Data protection is a major concern for the University of Music Würzburg (HfM Würzburg) and its legal obligation. In order to adequately protect the security of personal data during transmission, the HfM Würzburg uses appropriate encryption procedures and secure technical systems based on the current state of technology.

This privacy policy describes the processing of personal data in the areas of study, counseling, career, and continuing education.

The controller, i.e. the organisation responsible for data processing as defined in data protection legislation, especially the General Data Protection Regulation (GDPR), is the:

University of Music Würzburg
Hofstallstr. 6-8
97070 Würzburg
Phone: +49 (0)931-32187-0
Fax: +49 (0)931-32187-2800

The University of Music Würzburg is a corporation under public law and a state institution (Art. 4 para. 1 BayHIG). It is represented by the President of the University of Music Würzburg, Prof. Dr. Christoph Wünsch.

You can contact the data protection officer as follows:

Data Protection Officer of the University of Music Würzburg
Felix Eisenmenger
Hoftstallstr. 6-8
97070 Würzburg
E-Mail: datenschutz@hfm-wuerzburg.de

The university processes personal data in order to perform its statutory duties in the areas of study, counseling, careers, and continuing education.
This includes, in particular:

• Organizing and conducting application, admission, and enrollment procedures
• Administering student status, including re-registration, leave of absence, and de-registration
• Organizing and conducting courses and study-related administrative processes
• Study, career, and professional counseling
• Organizing continuing education, mentoring, and support programs
• Maintaining contact with graduates (alumni)
• Conducting internal university elections and committee procedures

Legal basis

Processing is carried out on the basis of the following legal grounds:

• Article 6 (1) (e) of the GDPR (performance of a task carried out in the public interest or in the exercise of official authority)
• Article 6 (1) (c) of the GDPR (fulfillment of legal obligations)
• Article 6 (1) (a) of the GDPR (consent, where necessary for voluntary offers)

The specific legal bases are, in particular:

• Bavarian Higher Education Innovation Act (Bayerisches Hochschulinnovationsgesetz - BayHIG)
• University statutes and study and examination regulations
• Fee and contribution regulations

Depending on the purpose of the processing, the following categories of data in particular are processed:

• Identification and master data
• Contact details
• Application and admission data
• Study, examination, and status data
• Event and participation data
• Consulting and communication data
• Billing and payment data

Special categories of personal data within the meaning article 9 of the GDPR are only processed if this is required by law or necessary in individual cases.

• Prospective students and applicants
• Students
• Guest and auditing students
• Participants in counseling, support, and continuing education programs
• Graduates (alumni)
• Participants in university-related events

Personal data will only be disclosed to the extent necessary, in particular to:

• responsible organizational units within the university
• IT service providers within the scope of order processing in accordance with article 28 of the GDPR
• public authorities, provided that there is a legal obligation to do so

We do not plan to transfer your personal data to a non-EU country.

Personal data will only be stored for as long as is necessary to fulfill the aforementioned purposes.
The following are particularly relevant:

• Retention periods under university and examination law
• Budgetary and tax law requirements
• Archiving regulations

Once the purpose for processing the data no longer applies, the data will be deleted or anonymized.

The provision of personal data is necessary in order for the university to perform its statutory duties.
Without the provision of the necessary data, participation in the aforementioned procedures and offers is not possible.

Pursuant to articles 15 et seq. of the GDPR, you, the data subject, are entitled to the following rights concerning the processing of your data: 

• You can ask for information about whether data concerning you is being processed. If this is the case, you are entitled to information about which data is processed and other information relating to the processing (article 15 of the GDPR). Please note that this right to information can be restricted or excluded in certain cases (see in particular article 10 of the BayDSG).
• If the personal data concerning you is/has become inaccurate or incomplete, you can request that this data is rectified and/or completed (article 16 of the GDPR).
• If the legal requirements are met, you can request that your personal data be deleted (article 17 of the GDPR) or processing of your data be restricted (article 18 of the GDPR). The right to deletion pursuant to article 17 (1) and (2) of the GDPR does not apply in certain cases, however, such as if the processing of personal data is vital for the performance of a task that is in the public interest or is performed in the exercise of official authority (article 17 (3) point b) of the GDPR).
• If you have consented to data processing or there is a contract concerning data processing and data is processed automatically, you may be entitled to data portability (article 20 of the GDPR).
• You are entitled to file a complaint concerning the processing of your personal data with a supervisory authority as defined in article 51 of the GDPR. The pertinent supervisory authority for the Bavarian public service is the Bavarian Data Protection Commissioner, Wagmüllerstraße 18, 80538 München. 

You may object to the processing of your personal data at any time due to reasons based on your personal circumstances (pursuant to article 21 of the GDPR).
If the legal requirements are met, we will then not further process your personal data.

If you choose to exercise the rights stated above, the public office will check whether the legal requirements for doing so have been met.

The university reserves the right to amend this privacy policy if this becomes necessary due to changes in legal requirements, organizational adjustments, or technical developments.