WU Vienna University of Economics and Business is committed to protecting your personal data. Your personal data are kept confidential and processed in accordance with the provisions of the applicable data protection laws. In fulfillment of the regulations of the General Data Protection Regulation (GDPR), in particular Article 13, we would like to inform you about the types of personal data that are processed in connection with your visit to our publicly accessible WU Executive Academy (EA) website or when accessing the content provided at the "executiveacademy.at" domain, and we would also like to inform you about the purposes for which these data are processed. The Privacy Policy primarily refers to the pages of the EA website that are publicly accessible, that means they can be accessed without prior registration.

Contact information

You can contact us at:

Controller:

WU Wirtschaftsuniversität Wien
attn: Executive Academy (EA)
Welthandelsplatz 1, Gebäude EA, 1020 Wien
 

Data Protection Officer:

WU Wirtschaftsuniversität Wien
attn: Datenschutzbeauftragter p.A. Rechtsabteilung
Welthandelsplatz 1, Gebäude AR, 1020 Wien
 

If you have any questions regarding the content of this Privacy Policy, please contact EA IT-Team at ea-it-team@wu.ac.at

For any other matters related to data protection, please contact the WU data protection team at datenschutz@wu.ac.at

Which types of personal data are processed and for which purposes?

When you visit the EA website, we collect the following data:

1. Server Logfiles

We process only the technically necessary data that are provided to us automatically as a result of your visit to the EA website. These data are logged in server log files. The following categories of personal data are logged:

• The IP address you are accessing the site from

• Access date and time

• Access method (e.g. GET)

• Accessed URL

• Access protocol used (e.g. HTTP/1.1)

• HTTP response status code

• File size

• Referring page (referrer URL)

• Operating system and browser type (user agent)

Log files are saved for a period of 4 weeks. We process these data to ensure proper operations and to monitor the performance of the EA website. If you have given your consent, we also process these data to generate user statistics.

2. Cookies

We use so-called cookies on the EA website. Cookies are small files stored on your end device by your browser when you visit a website. The next time you visit the EA website using the same end device, the information stored in the cookies is sent back to us. Cookies enable us to recognize the browser of your end device on your next visit to the EA website and to ensure the EA website is optimally displayed in accordance with your preferences and settings. Some cookies on the EA website are so-called session cookies. They will be deleted automatically once you leave our website. Other cookies will be deleted after expiry of the period mentioned in the cookie settings.

Our website uses the following types of cookies, the scope and functionality of which are explained below:

• Strictly necessary cookies (Essential) are set to ensure that our website functions properly.

• Statistics cookies(Functional) help us make the EA website as user-friendly as possible. We use these cookies to analyze our website’s access statistics, find out more about how our visitors use the EA website, and improve our services.

• Marketing Cookies (Marketing) are set to integrate third-party website services to display advertising that may be of interest to you.

For detailed information on the cookies used on the website, please see the “Cookie settings” menu. Here you can review and change the settings any time you wish. You can also change the settings for handling cookies directly in your browser, or you can delete cookies. For details, please see the help menu in your browser. Please note that blocking or deleting cookies can limit certain functions of the website.

If you enable statistics cookies or marketing cookies or click the “Select all” button, your data are processed on the basis of your consent (Art. 6 (1) item a of the GDPR). By consenting to the use of such cookies, you also expressly consent to your data being transferred to the USA (Art. 49 (1) item a of the GDPR).

You can withdraw your consent at any time. However, this withdrawal does not affect the lawfulness of processing before the withdrawal. The easiest way to do that is by adjusting the settings in your individual cookie preferences accordingly.

You can find more information about cookies in the cookie settings.

3. Tracking and analysis

Detailed information on the tracking and analysis tools used on the website can be accessed under the menu item Data protection settings and changed at any time if desired.

4. Social Media

4.1 Social Media Share Buttons

The EA website uses social media buttons to allow users to share content from the pages to their social networks. Unlike other share buttons, the solution used by EA does not pass on any data to social media operators when you simply access the EA website. Only if you click on the share button will your data be transferred to the relevant social network. If you do not click on the share button, no data will be exchanged between you and the relevant social network.

4.2.

We maintain online profiles on social networks and platforms. We operate our social media pages to inform the public about the fulfillment of the university’s responsibilities (public relations) in connection with the tasks entrusted to it by law, as well as for communication (responding to relevant inquiries). This is an additional service in addition to EA’s existing information and communication services, making it possible for users to communicate with EA.

