Data protection policy

1. Name and address of the responsible controller

The responsible controller as defined in the EU General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states as well as other data protection-related provisions is:

University of Münster
represented by the Rector
Schlossplatz 2, 48149 Münster
Tel.: + 49 251 83-0
Email: mailbox@uni-muenster.de

2. Name and address of the Data Protection Officer

You can reach the Data Protection Officer of the University of Münster at:

Data Protection Office
Schlossplatz 2, 48149 Münster
Tel.: + 49 251 83-22446
Email: datenschutz@uni-muenster.de

3. General information on data processing

We collect and use the personal data of our users insofar as necessary for operating a functional website and delivering our content and services, and to the extent to which the law permits.

Legal basis for processing

Whenever we obtain consent to process personal data from a data subject, Art. 6 (1 a) GDPR serves as the legal basis for processing this personal data.

If the processing of personal data is required for fulfilling contractual obligations or executing pre-contractual measures, Art. 6 (1 b) GDPR serves as the legal basis for processing.

Whenever processing such data is necessary for compliance with a legal regulation, to which the University of Münster is subject, Art. 6 (1 c) GDPR serves as the legal basis.

In cases for which processing is necessary to protect the vital interests of the data subject or of another natural person, Art. 6 (1 d) GDPR serves as the legal basis.

If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, Art. 6 (1 e) and Art. 3 (1 b) GDPR in conjunction with § 3 (1) DSG NRW in connection with § 3 (1) HG NRW serve as the legal basis for processing this data.

Duration of storage of personal data

We reserve the right to retain the data subject’s personal data for as long as the purpose of such storage exists. If processing is permitted on the basis of the subject’s consent, his/her personal data is only stored until the data subject withdraws his/her consent, except in cases where processing is governed by a different legal basis.

Right to rectification and erasure of personal data

The data subject has the right to demand the rectification of inaccurate personal data concerning him or her from the controller without undue delay. The data subject also has the right to demand the erasure of personal data concerning him or her without undue delay as soon as the purpose of storage is no longer necessary, when data processing is performed on the basis of consent, when the data subject withdraws their consent and no other legal grounds exist for processing the data.

Personal data is erased if the data subject objects to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or if the personal data has been unlawfully processed, or if erasure of the personal data is legally required by an EU or member state law, to which the University of Münster is subject.

The right to erasure as put forth in the cases stated above does not apply, however, if it would prevent compliance with a legal obligation which requires processing by EU or member state law, to which the University of Münster is subject, or hinder the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, or if extended storage is necessary for the establishment, exercise or defence of legal claims.

Right to withdrawal

If permission to process personal data was granted by the consent of the data subject, he or she may withdraw their consent at any time. All processing of personal data performed prior to withdrawal remains lawful irrespective of the subject’s withdrawal.

Right to information

The data subject has the right to obtain confirmation from the University of Münster whether it is processing any personal data concerning them. If such is the case, the data subject has a right to information regarding the type of personal data and the purpose for which it is being processed. The data subject also has the right to obtain information on the duration of the planned storage of their data, or on the criteria for determining how long their data is to be stored.

Right to lodge a complaint

If the data subject believes that the processing of their personal data is in violation of the GDPR, they have the right to lodge a complaint with the supervisory authority, e.g. the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, tel.: +49 211 38424-0, email: poststelle@ldi.nrw.de.

4. Provision of the website and creation of log files

Scope of processing

For every access query to our website, our system automatically collects data and information from the querying computer system. The following data is collected in this process:

information on the browser type and version
the user's operating system
the user’s Internet service provider
the user’s IP address
the date and time of the query
websites from which the user’s system was directed to our website
websites which the user’s system accesses via our website

This data is compiled in log files and saved on our system and in centralised systems for purpose of analysis. No further personal data is stored together with the log file data.

Legal basis for processing

The legal basis for storing data and log files is provided in Art. 6 (1, sent. 1 e) and Art. 6 (3, sent. 1 b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The temporary storage of the IP address on our system is necessary for granting the user’s computer access to our website. For this purpose, the user’s IP address must remain stored for the duration of the session.

Data storage in log files is required to ensure the functionality of the website. Furthermore, the data enables us to optimise the website and guarantee the security of our IT systems. Data analysis for marketing-related purposes is not performed in this context.

Duration of storage of personal data

The data required for delivering the website content is erased at the conclusion of the respective session.

