Privacy Policy

Information on data protection and data security at WHU – Otto Beisheim School of Management, Burgplatz 2, 56179 Vallendar ("WHU")

With this privacy policy, WHU fulfills its existing legal obligation to provide information in accordance with Art. 13 of the General Data Protection Regulation ("GDPR") regarding the processing of personal data on our website. In the following, we explain which of your personal data we process and how. Please get in touch with us if you have any further questions. You will find our contact details below and at the end of this page.

General information about the processing of personal data

Responsible according to Art. 4 (7) of the EU General Data Protection Regulation ("GDPR") is WHU - Otto Beisheim School of Management, Burgplatz 2, 56179 Vallendar (see our imprint, email: datenschutz[at]whu.edu.

You can contact our data protection officer with the data provided at the end of this Privacy Policy.

Personal data

Personal data is any information that relates to an identified or identifiable natural person. A natural person is considered to be identifiable if, directly or indirectly, in particular by association with an identifier such as a name, identification number, location data, an online identifier, or one or more special features that express the physical, physiological, genetic, mental, economic, cultural, or social identity of this natural person, can be identified. This includes, for example, your name, address, telephone number, language, location, email address, bank details, and date of birth.

Processing of personal data

The processing of personal data applies to any operation performed with or without the aid of automated procedures or in any series of procedures related to personal data. In particular, data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

We process personal data in accordance with the specifications and conditions described below within the framework of automated processing authorized by law. The scope of the processing of your personal data is limited by the purposes described in each case.

Automated decision-making in individual cases, including profiling according to Art. 22 GDPR, does not take place.

If we use a processor to process your personal data, we conclude a data processing contract with them that meets all the requirements of Art. 28 GDPR.

Purpose of processing personal data when visiting our website

In the case of merely informative use of the website, for example, if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you visit our website, we collect the following data that is technically necessary for us to show you our website and to ensure stability and security (the legal basis is Art. 6 para. 1 sentence 1 lt. f GDPR):

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the requirement (concrete page)
Access Status / HTTP status code
The transmitted amount of data
The website from which the request comes
Browser
Operating system and its interface
Language and version of the browser software.

In addition to the purely informative use of our website, we offer various services that you can use if you are interested. For this purpose, you will generally have to provide additional personal data, which we use to provide the respective service, and to which the aforementioned data processing principles apply. We present these to you in this privacy policy.

Use of Cookies

In addition to the above-mentioned data, cookies are stored on your computer when you use our website, if you give us your consent.

Cookies are small text files that are stored on your hard drive by the browser you are using, and through which certain information flows to the site that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They help make the Internet more user-friendly and effective.

We use technically necessary cookies. These cookies are necessary for the proper functioning of our website and cannot be disabled in our system. The legal basis is Art. 6 para. 1 sentence 1 lt. f GDPR ("legitimate interest"). However, you can, of course, configure your browser settings as you wish and also reject such technically necessary cookies. Please note that you will not be able to use our website in that case.

Otherwise, Art. 6 para. 1 sentence 1 lt. GDPR is the legal basis for the use of cookies ("consent"). You can choose whether to give us consent for all cookies, only certain types (e.g., functional, performance, or advertising/tracking), or none at all.

This consent is voluntary. You can refuse it without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages. However, we would like to point out that if you do not give your consent or if you revoke it, you may not be able to use all the functions of this website to their full extent.

We will also provide you with further information on the use of cookies in the following sections if cookies are used.

You will also find detailed information in our cookie policy, available here.

Use of social media plug-ins

We currently use the following social media plug-ins: Facebook, Xing, YouTube, LinkedIn, Instagram, and Flickr.

We use the two-click solution. In other words, when you visit our site, no personal data is initially passed on to the providers of the plug-ins. The provider of the plug-in can be identified by the marking on the box above its initial letter or by its logo. We provide you with the opportunity to communicate directly with the plug-in provider via the button. Only if you click the marked field and activate it does the plug-in provider receive the information that you have accessed the corresponding website of our online service. In addition, the data mentioned above under "Purpose of processing personal data when visiting our website" is transmitted. According to the respective providers in Germany, Facebook and Xing anonymize the IP address immediately after collection. By activating the plug-in, you will transmit your personal data to the respective plug-in provider and store it there (with US providers in the USA). 

We do not influence the collected data and data processing operations, nor are we aware of the full extent of data collection, the purpose of the processing, or the retention periods. We also have no information on how to delete the data collected by the plug-in provider.