In respect of our social media presence, we refer to information we provide on the relevant social media in our Social Media Data Protection Statement.

4.3 Video Player

YouTube

We have embedded YouTube videos on our website that are stored on http://www.YouTube.com. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The videos have been embedded on our website using a technical method whereby no cookies are set (YouTube no cookie), that means none of your personal data as the user will be transferred to Google as long as you do not play the videos. Only if you play the videos will your IP address and, where applicable, activity data be transferred to Google. We do not have any influence on the type and extent of the data transferred and/or retained.

As a consequence of using this service, data are transferred to the USA, or the transfer of data to the USA cannot be ruled out. For organizations participating in the Data Privacy Framework (DPF), the EU Commission recognizes an adequate level of data protection. Accordingly, the transfer of data to the USA is based on the DPF.

Data are processed on the basis of your consent (Art. 6 (1) item a of the GDPR), which you expressly gave by setting your cookie preferences.

If you are logged in to your YouTube account, you enable Google to link your surfing behavior directly to your personal profile. You can prevent this by logging out from your YouTube account.

For more information on the purpose and scope of data processing and the options to set preferences to protect your privacy, please see Google’s Privacy Policy at https://policies.google.com/privacy?hl=en&gl=de.

Vimeo

We use Vimeo of Vimeo Inc., 555 West 18th Street, New York 10011, USA, to embed videos.

The videos have been embedded on our website in a manner so that none of your personal data as the user will be transferred to Vimeo as long as you do not play the videos. Only if you play the videos will your IP address and, where applicable, activity data be transferred to Vimeo. We do not have any influence on the type and extent of the data transferred and/or retained.

As a consequence of using this service, data are transferred to the USA, or the transfer of data to the USA cannot be ruled out. For organizations participating in the Data Privacy Framework (DPF), the EU Commission recognizes an adequate level of data protection. As of 1.9.2023, Vimeo does not participate in the DPF. The transfer of data to the USA is therefore still based on standard contractual clauses.

Data are processed on the basis of your consent (Art. 6 (1) item a of the GDPR), which you expressly gave by setting your cookie preferences. Your consent also means that you agree to your data being processed in the USA although there are no appropriate safeguards to ensure an adequate level of data protection (Art. 49 (1) item a of the GDPR).

If you are logged in to your Vimeo account, you enable Vimeo to link your surfing behavior directly to your personal profile. You can prevent this by logging out from your Vimeo account.

For more information on the purpose and scope of data processing and the options to set preferences to protect your privacy, please see Vimeo’s Privacy Policy at https://vimeo.com/privacy.

5. Forms

You can revoke your consent at any time by e-mail. The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

5.1 Newsletter

The personal data you provide voluntarily will be processed by the WU Executive Academy on the basis of your consent (Art. 6 para. 1 lit a DSGVO). We store your data only as long as you wish to receive the newsletter. We do not pass on your data to third parties.

Liability: All newsletter texts are carefully checked. Nevertheless, no guarantee can be given for the correctness, completeness and topicality of the information. Any liability of WU is therefore excluded. Any links contained in the newsletters to websites not operated by the WU Executive Academy have been carefully selected. Since the WU Executive Academy has no influence on their content, WU assumes no responsibility for them.

5.2. Inforequest/Brochure Download

The personal data you provide voluntarily will be processed by the WU Executive Academy on the basis of your consent (Art 6 (1) (a) DSGVO). We store your data only as long as you wish to receive study-related information, campaigns and surveys. We do not pass on your data to third parties.

5.3 Profile Check/Consultation:

The voluntarily provided personal data will be processed by us on the basis of the consent you have given (Art 6 para. 1 lit a DSGVO). We store your data only as long as we need it to process your Profile Check/your counselling interview and you wish to receive information, campaigns and surveys relevant to your studies.

What are your rights as a data subject?

As a data subject in the context of these data processing operations, you have the following rights vis-a-vis EA: information and access, rectification, deletion, restriction of data processing, data portability, and objection. As a data subject, you also have the right to file a complaint with the Austrian Data Protection Authority. Further information on your rights as a data subject is available on our website at Your rights as a data subject.

To exercise any of these rights, please contact the WU data protection team at datenschutz@wu.ac.at.

What is the legal basis for processing your data?