All data stored in log files is erased within seven days. Security-relevant data is forwarded to a centralised system for analysis to help identify and investigate security breaches. The duration of storage in such cases is provided in the data protection statement on the “Operation of a Central Log Server and SIEM System” (PDF) [de].

5. Use of cookies

Scope of processing

Parts of our website employ cookies. Cookies are text files saved on or by the web browser, installed on the user’s computer system. Whenever a user accesses a website, a cookie is often saved on the user’s operating system. The file contains a distinctive sequence of characters which enables the browser to correctly identify a website when it is visited again.

We use cookies to customise and continually improve the user friendliness of our website. Some elements on our website make it necessary to identify a querying browser after a page change. The following data is stored in and transmitted via cookies:

login information
session settings

The University of Münster only uses cookies that are technically necessary. Moreover, it does not use third-party cookies

Legal basis for processing

The legal basis for storing technically necessary cookies on the data subject’s device and accessing the information storied therein is provided in § 25 (2, 2) TDDDG.

Purpose of processing

The purpose of using technically necessary cookies is to make it easier for the data subject to use the website. Some functions on our website cannot be offered without cookies. Such functions require the browser to identify the user after a page change.

Cookies are required for the following applications:

single sign-on, storage of the Shibboleth login, authentification of personal ID
assigning login sessions to specific servers (“sticky sessions”)

The data collected via technically necessary cookies is not used for creating user profiles.

Duration of storage of personal data

Cookies are saved on the user’s computer which transfers them to our server. Consequently, as the user, you have complete control over how cookies are used by your system. By changing the settings in your web browser, you can deactivate or restrict the transmission of cookies to external websites. You can also delete all saved cookies on your system at any time. Restrictions on cookie usage can be managed automatically by your browser. If you choose to deactivate cookies for our website, it may prevent you from taking full advantage of all the features offered on the website.

6. Matomo web analysis (formerly PIWIK)

Scope of processing

Our website uses the open-source software tool Matomo (formerly PIWIK) for analysing and statistically evaluating page views. The following data is processed when a user accesses our website:

two bytes of the user’s IP address
the accessed webpage
the website from which the user is directed to the accessed page (referrer)
the sub-pages to which the user is directed from the accessed page
the length of time the user remains on the page
the frequency the page is accessed

IP addresses are stored in abbreviated form of only several bytes in length and provide no further reference to the user’s computer.

Matomo runs exclusively on the servers of our website. Any storage of the user’s personal data only takes place there. Data cannot be compiled or aggregated across multiple devices, and no data is shared with third parties.

Activating the “Do not track” function in your browser prevents Matomo from collecting any session data.

If you choose not to activate the “Do not track” function and consent to data processing by Matomo, you can withdraw your consent on cookie storage and usage at any time with a mouse click below. In such cases, Matomo places an “opt-out cookie” onto your browser which prevents it from collecting any data during your visit to our website. Please note: If you choose to delete the cookies in your browser, the opt-out cookie will also be erased. This means that you will have to reactivate the opt-out cookie during your next visit if you wish.

Legal basis for processing

The legal basis for processing the user’s personal data is provided in Art. 6 (1, sentence 1, e) and Art. 6 (3, sentence 1, b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The processing of the data listed above allows us to analyse the usage of our online services. The analysis of the collected data permits us to generate information about how certain components of our website are used. This helps us to improve our website and enhance user friendliness on a continual basis. The anonymisation of IP addresses serves to protect the user’s personal data. This anonymised data is only processed for statistical purposes and cannot be used to identify individual users.

Duration of storage of personal data

All personal data is deleted as soon as it is no longer required for purposes of documenting the user’s visit.

7. Newsletter

Scope of processing

Our Internet users have the possibility of subscribing to a free University newsletter. When registering for the newsletter, the user is asked to provide information via an input mask which is then transferred to our server. This includes the following information:

user’s email address
user’s name
password
desired language
desired form of delivery
number of recognised deliverability issues

The following information is also collected at registration:

IP address of the querying computer
date and time of registration

As part of the registration process, the user is asked to consent to have their data processed and is informed of this data protection policy.

No personal data processed in connection with newsletter delivery is shared with third parties. This data is exclusively used for delivering the newsletter.

Legal basis for processing

The legal basis for processing the user’s personal data after registering and granting consent is provided in accordance with Art. 6 (1 a) GDPR.

Purpose of processing

The user’s email address is collected for the purpose of delivering the newsletter. Other personal data collected during registration is processed in order to prevent the improper use of our services or the provided email address.