The plug-in provider stores the data collected about you as usage profiles and uses them for advertising, market research, and /or customized website design. Such an evaluation is carried out (also for non-logged-in users) to present customized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the formation of these user profiles; to exercise this right, you must contact the respective plug-in provider. Through the plug-ins, we offer you the opportunity to interact with social networks and other users, so we can improve our offer and make it more interesting for you.

The data transfer takes place regardless of whether you have an account with the plug-in provider and whether you are logged in. If you are logged in, the data collected from us will be assigned directly to your existing account with the plug-in provider. If you press the activated button and, for example, link the page, the plug-in provider also stores this information in your user account and shares it publicly with your contacts. We recommend logging out regularly after using a social network, especially before activating the button, to prevent your data from being associated with your profile by the plug-in provider.

The plug-in provider may also process your personal data in the USA. Before giving your consent in accordance with Art. 49 para. 1. Under GDPR, we would like to point out that in the USA, without a degree of adequacy and without suitable guarantees, there may not be an adequate level of data protection, as data protection laws do not comply with the provisions of the GDPR. In particular, data subjects' rights may not be enforceable.

The above will only take place if you give us your consent. The legal basis is Art. 6 para. 1 sentence 1 lt a GDPR ("Consent"). This consent is voluntary. You can refuse without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages.

For more information on the purpose and scope of data collection and its processing by the plug-in providers, please refer to the privacy declarations below. There you will also find further information about your rights and privacy settings.

Addresses of the respective plug-in providers and URL with their privacy notices:

Facebook (Meta Platforms Ireland Limited), Merrion Road, Dublin 4, D04 X2K5, Ireland, www.facebook.com/privacy/policy/ Further information on data collection: www.facebook.com/help/186325668085084 www.facebook.com/about/privacy/your-info-on-other#applications sowie www.facebook.com/about/privacy/your-info#everyoneinfo
Xing AG, Gänsemarkt 43, 20354 Hamburg, Germany, www.xing.com/privacy
YouTube (Google Ireland Limited), Gordon House, Barrow Street, Dublin 4, Ireland, policies.google.com/privacy?hl=de&gl=de
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; www.linkedin.com/legal/privacy-policy
Instagram (Meta Platforms Ireland Limited), Merrion Road, Dublin 4, D04 X2K5, Ireland, help.instagram.com/155833707900388/?helpref=hc_fnav&bc[0]=Instagram-Hilfe&bc[1]=Datenschutz%20und%20Sicherheitsbereich
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, www.google.com/policies/privacy/partners/?hl=de
Flickr, Oath (EMEA) Limited, 5-7 Point Square, North Wall Quay, Dublin 1, policies.yahoo.com/privacy/flickr/

Integration of YouTube Videos

We have included YouTube videos in our online offering, available on www.YouTube.com and playable directly on our website. These are all incorporated in the "extended privacy mode", which means that none of your user data is transferred to YouTube if you are not playing the videos. Only when you play the videos will the above data be transmitted. We don't have any influence on this data transfer.

By visiting the website, YouTube receives the information that you have accessed on the corresponding sub-page of our website. Furthermore, the data mentioned above in this privacy policy under "Purpose of processing personal data when visiting our website" will be transmitted. This happens regardless of whether you are logged in to a YouTube user account. When you're logged in to Google, your data will be assigned directly to your account. If you do not wish to be associated with your YouTube profile, you must log out before activating the button. YouTube saves your data as usage profiles and uses them for advertising, market research, and/or custom design of its website. Such an evaluation is done in particular (even for users who are not logged in) to provide appropriate advertising and to inform other users of the social network about their activities on our website. You have the right to object to the creation of these usage profiles, but you need to contact YouTube to do so.

YouTube also processes your personal data in the USA. Before you give your consent in accordance with Art. 49 para. 1 a GDPR, we would like to point out in particular that in the USA, there may not be an adequate level of data protection without a decision on appropriateness and without suitable guarantees, as data protection laws do not comply with the provisions of the GDPR, and in particular, the rights of data subjects may not be enforceable.

The above will only take place if you give us your consent. The legal basis is Art. 6 para. 1 sentence 1 lt. a GDPR ("Consent"). This consent is voluntary. You can refuse it without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages.

For more information on the purpose and scope of data collection and its processing by YouTube, please see the Privacy Policy. There you will also find further information on your rights and setting options to protect your privacy: www.google.de/intl/de/policies/privacy.

