Privacy

General Information

This privacy notice provides you with basic information about how the Hamburg University of Music and Drama (HfMT Hamburg) processes your personal data. For certain services and areas—such as data processing related to your studies, the use of our library, or specific web services—additional, specific privacy notices apply. You can find these directly on the respective service pages or as separate documents on our website.

Contact Information for the Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of EU member states, as well as other data protection regulations, is:

Hamburg University of Music and Drama
Harvestehuder Weg 12
20148 Hamburg
Email: privacy@hfmt-hamburg.de
Tel.: +49 40 209494-100 /-200

Legal Form and Legal Representation

The Hamburg University of Music and Drama is a public-law corporation. It is legally represented by Prof. Dr. Jan Philipp Sprick, President of the Hamburg University of Music and Drama, Harvestehuder Weg 12, D-20148 Hamburg.

Contact Information for the Data Protection Officers at HfMT Hamburg

datenschutz nord GmbH
Konsul-Smidt-Str. 88
28217 Bremen
Web: https://www.dsn-group.de/
Email: office@datenschutz-nord.de

Website Hosting and Log File Generation

Data and information are collected every time this website is accessed or used. This data and information are stored in the server’s log files. The following may be collected:

• IP address
• Information about the browser type and version used
• Date and time of access
• The user’s Internet service provider
• The user’s operating system
• Websites from which the user’s system accessed our website
• Page accessed/name of the file accessed
• Amount of data transferred
• Notification of whether access/retrieval was successful

Legal basis and purpose of data storage and processing

To the extent that we temporarily store, publish, or make available information to fulfill our legally mandated duties as a university, the processing is based on Article 6(1)(e) of the GDPR in conjunction with Sections 3 and 4(5) of the Hamburg Higher Education Act (HmbHG).

The system’s temporary storage of the IP address is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

Storage in log files serves to ensure the functionality of the website, optimize the content provided, and guarantee the security of our information technology systems. Any further analysis for statistical purposes and to improve our services is conducted using the Matomo analytics tool. For more information, see the “Web Analytics/Consent” section.

No other processing or disclosure to third parties takes place.
→ Comment from Drazen: Are you sure? “Service providers, hosting, maintenance… It would be better to transparently list the recipient categories.”

Deletion of Data

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

In the case of data collected for the purpose of providing the website, this occurs when the respective session ends.

In the case of data stored in log files, this occurs after seven days at the latest. After that, the log files are deleted or anonymized.
→ Comment by Drazen: “It is not clear to the data subject under what conditions data may be stored beyond this period. Problem: transparency. Specify triggers --> security incident, suspected misuse, preservation of evidence, legal proceedings, followed by deletion/anonymization.”

Parts of our website use cookies. Cookies are text files that are stored in or by the web browser on the user’s computer. When a user visits a webpage, a cookie may be stored on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the webpage is visited again.

Technically Necessary Cookies

We use only those cookies (or browser local storage entries) on our website that are technically essential for delivering the site, ensuring IT security, and storing the consent status. These session cookies are automatically deleted at the end of the browser session; persistent security cookies (e.g., “csrf_token”) expire after 24 hours at the latest.

The legal basis for technically essential cookies is Section 25(2)(2) of the TDDDG. The basis for the subsequent processing of the personal data collected in this process (IP address, session ID) is Article 6(1)(e) of the GDPR in conjunction with § 4 of the HmbDSG and §§ 3, 4 of the HmbHG for the purpose of fulfilling our public duty to provide a secure and functional web service.

Cookies are stored on the user’s computer and transmitted to us from there. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you may no longer be able to use all of the website’s features to their full extent.

Optional Cookies

The legal basis for storing information on your device or accessing information already stored is Section 25(1) of the TDDDG. To the extent that personal data is processed in this context, this is done on the basis of Article 6(1)(a) of the GDPR.

Comment from Drazen: Are there any at all? Optional cookies? If not, then this paragraph can/must be removed entirely, or it must be explicitly stated that no optional cookies are used.

The HfMT Hamburg website uses Matomo, an open-source software program for analyzing and statistically evaluating visitor traffic.

Matomo uses so-called “cookies,” small text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is stored on a server belonging to HfMT Hamburg in Germany. The IP address is anonymized immediately after processing and before it is stored.