Duration of storage of personal data

Your email address is stored for as long as your newsletter subscription is active. Other personal data collected during the registration process is normally erased within seven days.

The newsletter subscription can be cancelled by the user at any time. For this purpose, a cancellation link is embedded in every newsletter. When cancelling the subscription, the user can also withdraw their consent to having their personal data, which was collected during the registration process, stored on our server.

8. Email contact

Scope of processing

On our website, users can personally contact the University via email by using the email address provided for such purposes. In this case, the email together with the user’s personal data is stored on our server.

The user’s personal data is not shared with third parties in this context.

Legal basis for processing

The legal basis for processing the user’s personal data, acquired as a result of the user sending an email for the purpose of processing their request within the scope of our responsibilities, is provided in accordance with Art. 6 (1, sentence 1, e) and Art. 6 (3, sentence 1, b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW. Should you send us further personal information via email, this is done voluntarily with your express consent in accordance with Art. 6 (1, sentence 1, a) and Art. 9 (2, a) GDPR, insofar as special categories of personal data apply.

Purpose of processing

The user’s personal data is processed only for the purpose of establishing and maintaining contact with the user via email.

Duration of storage of personal data

All personal data sent to us via email is deleted as soon as the respective dialogue with the user is concluded and no other reason for further storage exists. The dialogue is deemed concluded when circumstances indicate that the issue in question has been clarified to the satisfaction of all parties.

9. Contact form

Scope of processing

On our website, you have the possibility to send us a message digitally via our contact form. In this case, irrespective of the reason for submitting the query, we process any personal data you provide along with the content of your message.

Legal basis for processing

The legal basis for processing any personal data contained in the contact form is the user’s consent as provided in accordance with Art. 6 (1, a) and Art. 9 (2, a) GDPR in so far as special categories of personal data apply. If the processing of personal data provided in the contact form is necessary for addressing the matter within the scope of our responsibilities, the legal basis is provided by Art. 6 (1, e) and Art. 6 (3) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The user’s personal data is processed only for the purpose of addressing the matter indicated in the corresponding contact form.

Duration of storage of personal data

All personal data sent to us via the contact form is deleted as soon as the respective dialogue with the user is concluded and no other reason for further storage exists. The dialogue is deemed concluded when circumstances indicate that the issue in question has been clarified to the satisfaction of all parties.

10. Campus map/Google Maps

Scope of processing

Our website uses Google Maps API, provided by Google Inc. (“Google”) to provide users with online interactive maps, site information and route maps. To protect our users’ personal information, the app content can only be loaded by clicking on the button “View campus map” (double-click method). Only then is user data transferred to Google.

By using Google Maps, information about your usage of this website (along with your IP address) can be transmitted to and stored on a Google server in the USA. Google’s terms of service and privacy policy are embedded as links in the respective maps.

Google forwards collected data to third parties insofar as is required by law or if third parties are commissioned to process this data on behalf of Google. It is technically possible for Google to identify individual users on the basis of the data it receives. It is likewise possible to process personal data and the personal profiles of users on Google’s website for other purposes over which we have no control.

Legal basis for processing

The legal basis for processing the user’s personal data is provided in Art. 6 (1 a) GDPR.

Purpose of processing

The use of Google Maps enables users to more easily locate specific places indicated on our website.

11. Search/Google Programmable Search Engine (CSE)

Scope of processing

We use the Google Programmable Search Engine (CSE) application programming interface (API) on the website of the University of Münster. To better protect our users’ personal data, after entering content into the search bar, the user must click on a confirmation button before any data is transferred to Google.

By using the Google CSE, information about your usage of our website (including your IP address and search query) may be transferred and stored on a Google server in the USA. Google’s terms of service and privacy policy are embedded as links in the search mask.

If a user is signed into their Google account, Google could transfer personal data linked to their account while processing the search query.

Legal basis for processing

The legal basis for processing the user’s personal data is provided in Art. 6 (1, sentence 1, a) GDPR.

Purpose of processing

The use of Google CSE enables users to more easily search for information on our website.

12. Use of social media content

Scope of processing

We incorporate the content of various social media providers into our website. This allows our users to directly view social media content while visiting our website. To protect our users’ personal information, social media content can only be loaded by clicking on the corresponding button (double-click method). Only then is data exchanged with the respective social media provider.

Social media providers forward collected data to third parties insofar as is required by law or if third parties are commissioned to process this data on their behalf. It is technically possible for social media providers to identify individual users on the basis of the data they receive. It is likewise possible to process personal data and the personal profiles of social media users for other purposes over which we have no control.