Integration of Google Maps

On this website, we use Google Maps. This allows us to display interactive maps directly on the website and to enable you to conveniently use the map feature.

By visiting the website, Google receives the information that you have accessed the corresponding subpage of our website. Furthermore, the data mentioned above in this declaration under "Purpose of processing personal data when visiting our website" will be transmitted. This is done regardless of whether Google provides a user account for you to log in to, or if there is no user account. When you're logged in to Google, your data will be assigned directly to your account. If you do not wish to be associated with your Google profile, you must log out before activating the button. Google stores your data as user profiles and uses it for advertising, market research, and/or tailored website design. Such an evaluation is done (even for users who are not logged in) to provide appropriate advertising and to inform other users of the social network about their activities on our website. You have the right to object to the formation of these user profiles, whereby you must contact the respective provider to exercise this right.

Google also processes your personal data in the USA. Before giving your consent in accordance with Art. 49 para. 1 a GDPR, we would like to point out in particular that in the USA, there may not be an adequate level of data protection without a decision on appropriateness and without suitable guarantees, as data protection laws do not comply with the provisions of the GDPR, and in particular, the rights of data subjects may not be enforceable.

The above will only take place if you give us your consent. The legal basis is Art. 6 para. 1 sentence 1 lt. a GDPR ("Consent"). This consent is voluntary. You can refuse it without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages.

Further information on the purpose and scope of data collection and processing can be found in the provider's data protection declarations. There you will also find further information on your rights in this regard and setting options to protect your privacy: www.google.de/intl/de/policies/privacy.

LinkedIn Insight tag

This website uses the LinkedIn Insight tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Pl, Dublin 2, Ireland ("LinkedIn"), subject to your consent. The LinkedIn Insight tag is a small JavaScript code snippet we added to our website to enable detailed campaign reporting and gather valuable information about visitors. Specifically, we use the LinkedIn Inside tag to track conversions, retarget our site visitors, and gather additional information about LinkedIn members who view our ads.

In particular, the LinkedIn Insight tag allows us to collect information about visits to our site, including URL, referrer URL, IP address, device and browser characteristics (user agent), and timestamps. IP addresses are truncated or (if used to reach members across devices) hashed. Direct identifiers for members are removed within 7 days to pseudonymize the data. This remaining pseudonymized data is then deleted within 180 days. LinkedIn does not share any personally identifiable information with us. However, it only provides reports (where you are not identified) on website audience and ad performance. LinkedIn also provides retargeting for site visitors, which allows us to use this data to display targeted advertising outside of our site without identifying the member. We also use data that does not identify you to improve the relevance of ads and reach members across devices. LinkedIn members can also control the use of their personal information for advertising purposes in their account settings.

LinkedIn also processes your personal data in the USA. Before giving your consent in accordance with Art. 49 para. 1 a GDPR, we would like to point out in particular that in the USA, there may not be an adequate level of data protection without a decision on appropriateness and without suitable guarantees, as data protection laws do not comply with the provisions of the GDPR, and in particular, the rights of data subjects may not be enforceable.

For more information about LinkedIn's processing of your personal data and your rights and options for protecting your privacy, please refer to LinkedIn's privacy policy at www.linkedin.com/legal/privacy-policy.

Facebook pixel

This website uses the Facebook pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland („Facebook“). ("Facebook"), if you have given your consent. 

As a result, users of the website can be shown interest-based advertisements ("Facebook Ads") when visiting the social network Facebook or other websites that use the same procedure. In this way, we aim to display advertisements that interest you to make our website more engaging.

Via the Facebook pixel, we process in particular information about the activities of website visitors outside of Facebook. This includes information about the website visitor's device, the websites visited, purchases made, the advertisements the website user sees, and how the visitor uses our website. This happens regardless of whether you have a Facebook account or are logged in to Facebook as a visitor to our website. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or logged in, the provider may still find and store your IP address and other identifying information.

The Facebook pixel records these five types of data:

HTTP headers - everything that is present in HTTP headers. HTTP headers are a standard web protocol used in every browser request and server response on the Internet. HTTP headers contain IP addresses, web browser information, page location, document, referrer, and information about the website visitor.
Pixel-specific data — this includes the pixel ID and the Facebook cookie.
Button-click data — this includes any buttons clicked by visitors to the site, the labels of those buttons, and any pages viewed as a result of clicking on the button.
Optional values — developers and marketers can send additional information about the visit through personalized data events. Examples of personalized data events are the conversion value, page type, etc.
Form field names — these include the names of website fields such as "email", "address", and "quantity" that are filled in when a product or service is purchased. The pixel generally does not capture field values.

In the context of usage-based online advertising, we use Meta Platforms Ireland Limited's "Custom Audiences" service, Merrion Road, Dublin 4, D04 X2K5, Ireland („Facebook“).). For this purpose, we define target groups of users in the Facebook Ads Manager based on certain characteristics, who are subsequently shown ads within the Facebook network. Facebook selects users based on the profile information they provide, and other data provided through their use of Facebook. If a user clicks an advertisement and subsequently arrives on our website, Facebook receives information that the user clicked the advertising banner via the Facebook pixel embedded on our website. A non-reversible and non-personal checksum (hash value) is generated from your usage data, which is transmitted to Facebook for analysis and marketing purposes. A Facebook cookie is set in the process. This collects information about your activities on our website (e.g., surfing behavior, subpages visited, etc.). For geographic advertising targeting, your IP address is also stored and used. We do not use Facebook Custom Audiences via the customer list, nor the "advanced matching" function.

Facebook also processes your personal data in the USA. Before giving your consent in accordance with Art. 49 para. 1 a GDPR, we would like to point out in particular that in the USA, there may not be an adequate level of data protection without a decision on appropriateness and without suitable guarantees, as data protection laws do not comply with the provisions of the GDPR, and in particular, the rights of data subjects may not be enforceable.

You can also deactivate the Facebook Marketing function as a logged-in Facebook user at https://www.facebook.com/settings/?tab=ads#. You can also turn off the Custom Audiences remarketing feature in the Ad Settings section at https://accountscenter.facebook.com/ad_preferences. To do this, you must be logged into Facebook.

If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/. 

Further information on Facebook's processing of personal data, as well as your rights and options for protecting your privacy, can be found in the Facebook privacy policy at www.facebook.com/about/privacy/.

TikTok Pixel

Within our online offer, the so-called "TikTok pixel" of the social network TikTok, which is operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"), is used. This code has been implemented on our website. If you give your explicit consent, when you visit our website, a connection to TikTok is established to track your behavior.

With the help of the TikTok pixel, TikTok can determine you as a visitor to our online offer and target you with advertisements (so-called "TikTok ads"). Accordingly, we use the TikTok pixel to display the TikTok ads placed by us only to those TikTok users who have also shown an interest in our online offer or who have certain characteristics (e.g., interests in certain topics or products determined based on the websites visited) that we transmit to TikTok (so-called "Custom Audiences"). With the help of the TikTok pixel, we also want to ensure that our TikTok ads align with users' potential interests and do not harass them. The TikTok pixel also allows us to track the effectiveness of TikTok ads for statistical and market research purposes by measuring whether users are redirected to our website after clicking a TikTok ad (so-called "conversion").

TikTok processes data in accordance with its data use policy. Accordingly, general guidance on the display of TikTok ads is available in TikTok's Data Use Policy. For specific information and details about the TikTok Pixel and how it works, please see the TikTok help section.

The use of the TikTok pixel and the storage of "conversion cookies" are based on Art. 6 (1) lit. a DSGVO. You can revoke your consent to the use of TikTok's marketing cookies at any time, with effect for the future, here.

You can object to the TikTok Pixel's collection of your data and to the use of your data to display TikTok ads. You can find an opt-out option in our cookie declaration.

Stape

This website uses Stape. Stape OÜ is a company located in Estonia at the following address: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia. Stape OÜ supports both Google Tag Manager and Meta's Conversion API for order processing in accordance with Art. 28 GDPR. For further information, please refer to Stape's privacy policy at https://stape.io/gdpr. 

Hootsuite

The data provided to WHU by the social media network operators mentioned in this privacy policy is processed at WHU using the social media management software "Hootsuite." WHU has a legitimate interest in using this software in accordance with Art. 6 para. 1 f) GDPR. Hootsuite allows for the management, scheduling, publishing, and analysis of social media channels.

Further information and Hootsuite's current privacy policy can be found at Privacy and Hootsuite, as well as the General Data Protection Regulation (GDPR).

Hootsuite is a Canadian company. Data transfers to Canada fall within the scope of the EU Commission's adequacy decision, which has determined that Canada has an adequate level of data protection.

