Privacy Policy

1. Data Controller

Health Innovation University of Applied Sciences Brebacher Weg 15, Haus 2 12683 Berlin, Germany Phone: +49 030259309220 Email: info@hi-university.de

2. Data Protection Officer

ISiCO GmbH Email: datenschutz@hi-university.de If you have any questions about how your personal data is processed or about data protection in general, please contact our Data Protection Officer.

3. Server Log Files

The hosting provider of this website automatically collects and stores information in so-called server log files, which your browser transmits to us. These include: • Browser type and version • Operating system used • Referrer URL • Hostname of the accessing computer • Time of the server request • IP address This data is strictly necessary to enable you to visit the website, to keep our systems functional and secure, and to carry out general administrative maintenance of our website. Connection data is also stored in internal log files for the purposes described above, limited in time and scope to what is strictly necessary, so we can identify the cause of and respond to repeated or malicious access attempts that jeopardise the stability and security of our website. The data is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and security of our website.

4. Contact and Recall

If you send us inquiries by email, WhatsApp message or via the contact form, the details from your inquiry, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and any follow-up questions. Processing is based on your consent (Art. 6(1)(a) GDPR), on our legitimate interests (Art. 6(1)(f) GDPR), or on the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Our legitimate interests are to receive and answer your inquiries and to simplify our application process.

5. Applications

You can apply for university places via our application management system JotForm. The provider is JotForm Ltd., 25 Cabot Square, London E14 4QZ, United Kingdom. For the transfer to the United Kingdom, an adequacy decision applies. The purpose of collecting your data is to select candidates in the approval process. To receive and process your application, we process in particular the following personal data: • Core data: e.g. first name, surname, date of birth, address • Contact data: e.g. email address, telephone number • Study data: e.g. course of study • Application data: e.g. references, qualifications, CV, training, experience, approval application • Device and connection data: e.g. HTTP header information, user agent, information about your device, operating system and browser The legal basis for processing your application data is Art. 6(1)(e) GDPR in conjunction with § 6(1) no. 1 BerlHG. Where we have to fulfil legal duties, the legal basis is also Art. 6(1)(c) GDPR. The technical processing of device and connection data on the JotForm website is based on Art. 6(1)(f) GDPR. We have a legitimate interest in offering a modern application platform. We store your personal data once we receive your application. If we accept your application, we will store the application data for as long as is necessary for the purposes of your study and to the extent that legal provisions require us to retain it. More information about JotForm's data processing is available at: https://www.jotform.com/privacy/. The following cookies are stored on your device: • "userReferer" (1 month): stores the previous domain • "guest" (1 month): stores the applicant's identifier

6. Necessary Tools

The use of necessary tools is based on Art. 6(1)(b) GDPR (performance of a contract or preparations for concluding a contract) or Art. 6(1)(f) GDPR (legitimate interests). We have legitimate interests in ensuring a secure and stable website visit with content and information that loads correctly, in detecting and preventing misuse, and in fulfilling the legal requirements for consent management. Besides the tools mentioned below, the following cookie is stored on your device: • "NEXT_LOCALE" (1 year): determines the preferred visitor's language and stores the user's selected language.

7. Optional Tools

The use of optional tools is based on Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time in our consent management platform (CMP), which you can open by clicking the clip icon in the bottom-left corner.

8. Newsletter, information material and events

You can request information material and you can sign up for online information events about our university and study courses. We use your email address to send you the requested material, to perform your registration, and to send you ongoing emails with similar information about our university, study courses, further events and news, as well as related reminders. You can opt out of these emails and notifications at any time. Your interaction (opening and clicks on links) with the newsletter is recorded and analysed on an aggregated level. We use the following service providers: • MailerLite Limited, Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland (subscribepage.io, *.mlcdn.com, *.mailerlite.com) • Google reCAPTCHA (see above) Data processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by unsubscribing from our mailing list. The following cookies and local storage elements are stored on your device: • "mailerlite_session_id" (7 days): stores the session ID • "ml_guid": stores the user ID More information about these stored items is available in our CMP.

9. Study portals

We use different portals and platforms during your studies, where your personal data is processed for purposes such as course management, internal communication, eLearning and other university-related purposes. The legal basis for this processing is Art. 6(1)(e) GDPR in conjunction with § 6(1) no. 1, 2 BerlHG, to perform your studies and for university organisation. The technical processing of device and connection data on the respective platform is based on Art. 6(1)(f) GDPR. We have a legitimate interest in offering modern digital platforms and services.

10. Social Media

We maintain online presences on social media platforms in order, among other things, to communicate with interested persons and students and to provide information about our university and university places.

