data processing is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

The legal basis for processing data transmitted in the course of sending an email is Article 6(1)(f) GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

The processing of personal data from the input mask serves us solely for the purpose of processing the contact request. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in the processing of the data.
The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data from the input mask of the contact form and that sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

The user has the option of revoking their consent to the processing of their personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of establishing contact will be deleted in this case.

Osnabrück University of Applied Sciences' social media presence is an integral part of its central communication strategy. Its activity on Instagram, Facebook, YouTube, LinkedIn and TikTok serves to effectively address various target groups of the HSOS. The channels are used by different user groups, who are reached with targeted information through an active presence. In this respect, each social media channel pursues its own content strategy, which differs in terms of communication goals, target groups, topic planning and evaluation. Overall, it can be summarised that the presence serves to increase visibility and strengthen the positive image in the public eye, especially among potential students. Social networks have proven themselves in increasing reach in a short period of time and among previously unknown target groups. In addition, they promote direct interaction and communication with interested parties.

In recent years, social media activity has established itself as an indispensable communication channel, particularly in the area of student recruitment. Instagram and TikTok can be used as effective marketing tools throughout the entire study lifecycle by publishing a wide variety of content formats. Links to the website can be visibly incorporated as alternative, but also forwarding, communication channels. The cross-media use of various central channels can be ideally combined with social media activity. In addition, important short-term news can also be communicated to students.

In connection with the use of social media, associated messenger services are used to easily get in touch with users and, in addition to providing information, to enable communication.

In accordance with Article 15 ff. of the European General Data Protection Regulation (GDPR), we inform users of our social media channels about the processing of their personal data by the respective platform operators.

The use of social media channels and the associated processing of personal data is based on the provisions of Article 6(1)(e) of the General Data Protection Regulation (GDPR) and serves to perform necessary tasks in the public interest (public relations work of Osnabrück University of Applied Sciences).

Purpose of processing: Osnabrück University of Applied Sciences' social media presence is an integral part of its central communication strategy and thus its public relations work. In particular, it serves to increase the reach of various interest groups, which differ depending on the channel. Further information can be found in the usage concept.

Categories of personal data that are processed: User names (e.g. name, address), contact details (e.g. e-mail address, telephone number, date of birth), content data (e.g. text information, posts, photos, videos), usage and interaction data (e.g. websites visited, interests, access times), meta and communication data (e.g. device information, IP address and, if applicable, location data)

Recipients of personal data:

Facebook
Recipient: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Data protection: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0Opt- and https://www.facebook.com/legal/EU_data_transfer_addendum/update
Opt-out link: https://www.facebook.com/policies/cookies/

Instagram
Recipient: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Data protection: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect and https://www.facebook.com/legal/EU_data_transfer_addendum/update
Opt-out link: https://www.facebook.com/help/631125599118423

LinkedIn
Recipient: LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA
Data protection: https://www.linkedin.com/legal/privacy-policy
Opt-out link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

TikTok
Recipient: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland
Data protection: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE
Opt-out link: https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=de-DE
Additional information on the use of data by TikTok can be found in this explanatory video:
Information on TikTok | The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Usage concept including assessment of the consequences of use

X (formerly Twitter)
Recipient: X Internet Unlimited Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 Ireland
Data protection: https://x.com/de/privacy
Opt-out link: https://help.x.com/de/rules-and-policies/x-cookies#privacy-options

YouTube
Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: https://policies.google.com/privacy?hl=de&gl=de
Opt-out link: https://tools.google.com/dlpage/gaoptout?hl=de
Storage period: This can be found in the respective data protection guidelines of the platform operators.
Right of withdrawal: This can be found in the respective data protection guidelines of the platform operators.

Additional information:

Users are informed that Osnabrück University of Applied Sciences has no further influence on the processing of personal data on these platforms. Only the respective operator of the platform has full knowledge of the content of the transmitted data and its use.

Please note that the security of individual services may depend on the user's account settings, which are managed under their own responsibility. The platforms themselves offer the option of restricting the processing of your own user data (see opt-out links).

Depending on where the social network is operated, user data may be processed outside the European Union or outside the European Economic Area. This may result in risks for users, for example by making it more difficult to enforce their rights.

For information requests and the assertion of rights, we would like to point out that these should best be asserted directly with the operators of the social media platforms, as only they have access to user data and can act accordingly. If necessary, we can support you in exercising your rights by making an identical request, provided you ask us to do so. The consequences of data protection violations must be clarified with the platform operator on a case-by-case basis.

Alternative communication channels:

The university's social media channels are a supplementary platform for targeting potential prospective students and students. They serve as an early touchpoint for positioning ourselves towards the preferred target group and providing information about the courses offered at HSOS.

In addition, in-depth information is available on the website www.hs-osnabrueck.de or from the Student Secretariat.

On some pages, we embed videos from the YouTube platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Privacy policy: https://policies.google.com/privacy
Opt-out: https://adssettings.google.com/authenticated

The search field on the Osnabrück University of Applied Sciences website is provided by Google Inc. (‘Google’) as Google Custom Search Engine. By using the search field, you acknowledge and agree that Google's privacy policy (available at https://policies.google.com/privacy) applies to your use of the search field. You further agree that by using the search field, you are committing to Google to use your personal data in accordance with Google's privacy policy.