• Art. 6 (1) item a of the GDPR – consent

Your consent is required before we can process any personal data obtained from statistics or marketing cookies. You can withdraw your consent to any future data processing at any time. However, any processing of your data which occurred before consent was withdrawn remains legal and unaffected.

• Art. 6 (1) item f of the GDPR – pursuit of legitimate interests

The setting of strictly necessary cookies and the resulting processing of personal data is carried out in pursuit of our legitimate interest in providing our EA website for use without technical problems.

Does the processing involve any automated decision-making (profiling)?

No, no automated decision-making or profiling is involved.

Are you obligated to provide your personal data?

Consent to statistics and marketing cookies is voluntary. You are in no way obligated to provide the data associated with this consent.

Strictly necessary cookies are placed automatically when the EA website is accessed. Without collecting the personal data resulting from these cookies, we would not be able to provide the EA website for use without technical problems.

If you want to prevent cookies being saved on your computer altogether, you can also set this in your internet browser. Once set, cookies can also be deleted again. More information on managing your browser settings can usually be found in your browser’s help menu. Please also see item 2, Cookies, above.

To which other parties do we pass on your data?

As a general rule, we do not transmit your personal data to any third parties. In some cases, however, we may share your data with external service providers we cooperate with (currently, for example, Fonda Interaktive Medien und Kommunikation GmbH, Strg GmbH and Noodles agency GmbH) for website maintenance, development and design purposes.

If you have given your consent, we will transmit personal data collected by statistics cookies and marketing cookies to the third parties mentioned in the “Cookie settings” in accordance with Art. 49 (1) item a of the GDPR. Please note that the European Court of Justice has not certified an adequate level of data protection for the USA. In particular, there is a risk that US authorities will process data for supervisory and monitoring purposes and that no effective legal remedies are available against this.

You can withdraw your consent to any future data processing at any time. The easiest way to do that is by adjusting the settings in your individual cookie preferences accordingly.

References to third-party websites (external links)

The EA website contains links to external, i.e. third-party websites that are not under EA’s control. EA does not have any influence on the contents and data protection standards of such linked websites. EA shall not be held liable for any external links.

Updates and amendments of this Data Privacy Policy

As our website and the services we offer on it are continuously enhanced, or following a change of legal requirements or requirements by authorities, it may become necessary to amend this Data Privacy Policy. The latest Data Privacy Policy can always be found on our website.

Version: 20.11.2023

1. What do we use your data for and to whom we transfer the data?

The purposes and legal basis for data processing are listed below. For some of these purposes, it may be necessary to transfer the data to third parties. If data are transferred, the respective categories of recipients are also listed. If you do not provide us with the respective required data, we will unfortunately not be able to provide you with our services.

1.1. Online pre-registration

The processing is carried out for the implementation of the application/admission procedure and for the eventual admission to the degree program applied for.

The following categories of data are processed: Name; dates of birth; gender; nationality; mother tongue; academic titles awarded and any other academic titles; contact details; home and mailing address; degree program applied for; data and certificates proving eligibility for admission to a Master's program (for Master's programs) or proof of higher education entrance qualification (for university courses and DiplombetriebswirtIn), matriculation number (if available), previous study data, professional experience data, information on program decision and media preferences, passport copy, social security number, sector-specific personal identifier (bPK), CV, motivation letter, recommendation letters, graduation documents from previous studies, digital photo.

The legal basis for the processing is the fulfillment of legal obligations pursuant to Art 6 para 1 lit c GDPR, including the Universities Act 2002 (Universities Act), By-laws of WU Person Group Ordinance 2018, University Entitlement Ordinance (UBVO), University Student Records Ordinance 2004, Education Documentation Act 2020 (BilDokG), University Statistics and Education Documentation Ordinance (UHSBV), Student Union Act 2014 (HSG), as well as the performance of a task in the
public interest pursuant to Art 6 para 1 lit e GDPR.

Recipients are the Data Network of the Universities, the Austrian Student Union (ÖH) and Statistics
Austria.

1.2. Student Administration

The processing is carried out for the implementation and handling of your degree program, such as communication, issuing of the student ID card, room reservations and access authorizations, prescribing/payment of any tuition fees or waiver/reimbursement or repayment, and, if applicable, managing the awarding of scholarships and conferral of an academic degree.

