Data Privacy Statement

Effective: July 19, 2023

1) Preamble

Welcome to our website! In the following, we want to detail which data we process when and to what purpose and on which legal basis. This is to explain how the services we offer work and how the protection of your personal data is guaranteed in doing so.

According to article 4(1) of the General Data Protection Regulation (GDPR), personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. For more information see GDPR art. 4(1), among others.

To view, save and print this Data Privacy Statement at any time go to https://www.munich-business-school.de/en/mbs/university/legal/privacy-policy

In each chapter, we will specifically refer to the right of objection again (e.g. by stating: “You have the right of objection”), provided there is such a right. There, you will also find additional information with regard to exercising your right of objection.

In order to help clarify the following Data Privacy Statement, we will include various links to information and data protection notes on external websites (see also chapter titled “Social Networks & External Links” in this Data Privacy Statement). We aim to diligently update the links included in this Data Privacy Statement as necessary. Nevertheless, it is possible that links might not work properly due to periodic updating of the cited websites. If you encounter a dead or broken link, we ask that you inform us so we can replace it with an updated link.

2) Controller

For the purpose of GDPR art. 4(7) relating to the processing of personal data, Controller is:

Munich Business School GmbH
Elsenheimerstraße 61
80687 München

Tel.: +49 (0)89 547678-0
Fax: +49 (0)89 547678-29
Email: info(at)munich-business-school.de

Data Protection Officer

For any questions relating to the processing of your personal data as well as to your rights concerning data protection please contact:

In-house:

Petra Kaltofen
Hauptstraße 23
63811 Stockstadt am Main
Phone: +49 (0)6027 4188-0
Fax: +49 (0)6027 4188-20
Email: datenschutz(at)eso.de

Off-site:

Marc Althaus (Data Protection Controller (off-site))

Contact form: https://www.dsextern.de/anfragen
DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Frapanweg 22
D-22589 Hamburg
Email: datenschutz(at)eso.de

4) Logfiles

Any time you access our website, we automatically gather data and information from your device’s system and store it in so-called server logfiles. This data concerns information relating to an identified or identifiable natural person (in this case, the website visitor). The data is automatically transferred by your personal browser when you access our website. Specifically, the following data is gathered:

• the time our website was viewed (request to server of host provider),
• the URL of the website from which you accessed our website,
• the IP address of your computer.

We process this data in order to enable your device to access our website and enable the correct display of our website on your device and in your browser. In addition, the data serves to optimize our website and to ensure the security of our systems. Interpretation of these data is not used for the purpose of marketing.

The legal basis for our processing of this data is GDPR art. 6(1)(f). We have a legitimate interest in providing you a website, which is optimized for your browser, and in allowing communication between our server and your terminal device. For the latter, the processing of your IP address is necessary in particular.

The processed information will be stored only as long as this is necessary for the intended purpose or as is required by law.

The recipient of the data is our server host which operates on our behalf in the context of a commissioned data processing agreement.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

5) Cookies

Our website uses cookies. Cookies are text files which are stored on your device in order to facilitate the use of a website, recognize the device of the user and save settings, and permit the customization of educational offerings & products to the specific requirements of customers. Cookies can be used to store input and settings made on a website so that you don’t have to re-enter the same details each time you visit the website. Cookies contain a so-called “cookie ID tag” which makes it possible to identify the device on which the cookie is stored. In particular, we use following cookies:

• Cookies which contain a randomly generated specific identification number which will make you and/or your device identifiable during your visit to our website. These cookies will be deleted automatically at the end of your visit.
• Cookies which contain a randomly generated specific identification number which will make you and/or your device identifiable on our website. These cookies track whether a user came through Google Ads. This information is sent to the CRM forms. These cookies will be deleted automatically after 30 days.

Purpose of this data processing is to facilitate the use of our website for you, to allow you to save settings, and to improve the customization of educational offerings & products to the specific requirements of customers.

The legal basis for our processing of this data is GDPR art. 6(1)(f). We have a legitimate interest in providing you a website which remembers your personal settings and facilitates your visit.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

Other services we use also employ cookies. We will indicate to you when any of these services is using cookies.

6) Information on Google Services

On our website, we use several services provided by Google Inc. (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

In the following text of the Data Privacy Statement, you will find more information about each specific service provided by Google which we use on our website.

By integrating these Google Services, Google may under certain conditions collect and process information (this includes personal data). In doing so, it cannot be ruled out that Google may transfer this information to a server in a third country.