If you do not wish to give this consent, please refrain from using the search function on this website. Data is only transmitted when the search form is submitted.

The site map on the Osnabrück University of Applied Sciences website (map field) is provided by Google Inc. (‘Google’) as Google Maps. By using (clicking on) the map field, you acknowledge and agree that Google's privacy policy (available at https://policies.google.com/privacy) applies to your use of the map field. You also agree that by using the map field, you are committing to Google to use your personal data in accordance with Google's privacy policy.

If you do not wish to give this consent, please refrain from using the map function on this website. Data is only transmitted when the map field is clicked.

We use the podcast hosting service Podigee from the provider Podigee UG, Am Walde 2, 56249 Herschbach, Germany. The podcasts are loaded by Podigee or transmitted via Podigee.

Use is based on our legitimate interests, i.e. interest in the secure and efficient provision, analysis and optimisation of our podcast offering in accordance with Art. 6 (1) lit. f. GDPR.

Podigee processes IP addresses and device information to enable podcast downloads/playback and to determine statistical data, such as the number of hits. This data is anonymised or pseudonymised before being stored in the Podigee database, unless it is required for the provision of the podcasts.

Further information and options for objection can be found in Podigee's privacy policy: https://www.podigee.com/de/about/privacy/.

You can request confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing is taking place, you can request the following information from the controller:

1. the purposes for which the personal data is being processed;
2. the categories of personal data being processed;
3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
4. the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
6. the existence of a right to lodge a complaint with a supervisory authority;
7. any available information on the origin of the data, if the personal data is not collected from the data subject;

You have the right to request information on whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

This right of access may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes.

You have the right to obtain from the controller the rectification and/or completion of your personal data if the processed personal data concerning you is inaccurate or incomplete. The controller shall carry out the rectification without delay.

Your right to rectification may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes.

Under the following conditions, you may request the restriction of the processing of personal data concerning you:

1. if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims; or
4. you have objected to processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Your right to restriction of processing may be limited to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes.

a) Obligation to erase

You may request that the controllers erase your personal data without undue delay, and the controller is obliged to erase this data without undue delay if one of the following reasons applies:

(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) You withdraw your consent on which the processing was based in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

(4) The personal data concerning you has been processed unlawfully.

(5) The erasure of personal data concerning you is necessary to comply with a legal obligation under Union or Member State law to which the controller is subject.

(6) The personal data concerning you has been collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

b) Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it in accordance with Art. 17 (1) GDPR, it shall take reasonable measures, including technical measures, taking into account the available technology and implementation costs, to inform data controllers who process the personal data that you, as the data subject, have requested them to delete all links to this personal data or copies or replications of this personal data.

c) Exceptions

The right to erasure does not apply if the processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing, or

(5) for the establishment, exercise or defense of legal claims.

If you have exercised your right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

1. the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
2. the processing is carried out using automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of automated procedures using technical specifications.

You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR.

Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes.

You have the right to revoke your declaration of consent under data protection law at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent prior to revocation.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision 

1. is necessary for the conclusion or performance of a contract between you and the controller,
2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

We use the open source software tool Matomo (formerly PIWIK) on our website to analyze the surfing behavior of our users. The software sets a cookie on the user's computer (see above for information on cookies). When individual pages of our website are accessed, the following data is stored:

(1) Two bytes of the IP address of the user's accessing system

(2) The accessed web page

(3) The website from which the user accessed the accessed web page (referrer)

(4) The subpages accessed from the accessed website

(5) The length of time spent on the website

(6) The frequency with which the website is accessed

The software runs exclusively on our website's servers. The user's personal data is only stored there. The data is not passed on to third parties.

The legal basis for the processing of the user's personal data is Art. 6 (1) lit. f GDPR.

The processing of users' personal data enables us to analyze the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. These purposes also constitute our legitimate interest in processing the data in accordance with Art. 6 (1) lit. f GDPR. The anonymization of the IP address takes sufficient account of the users' interest in the protection of their personal data.

The data will be deleted as soon as it is no longer required for our recording purposes.
In our case, this is after 6 months.

Cookies are stored on the user's computer and transmitted to our site by the user.

Therefore, as a user, you have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

We offer our users the option of opting out of the analysis process on our website. This sets another cookie on your system that signals to our system not to store the user's data. If the user deletes the corresponding cookie from their own system in the meantime, they must set the opt-out cookie again.

WhatsApp counseling is an additional counseling channel for prospective students and current students. Alternatively, you are welcome to make an appointment for a personal one-on-one counseling session or contact us by phone or email.

If you wish, you can remain completely anonymous: You do not have to give us your (real) name, and we will not ask you for it. We do not store phone numbers or chat histories; all data will be deleted after your request has been answered and will of course not be forwarded or reused.

Please note: WhatsApp counseling is only a limited data-protected space. We would like to point out that this service is subject to the terms of use and privacy policy of WhatsApp Inc., over which Osnabrück University of Applied Sciences has no influence. Therefore, please do not share any sensitive or personal data or confidential information with us. Always use the personal one-on-one counseling service or contact us by phone or email.

You can find the contact details for WhatsApp counseling in the Contact section on the degree program pages. Please note that we do not offer WhatsApp counseling for all degree programs.