11. Data recipients

We will only disclose the data we have collected if there is a legal basis under data protection law for doing so in the specific case, in particular if: • you have given your explicit consent in accordance with Art. 6(1)(a) GDPR • the disclosure is necessary pursuant to Art. 6(1)(f) GDPR to follow our interests or to establish, exercise or defend legal claims, and there is no reason to assume that you have an overriding legitimate interest in preventing the disclosure of your data • we are legally obliged to disclose the data pursuant to Art. 6(1)(c) GDPR, in particular where this is necessary for the purposes of legal proceedings or enforcement due to binding requirements (e.g. in the context of a tax audit by the tax authorities), official enquiries, court orders and legal proceedings • this is permitted by law and is necessary, pursuant to Art. 6(1)(b) GDPR, for the performance of contractual relationships with you or for the implementation of pre-contractual measures taken at your request • the transfer is allowed in accordance with Art. 6(1)(e) GDPR in conjunction with § 6a BerlHG Some data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular: • Data centres that host our website and databases • Software providers • IT service providers who maintain our systems • Agencies • Consultancy firms Where we transfer data to our service providers, they may use the data solely for the purpose of fulfilling their tasks. We have carefully selected and commissioned these service providers. They are contractually bound by our instructions, have appropriate technical and organisational measures in place to protect the rights of data subjects, and are regularly monitored by us. Agreements are always concluded with external consultants and auditors to ensure the confidentiality of the data. In addition, we may transfer your personal data to other recipients who process your personal data under their own responsibility. These may include, in particular: • Postal service providers • Banks and payment service providers • Tax advisers, solicitors or auditors • Credit reference agencies • Public bodies such as government departments and courts

12. Transfer to third countries

Where necessary, we may use services provided by companies that are based in so-called third countries (outside the European Union or the European Economic Area) or that transfer personal data to such countries, that is, countries whose data protection standards do not match those of the European Union. Where an adequacy decision by the European Commission (Art. 45 GDPR) exists for these countries, we base the data transfer on this. This applies, for example, to transfers to Argentina, Israel, Japan, Canada, the Republic of Korea, New Zealand, Switzerland, Uruguay or the United Kingdom. In the case of the USA, this applies only insofar as the US recipient has been certified under the EU-US Data Privacy Framework. Where no adequacy decision has been issued for the relevant country, we have taken appropriate measures to ensure an adequate level of data protection for any data transfers. These include the European Union's Standard Contractual Clauses or binding internal data protection policies (Art. 46 GDPR). Where this is not possible, we base the data transfer on the exceptions set out in Art. 49 GDPR, in particular your explicit consent or the necessity of the transfer for the performance of a contract or for the implementation of pre-contractual measures. Where a transfer to a third country is envisaged and no adequacy decision or suitable safeguards are in place, it is possible and there is a risk that authorities in the relevant third country (e.g. intelligence services) may gain access to the transferred data in order to collect and analyse it, and that the enforceability of your data subject rights cannot be guaranteed. Where we gather your explicit consent, you will also be informed of this.

13. Your Rights under the GDPR

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR) at any time on grounds of your particular situation, or in case of processing for direct marketing
• Right to withdraw consent (Art. 7(3) GDPR) at any time with effect for the future
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

14. Data Storage and Deletion

Personal data is only stored for as long as is necessary for the respective processing purpose (see § 6a(8) BerlHG). Once the purpose ceases to apply, the data will be deleted, unless we need the data or have to store it for the purposes of providing evidence in civil proceedings (e.g. three years), due to statutory retention obligations (e.g. up to ten years), or if there is another legal basis under data protection law for the continued processing of your data in a specific individual case. If you have questions about the storage duration of specific data, please contact our Data Protection Officer.

15. Duty to provide data

There is generally no obligation to provide your data. Where the provision of your data is necessary for the conclusion of a contract, for submitting requests, or for contacting us (such as the application form), the relevant input fields are marked as mandatory (usually with an asterisk *). In such cases, without the provision of this data, a contract cannot be concluded, the request cannot be submitted, or the contact cannot be established. Other information not marked as mandatory is voluntary. The provision of such data is not required for the conclusion of a contract, the submitting of a request, or for contacting us, and has no influence on the performance of the contract.

16. Automated decision-making

No automated decision-making, including profiling as defined in Art. 22 GDPR, takes place that produces legal effects or similarly significantly affects you.

17. Changes to this privacy notice

We occasionally update this privacy policy, for example when we make changes to our website or when legal or regulatory requirements change.