The following categories of data are processed: Name; dates of birth; gender; student ID number; social security number; nationality, in the case of foreigners the data of the travel document presented to establish identity; home and mailing address; academic titles awarded and any other academic titles, contact details; area-specific personal identifier (bPK); study application data; statistical marks for the census of persons and studies; bank details; contribution status according to §§ 91 and 92 of the Universities Act; amounts and value date of the tuition fee advance notice; amounts and value date of any subsequent claim; payment status and actual amount; last posting date; binding proof of waiver of tuition fees; number of semesters for which the proof is valid; university tuition fee account; education and qualification data; application, admission or start date of the degree program; form, date and issuance of the general university entrance qualification; Matura language and place; highest completed school education of parents (UHStat1); degree of any impairment; photograph for student ID card; admission status; any time limit on admission; notification of continuation of studies (re-registration); completion date and form of the respective education and the designation of the completed education; if available, data of previous university entrance examinations;

The legal basis for processing is the fulfillment of legal obligations pursuant to Art 6 para 1 lit c GDPR, including the Universities Act 2002 (Universities Act), By laws of WU, Person Group Ordinance 2018 (PersGV), University Entitlement Ordinance (UBVO), University Student Records Ordinance 2004, Tuition Fees Ordinance (StubeiV), Education Documentation Act 2020 (BilDokG), University Statistics and Education Documentation Ordinance (UHSBV), Delivery Laws (ZustG), Student Support Act (Student Support Act), Student Union Act 2014 (HSG), General Administrative Procedure Act 1991 (AVG), as well as the performance of a task in the public interest pursuant to Art 6 para 1 lit e GDPR.

Recipients are the Data Network of Universities, the Austrian Student Union (ÖH), banks, Statistics Austria.

1.3. Teaching and exam administration, learning and media platforms

The processing is carried out for the announcement, implementation, support and administration of courses and exams, such as registration and deregistration, attendance control via WU Check-in, provision of teaching and learning content as well as communication, documentation of courses as well as examination performance and academic work including plagiarism checks.

The following categories of data are processed: account data for courses/examinations; examination data in the scope of examination reports including university entrance examination; semester hours of examinations taken; semester hours of positively assessed examinations; ECTS credits earned and ECTS credits; examination recognition data; type and date of examinations successfully passed; additional examinations; data on academic papers; plagiarism case data; name; email; organizational affiliation; account data, course data; exam data; course information; calendar entries and synchronized appointments (e.g., LV appointments); metadata/log data (e.g., IP addresses, device/hardware information); text, audio, and video data; content data (e.g., file uploads, web
recordings).

The legal basis for the processing is the fulfillment of legal obligations according to Art 6 para 1 lit c GDPR (among others § 78 Universities Act), the performance of a task in the public interest according to Art 6 para 1 lit e GDPR, Art 89 GDPR (scientific research purposes), the Universities Act 2002 (Universities Act), the Research Organization Act (FOG) as well as By-laws of WU, the WU Examination Regulations and the curriculum.

Recipients are the public (e.g. obligation to publish a list of courses according to § 59 Abs 5 Universities Act; obligation to publish positively evaluated academic work of students according to § 86 Universities Act), surveyors as well as data processors used by WU for digital teaching.

1.4. Use of video conferencing systems

The processing is carried out for the purpose of holding courses in hybrid form (partly distance and partly presence) or online using the videoconferencing systems MS Teams and Zoom, in order to ensure the proper operation of studies.

The following categories of data are processed: Metadata such as participant IP addresses; device/hardware information; connection data; text input when using the chat function; audio and video data when activating the camera and microphone; Microsoft Teams or Zoom account data; presentations provided.

The legal basis for the processing is the fulfillment of legal obligations pursuant to Art 6 para 1 lit c GDPR (§ 3 (1), (6) and (7) and § 76 ff Universities Act 2002) as well as the performance of a task in the public interest pursuant to Art 6 para 1 lit e GDPR; in particular, to guarantee the right to education pursuant to Art 14 of the Charter of Fundamental Rights of die European Union (GRC), freedom of study pursuant to § 2 Universities Act and the right of students to attend the courses necessary for the achievement of their educational goal pursuant to § 59 Universities Act. With regard to communication with each other, WU invokes the legitimate interest pursuant to Art 6 para 1 lit f GDPR., easily accessible and location-independent communication.

The recipients are the video conferencing systems of Zoom Video Communications Inc. (Zoom) and Microsoft (Microsoft Teams) based in the USA. Virtually participating persons receive text, video and audio data of the other participating persons as part of the transmission. In addition, the names of the virtually participating persons are also visible to the other participants.

1.5. Online supervision for online exams

The processing is carried out for the purpose of conducting and ensuring the integrity of the online exam, in particular to ensure that the exam is processed exclusively by you, that there is no oral exchange with third parties and that no unauthorized resources (Internet, own computer) are accessed.

The following categories of data are processed: Name; student ID number; contact details; audio and video data when the camera and microphone are activated; uploaded photos/ID;

The legal basis for the processing is the performance of a task in the public interest pursuant to Art 6 para 1 lit e of the GDPR, in particular for the determination and assessment of academic performance pursuant to § 72 of the Universities Act. Pursuant to § 73 Universities Act, an assessment shall be declared void by notice if the assessment was cheated during an exam, in particular by using unauthorized aids. Further legal bases are Art 9 para 2 lit j GDPR in conjunction with Art 89 para 1 GDPR and § 2f para 5 Research Organization Act (FOG).

1.6. Evaluation and quality assurance in teaching

The data from the student and alumni surveys as well as the evaluation of the admission test are processed for the purpose of quality assurance and further development of the portfolio of courses. The WU Student Panel provides us with important information about the study situation from the students perspective over the entire student lifecycle as a basis for the further development of study quality at WU.

The following categories of data are processed: Study data; selection procedure and start of studies; socio-demographic data; study decision; activities prior to start of studies; study entitlements; planned course of studies; planned study-related stays abroad; plans after studies; workload during studies; career planning; satisfaction with studies; orientation during studies; attitudes towards studies; Self-assessment in the course of studies; planned course of further studies; satisfaction with technical infrastructure; job search; occupational situation; duration of occupation; occupational title; occupational experience; possible suggestions for improvement; financial situation; information on bachelor's / master's thesis; special knowledge and qualifications; account data;

The legal basis for the processing is the fulfillment of legal obligations pursuant to Art 6 para 1 lit c GDPR as well as the performance of a task in the public interest pursuant to Art 6 para 1 lit e GDPR (inter alia § 14 Universities Act; §§ 18ff Higher Education Quality Assurance Act; § 141 Universities
Act; Education Documentation Act; By-laws of WU).

1.7. IT user management and support, ensuring IT functionality and IT security

The processing is carried out for the administration of accounts, authorizations, user IDs and selfservices related to the WU account and associated services. For this purpose, WU also uses external IT service providers as data processors for the provision, support and/or maintenance of the IT applications and IT systems used by WU. Without this data processing, secure operation and data protection-compliant use of the IT systems is not possible.

The following categories of data are processed: WU login data; name; area-specific personal identifier
(bPK); contact details; student ID card photo; content data; log data; access authorizations;

The legal basis for the processing is the legitimate interest pursuant to Art 6 para 1 lit f GDPR (Interest in secure and functioning user* administration) and the fulfillment of a legal obligation pursuant to Art 6 para 1 lit c GDPR (Art 24, Art 32 GDPR) to take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

Recipients are Microsoft Austria for the student email account (Microsoft 365). The data are stored by Microsoft within the EU. For the physical storage of the data (backup data), we use the Federal Government Failure Computer Center (Ausfallsrechenzentrum des Bundes) as a data processor. In addition, we use other IT service providers as data processors for the provision, support and/or maintenance of the IT applications and IT systems used by WU.

1.8. Support services for first-semester students

The data are processed and stored for the purpose of conducting study-accompanying tutorials to support first-year students at bachelor level in their social and academic integration at WU, as well as to divide first-year students into groups and to assign them to tutors. Furthermore, we process
the data of the tutors for the purposes of selection and, if applicable, for crediting the activity as a
free elective.

Categories of data students: Name; gender; date of birth; citizenship; Student ID number; contact details; degree program.

Categories of data tutors: Name; gender; date of birth; citizenship; student ID number; contact details; degree program; ECTS already completed; examination results.

The legal basis for the processing is the fulfillment of a legal obligation pursuant to Art 6 para 1 lit c GDPR (§ 60 para 1 c Universities Act - Establishment of Beginners' Tutorials). Virtually participating persons receive text, video and audio data of the other participating persons as part of the transmission. In addition, the names of the virtually participating persons are also visible to the other participants.

1.9. Student mobility

The processing is carried out for the purpose of the application procedure and subsequently for the organizing of the stay within the framework of a mobility program at WU.

The following categories of data are processed: Type of international mobility and host country of stay abroad; name; contact details; address; gender; nationality; emergency contact; degree program; start date; semesters completed at WU; collective certificate; grade point average; international experience; language skills; curriculum vitae; copy of passport; track record;

The legal basis for the processing is the fulfillment of a legal obligation pursuant to Art 6 para 1 lit c GDPR (§§ 2,3 Universities Act: obligation of the University to promote international mobility), consent pursuant to Art 6 para 1 lit a GDPR and the legitimate interest pursuant to Art 6 para 1 lit f GDPR.

Recipients are partner universities, insurance companies, funding agencies.

1.10. Graduate administration

Processing is done for maintaining contact with graduates, such as information on continuing education, events, field trips, surveys.

The following categories of data are processed: Name; contact details; date of birth; student ID number; graduation; degree program; title; salutation; gender; previous names; donations; event data.

The legal basis for the processing is the performance of a task in the public interest pursuant to Art 6 para 1 lit e GDPR (§ 3 para 10 of the Universities Act: maintaining contact with graduates; § 3 para 5 of the Universities Act: continuing education of graduates), in the case of participation in paid events the performance of a contract pursuant to Art 6 para 1 lit b GDPR and the legitimate interest pursuant to Art 6 para 1 lit f GDPR (public relations).

Recipients are printers, postal services, banks, payment providers, tax consultants, auditors, tax authorities. Data Dialog EDV Systeme GmbH is used as data processor.

1.11. Library management

The processing is carried out for the purpose of using the University Library and the library services offered borrowing included and, if necessary, for dunning purposes and any related law enforcement.

The following categories of data are processed: Name; student ID number; gender; date of birth; contact details; library card data; user ID; borrowing data; billing and payment data; dunning data; log data.

The legal basis for the processing is the performance of a task in the public interest pursuant to Art 6 para 1 lit e GDPR and the legitimate interest in the provision of services by the library pursuant to Art 6 para 1 lit f GDPR and Art 9 para 2 lit f GDPR for the assertion or defense of legal claims.

Recipients are external service providers (Ex Libris GmbH, Discoverysystem Primo, Smartfreq Ltd. and k42-Gregor Dorfbauer), Austrian Library Network, Financial Procurator's Office, Mensa cafeteria.

1.12. Locker management

The processing is carried out for the purpose of using electronic lockers.

The following categories of data are processed: Name; student ID number; gender; date of birth; contact details; locker number; library card data; period of use; log data.

The legal basis for the processing is the performance of the contract pursuant to Art 6 para 1 lit b GDPR and the legitimate interest in the protection of the property pursuant to Art 6 para 1 lit f GDPR.

Recipient is the company Gantner Electronic GmbH, which uses WU as a data processor.

1.13. Legal disputes

The processing is carried out for the assertion, exercise or defense of legal claims.

The following categories of data are processed: Name, contact details, student ID number, file contents;

The legal basis for the processing is WU's legitimate interest in asserting, exercising or defending legal claims pursuant to Art 6 para 1 lit f GDPR.

Recipients are involved persons, such as courts and legal representatives, public prosecutor's office.

2. Will your data be passed on to recipients outside the EU / EEA?

In the context of student administration, no data is usually transferred to recipients outside the EU / EEA. However, in connection with the use of cloud providers, data may be transferred to third countries. In this case, the regulations according to Art 44 ff GDPR may apply. The transfer takes place either on the basis of an adequacy decision pursuant to Art 45 GDPR or with the express consent of the data subjects pursuant to Art 49 para lit 1 lit a GDPR or for the performance of a contract concluded with the data subjects or in their interest pursuant to Art 49 para 1 lit b GDPR or for important reasons of public interest pursuant to Art 49 para 1 lit d GDPR.

If it is possible by reasonable means, we avoid the use of data processors from third countries. If the use of data processors from a third country cannot be avoided, we ensure the conclusion of appropriate contractual agreements (in particular the conclusion of standard contractual clauses pursuant to Art. 46 para 2 lit c GDPR) and the promise of appropriate guarantees in order to guarantee an equivalent level of data protection.

3. How long do we store your data?

WU is required by various legal provisions, including the Universities Act 2002, the Education Documentation Act, and the University Student Records Ordinance 2004, to keep a variety of data on its students, including, for example, name, date of birth, gender, nationality, address, start and end dates of education, student ID number and examination data.

The home address and mailing address shall be stored for 10 years. With regard to ensuring the proper allocation of student ID numbers, the student ID number, last name and first name(s), date of birth, gender, nationality, date of general university entrance qualification, identification as invalid student ID number, area-specific personal identifier (BF) must be stored for 99 years. Examination data must be stored for at least 80 years in accordance with § 53 Universities Act. Examination reports, corrections of written exams, assessment sheets and examination forms must be kept for 6 months after the announcement of the assessment (§§ 79, 84 Universities Act). The students' social security number or substitute identification number contained in their records are deleted by the educational institution no later than 2 years after their departure. Data related to bank payments are kept for 7 years in accordance with § 132 BAO and deleted thereafter.

Student and alumni survey data are deleted after six years. Online supervision data is stored during the 4-week assessment period and beyond that during the 2-week appeal period, after which it is deleted. In the event of an appeal, the data will be stored until the conclusion of the relevant proceedings and then deleted. Locker management data will be deleted from the system 14 days after use. In the event of legal disputes, data is generally retained at least as long as claims can be asserted against WU and until the conclusion of any legal disputes in which the data is needed as evidence. Statutory limitation periods are usually 3 years and 30 years at the longest.

4. What rights do you have as a data subject?

As a data subject in the context of these data processing operations, you have the following rights vis-a-vis WU as the controller: information and access, rectification, deletion, restriction of data processing, data portability, and objection. As a data subject, you also have the right to file a complaint with the Austrian Data Protection Authority. Further information on your rights as a data subject is available on our website at www.wu.ac.at/betroffenenrechte. 

To exercise any of these rights, please contact the WU data protection team at datenschutz@wu.ac.at.

WU Vienna University of Economics and Business is committed to protecting your personal data. Your personal data are kept confidential and processed in accordance with the provisions of the applicable data protection laws. Pursuant to Article 13 of the GDPR, we hereby inform you about the processing of personal data in connection with your registration for and participation in a EA (Executive Academy) event.

Contact information

You can contact us at:

Controller:

WU Wirtschaftsuniversität Wien
attn: Executive Academy (EA)
Welthandelsplatz 1, Gebäude EA, 1020 Wien
 

Data Protection Officer:

WU Wirtschaftsuniversität Wien
attn: Datenschutzbeauftragter p.A. Rechtsabteilung
Welthandelsplatz 1, Gebäude AR, 1020 Wien
 

If you have any questions regarding the content of this Privacy Policy, please contact EA IT-Team at ea-it-team@wu.ac.at

For any other matters related to data protection, please contact the WU data protection team at datenschutz@wu.ac.at

What types of personal data are processed?

We process the personal data you provided when signing up for the event.

Are you obligated to provide your personal data?

The personal data that you are asked to provide during the sign-up process are required for participation in the event, because they are necessary for WU to be able to properly organize and carry out the event. Without providing these data, participation in the event is not possible.

For which purposes do we process your data?

We process your personal data for the purposes of event registration, implementation, and management. This includes short-term notifications in the event of any scheduling changes or cancellations made on short notice and billing for events that are subject to a fee. In addition, we may also process your data for documentation and information purposes. This includes event reports and reviews and information about future events.

What is the legal basis for processing your data?

• Art. 6 (1) item a of the GDPR – consent

If you consented to the processing of your personal data when signing up for the event, we will only process your data for the purposes and within the scope specified in the declaration of consent.

You can withdraw your consent to any future data processing at any time. Once you withdraw your consent, we will no longer process your data for the purposes indicated above.

In all other cases, the following regulations provide the legal basis for the processing of your data:

• Art. 6 (1) item b of the GDPR – performance of a contract or taking steps prior to entering into a contract

• Art. 6 (1) item e of the GDPR – performance of a task carried out in the public interest (public relations work pursuant to § 3 [11] of the Universities Act 2002 [Universitätsgesetz, UG])

• Art. 6 (1) item f of the GDPR – legitimate interests pursued by WU (information about future events and documentation of WU’s activities and developments at WU)

Who has access to your data?

As a general rule, we do not transmit your data to any third parties. In individual cases, however, it may be necessary to transmit the data to service providers commissioned by WU to meet the purposes specified above. We select our service providers carefully and conclude data processing agreements that obligate them to process your data in accordance with the applicable legislation.

How long do we store your data?

We process your data only as long as necessary for the purposes of event registration, implementation, and documentation and for the purposes of performing the relevant contracts and providing information.  Beyond that, we retain your data only as long as required by any applicable statutory data retention periods.

