Privacy Policy

As at 23 September 2026

We, Worms University of Applied Sciences, hereby inform users of our website www.hs-worms.de about how personal data is handled when using the website as follows: 

A. Basic information 

1. Data controller 

The data controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR): 

Worms University of Applied Sciences, a public-law body
Erenburgerstraße 19
67549 Worms
T: +49 (0) 6241 509-245
F: +49 (0) 6241.509-222
E: praesidentin[at]hs-worms.de 

Worms University of Applied Sciences is represented by its President,
Prof. Dr Alexandra Nonnenmacher. 

2. Data Protection Officer 

You can contact our Data Protection Officer using the following details: 

Worms University of Applied Sciences
Data Protection Officer
Erenburgerstraße 19
67549 Worms 

T: +49 (0) 6241.509-0
E: datenschutz[at]hs-worms.de 

3. Data and system security 

We protect our website and our systems against the loss, destruction, unauthorised access, alteration or disclosure of your data by unauthorised persons through technical and organisational measures. 

We use the external service provider web-vision GmbH, An der Eickesmühle 38, 41238 Mönchengladbach, to host our website. A data processing agreement (DPA) has been concluded with this provider in accordance with Article 28 of the GDPR. This is a contract required under data protection law, which ensures that this service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

In connection with visits to our website, data that may allow identification (e.g. IP address) is stored temporarily on the servers for the purposes of data and system security, but generally for no longer than seven days. The processing of data that may be used to identify individuals for the purposes of data and system security is carried out on the basis of Section 3 of the Rhineland-Palatinate State Data Protection Act (LDSG RP) in conjunction with Article 6(1), first sentence, point (e) of the GDPR. 

4. Principles governing the storage and erasure of personal data 

(Text unchanged, taken from the template: Old Privacy Policy for the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

4.1. Personal data is processed only for the period necessary to fulfil the respective purpose of storage, or insofar as this is provided for in laws or regulations applicable to us (e.g. statutory retention obligations). If a storage purpose ceases to apply or a statutory retention period expires, the personal data concerned shall be routinely deleted in accordance with statutory provisions, or its processing shall be restricted (e.g. restricted processing within the framework of commercial or tax law retention obligations). Data may also be retained if this is provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned provisions expires, unless there is a need to continue storing the data for the conclusion or performance of a contract. 

4.2. The processing of personal data on the basis of a legal obligation, namely the fulfilment of statutory retention obligations, is based on Article 6(1), first sentence, point (c) of the GDPR. Insofar as personal data is processed for the purposes of preserving evidence in accordance with Section 3 of the LDSG RP in conjunction with Article 6(1), first sentence, point (e) of the GDPR, these processing purposes cease to apply upon the expiry of the statutory limitation periods; the standard statutory limitation period is three years. 

4.3. For further details on specific retention and deletion periods, please refer to the individual service descriptions or information contained in this privacy policy and the forms on this website. 

B. Visiting our website 

1. General 

(Text unchanged, taken from the template: Old Privacy Policy for the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

When using our website purely for information purposes – that is, if you do not enter any personal data into online forms and do not otherwise provide us with personal information – data that may be linked to you may be generated and transmitted by your browser to our server. We also use tracking technologies to the extent described below for the purposes of web analytics. 

2. Data collection and processing when accessing the website from the internet 

(Text unchanged, taken from the template: Old Privacy Policy for the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

When you visit our website, we collect the following data, which is technically necessary for us to display our web pages to you and to ensure the stability and security of our online service: 

• IP address 

• Name of your internet service provider 

• Date and time of the request 

• Time zone difference from Greenwich Mean Time (GMT) 

• Content of the request (specific page) 

• Access status/HTTP status code 

• Amount of data transferred in each instance 

• Website from which the request originates 

• Identifying details of the browser and operating system used. 

The processing of this data enables the use of our website (establishing a connection), serves to ensure system security and the technical administration of the network infrastructure, and helps to optimise the website. 

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs when the relevant session ends. 

Where data is stored in log files, this occurs after seven days at the latest. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymised so that it is no longer possible to identify the client making the request. 

IP addresses are analysed only in the event of attacks on the network infrastructure of Worms University of Applied Sciences. 

The legal basis for this collection and processing is Section 3 of the LDSG RP in conjunction with Article 6(1), first sentence, point (e) of the GDPR. 

3. Use of cookies 

(Text unchanged, adapted to ‘users’) 

Our website uses cookies. Cookies are small text files that are placed and stored on a computer system via an internet browser. 