As described in Google’s Privacy Shield certification (see https://www.privacyshield.gov/list and enter the search term “Google“), Google complies with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework regarding the collection, use and retention of personal data from European Union member countries and Switzerland respectively. Google, including Google LLC and its wholly-owned US subsidiaries, has certified that it adheres to the Privacy Shield Principles. For more information please go to https://www.google.de/policies/privacy/frameworks/.

We ourselves are unable to influence which data and information Google is actually collecting and processing. However, Google states that, in principle and in addition to other information, the following information (including personal data) is processed:

• log information (especially IP address)
• location information
• unique application numbers
• cookies and similar technologies

When you are signed in to your Google account, Google can, depending on your account settings, add the processed information to your account and treat it as personal data. (For more information on this, see https://www.google.de/policies/privacy/partners/.)

In this respect, Google states the following:

“We may combine personal information from one service with information, including personal information, from other Google services – for example to make it easier to share things with people you know. Depending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google.” (https://policies.google.com/privacy?hl=en)

You can prevent this data from being added directly by logging out of your Google account or by changing the corresponding settings in your Google account. Furthermore, you can prevent the installation of cookies – as far as Google creates them – by changing the corresponding settings in your browser; however, it is important to note that if you do so, you may not be able to use all features of this website to their full extent.

Learn how to delete cookies in the most common browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Internet Explorer

For more information see the Google Privacy Policy which you can access under:
https://www.google.com/policies/privacy/

For references concerning Google’s Privacy Settings see:
https://privacy.google.com/take-control.html.

7) Google Analytics

On our website, we use Google Analytics, a web analytics tool provided by Google LLC (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies”, text files which are stored on your device and permit an analysis of your use of the websites you visited. Google Analytics can also use so-called Web Beacons (invisible graphics). Web Beacons are used to analyze information such as traffic on websites. Information created by cookies and Web Beacons about the use of our website (including the users’ IP addresses) is transferred to and stored on a server operated by Google which may be located in the USA or other third countries. This information may be passed on by Google to their contract partners.

For information on Google’s present Privacy Shield Certification and other relevant details about data processing by Google when using Google Services, see chapter “6) Information on Google Services“ of this Data Privacy Statement.

Google processes the following types of data:

• online identifications (including cookie identifiers)
• IP address
• device identifiers

For additional, more detailed information about the processed data, see “Information we collect as you use our services” at https://www.google.com/intl/en/policies/privacy/#infocollect as well as https://privacy.google.com/businesses/adsservices/.

We employ Google Analytics only with “anonymize IP” activated. In this setting, Google shortens your IP address in the member states of the European Union or other contractual states of the Treaty of the European Economic Area. Only in exceptional cases will Google send the complete IP address to one of their servers in the USA to shorten it there.

Furthermore, we concluded a contract with Google Analytics about the use of Google Analytics for the processing of data on our behalf (GDPR art. 28). Google processes the data on our behalf in order to analyze your use of our website, create reports about activities on our website, and render further services with regard to the use of our website and the Internet. Google may transfer this information to third parties if it is required by law or if such third parties process data on Google’s behalf.

We integrate Google Analytics for the purpose of analyzing user behavior on our website and allowing us to respond to this behavior. This enables us to constantly improve the services we offer.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit that the features described above provide in terms of the scope of our services. The statistical evaluation of user behavior allows us in particular to respond in a way that takes into account the users’ interests and to optimize the scope of our services.

For the purpose of processing data on our behalf, Google is allowed to employ subprocessors. You will find a list of such subprocessors at https://privacy.google.com/businesses/subprocessors

The processed information is stored for 38 of months and will be deleted automatically after expiration of this retention period.

For more information on how Google Analytics treats your data, see Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=en

For more information about Google’s privacy settings, see
https://privacy.google.com/take-control.html?categories_activeEl=sign-in

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

8) Google Tag Manager

We use the Google Tag Manager on our website. The Google Tag Manager is a service provided by Google LLC ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The Google Tag Manager helps us to integrate various codes and services on our website in a neat and simplified way. The Google Tag Manager implements the tags and “triggers” the integrated tags. When tags are triggered, Google may collect and process information (including personal data). In this regard, it cannot be ruled out that Google may transfer the information to a server in a third country.