The information is used to evaluate website usage and to enable the further development of our website in a way that better meets user needs. The legal basis for the processing of this data is Article 6(1)(af) of the GDPR and Section 25(1) of the TDDDG. If Matomo is used with device access that requires consent, its use is permitted only with your consent in accordance with § 25(1) TDDDG; we base the subsequent processing of personal data on Article 6(1)(a) of the GDPR.

You may revoke any consent you have given at any time with future effect; the easiest way to do this is via the website’s cookie/Privacy settings. Regardless of this, you can delete or block cookies at any time in your browser settings.

On the HfMT Hamburg website, you can subscribe to free newsletters. The HfMT newsletter is generally published once a month and provides information about events, projects, offerings, and background reports from HfMT Hamburg.

HfMT Hamburg sends out the newsletter using its own newsletter template and its own technical systems and servers. No external newsletter service provider is used for this purpose. Personal data collected during the newsletter registration process is not shared with third parties.

Your consent to the processing of your data is obtained during the registration process, and reference is made to this privacy policy. The personal data processed consists of the information you provide in the respective input form. This includes your email address, which is requested in the registration form.

The legal basis for processing the data following the user’s newsletter subscription is Article 6(1)(a) of the GDPR, provided the user has given consent.

This personal data is processed exclusively for the purpose of sending the newsletter and invitations to events. The data will not be disclosed to third parties. You may unsubscribe from the newsletter at any time. Your data will then be deleted from the system immediately.

Add text

Registration

Users can register on the HfMT Hamburg website by providing personal data. The specific personal data collected during registration is determined by the respective form used for registration.

As part of the registration process on the application portal, the user’s consent to the processing of this data is obtained.

The legal basis for processing the data, provided the user has given consent,Article 6(1)(a) of the GDPR or the HfMT Hamburg bylaws regarding the collection and further processing of personal data pursuant to § 111(1) and (3) of the Hamburg Higher Education Act.

Comment by Drazen: “Applications, admissions, etc. --> special procedures. These could instead be handled where they become relevant. And there, the legal basis should be subparagraph (e), not consent.”

User registration is required to provide certain content and services, including , among other things, the newsletter, the creation and management of user accounts, participation in surveys, the administration of applications for admission to entrance and final exams, the organization of exams, registration for courses, events, and exams, as well as the related administrative tasks.

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

Email Contact

Users may contact us via the email addresses provided. In this case, the user’s personal data transmitted with the email will be stored. The data will not be disclosed to third parties.

The legal basis for processing the data, provided the user has given consent, is Article 6(1)(a) of the GDPR.

The legal basis for processing data transmitted when sending an email is Article 6(1)(e) or (f) of the GDPR.

Comment from Drazen: Too general. Again, the issue with subparagraph (f). It also depends on the purpose of the inquiry. University communications, performance of duties.

The data is used to process the conversation. The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

OpenStreetMap

On certain subpages, we use map data from OpenStreetMap via an API, a map service provided by the OpenStreetMap Foundation.

By using OpenStreetMap, information about your use of this website (including your IP address) may be transmitted to a server operated by the OpenStreetMap Foundation and stored there. The OpenStreetMap Foundation may transfer the information obtained through Maps to third parties if required by law or if third parties process this data on behalf of the OpenStreetMap Foundation.

You have the option to disable the OpenStreetMap service and thus prevent the transfer of data to the OpenStreetMap Foundation by disabling JavaScript in your browser. However, please note that in this case, you will not be able to use the map display on our website.

The OpenStreetMap Privacy Policy can be found at https://wiki.osmfoundation.org/wiki/Privacy_Policy

Data subjects have the following rights:

• Right to information about the personal data we have stored about them (Art. 15 GDPR);
• Right to rectification of inaccurate or incomplete personal data (Art. 16 GDPR);
• Right to erasure of stored personal data, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims (Art. 17 GDPR)
• Right to restriction of processing of personal data (Art. 18 GDPR);
• Right to object to processing which serves our legitimate interest, a public interest or profiling, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims (Art. 21 GDPR),
• the right to withdraw your consent to the collection, processing and use of your personal data at any time with effect for the future (Art. 7 para. 3 GDPR). As a result, we may no longer continue the data processing that was based on this consent in the future.
• Right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR).

You may exercise your right to object to the processing of your data, to withdraw your consent, and to request corrections by contacting the following address:

datenschutz nord GmbH
Konsul-Smidt-Straße 88
28217 Bremen
Web: www.datenschutz-nord-gruppe.de
Email: