Security Measures in Place

cuas.at takes measures to ensure data security in accordance with Articles 25 and 32 of the GDPR. We have implemented comprehensive security measures to protect your data from unauthorized access by third parties.

To this end, the following measures, among others, are taken to protect your data and safeguard it against loss, destruction, unauthorized access, alteration, and disclosure by unauthorized persons:

• Ensuring the confidentiality, integrity, availability, and resilience of the systems and services involved in processing;
• Ensuring the rapid restoration of the availability of personal data in the event of a physical or technical incident;
• Implementing procedures to regularly review, assess, and evaluate the effectiveness of the technical and organizational measures to ensure the security of processing.

The “Live Chat” feature on our website is designed to help you get in touch with us or share your comments.

Communication via WhatsApp

You have the option to contact us via the WhatsApp messaging service, for example, by scanning QR codes that take you to offers on WhatsApp or to subscribe to our WhatsApp newsletter.

For technical processing, we use a platform solution that complies with data protection regulations (e.g., Manychat), which ensures that your data is processed securely and is not shared with third parties without a legal basis.

Please note: WhatsApp is a service provided by WhatsApp Ireland Ltd. (part of Meta Platforms Inc.). When using WhatsApp, WhatsApp’s privacy policy and terms of service also apply, over which we have no control. In particular, metadata (such as IP address, timestamps, and mobile phone number) may be processed by WhatsApp. The legal basis for our processing is your voluntary consent pursuant to Art. 6(1)(a) of the GDPR. You can withdraw your consent at any time by sending us the word “STOP” via WhatsApp. This is the only way to permanently end communication via WhatsApp and have your contact information deleted from the WhatsApp distribution list.

Recipients:

When using the WhatsApp chat, your data (name, phone number, your inquiry) is forwarded to the company “Meta” with your consent in accordance with Article 6(1)(a) of the GDPR. You can find information on data protection at WhatsApp at https://www.whatsapp.com/legal/privacy-policy-eea.  

Purpose of Processing and Retention Period

The data you provide will be used to process your inquiry and to contact you regarding it. Your personal data will be stored by CU Carinthia University of Applied Sciences until your inquiry has been processed. Beyond that, only the data that is absolutely necessary will be stored in accordance with applicable legal provisions and retention requirements. To contact us, you must provide data such as

• first and last name
• Email address
• your inquiry.

Legal Basis

The processing of personal data in connection with your inquiry is based on pre-contractual measures within the meaning of Article 6(1)(b) of the GDPR. The personal data you provide is necessary to process your inquiry to CU Carinthia University of Applied Sciences. Without providing your data, it is not possible to process your inquiry.

In certain cases, the online event may be recorded and logged. You will be informed of this in advance, as well as of any subsequent use of the recording, and you will be able to see the recording function during the meeting.

The settings have been configured in advance so that you must manually enable audio, video, or chat. If you do not consent to the use of audio, video, or chat, please do not turn on your microphone or video camera and do not participate in chats. In this case, you can send us any questions about the event via email.

At our public events, photos and videos of the event and the participants are taken, which we use exclusively for reports about our events.

Data processing is carried out to process your registration and organize the event. Providing personal data is not required by law or contract, but it is necessary to process your registration for the event. Failure to provide this data will prevent us from processing your registration and, consequently, from allowing you to participate in the event.

When using a video conferencing tool for online events, we process your personal data when you participate in a video conference (meeting). Data processing is carried out to enable your participation—that is, to establish and maintain the connection. In doing so, we process personal data that is strictly necessary for the functionality of the service, corresponds to your selected settings, or depends on your communication behavior.

The following data (categories) may be affected:

• Data you provide when using the video conferencing system, e.g., first name, last name, email address, password (if “single sign-on” is not used), profile picture
• For students, faculty, and staff: login credentials from the CU Carinthia University of Applied Sciences information system
• Technical information regarding usage (meeting metadata), e.g., topic, description, start and end times of the communication, device/hardware information
• Communication content provided by you, e.g., spoken remarks, chat messages, camera data
• Data from your device’s microphone and/or video camera during the duration of use for audio playback and/or video display

At publicly accessible events, photos and video recordings are taken of the event and the participants, which we use exclusively for reports on our events. If you have any concerns in this regard, please feel free to contact us at: marketing(at)cuas.at

Data is stored until the expiration of the warranty, statute of limitations, and statutory retention periods applicable to us, and beyond that, until the resolution of any legal disputes in which the data is required as evidence.

Any recordings featuring you will be stored for as long as necessary for the purposes for which they are processed. In particular, the retention period depends on the following criteria:

• Type of image (in particular, number of people, surrounding environment depicted)
• Context in which the image was taken (e.g., public event, academic course, graduation ceremony)
• Suitability for use on the website and on social media
• Suitability for presenting the company’s history
• Suitability for use in anniversaries and commemorative publications
• Degree of infringement on confidentiality interests
• Suitability for historical and archival purposes

The legal basis for data processing is pre-contractual or contractual measures pursuant to Article 6(1)(b) of the GDPR.

The legal basis for the use of the video conferencing system during online events is pre-contractual or contractual measures pursuant to Article 6(1)(b) of the GDPR. In the case of open events, or if no contractual relationship regarding participation in the event has been established, we rely on Article 6(1)(f) of the GDPR (legitimate interest). In this case, our legitimate interest consists in conducting a modern, functional, and effective online event.

The legal basis for any recording and logging of meetings, as well as for making the recording (or parts thereof, e.g., a screenshot) available to a wider audience, is Article 6(1)(f) of the GDPR (legitimate interest); our legitimate interests in this case lie in documentation, reporting, promotional activities, and making the meeting available to a wider audience of interested individuals.

The creation of visual material (photos and video recordings) is also based on our legitimate interest under Article 6(1)(f) of the GDPR to publish photos and video recordings for reporting purposes on our website or our social media channels. We do not share the photos and video recordings with third parties.

If you are interested in a spot in a degree program or are (online), we process the personal data that you have provided to us when you contacted us or submitted your application via the online application tool or in person, as well as any data that becomes available during the admissions and enrollment process.

Purpose of Processing and Retention Period

We process your personal data to respond to your inquiries, assess your suitability and compliance with the admission requirements for your desired program, and to conduct the prescribed admission process. As a prospective student, you provide us with the data in connection with your inquiry; as an applicant, you provide us with the data as part of your pre-contractual obligations. If you do not provide us with the necessary data, we cannot process your request.

Your data will also be used for the purpose of further developing the admissions process in accordance with the provisions of the Research Organization Act (FOG). In this context, your data will be anonymized as soon as possible.

For prospective students: If a student-institutional relationship is subsequently established between you and us, your personal data from your application will be automatically transferred to your student file. If your application is rejected, the data you provided will be deleted within three years from the start of the semester for which you applied. The application account you created on bewerbung.cuas.at will be automatically deleted one year before the start of the new application period.

Legal Basis

The legal basis for data processing is the pre-contractual obligation associated with your inquiry (Art. 6(1)(b) GDPR).

Recipients

In certain cases, it is necessary to forward the documents you have submitted to the competent Federal Ministry of Science, to ENIC NARIC Austria located there, or to the foreign (higher) education institution that issued the documents, for verification purposes. If we conduct (online) admission tests as part of the admission process, your data (name, date of birth, email address, and your test results) may be shared with service providers (so-called “processors”) such as Hogrefe Austria GmbH, or collected by them directly, for the purposes of administering and evaluating the admission tests.

Processors we engage may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees for data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mail distribution services).

If you apply for a position at CU Carinthia University of Applied Sciences, we will process the personal data you provided to us as part of your application, as well as any data that becomes known to us during the selection process.

Purposes of Processing and Retention Period

When you apply for a position with us (online), we process your data to assess your suitability, qualifications, and professional performance in relation to the position you are applying for, and to conduct the application process. We require the data we ask you to provide in order to conduct the application process.

Failure to provide your personal data, or providing incomplete data, may result in us being unable to consider your application.

If you wish for us to keep a record of your documents, we will also process your data so that we can contact you at a later date.

We process your data only for as long as is necessary to conduct the application process. If an employment relationship between you and us does not materialize, we will store your data for 7 months after rejecting your application, based on our legitimate interest in defending against and addressing legal claims.

If an employment relationship is established, your personal data from your application will automatically be transferred to your personnel file.

If you have consented to the retention of your documents, we will store your data for up to twelve months or until you revoke your consent—whichever occurs first—provided that the seven-month period following a rejection has expired.

Legal Basis

Your data is processed for the purpose of carrying out pre-contractual measures. The processing of your data for record-keeping purposes is based on your consent. You may revoke your consent at any time by contacting jobs(at)cuas.at.

Recipients

Data is not transferred to third parties, or is transferred only if you have separately consented to such transfer.

This data is processed, in particular, to manage and carry out the degree program within the framework of the educational contract—including through the use of cloud-based IT systems—as well as to fulfill legal documentation and disclosure requirements, to ensure the quality of the degree program at CU Carinthia University of Applied Sciences, to establish and administer a student directory; to administer an effective access control system to secure restricted areas against unauthorized access; for library administration purposes; to send information; for legitimate marketing purposes; and to administer study-related research and practical training, and cooperation projects.

The retention period for the data is governed by applicable legal provisions and ranges from 2 years after graduation (e.g., Social Security number, Education Documentation Act) to 80 years after graduation (e.g., data verifying graduation, § 13(8) of the University of Applied Sciences Act). Notwithstanding any special statutory retention provisions, the data will be stored until the expiration of the applicable warranty and statute of limitations periods (generally 3 years). In addition, we reserve the right to store the data for a longer period should this be necessary for evidentiary purposes in any legal disputes.

• Master Data (Academic degree(s), first name, last name, marital status, gender, citizenship, Social Security number or substitute identifier, date of birth, place of birth, citizenship)
• Contact information (address, phone number, personal and provided email addresses, Skype account)
• Information from the application (passport photo, current occupation, desired study/educational programs, admission requirements: Information about previously completed educational programs, type of degree, country and location where the program was completed, (expected) graduation date, additional educational programs, resume, any other certificates as applicable, proof of academic achievement, statement of purpose, language proficiency, information provided regarding motivation for the selection process)
• Information on the use of infrastructure (PIN and user account (library access system), various details regarding technical infrastructure (copy jobs, email, etc.), information on library usage, user ID, number of outstanding loans, branch location, fees and credit balances, holds, status, reservations, copy jobs, title requests)
• Information about your studies (assignment to a field of study, degree program or course information, study location, start and end dates of studies, academic semesters, student ID number, personal identification number, student status, exam dates and transcripts, academic history, completed courses, academic performance, exams, course credits, information about internships and semesters abroad, abstracts of the bachelor’s/master’s thesis or diploma thesis, bachelor’s/master’s/diploma theses and their titles, degree documents for the bachelor’s/master’s program, information on research projects and research publications, payment status for tuition and ÖH fees, information on federal grants awarded, and data on scholarships)

The data processing is based on the following legal grounds:

• the performance of the training contract (Art. 6(1)(b) GDPR);
• when used for marketing purposes, on the basis of our legitimate interest in such use (Article 6(1)(f) of the GDPR);
• compliance with legal obligations (Art. 6(1)(c) GDPR), in particular reporting obligations under the University of Applied Sciences Act and the Student Financial Aid Act, to the federal ministry responsible for science, via the Agency for Quality Assurance and Accreditation Austria, to Statistics Austria and the Federal Computing Center pursuant to the Education Documentation Act, to the Austrian Student Union pursuant to Section 6(1) of the 2014 Act on Female and Male Students and Student Unions (HSG), the 2014 Student Union Election Regulations (HSWO 2014), as well as other information obligations in accordance with the applicable legal provisions.

Failure to provide the data listed in this privacy notice may prevent the fulfillment of the educational contract and thus the successful completion of the degree program.

Based on the processing purposes listed above, we, as a university, are required to disclose data to the following recipients:

• Austrian Library Network and Service GmbH regarding data from library administration
• Agency for Quality Assurance and Accreditation Austria
• Student Financial Aid Authority
• Austrian National Union of University Students
• Data Consortium of Austrian Universities
• BRZ Federal Computing Center GmbH
• Statistics Austria - Federal Statistical Office of Austria
• Ministry of Finance Transparency Database

If you have submitted an application for the recognition of your education, we will process the personal data you provided to us with your application for recognition, as well as any additional data collected during the course of the recognition process.

Failure to provide the required information will prevent us from carrying out the recognition process.

Purpose of Processing and Retention Period

Your personal data is processed on the basis of and for the purpose of fulfilling your recognition application in connection with the legal obligation to conduct recognition procedures and to comply with statutory reporting requirements.

Your data will be stored in accordance with statutory retention periods. Pursuant to the University of Applied Sciences Act (FHG), retention periods may extend up to a maximum of 80 years from the completion of the recognition process.

Recipients

Your data will be disclosed to the Federal Ministry responsible for science, to Statistics Austria, or to the Austrian Agency for Quality Assurance and Accreditation (AQAA) in accordance with legal obligations.

We may forward the documents you have submitted to the relevant Federal Ministry of Science, to ENIC NARIC Austria located there, or to the foreign (higher) education institution for verification purposes.

Processors engaged by us may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees for data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mail distribution services).

When you submit an application for a merit-based or financial aid scholarship, we process the personal data you provided with your application, as well as any additional data collected during the processing of your application.

Purposes of Processing and Retention Period

We process your personal data in order to process your application and make a decision regarding the award of a merit-based or financial aid scholarship as defined by the StudFG. In addition to your name, personal identification number/student ID number, address, citizenship, bank account information, etc., we also process your grade point average for the relevant period as well as, if applicable, information regarding financial need as defined by the StudFG.

If your application is approved, your personal data will be retained—based on legal obligations under Section 36e of the Transparency Database Act (TDBG)— — for a period of 10 years from the end of the academic year in which the merit-based or need-based scholarship is awarded, after which it will be deleted. If your application is rejected, your personal data will be deleted at the end of the academic year in which you submitted your application.

Legal Basis

Processing is based on legal obligations to administer the awarding of merit-based scholarships in accordance with the Student Financial Aid Act (StudFG). There is no obligation to provide your data; however, without it, your application cannot be processed.

Recipients

We treat your personal data confidentially and process it internally only by our staff. The awarding of merit-based and financial aid scholarships is carried out in accordance with § 61 StudFG and § 67 StudFG, respectively.

In accordance with the TDBG, personal data of students and graduates who have been awarded a merit-based or financial aid scholarship must be reported to the Transparency Database.

Processors engaged by us may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees for data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mail distribution services).

Your data is processed for the purpose of carrying out and managing your employment relationship. This includes, for example, human resources and organizational management, payroll processing, and the conduct of academic, teaching, and research activities, as well as administrative operations.

Personal data from your personnel file is retained for seven years after the termination of your employment. This does not apply to data necessary for the issuance of employment references. Such data is retained for 30 years after the termination of your employment.

If you are involved in academic or teaching activities, longer statutory retention periods apply to the data processed by you for the purposes of academic and teaching operations.

If you are involved in (funded) research projects, retention periods apply that are derived from the relevant funding guidelines or from statutory provisions, primarily the Research Organization Act (FOG).

The legal basis for the processing of your personal data is the service agreement entered into between you and us, as well as compliance with legal obligations. If, in a specific case, you have expressly given your consent to the processing of your data, that consent serves as the legal basis for the processing.

The employees responsible for performing duties related to your employment have access to your personal data.

Some of your data will be forwarded to external agencies due to legal reporting requirements. These include, for example:

• social security agencies, the General Accident Insurance Institution, and pension insurance agencies
• Labor Inspectorate
• Bodies representing employee interests (e.g., works council, safety representatives, election committee for works council elections)
• Occupational health physician and safety officer
• Apprenticeship Office, Public Employment Service, Federal Office for Social Affairs and Disability Issues, Tax Office,
• Chamber of Labor
• the bank where you have set up your payroll account
• Agency for Quality Assurance and Accreditation Austria

If you work in research, your personal data will also be transferred to the respective research funding agencies and, if applicable, to the consortium leaders for the purposes of reviewing and monitoring research projects.

Processors engaged by us may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees for data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mailings).

Your data is processed for the purpose of carrying out activities related to the use of the library.
In doing so, the following personal data about you is processed:

• all data obtained through your use of the library and provided by you, such as your name, address, phone number, email address, date of birth, gender, user number, items borrowed, and loan periods (borrowing history), as well as any reservations, return reminders, overdue notices, and, if applicable, information related to reminders
• program of study or course, and personal identification number/student ID number, if you are a student 

Your personal data will be automatically deleted three years after the last contact (return of media).

Your data is processed for the purpose of fulfilling the contractual obligations arising from your use of the library. The automated transfer of your data from your student or personnel file is carried out to safeguard legitimate interests. Our legitimate interest lies in the effective and efficient performance of activities related to the use of the library.

We use the “ALEPH” software provided by Österreichische Bibliothekenverbund und Service GmbH to manage the library. The data processed in the library system is therefore disclosed in accordance with a contractual obligation of Österreichische Bibliothekenverbund und Service GmbH.
Processors we engage may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees regarding data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mail distribution services).

External recipients will only receive your data to the extent necessary to fulfill the purpose in each individual case. For example, other participants in an online event may see your image if you have your video camera turned on.

In certain cases, any recordings (or parts thereof, e.g., screenshots) may be used or published for the purposes of documentation, reporting, promotional activities, and making the event available to a wider audience of interested individuals.

Processors engaged by us may also process data on our behalf to fulfill the purposes described, provided they offer sufficient guarantees for data security (e.g., cloud services, IT service providers, printing companies, and providers of newsletter or mailings).

We use Microsoft 365 for our internal and external communications. Microsoft 365 is a Microsoft product that is operated in the Microsoft Cloud. Because the Microsoft Cloud processes personal data on our behalf, it is a data processor pursuant to Article 4(8) of the GDPR. A data processing agreement pursuant to Article 28 of the GDPR is a prerequisite for lawful processing. Microsoft stipulates in its data processing agreements that the processing of personal data generally takes place within the EU; however, Microsoft reserves the right to process data in third countries or for its own purposes. We base the permissibility of this use on the Standard Contractual Clauses concluded between us and Microsoft in accordance with Article 46 of the GDPR.

We do not use automated decision-making, including profiling.

RIGHTS OF DATA SUBJECTS

As a data subject, you have the following rights:

Right of Access (Art. 15 GDPR)

You have the right to request information about whether we process your personal data. If we do, you have the right to obtain information about this personal data as well as other information related to its processing.

Right to Rectification (Article 16 of the GDPR)

If the personal data we process about you is inaccurate or incomplete, you may request that we rectify and, where necessary, complete this data.

Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data provided the legal requirements are met.

Right to Restriction of Processing (Art. 18 GDPR)

In the cases specified in Article 18 of the GDPR (e.g., you contest the accuracy of the personal data or the processing is unlawful), you have the right to request that processing be restricted.

Right to Data Portability (Art. 20 GDPR)

If the legal requirements are met, you may request that your data be transferred in a structured, commonly used, and machine-readable format.

Right to Object to Unreasonable Data Processing (Art. 21 GDPR)

For reasons arising from your particular situation, you may at any time object to the processing of data concerning you that we process on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Right to Withdraw Consent (Article 7 of the GDPR)

If processing is based on a declaration of consent, you have the option to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal.

Measures Related to Automated Decision-Making in Individual Cases, Including Profiling (Article 22 of the GDPR)

No automated decision-making, including profiling, takes place.

Right to File a Complaint

In addition, you may file a complaint at any time with the
Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna. Phone: +43 1 521 52-25 69 Email: dsb(at)dsb.gv.at
You may exercise your data subject rights—with the exception of the right to lodge a complaint with the Austrian Data Protection Authority—with CU Carinthia University of Applied Sciences at the following address:
FH Carinthia – non-profit limited liability company, Europastraße 4, 9524 Villach, +43 5 90500-0

Facebook Pixel

With the help of the Facebook Pixel, Facebook is able to identify visitors to our website as a target audience for displaying ads, known as “Facebook Ads.” The Facebook Pixel is integrated directly by Facebook when you visit our website and may store a so-called cookie—that is, a small file—on your device.

Google Analytics

Among other things, this service analyzes the origin of visitors, the length of time they spend on individual pages, and their use of search engines.

Yumpu

Yumpu is a digital platform for publishing magazines, brochures, and catalogs. 
Yumpu Privacy Policy: https://helpcenter.yumpu.com/en/articles/2032220-dsgvo-passus-webkiosk-mit-yumpu-com-und-custom-domain

Use of AccessWidget (Accessibility)

FH Kärnten – gemeinnützige GmbH uses the services of AccessiWay GmbH, based in Vienna, Austria, to create a website that is as digitally accessible as possible. To ensure the website is technically accessible, purely technical data is transmitted to the server of AccessiBe Ltd, Israel (GDPR-compliant via an adequacy decision), with an EU server location in Brussels, Belgium (GDPR-compliant and additional SCCs, Standard Contractual Clauses). This data is encrypted using SSL3 and deleted immediately after the accessible, technical information has been retrieved. No data is stored. Only the IP address and user agent (web browser) are transmitted. See the website. No cookies are set or stored; the data transfer is purely technical in nature and serves to technically ensure the accessibility of the website.