For information on Google’s present Privacy Shield Certification and other relevant details about data processing by Google when using Google Services, see chapter “6) Information on Google Services“ of this Data Privacy Statement.

In particular, the following personal data is processed by the Google Tag Manager:

• online identifications (including cookie identifiers)
• IP address

For additional, more detailed information about the Google Tag Manager see:
https://www.google.com/analytics/terms/tag-manager/ and “Information we collect as you use our services” at https://www.google.com/intl/en/policies/privacy/index.html.

Furthermore, we concluded a contract with Google about the use of the Google Tag Manager for the processing of data on our behalf (GDPR art. 28). Google processes the data on our behalf in order to trigger the stored tags and display the services on our website. Google may transfer this information to third parties if it is required by law or if such third parties process data on Google’s behalf.

If you have disabled individual tracking services (e.g. by having an opt-out cookie created), every relevant tracking tag integrated through the Google Tag Manager remains disabled.

We implemented the Google Tag Manager for the purpose of integrating various services in a neat and simplified way. In addition, integrating the Google Tag Manager optimizes the loading times of the various services.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit gained from integrating various services through the Google Tag Manager. Integrating the Google Tag Manager reduces the time and effort required for maintenance and loading the website as well as the server load and the traffic load. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services.

The processed information will be stored only as long as this is necessary for the intended purpose or as is required by law.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, the failure to provide such data could under certain conditions result in your being unable to use our website at all or to the full extent possible, and the display of the website may also differ.

For more information see the Google Privacy Policy which you can access under:

• www.google.com/fonts#AboutPlace:about
• https://developers.google.com/terms/
• www.google.com/policies/privacy/

For more information about Google’s privacy settings, see https://privacy.google.com/take-control.html?categories_activeEl=sign-in

10) Google Ads

This website uses Google Ads and, within the scope of Google Ads, Conversion Tracking, an online marketing service by Google LLC (“Google“), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Ads and Google Conversion Tracking are analytic services provided by Google. When clicking on an advertisement placed by Google, a so-called “cookie”, a text file, is stored on your device permitting an analysis of your use of the websites you visit. Information created by the cookie about your use of this website (including your IP address) is transferred to and stored on a server operated by Google which may be located in the USA or other third countries. These cookies lose their validity after 30 days. When you visit some of our sites while the stored cookie has not expired, Google and ourselves can recognize that somebody clicked on the advertisement and was redirected to our website. Each Ads customer gets a different cookie. In this way, cookies can be tracked across the websites of Ads customers.

For information on Google’s present Privacy Shield Certification and other relevant details about data processing by Google when using Google Services, see chapter “6) Information on Google Services“ of this Data Privacy Statement.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). The potential to evaluate the success of individual offers allows us to respond specifically to market behavior and place our offers in the best position for interested users. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services, among other things.

For more information see the Google Privacy Policy which you can access at:
www.google.com/policies/privacy/

For more information about Google’s privacy settings, see
https://privacy.google.com/take-control.html?categories_activeEl=sign-in

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use this feature of our website at all or to the full extent possible.?

11) Google Remarketing

We use the service Google Remarketing provided by Google LLC ("Google"), 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Google Remarketing creates a cookie on your computer. This cookie allows Google to recognize you when you access other sites within the Google advertising network. This makes it possible to recognize your device on other websites of the Google advertising network and to show you personalized advertisements. In the context of this process, information (including personal data) is transferred to Google. This may also mean transferring data to states outside the EC, especially to the USA. In some circumstances, Google may share information with third parties.

The collected information is used by Google in particular to show you advertisements within the Google advertising network which are aimed at your interests. We will not receive any information which allows to draw conclusions about you as a person at any time.

For information on Google’s present Privacy Shield Certification and other relevant details about data processing by Google when using Google Services, see chapter “6) Information on Google Services“ of this Data Privacy Statement.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). The potential to evaluate the success of individual offers allows us to respond specifically to market behavior and to place our offers in the best position for interested users. In addition, Google has a legitimate interest in the collected (personal) data in order to market personalized advertisements and to improve its own services.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

12) Information Material Form

On our website you will find a form which you can use to request information material about training, studies and / or further education. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• program
• start date of the program
• preferred location (only on general pages)
• delivery method (digital or postal)

If you want to receive the information material digitally, the required details (marked with an “*”) include the following additional data:

• form of address
• first name
• last name
• phone number/mobile number
• email address
• Country

If you want to receive the information material by post, the required details (marked with an “*”) include the following data:

• form of address
• first name
• last name
• street
• house number
• zip code
• place
• country
• phone number / mobile number
• email address

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and to guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old.

The purpose of processing your personal data is to deal with your request for information material, answer your inquiry or other queries, contact the inquirer, provide professional and consistent advice during the decision-making process, invite you to information sessions, for example to an Open House, study taster, or the like, or to prepare customized offers.

Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6(1)(f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent with regard to and/or have seen the Data Privacy Statement as well as proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. The legal basis for processing this data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of your request for brochures in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our contact form.

13) Contact Form

On our website you will find a contact form which you can use to contact us electronically. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• email address
• favored location (only on general pages)
• form of address
• first name
• last name
• phone number/mobile number
• Country
• the information contained in your message

Please note that the amount of personal data collected in the context of the contact form also depends on the details you provide in the message part of the contact form.

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old.

The purpose of processing your personal data, in terms of the required as well as the voluntary details, is to deal with contact inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your inquiries.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent to and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the contact form in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our contact form.

14) Consultation Form

On our website you will find a form which you can use to contact us electronically in order to make an appointment for a no-obligation consultation about our educational offers. When you contact us using this consultation form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• form of address
• last name
• first name
• email address
• phone number/mobile number
• Country
• the information contained in your message

Please note that the amount of personal data collected in the context of the consultation form also depends on the details you reveal in the message of the consultation form.

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to our best knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.?

In addition, the following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old or have the consent of a parent or legal guardian.

The purpose of processing your personal data in terms of the required as well as the voluntary details, is to deal with consultation inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time in order to make an appointment for a consultation so that we can answer your queries.

Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.

The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.?

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our contact form.

15) Application Form

On our website you will find a form which you can use to contact us electronically in order to submit your application for the training, studies or further education offered.

When you contact us using this contact form, we will process the data you enter in the input fields.

The following data will be collected in this context:

• master data
• applicant’s data
• information contained in the application documents you send

The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, process the application in its entirety, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.

In addition, following data is processed when sending the message:

• your IP address
• date and time of sending
• your consent to the Data Privacy Statement
• your agreeing or disagreeing to receive advertisements from Munich Business School
• your confirmation that you are at least sixteen years old or have the consent of a parent or legal guardian.

Please note that the amount of personal data collected in the context of the application form also depends on the details you reveal in the message included in the form or in the application documents.

The purpose of processing your personal data is to process the application and to enable us to contact the inquirer in order to answer his or her queries. The purpose of processing your personal data resulting from the application documents is to identify suitable applicants.

All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.

The legal basis for our processing of your master data is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries. The legal basis for our processing of your personal data resulting from the application is GDPR art. 6(1)(b) and art. 88(1) as well as §26(1) of the new Federal Data Protection Act.

Additional personal data processed at the time of sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.

The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as to document the proof that you are at least sixteen years old.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.

Your personal data will be processed only as long as this is necessary for the purpose. The application email and the documents you send us will be retained until a decision is made as to whether to accept the applicant or not, and it will be deleted afterwards.

The additional data collected when the form was sent will be deleted after a maximum of 14 days.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your data, you have the right to object.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, the failure to provide such data could under certain conditions result in you being unable to use our contact form.

16) "Welcome to Munich Business School" Form

When you visit our locations or when we visit your company or when you meet us at exhibitions or any other event, you have the option to fill in a form (“Welcome to Munich Business School!”) which you can use to request information material about training, studies, further education and/or other educational opportunities or to ask for individual consultation. The location indicated on the form you filled in is the Controller with regard to the processing of personal data resulting from the utilization of the form (see Chapter 2) Controller). When you contact us using this “Welcome to Munich Business School!” form, the data you enter will be processed exclusively by the location you selected.

The comprises the following information:

• form of address
• last name
• first name
• street
• house number
• zip code
• place
• phone number/mobile number
• email address
• start date
• the data you entered as part of the field education program / remarks
• if applicable, any other data you entered in the form.

The purpose of processing your personal data is to deal with your request for information material, answer your inquiry or other queries, contact the inquirer, provide professional and consistent advice during the decision-making process, invite you to information sessions, for example to an Open House, study taster, or the like, or to prepare customized offers.

Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6 (1) (f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.

If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6 (1) (f). We have a legitimate interest in processing the data you entered as part of this form in order to send you information about our products and services.