Chatbot Usage and Session Logging

We use an integrated chatbot on our website to support users with questions and navigation. When you interact with the chatbot, your chat session may be logged. This process serves exclusively to help us improve the quality and effectiveness of the chatbot through internal feedback and evaluation. In particular, your data will not be processed outside WHU, including for so-called training purposes by external AI systems.

In this way, we can detect how the chatbot was used and which topics or functions may require improvement. A combination of the logged data with other personal data does not occur. We do not intentionally collect personally identifiable information unless you voluntarily provide it within the chat.

Chat logs are deleted once they are no longer needed for our internal purposes of feedback gathering and system improvement.

TYPEFORM

This website uses the Typeform service. Typeform is operated by TYPEFORM SL, C/Bac de Roda, 163, 08018 Barcelona, Spain. Typeform is a service that we use to display "online surveys" in the form of a quiz for study orientation on our website. In this context, the following data may be collected and processed:

IP address, Network ID
First & last name
Email address
Duration of visit
Date and time of visit
Data collected as part of the survey
Result count & score

The legal basis for the processing is your consent in accordance with Art. 6 (1) lit. a DSGVO. If you do not want Typeform to collect and process the above-mentioned data, you can refuse your consent (declaration of consent first slide of the survey) or revoke it at any time with effect for the future. An informal communication by email is sufficient for the revocation.

Personal data will be kept for as long as necessary to fulfill the purpose of the processing. The data will be deleted as soon as they are no longer necessary to achieve the purpose.

This data is processed on servers located in the USA.

Further information on the collection and use of data. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data.

You can find further information on objection and removal options regarding Typeform at: https://admin.typeform.com/to/dwk6gt.

Contact form

When you contact us by email or through a contact form, we will collect the personal information you provide (email address, first name, last name, and, if applicable, your telephone number) to answer your questions. We will delete data for these purposes after storage is no longer required or limit the processing if there are statutory retention requirements.

The legal basis is Art. 6 para. 1 sentence 1 lt. f GDPR.

Registration form

There are registration forms on this website that you can use for electronic registration. Some of our offers can only be used if you create an account, for example, to participate in online surveys and seminars. If you use this option, the data entered in the input mask will be transmitted to us and stored. These data are:

Company
Salutation
Title
First name
Last name
Address
Postal code
Head office
Country
Telephone number
Email address
Information about ICV-Membership
Information about membership on LinkedIn or Xing

The following data is also stored at the time the message is sent:

The IP address of the user
Date and time of registration

Mandatory data requested during registration must be provided in full.

The processing of the data entered during registration is based on your consent (Art. 6 para. 1 lit. a GDPR). Revocation of your previously given consent is possible at any time. An informal email communication is sufficient for the revocation. The legality of the data processing already carried out remains unaffected by the revocation.

We store the data collected during registration for as long as you remain registered on our website. Your data will be deleted should you cancel your registration.

Student application form

If you apply to WHU, we will process the data you provide to determine whether we would like to establish and continue a study partnership with you.

During the application process, in addition to the form of address, surname, and first name, the usual correspondence data, such as postal address, email address, and telephone numbers, are also stored. Furthermore, application documents such as letters of motivation, curriculum vitae, vocational, educational, and further education certificates, and references are recorded.

The applicant data you sent to us and entered will only be processed up to the time of the hiring decision if a contractual relationship is not established. Four months after the rejection is sent or the application documents are returned to the applicant, the data will be deleted.

The data will only be stored in an applicant pool if you give us your express consent (Art. 6 para. 1 sentence 1 lt. a GDPR). This storage will be for a maximum period of two years. This consent is voluntary. You can refuse it without giving a reason, without fear of any disadvantages. You can also revoke this consent at any time in text form (e.g., letter, email) with future effect to the contact data shown above, without having to fear any disadvantages.

If we enter into a contractual relationship with you, the data you have provided will be processed to establish, implement, and, if necessary, terminate the student relationship.

The data may be processed for statistical purposes (e.g., reporting). It is not possible to conclude about individual persons.

The legal basis is Art. 6 para. 1 sentence 1 lt. b GDPR ("Contract implementation, preliminary negotiations").

Staff application form

If you apply for a job at WHU, the data you provide will be processed by us to determine whether we wish to establish and enter into an employment relationship with you.

During the application process, in addition to the form of address, surname, and first name, the usual correspondence data, such as postal address, email address, and telephone numbers, are also stored. Furthermore, application documents such as letters of motivation, curriculum vitae, professional qualifications, training qualifications, and job references are recorded.

