Privacy Policy

» Hier finden Sie die Datenschutzerklärung auf Deutsch.

I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States, and other data protection regulations is:

Universität Heidelberg
Grabengasse 1
69117 Heidelberg
Germany
Email: rektorin@rektorat.uni-heidelberg.de

Local M3EP Programme Coordination & Website Management:
Heidelberg University | Alfred-Weber-Institute
Bergheimer Straße 58
69115 Heidelberg
Germany
Email: m3ep@uni-heidelberg.de

II. Name and Address of the Data Protection Officer

The external data protection officer of Universität Heidelberg is:

Christian Dugall
datenschutz süd GmbH
Heilbronner Straße 156
70191 Stuttgart
Germany
Email: uni-heidelberg@datenschutz-sued.de

III. Server Log Files

When you visit this website, technical access data is automatically collected and stored in so-called server log files. This data is transmitted by your browser to our web server. The following categories of data are processed:

  • IP address of the requesting device
  • Date and time of access
  • HTTP method used (e.g., GET, POST)
  • Requested resource (page, graphic, or other file)
  • HTTP status code of the server response
  • Amount of data transferred
  • Referrer URL (the page from which you visited us)
  • Information about the browser and operating system used (User-Agent)

This data is processed in the widely used Combined Log Format.

Purpose and Legal Basis

The full IP address is stored exclusively for the purpose of IT security, specifically for the detection, prevention, and analysis of attacks on this website’s infrastructure (e.g., DDoS attacks or unauthorized access). The legal basis for this processing is Art. 6(1)(e) GDPR in conjunction with § 4 of the State Data Protection Act of Baden-Württemberg (Landesdatenschutzgesetz Baden-Württemberg – LDSG BW), which permits the processing of personal data by public bodies of the state if it is necessary to fulfill a task within their competence.

Storage Duration and Anonymization

The complete log files, including full IP addresses, are stored for a period of 5 days. After this period, the IP address is anonymized so that it can no longer be linked to an individual. The log data anonymized in this manner is stored for the duration of the project, as it no longer constitutes personal data within the meaning of Art. 4(1) GDPR and serves exclusively statistical and operational evaluation purposes.

Our service provider, Xeneris Media (Wieblinger Weg 17, 69123 Heidelberg), assists us with the hosting of this website. We have contractually bound Xeneris Media in accordance with Art. 28 GDPR.

IV. Cookies

This website uses cookies and similar technologies to store and access information on your terminal device. Cookies are small text files stored in your browser. This website exclusively uses first-party cookies, which are set by the university itself.

The legal basis for setting cookies is governed by § 25 of the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). Under this provision, setting cookies generally requires the user’s consent unless the processing is strictly necessary to provide the service explicitly requested by the user (§ 25(2)(2) TDDDG). This exception applies solely to technically necessary cookies.

Cookies on this website are classified into the following categories:

  • Technically necessary cookies: These are set without your consent. They are strictly required for the proper operation of the website. Without these cookies, the website cannot function or can only function to a limited extent. The legal basis is § 25(2)(2) TDDDG.
  • Optional cookies (Analysis): These are only set if you explicitly consent via the cookie consent banner. If you reject these cookies, the website remains fully accessible to you. Rejecting them is just as easy as giving consent.

You can revoke your consent at any time via the cookie consent banner link provided on this website. Furthermore, you can generally deactivate the setting and storing of cookies in your browser settings or delete cookies that have already been set.

Change Cookie Settings

V. Matomo (Web Analytics)

This website uses the web analytics tool Matomo. Matomo is an open-source software utilized to analyze user behavior on websites. No data is transferred to third parties or to third countries.

The following data may be processed as part of the Matomo analysis:

  • Shortened or anonymized IP address
  • Accessed pages and resources
  • Date and time of access
  • Browser, operating system, and screen resolution used
  • Country of origin (based on the anonymized IP address)
  • Referrer URL (the page from which you visited us)

Matomo analysis sets a cookie that allows page views to be assigned to a specific session. This cookie is used exclusively for analytical purposes and does not contain any information that allows you to be directly identified.

Purpose and Legal Basis

Web analytics serve to improve the university’s online services based on anonymized usage data. No user profiles are created for advertising or commercial purposes. The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

VI. Data Subject Rights

Pursuant to Art. 15(1) GDPR, you have the right to request, free of charge, information about the personal data stored about you by Universität Heidelberg.

In addition, provided the legal requirements are met, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDPR) of your personal data.

If the data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object pursuant to Art. 21 GDPR. If you object to data processing, it will be discontinued in the future unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests as a data subject.

If you have provided the processed data yourself, you have the right to data portability under Art. 20 GDPR.

If the data processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, you can withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to the point of withdrawal.

In the aforementioned cases, if you have open questions, or in the event of complaints, please contact the Data Protection Officer in writing or by email.

Furthermore, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the data protection supervisory authority of the federal state in which you reside or in which the controller has its registered seat (Baden-Württemberg).

VII. Data Processing by the European Education and Culture Executive Agency (EACEA)

The European Education and Culture Executive Agency (EACEA), in the context of managing the Erasmus Mundus Joint Masters, collects and processes the personal data of some of the candidates. In particular, certain data of the scholarship holders and non-scholarship holders is shared with the Agency and treated according to this privacy statement.

Scroll to Top