Legal basis for processing

The legal basis for processing the user’s personal data is provided in Art. 6 (1 a) GDPR.

Purpose of processing

Integrated social media content serves to inform the public about the activities of the University of Münster.

13. Podcasts

Scope of processing

We use the podcast hosting service Podigee provided by Podigee GmbH, Revaler Straße 28, 10245 Berlin, Germany. The podcasts are loaded or transmitted via Podigee.

The use is based on our legitimate interests, i.e. interest in secure and efficient provision, analysis and optimisation of our podcast offer according to Art. 6 (1 f) GDPR.

Podigee processes IP addresses and device information to enable podcast downloads/playbacks and to generate statistical data, such as page loads. This data is anonymised or pseudonymised before storage in the Podigee database, provided it is not required for the provision of the podcasts.

For more information and possibilities for revoking consent, see Podigee’s privacy policy: https://www.podigee.com/about/privacy/

Podigee podcast player

The Podigee player is GDPR-compliant. All integrated social media buttons (e.g. “Share”) work exclusively via static links. This means:

No cookies are set.
No communication with external services takes place, provided there is no active interaction with the listeners.

If you should access the podcast of the University of Münster via an external provider, we and especially the external providers may process any personal information collected in connection with using the service. For more information, please read the data protection policies of the respective providers:

Spotify (Spotify AB, Regeringsgatan 19, 11153 Stockholm, Sweden): https://www.spotify.com/de/legal/privacy-policy/plain/ and https://www.spotify.com/de/legal/cookies-policy/plain/ as well as https://www.spotify.com/de/privacy/
Deezer (Deezer Limited Company, 12 rue d'Athènes 75009 Paris, France): https://www.deezer.com/legal/personal-datas
iTunes, Apple Podcast (Apple Inc. One Apple Park Way, Cupertino, California, USA, 95014): https://www.apple.com/legal/privacy/de-ww/

Legal basis for processing

The legal basis for processing personal data is provided in accordance with Art. 6 (1, sentence 1, e) and Art. 6 (3, sentence 1, b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The user’s personal data is processed for the purpose of providing, analysing and optimising our podcast services in a secure and efficient manner.

14. Job offers

Scope of processing

When viewing the current job openings on our website, the service provider BITE GmbH (the “processor” as defined in accordance with Art. 28 GDPR) contracted by the University of Münster, processes the user’s IP address. Additional personal data is transferred when users apply online via the application portal. You can find detailed information in data protection statement provided on the application portal.

Legal basis for processing

The legal basis for processing personal data is provided in accordance with Art. 6 (1, sentence 1, e) and Art. 6 (3, sentence 1, b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The IP address is temporarily processed to facilitate delivery of the job postings from our website to the user’s computer. The user’s IP address is required for processing for the duration of the session.

Duration of storage of personal data

The user’s personal data is erased as soon as their corresponding session is finished.

15. Event management with Indico

Scope of processing

Employees of the University of Münster can use the service provider Indico to plan and manage upcoming events. When Indico is used for event management, the following employee data is transferred to us:

first and last name
email address (business)
telephone number (business)
IP address of the querying computer (with no reference to individual account, erased after seven days)
date and time of last login

The following optional information is only processed if the user added it to their profile themselves:

title (optional)
membership (optional)
address (optional)
other email addresses (optional)
profile picture (optional)
preferences (language, time zone, view of events, name format, PDF preview, iCal alarm, Markdown editor for minutes (all optional)
favourites (users, categories, events) (optional)
accounts (local, external) (optional)
applications (optional)
API token (optional)
HTTP API (optional)

For all personal data processed by Indico in connection to registering for University events, the event organiser is responsible for providing a data protection statement for their respective event (see Indico’s General Conditions and Terms of Usage).

Legal basis for processing

The legal basis for processing personal data is provided in accordance with Art. 6 (1, sentence 1, e) and Art. 6 (3, sentence 1, b) GDPR in conjunction with § 3 (1) DSG NRW and § 3 (1) HG NRW.

Purpose of processing

The processing of the data specified above serves to provide event management services. The optional data serves to facilitate collaboration and improve reachability.

Duration of storage of personal data

The user’s personal data is erased as soon as it is no longer required for the aforementioned purposes.

Please note

This data protection policy was last updated in November 2024. As our Internet services develop and improve, the terms of our data protection policies are also subject to change.