Numerous websites and servers use cookies. Cookies often contain what is known as a ‘cookie ID’. Such an ID is a unique identifier for the cookie and consists of a string of characters that enables websites and servers to be associated with a specific web browser in which the cookie has been stored. Such cookies make it possible to distinguish your individual browser from other web browsers that contain different cookies. A specific web browser can therefore be recognised and identified via a unique cookie ID. 

By using cookies, Worms University of Applied Sciences can provide you with more user-friendly services which, without the use of cookies, could not be provided at all or only to a limited extent. The use of cookies is based on Section 3 of the LDSG RP in conjunction with Article 6(1), first sentence, point (e) of the GDPR. 

This website uses technically necessary cookies as well as optional cookies. Optional cookies are only set with your consent. They are used to collect visitor statistics and to display external content. 

You can configure your cookie settings here. 

You can prevent cookies from being set by adjusting your web browser settings and thereby permanently object to the setting of cookies. You can also delete cookies that have already been set via your web browser or other software programmes. Please bear in mind, however, that you may not be able to use all the features of our website or other online services if you disable cookies in your web browser. 

4. Web analytics 

(including the Matomo Growth Bundle extension) 

This website uses the open-source software tool Matomo to analyse users’ browsing behaviour. The software places a cookie on the user’s computer (see above for information on cookies). When you access our website, the following data is stored: 

• two bytes of the IP address of the user’s system, 

• the webpage accessed, 

• the website from which the user accessed the visited website (referrer), 

• the subpages accessed from the website visited, 

• the duration of the visit to the website, 

• the frequency with which the website is visited. 

The software runs exclusively on the servers of our website. Personal data relating to users is stored only there. The software is configured so that IP addresses are not stored in full; instead, 2 bytes of the IP address are masked (e.g. 192.168.xxx.xxx). This means that it is no longer possible to link the truncated IP address to the visiting computer. 

In addition, we use Matomo’s Growth Bundle. This is an extension of the Matomo web analytics tool that enables additional evaluation and optimisation functions (e.g. advanced visitor statistics, content tracking and conversion analyses). Processing takes place on the same servers as the standard version of Matomo and exclusively within the European Union. Personal data continues to be processed only in anonymised form (truncated IP address). 

The legal basis for the processing is Section 3 of the LDSG RP in conjunction with Article 6(1), first sentence, point (e) of the GDPR. This processing enables us to analyse our users’ browsing behaviour. By analysing the data obtained, we are able to compile information on the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. The anonymisation of the IP address ensures that users’ interests in the protection of their personal data are adequately safeguarded. 

The data is deleted as soon as it is no longer required for our record-keeping purposes. In our case, this occurs after 180 days. 

We offer our users the option to consent to or object to the collection of user statistics. You can adjust the settings for the statistics cookie in our cookie settings. 

5. Links to third-party websites 

(Text unchanged, taken from the template for the old privacy policy on the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

Where cross-references (links) are provided to content on other websites, please bear in mind that the respective provider is responsible for data collection and processing on that external website. Please note that data processing on the external websites referred to via these cross-references may be subject to different rules. 

6. Links to social media platforms 

(Text updated) 

Our website contains links to the external social media platforms Facebook, LinkedIn, Instagram, YouTube and – for certain Faculties such as Computer Science – also TikTok. These links are identified on our website by the relevant logo. As we do not use social plugins, no data is transferred to third parties when you visit our website. Data is only transferred once you have accessed the social network’s website and have registered or logged in to that service. 

C. Use of specific services 

1. Communication 

(Text unchanged, adapted to ‘users’) 

On our website, we offer you various ways to get in touch with us and send us messages. In particular, you can also contact us by telephone or email. 

Should you contact us in this way, the data you provide (e.g. your email address, and, where applicable, your name and telephone number) will be stored and processed by us in order to deal with your enquiry. The legal basis for this is Section 3 of the LDSG RP in conjunction with Article 6(1), first sentence, point (e) of the GDPR. We will delete the data in question once storage is no longer necessary, or restrict its processing where statutory retention obligations apply. 

2. Alumni Newsletter 

(Text unchanged, taken from the template: Old Privacy Policy on the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

To subscribe to the newsletter offered in our alumni section, you can register using our form. We use the so-called double opt-in procedure. This involves first sending a confirmation email to the email address you have provided, asking you to confirm your subscription. Your registration will only become effective once you have clicked on the activation link contained in the confirmation email. We use the data you provide to us to contact you and send you the alumni newsletter, invitations to events, other information and any enquiries. 

The legal basis for the collection and processing of personal data in this context is Article 6(1), first sentence, point (a) of the GDPR (consent). 

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. The user’s data will therefore be stored for as long as the newsletter subscription remains active. 

You may withdraw your consent to the storage of your data and its use for sending the newsletter at any time with future effect, either via the unsubscribe link in the newsletter or by emailing: alumni[at]hs-worms.de. 

We use RapidMail for the technical processing of newsletter distribution. Your data will therefore be transferred exclusively to our data processor, RapidMail GmbH, for the purpose of sending the newsletter. 

3. Online applications 

(Text unchanged, taken from the template: Old Privacy Policy on the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

Prospective students can apply online to Worms University of Applied Sciences for a place on a course. Applications can only be submitted once you have read and accepted the specific privacy policy, to which we refer here to avoid repetition. 

4. Data protection information on online meetings 

(Text unchanged, taken from the template ‘Old Privacy Policy’ on the HSW website (https://www.hs-worms.de/footer/rechtliches/datenschutz) with sub-points a–d) 

Worms University of Applied Sciences uses various video conferencing solutions to conduct video conferences, online meetings, webinars and online lectures (collectively referred to as ‘online meetings’). Below, we would like to inform you about the processing of personal data in connection with the conduct of online meetings. 

a) BigBlueButton 

We continue to use the ‘BigBlueButton’ web conferencing system to hold online meetings. ‘BigBlueButton’ is open-source software for online meetings, hosted on a server at Johannes Gutenberg University Mainz. When conducting online meetings via ‘BigBlueButton’, Johannes Gutenberg University Mainz acts as a data processor on our behalf within the meaning of Article 28 of the GDPR. 

If you take part in a “BigBlueButton” meeting, you will have the option at the start of the meeting to enter your name as a user ID. This user ID, which is voluntary and may also be provided anonymously, is processed for the duration of your participation in the respective online meeting and subsequently deleted. Any audio, video or chat content provided by participants is also processed only during the relevant online meeting, unless a recording is made with the prior consent of all participants in order to make the online meeting available afterwards to students who were unable to attend the live event. 

In order to hold the online meeting, the IP address used by your device must be processed. When setting up an online meeting, the organiser chooses a name for the online meeting. In addition, a password may be set for participation in the online meeting. This data is processed only until the end of the respective online meeting and is subsequently deleted. Please note that the name of the ‘online meeting’, as well as the date, time and duration of the ‘online meeting’, may be stored locally in your browser. If you do not wish to see this data any longer, you should clear your browser cache. 

b) Zoom 

We also use the cloud-based web conferencing service “Zoom” to conduct online meetings. “Zoom” is a web conferencing system provided by Zoom Video Communications, Inc., based in San José (California, USA). 

The data controller responsible for data processing directly related to the conduct of ‘online meetings’ is the data controller named in Section A.1. Zoom Video Communications, Inc. acts as a data processor in this regard. 

You can join ‘online meetings’ via ‘Zoom’ either using the ‘Zoom’ meeting app or via the browser version. If you take part in an ‘online meeting’ via ‘Zoom’ on the basis of a meeting invitation, you can do so without having your own Zoom account. If you create a user account with ‘Zoom’ or visit the websites of Zoom Video Communications, Inc., Zoom Video Communications, Inc. is responsible for processing the data generated in the process. 

Various types of data are processed when using “Zoom”. The scope of the processing depends on which personal data you provide before or whilst participating in the “online meeting”. 

The following personal data is processed when using ‘Zoom’: 

• User details: first name, surname, telephone number (optional), email address, password (if ‘Single Sign-On’ is not used), profile picture (optional), department (optional) 

• Online meeting metadata: Topic, description (optional), participants’ IP addresses, device/hardware information 

• In the case of recordings (optional, only with the consent of all participants): MP4 file of all video, audio and presentation recordings; M4A file of all audio recordings; text file of the online meeting chat. 

• When dialling in by telephone: details of the incoming and outgoing telephone numbers, country name, start and end times. Where applicable, further connection data, such as the device’s IP address, may be stored. 

• Text, audio and video data: You may have the option to use the chat, question or poll functions during an ‘online meeting’. In this respect, the text you enter will be processed in order to display it in the ‘online meeting’ and, where applicable, to log it. To enable the display of video and the playback of audio, data from your device’s microphone and, where applicable, its video camera will be processed for the duration of the meeting. You can switch off the camera or mute the microphone yourself at any time via the Zoom application. 