In connection with the performance of contracts, specific statutory data retention periods may apply under the Austrian Commercial Code (Unternehmensgesetzbuch) and the Federal Fiscal Code (Bundesabgabenordnung).

What are your rights as a data subject?

As a data subject affected by these data processing activities, you have the following rights vis-a-vis the controller:

• Right to information and access to the data

• Right to correction of data

• Right to deletion of the data

• Right to restrict the data processing

• Right to data portability

• Right to object to the data processing

As a data subject, you also have the right to file a complaint with the Austrian Data Protection Authority. You can find more information on your rights as a data subject on the website https://www.wu.ac.at/en/datenschutz/betroffenenrechte.

WU (Vienna University of Economics and Business) is committed to protecting your personal data. Your personal data are kept confidential and processed in accordance with the provisions of the applicable data protection laws. Pursuant to Article 13 of the GDPR, we hereby inform you about the processing of personal data in connection with your registration for and participation in a EA (Executive Academy) event.

Contact information

You can contact us at:

Controller:

WU Wirtschaftsuniversität Wien
attn: Executive Academy (EA)
Welthandelsplatz 1, Gebäude EA, 1020 Wien
 

Data Protection Officer:

WU Wirtschaftsuniversität Wien
attn: Datenschutzbeauftragter p.A. Rechtsabteilung
Welthandelsplatz 1, Gebäude AR, 1020 Wien
 

If you have any questions regarding the content of this Privacy Policy, please contact EA IT-Team at ea-it-team@wu.ac.at

For any other matters related to data protection, please contact the WU data protection team at datenschutz@wu.ac.at

Regulations for participants in university courses, short programs, lectures and other events at the WU Executive Academy

The participant acknowledges that the personal data collected in the course of the initiation and execution of the program or event will be processed automatically by the WU Executive Academy for the purpose of contractual fulfillment and for the fulfillment of the legally assigned tasks of a university.
 

For the administration of the program or event, participants' personal data will be passed on to lecturers, WU staff members responsible for the organization of the program (Studies and Examination Office, study law), as well as those cooperation partners of the WU Executive Academy who are involved in the program or event booked.
 

The legal basis for the processing is in particular Article 6 paragraph 1 letter b DSGVO (fulfillment of contract) and, in particular in the case of university courses as defined in Article 56 of the University Act 2002 (UG), also Article 6 paragraph 1 letter c DSGVO (legal obligation), Article 6 paragraph 1 letter e DSGVO (performance of a task in the public interest), Article 9 paragraph 2 letter j DSGVO, Article 89 DSGVO (scientific research purposes), the UG, the Research Organization Act (FOG), and the WU statutes. In addition, certain personal data within the scope of application of the UG must also be transferred by the WU Executive Academy to the "Datenverbund der Universitäten und der Pädagogischen Hochschulen" (Data Network of Universities and Universities of Teacher Education) due to legal requirements.
 

In some programs, the WU Executive Academy provides its participants with an online learning platform, which is designed to facilitate and promote internal communication between participants. Participants are therefore aware that name, e-mail and other personal data will be passed on to other participants. Under the University Act, the universities are responsible in particular for the continuing education of university graduates (section 3(5) UG) and for maintaining contacts with graduates (section 3(10) UG). In order to fulfill these tasks, WU uses graduates' data to inform them about the services offered by WU Alumni Services. The legal basis is Art 6 (1) lit e DSGVO (performance of public duties).
 

For evaluation and quality assurance purposes, the relevant accreditation bodies (e.g. EFMD, FIBAA, AMBA, AACSB) as well as supervisory authorities of the WU Executive Academy may also have access to the personal data of participants. The legal basis for this are legal obligations under Art 6 para. 1 lit c DSGVO (including Art 14 UG; Art 18 ff Hochschul-Qualitätssicherungsgesetz) as well as important public interests under Art 89 DSGVO, Art 9 para. 2 lit j DSGVO in conjunction with Art 2e FOG.
 

Furthermore, WU Executive Academy allows participants to send information about WU Executive Academy offerings by mail or e-mail, even after completion of a program or event, as long as participants do not object to the use of their data for direct marketing purposes.
 

All personal information provided by participants will be treated confidentially by the WU Executive Academy and will only be used in the manner and for the purposes described above.
 

Version: 19.10.2019