This privacy policy describes the processing of personal data in the context of the ordering process.

The controller, i.e. the organisation responsible for data processing as defined in data protection legislation, especially the General Data Protection Regulation (GDPR), is the:

University of Music Würzburg
Hofstallstr. 6-8
97070 Würzburg
Phone: +49 (0)931-32187-0
Fax: +49 (0)931-32187-2800

The University of Music Würzburg is a corporation under public law and a state institution (Art. 4 para. 1 BayHIG). It is represented by the President of the University of Music Würzburg, Prof. Dr. Christoph Wünsch.

You can contact the data protection officer as follows:

Data Protection Officer of the University of Music Würzburg
Felix Eisenmenger
Hoftstallstr. 6-8
97070 Würzburg
E-Mail: datenschutz@hfm-wuerzburg.de

Personal data is processed for the purpose of organizing and processing orders, invoicing, payment processing, and dispatching the goods ordered.

Legal basis:
Processing is carried out on the basis of:

• article 6 (1) point b) of the GDPR (processing for the performance of a contract or in order to take steps prior to entering into a contract),
• article 6 (1) point c) of the GDPR in conjunction with budgetary and tax law retention obligations (e.g., German Commercial Code (HGB), German Fiscal Code (AO)), insofar as data is required for accounting and invoicing purposes.

The following personal data in particular may be processed as part of the ordering process:

• Address and contact details
• Order and billing details
• Payment information in connection with the order

Members of the university (teachers, employees, students)

Your data will only be transferred to those parties that need it to carry out the ordering and billing process. This includes in particular:

• internal organizational units (e.g., Ref. 1.2 Finance)
• external support for administrative activities (University Clothing Team)
• technical service providers for the form system used

We do not plan to transfer your personal data to a non-EU country.

Your data will only be stored for as long as is necessary to process your order.
Invoicing and accounting data are subject to statutory retention periods and are generally stored for 10 years.

Pursuant to articles 15 et seq. of the GDPR, you, the data subject, are entitled to the following rights concerning the processing of your data: 

• You can ask for information about whether data concerning you is being processed. If this is the case, you are entitled to information about which data is processed and other information relating to the processing (article 15 of the GDPR). Please note that this right to information can be restricted or excluded in certain cases (see in particular article 10 of the BayDSG).
• If the personal data concerning you is/has become inaccurate or incomplete, you can request that this data is rectified and/or completed (article 16 of the GDPR).
• If the legal requirements are met, you can request that your personal data be deleted (article 17 of the GDPR) or processing of your data be restricted (article 18 of the GDPR). The right to deletion pursuant to article 17 (1) and (2) of the GDPR does not apply in certain cases, however, such as if the processing of personal data is vital for the performance of a task that is in the public interest or is performed in the exercise of official authority (article 17 (3) point b) of the GDPR).
• If you have consented to data processing or there is a contract concerning data processing and data is processed automatically, you may be entitled to data portability (article 20 of the GDPR).
• You are entitled to file a complaint concerning the processing of your personal data with a supervisory authority as defined in article 51 of the GDPR. The pertinent supervisory authority for the Bavarian public service is the Bavarian Data Protection Commissioner, Wagmüllerstraße 18, 80538 München. 

You may object to the processing of your personal data at any time due to reasons based on your personal circumstances (pursuant to article 21 of the GDPR).
If the legal requirements are met, we will then not further process your personal data.

If you choose to exercise the rights stated above, the public office will check whether the legal requirements for doing so have been met.