To take part in an ‘online meeting’, you must provide at least your name in order to enter the ‘meeting room’. This information may also be provided anonymously. Any audio, video or chat content from participants is processed only during the respective online meeting, unless a recording is made with the prior consent of all participants in order to make the online meeting available afterwards to students who were unable to attend the live event. 

If you are registered as a user with ‘Zoom’, reports relating to ‘online meetings’ (meeting metadata, dial-in details, questions and answers in webinars, and the survey function in webinars) may be stored by Zoom Video Communications, Inc. for up to one month. 

The ‘attention tracking’ feature available in Zoom is deactivated. Automated decision-making within the meaning of Article 22 of the GDPR is not used. 

As the ‘Zoom’ web conferencing system is provided by a supplier based in the USA, any personal data generated during its use is also processed in a third country. The university has concluded a data processing agreement with Zoom Video Communications, Inc. based on the EU Standard Contractual Clauses. The use of “Zoom X” is based on a data processing agreement with Telekom Deutschland GmbH. The service provided by Telekom Deutschland GmbH in collaboration with Zoom Video Communications Inc. is hosted exclusively on servers in Germany. 

Further information on data protection relating to Zoom can be found at: https://zoom.us/gdpr and

c) DFNConf 

In addition, we use the “DFN-Conf” web conferencing system to hold online meetings. ‘DFN-Conf’ is a web conferencing system provided as a cloud service by the German Research Network Association for Scientific Institutions. The DFN-Verein e.V. acts on our behalf as a data processor within the meaning of Article 28 of the GDPR. 

Invited meeting participants do not need to register for the service; they join the online meeting using the access details provided to them. Any audio, video or chat content is processed only during the respective online meeting and deleted once the online meeting has ended, unless a recording is made with the prior consent of all participants in order to make the online meeting available afterwards to students who were unable to attend the live event. 

In order to hold the online meeting, the IP address used by your device must be processed. When setting up an online meeting, the organiser chooses a name for the meeting. In addition, a password may be set for participation in the online meeting. This data is processed only until the end of the respective online meeting. The logging of this data serves to identify and rectify faults and to protect against misuse. The maximum retention period is 7 days. Please note that the name of the ‘online meeting’, as well as the date, time and duration of the ‘online meeting’, may be stored locally in your browser. If you no longer wish to see this data, you should clear your browser cache. 

Further information on data protection relating to ‘DFNconf’ and the integration with learning management platforms, which may require registration, can be found at: https://www.conf.dfn.de/datenschutz/ 

d) Microsoft Teams 

We use the web conferencing service ‘Microsoft Teams’ to conduct ‘online meetings’. ‘Microsoft Teams’ is a cloud service provided by Microsoft Corporation. 

The data controller responsible for data processing directly related to the conduct of ‘online meetings’ is the data controller named in Section A.1. Microsoft Corporation acts as a data processor on our behalf in this regard. 

Insofar as you access Microsoft’s website to take part in a Teams online meeting, Microsoft Corporation is responsible for data processing on the website. However, accessing the website is only necessary for the use of “Microsoft Teams” in order to download the software required to use “Microsoft Teams”. If you do not wish to, or are unable to, use the ‘Microsoft Teams’ app, you can also use ‘Microsoft Teams’ via your browser. In such cases, the service is also provided via the ‘Microsoft Teams’ website. 

When using ‘Microsoft Teams’, various types of data are processed. The scope of the data also depends on what information you provide before or whilst participating in an ‘online meeting’. The following personal data is subject to processing: 

• User details: e.g. display name, email address (if applicable), profile picture (optional), preferred language 

• Meeting metadata: e.g. date, time, meeting ID, telephone numbers, location 

• Text, audio and video data: You may have the option to use the chat function during an ‘online meeting’. In this respect, the text you enter is processed in order to display it during the ‘online meeting’. To enable the display of video and the playback of audio, data from your device’s microphone and, where applicable, its video camera will be processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the “Microsoft Teams” application. 

If we wish to record ‘online meetings’, we will inform you of this transparently in advance and – where necessary – ask for your consent. 

Any audio and video content from participants will only be processed during the relevant online meeting, unless a recording is made with the prior consent of all participants in order to make the online meeting available afterwards to students who were unable to attend the live event. 

Chat content is logged when using Microsoft Teams. We store the chat content for a period of one month. If it is necessary for the purposes of recording the outcomes of an online meeting, we will log the chat content. However, this will not usually be the case. 

Automated decision-making within the meaning of Article 22 of the GDPR is not used. 

Legal basis 

Insofar as the above data processing is not based on consent, the legal basis for the data processing is Section 3 of the Rhineland-Palatinate State Data Protection Act in conjunction with Article 6(1), first sentence, point (e) of the GDPR. 

The Federal Data Protection Commissioner has announced that an adequacy decision regarding the so-called ‘EU-US Data Privacy Framework’ has entered into force. This adequacy decision, which was adopted by the European Commission, may serve as a basis for data transfers to certified organisations in the USA. Using the list of certified organisations, the university has checked which organisations are involved. ‘Microsoft’, for example, is named on this list. The need for further measures is constantly reviewed. 

D. Data subjects’ rights 

(Text unchanged, adapted to ‘users’, taken in full from the template ‘Old Privacy Policy HSW Website’ (https://www.hs-worms.de/footer/rechtliches/datenschutz)) 

1. Summary 

We are pleased to inform you of your rights under the GDPR as a ‘data subject’. Accordingly, you have the following rights with regard to your personal data: 

• Right of access (Art. 15(1), (2) GDPR) 

• Right to rectification (Art. 16 of the GDPR) or erasure (Art. 17 of the GDPR) 

• Right to restriction of processing (Art. 18 GDPR) 

• Right to data portability (Article 20 of the GDPR) 

• Right to object to processing (Article 21 of the GDPR) 

• Right to withdraw consent (Article 7(3) of the GDPR) 

• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR) 

2. Additional information on data subjects’ rights 

In addition, we have summarised the key points regarding data subjects’ rights under the GDPR as follows; please note that this summary does not claim to be exhaustive, but merely addresses the main features of data subjects’ rights under the GDPR: 

Right of access (including the right to confirmation and the right to receive a copy of the data) 

The data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed.
The data subject has the right to access personal data concerning them and to the following information: 

• the purposes of the processing; 

• the categories of personal data being processed; 

• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; 

•  where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period; 

• the existence of a right to have personal data concerning them rectified or erased, or to have processing restricted by the controller, or a right to object to such processing; 

• the existence of a right to lodge a complaint with a supervisory authority; 

• where the personal data are not collected from the data subject, any available information as to the source of the data; 

• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; 

• where personal data are transferred to a third country or to an international organisation, to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer. 

The data subject has the right to receive a copy of the personal data concerning them which is being processed. 

Right to rectification 

The data subject has the right to obtain from the controller the rectification without undue delay of any inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to request that incomplete personal data be completed – including by means of a supplementary statement. 

Right to restriction of processing 

The data subject has the right to request that the controller restrict processing if one of the following conditions is met: 

• the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data, 

• the processing is unlawful and the data subject opposes the erasure of the personal data and requests, instead, that the use of the personal data be restricted; 

• the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it to establish, exercise or defend legal claims; or 

• the data subject has objected to the processing in accordance with Article 21(1) of the GDPR, for as long as it remains to be determined whether the controller’s legitimate grounds override those of the data subject. 

Right to erasure 

The data subject has, in principle and subject to any statutory requirement for data processing (see Article 17(3) of the GDPR), the right to request that the controller erase personal data concerning them without undue delay, provided that one of the following grounds applies: 

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed. 

• The data subject withdraws their consent on which the processing was based in accordance with Article 6(1), first sentence, point (a) or Article 9(2), point (a) of the GDPR, and there is no other legal basis for the processing. 

• The data subject objects to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article 21(2) of the GDPR. 

• The personal data has been processed unlawfully. 

• The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject. 

• The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR. 

Right to data portability 

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and they have the right to transmit those data to another controller without hindrance from the controller to whom the personal data were provided, provided that the processing is based on consent or on a contract in accordance with Article 6(1), first sentence, point (b) of the GDPR and the processing is carried out by automated means. 

When exercising their right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, provided this is technically feasible. 

Right to withdraw consent 

The data subject has the right to withdraw any consent given at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal. 

Right to lodge a complaint with a supervisory authority 

Every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place where the alleged infringement occurred, if the data subject considers that the processing of personal data relating to them infringes this Regulation. 

The data protection supervisory authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate (LfDI), PO Box 340, 55020 Mainz. 

Separate notice regarding the right to object pursuant to Article 21(1) and (2) of the GDPR 

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1), first sentence, point (e) of the GDPR; this also applies to profiling based on these provisions. If you object, your personal data will no longer be processed, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms as the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.