The completed form which you hand in at your selected location will be scanned by the location and is recorded in our CRM.

The processed data will be stored only as long as this is necessary for the intended purpose or is required by law.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing. Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, the failure to provide such data could under certain conditions result in you being unable to use our contact form.

17) Form "Refer a Friend to MBS!"

For the recruitment of new students by students, we use a card "Refer a Friend to MBS" on which both the advertiser and the person to be recruited give their data and must sign in each case. The person responsible for the personal data processed as a result of the use of the form is the location indicated on the form you use (see section "2) Responsible person"). If you contact us by means of this form, the data provided in the contact form will be processed exclusively by the site you have chosen.

This includes the following data:

• last name
• first Name
• street
• house number
• zip Code
• place
• phone number/mobile number
• email address
• course of studies
• statement of recommendation
• payment details
• signature

The purpose of the processing of personal data is to recruit new students through already registered students and alumni and to provide the advertisers with a bonus for this.

The legal basis for the processing of the personal data provided by you within the scope of this campaign is, on the one hand, the initiation of a contract in accordance with Art. 6 Para. 1 lit. b) DSGVO, as well as our legitimate interest in accordance with Art. 6 Para. 1 lit. f) DSGVO through this incentive for registered students to advertise our educational offers and thus attract new students. As a further legal basis we use the consent according to Art. 6 para. 1 lit. a) DSGVO of the person to be advertised in order to provide him/her with the necessary offers.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement.

The processed data will only be stored for as long as necessary for the intended purpose or as required by law. In the event of successful placement, the data will be stored for 10 years. If the mediation was not successful, the data will be deleted after the first quarter of the following year.

Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.

18) Mathematics Intensive Course Form

On our website you will find a form which you can use to register for the Mathematics Intensive Course. When you contact us using this form, we process the data you enter in the input fields.

The required details (marked with an “*”) include the following data:

• last Name
• first Name
• date and place of birth 
• citizenship street
• zip Code
• place
• country 
• phone number/mobile number
• email address

The purpose of processing personal data is to process the registration for the course, to be able to contact the inquirer to answer the request and to subsequently carry out the course offer.
The legal basis for the processing of personal data described here is Art. 6 Para. 1 lit. b) GDPR.

The processed data will only be stored as long as it is necessary for the intended purpose or as is required by law. A statutory retention period of 10 years exists for the contract data after the end of the contract.
You are not obliged to provide the personal data, but the provision of the personal data is necessary for the registration for the course and thus for the conclusion of the contract. Failure to do so would result in the contract not being concluded.

19) “Executive Education” Certificate Courses

In co-operation with Controller Institut GmbH, Vorgartenstraße 204/6, 1020 Vienna, Austria, we implement “Executive Education” training programs. These training programs are part-time further education programs for professionals working in medium/higher management.

In this respect, our website provides a form which you may use to contact us electronically to apply for one of our further education programs. 

Should you use the form to contract us, we will process any data which you enter in the different entry fields. 
This may include, without limitation, the following data:

• your surname and first name;
• your address;
• your e-mail address;
• your telephone number;
• your position at the company; and
• the name of your employer.

These mandatory entries are required in the context of our internal routing processes to be able to assign to the applicants the right person to contact, to be able to fully process any applications and to be able to guarantee that clients are addressed in an appropriate manner. We employ a centralized CRM (customer relationship management) system, whereby our system directly transfers applications to the educational facility in charge and the relevant consultants based on the above mandatory entries. 
When sending the message, the following data will also be processed:

• your IP address;
• the date and time when it was sent;
• your consent to the privacy policy;
• your consent or objection to receiving Munich Business School advertising materials;
• your confirmation of having reached the age of sixteen or having obtained a consent from your parent or legal guardian. 

Please note that the extent of personal data collection in the context of the application process also depends on which data you provide on the form yourself. 

The purpose of processing your personal data consists in processing incoming applications and in being able to contact you to react to your queries. Personal data included in the application documents which you provide to us is processed for the purpose of being able to determine the adequacy of candidates. 
The legal basis of processing your master data is art. 6(1) point (f) of the GDPR. We have a legitimate interest in providing you with an opportunity to contact us at any time and in adequately reacting to your queries. The processing of personal data included in applications is made on the legal basis of the provisions under art. 6(1) point (b) of the GDPR, art. 88(1) of the GDPR and sec. 26 para. 1 of the German Federal Data Protection Act in its new version. 

Within the framework of these processing activities, co-operation with Munich Business School is based on a contract on joint controllership in terms of art. 26 of the GDPR; we will be happy to provide you with a copy upon your request.

Any other personal data which is processed at the time of form delivery (such as the IP address and the date/time of sending) have the purpose of preventing third parties from misusing our contact form and – if applicable – documenting the granting of consents, the agreement to the data protection notices and the confirmation of having reached the age of sixteen; 
in this case, the legal basis is our legitimate interest pursuant to art. 6(1) point (f) of the GDPR. We have a legitimate interest in preventing our contact form from being misused and in being able to prove that it was misused. In addition to the above, we have a legitimate interest in recording the declaration of consent we receive from you, your agreement to the data protection notices and your confirmation of having reached the age of sixteen. 

To the extent you consented to any advertising activities, we additionally process your data for this purpose. The legal basis of this type of personal data processing is your consent which you granted on the basis of art. 6(1) point (a) of the GDPR. 

In this regard, your personal data will be processed only for as long as this is required for the purpose of providing this function. Applications and related documents delivered by e-mail will be stored until a decision is made for or against the relevant applicant and they will be deleted after this. 

Any data which is additionally collected while sending the form will be deleted not later than after 14 days. 
All this data is transferred to Euro IT Solutions Service und Vertriebs GmbH who provides the CRM system and works for us in the context of contract data processing, as well as the server host also working for us in the context of a commissioned data processing contract.  Further recipients of data are service providers from the mail and SMS services sector, who are also active within the scope of order processing.

To the extent that our processing of your data is based on our legitimate interest, you have a right to object: 

Providing your personal data is neither a statutory nor a contractual requirement and this is not necessary for the conclusion of a contract. You are not obligated to provide your personal data, either; however, failure to provide such data might have the effect of you not being able to use our contact form.

20) Form for Registration of a Business Project

The "Business Project" is designed to give students the opportunity to implement a concrete business project in cooperation with a company. To register a business project, we use the form "Register your company's business project".

The person responsible for the personal data processed as a result of the use of the form is Munich Business School (see section "2) Responsible person"). If you contact us via this form, the data provided in the form will be processed exclusively by the location indicated.

This includes the following data:

• Company name
• Department
• Name of contact person
• Contact details
• Location address
• The language in which the business project is to be implemented
• The project description

The purpose of processing personal data is to carry out business projects and to be able to contact the contact person for coordination purposes.

The legal basis for the processing of the personal data provided by you in the context of this action is the implementation of the student projects with companies according to art. 6 paragraph 1 letter b) DSGVO, as well as our legitimate interest according to art. 6 paragraph 1 letter f) DSGVO. As a further legal basis we use the consent according to art. 6 para. 1 lit. a) DSGVO of the contact persons to provide her with the necessary offers.

The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH, which provides the CRM and works for us within the scope of order processing, and the server host, which works for us within the scope of an order data agreement.

The processed data is only stored for as long as necessary for the intended purpose or as required by law. 

If we base the processing of your personal data on our legitimate interest, you have the right to object.

21) Making Contact

You have the choice to contact us by mail, phone, fax, or email.

If you contact us by mail we may process in particular your address details (e.g. name, first name, street, place of residence, zip code), the date and time of reception of your mail as well as information gathered from the content of your letter.

If you contact us by phone, we can process in particular your phone number as well as information requested during the conversation such as your name, your email address, the time of your call and details of your query.

If you contact us by fax, we can process in particular the fax number and/or the source identifier as well as other details contained in your fax.

If you contact us by email, we will process in particular your email address, the time of emailing as well as data contained in the email (including attachments if any).

The purpose of processing the above data is to deal with the contact inquiry and to enable us to contact the inquirer in order to answer his or her queries.

The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries.

The personal data will be deleted as soon as it is no longer required for the intended purpose for which it was collected.

Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to contact us or in us being unable to get in touch with you.

22) WhatsApp

We allow you to use WhatsApp as a communication channel with the university. WhatsApp is a communication channel provided by WhatsApp Inc. ("WhatsApp"), 1601 Willow Road, Menlo Park, California 94025 (USA). Data sent to us by WhatsApp is saved within the university and forwarded internally in order to process your request or concern. Your data will be deleted after use.

Please note that different privacy policies and liability provisions apply when using external service providers such as WhatsApp. Storage and use of data by the service provider may exceed the extent of this data privacy statement. For the purpose and scope of data collection by WhatsApp and the further processing of your data there, as well as your rights in this regard, please refer to the provider's terms and conditions: https://www.whatsapp.com/legal/#privacy-policy

23) Social Networks & External Links

Apart from this website, we also maintain a presence in various social media which you can reach by clicking on the corresponding command buttons on our website. If you visit such a site, it may be possible that personal data is transferred to the provider of the social network. It is possible that, apart from storage of the data you specifically enter in this social medium, other information may be processed by the provider of the social network.

Moreover, the provider of the social network may process the most important data regarding the computer system from which you are accessing the social network – e.g. your IP address, the type of processor you use, and your browser version including plug-ins.

If you are logged into your personal user account in the respective network while visiting such a website, this network can associate your visit with your account.

You can communicate with us via our social media channels. Processing takes place on the legal basis of joint responsibility pursuant to Art. 26 GDPR. For all processing of our social media channels, the data protection declaration of the respective operator, which you can find here:  

• Twitter: https://twitter.com/en/privacy
• Instagram: https://help.instagram.com/155833707900388
• YouTube/Google: https://policies.google.com/privacy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Xing: https://privacy.xing.com/en/privacy-policy

Exception: If you provide us with personal data such as your name, e-mail address or similar data via the communication channels provided by the respective platform, for example in order to answer an enquiry, we also process this enquiry in our systems.

In addition to the platform operators, recipients of your data can also be service providers that we use to ensure a fast and efficient response to your enquiries.

We would also like to point out that our website contains further links to external external websites, whereby we have no influence on the processing of data on these external websites.

The social networks use Bitly, a service of Bitly Inc 139 5th Ave, Floor 5 New York, New York 10010, USA. This service enables URLs of any length to be shortened. For this purpose your IP address is processed and cookies are used. Information on the processing of your data by Bitly and the possibility to revoke the use of cookies is available to you at https://bitly.com/pages/privacy . The Bitly Inc is listed in the EU-U.S. Privacy Shield and has thus promised to orient itself to the European level of data protection. www.privacyshield.gov/participant

24) Facebook fan page

Our Facebook fan page is operated under URL https://www.facebook.com/Munich.Business.School, through which you can communicate with us. The privacy policy of Facebook Inc. which you can find here: https://de-de.facebook.com/about/privacy/ is relevant for all processing under this URL.

The legal basis for this data processing is art. 6 para. 1 b) GDPR. In this processing, our cooperation with Facebook is based on a contract of joint responsibility pursuant to art. 26 GDPR, which is available at this URL: https://www.facebook.com/legal/terms/page_controller_addendum. In addition, we process statistical data from Facebook Insight on the basis of art. 6 para. 1 f) GDPR, and our legitimate interest in continuously improving our services and our offer. If you provide us with personal data such as your name, email address or similar data via the communication channels provided by Facebook, for example to answer an enquiry, we also process this enquiry in our systems.

Recipients of your data may also be other service providers in addition to Facebook, which we use to ensure a fast and efficient response to your requests.

25) Data Security

We use technical and organizational means to secure our website and other systems against loss, damage, access, modification, or distribution of your data by unauthorized persons. Despite regular checks, however, complete protection against all dangers is not possible.

26) Modification of the Data Privacy Statement

Amendments of laws or changes in our in-house processes can make adapting this Data Privacy Statement necessary.

In case of any modifications, we will inform you accordingly in a separate notice under the heading “Data Privacy Statement”.

27) Disclaimer

You have the right to revoke any consent you have given at any time and this will apply from that moment on. The lawfulness of the processing done based on your consent up to your revocation remains unaffected by your revocation. Please send your revocation to datenschutz(at)eso.de.

28) Rights of the Data Subject

As a general rule, you have the following rights:

• Right of access (GDPR art. 15)
• Right to rectification (GDPR art. 16)
• Right to object (GDPR art. 21)
• Right to erasure (GDPR art. 17)
• Right to restriction of processing (GDPR art. 18f.)
• Right to data portability (GDPR art. 20)

Please send any inquiries concerning the above to datenschutz(at)eso.de. Please note that when we receive such inquiries, we have to make sure that they have actually been sent by the person concerned.

Without prejudice to other legal redress in terms of administrative law or judicial remedies, you have the right to file a complaint with a supervisory authority for data protection.

Our website does not include any automatized decision-making.