The applicant data you sent to us and entered will generally be processed only until the time of the decision to hire, if an employment relationship is not established. The data is deleted four months after the rejection is sent or after the application documents are returned to the applicant.

Data will only be stored in an applicant pool if you have given us your express consent. This storage will be for a maximum period of two years. This consent is voluntary. You can refuse it without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time in text form (e.g., letter, email) with future effect to the contact data shown above, without having to fear any disadvantages.

If we enter into a contractual relationship with you, the data that you have made available to us will be processed to establish, implement, and, if necessary, terminate the employment relationship.

The data may be processed for statistical purposes (e.g., reporting). No conclusions can be drawn about individual persons.

The legal basis is § 26 BDSG (§ 26 para. 8 sentence 2 BDSG).

Newsletter

With your voluntary consent, you can subscribe to our newsletter, which informs you about our current products and services. The advertised products and services are named in the declaration of consent.

To register for our newsletter, we use the double-opt-in procedure. This means that after you have registered, we will contact you at the email address specified, asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 14 days, your information will be blocked and automatically deleted after one month. In addition, we store your IP addresses and times of registration and confirmation. The purpose of this is to prove your registration and, if necessary, to inform you about possible misuse of your personal data.

The only requirement for sending the newsletter is your email address. The specification of additional, separately marked data is voluntary and will be used to address you personally. After your confirmation, we will save your email address to send you the newsletter. The legal basis is Art. 6 para. 1 sentence 1 lt. GDPR in combination with Art. 7 GDPR ("Consent"). You can revoke your voluntary consent to the sending of the newsletter at any time and unsubscribe. You can declare the revocation by clicking on the link provided in each newsletter email, by email to datenschutz[at]whu.edu, or by sending a message to the contact details stated in the imprint. Failure to provide or revocation of consent does not have any disadvantages for you. In this case, however, we cannot send you the newsletter.

Among other things, we use the email tool CleverReach to send our newsletter, which CleverReach GmbH & Co. KG, Rastede, Germany, operates. Your data is also processed by CleverReach pursuant to a data processing contract under Art. 28 GDPR. CleverReach offers evaluation options on how the newsletters are opened and used. Your data will not be passed on to any third parties for the purpose of receiving the newsletter, and CleverReach does not acquire any right to transfer your data.

Marketing Cloud Account Engagement (formerly Pardot)

We use Marketing Cloud Account Engagement (formerly "Pardot"), a service provided by Salesforce, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA ("Salesforce"), on our website. Marketing Cloud Account Engagement is a marketing automation platform that collects and evaluates how visitors use our website. To the extent that Salesforce processes personal data, it does so exclusively on our behalf and in accordance with our instructions. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded.

When you visit our website, Marketing Cloud Account Engagement records your click path and creates an individual usage profile under a pseudonym. For this purpose, cookies and similar technologies are used to recognize your browser.

Salesforce may also process personal data in the United States. Where personal data is transferred to the United States, such transfer is based on the European Commission's adequacy decision of 10 July 2023 regarding the EU-U.S. Data Privacy Framework, provided that Salesforce maintains its certification under that framework. In addition, we have concluded appropriate contractual safeguards with Salesforce to ensure the protection of personal data.

Cookies and similar technologies used by Marketing Cloud Account Engagement are only deployed with your consent. The legal basis for this processing is Art. 6(1), first sentence, point (a) GDPR ("Consent"). Your consent is voluntary. You may refuse to provide consent without giving any reason and without suffering any disadvantage. You may also withdraw your consent at any time with effect for the future here, without suffering any disadvantage.

Use of Google Analytics

The WHU website uses Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: Google). Google Analytics uses cookies to analyze your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities, and to provide other services related to website and internet usage to the website operator.

You can prevent the storage of cookies by adjusting your browser software accordingly. However, we point out that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent Google from collecting data generated by the cookie and related to your use of the website (including your IP address), and from processing this data, by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout. 

Google Analytics is used on this website with IP anonymization. This means that IP addresses are processed in a shortened form, thereby excluding a direct personal reference. If the data collected about you contains a personal reference, it is immediately excluded, and the personal data is promptly deleted.

Purpose and Legal Basis of Data Processing

We use Google Analytics to analyze how our website is used and regularly improve the user experience. The statistics obtained allow us to improve our offer and make it more interesting for you. The legal basis for the processing of your data is the consent you have given via the cookie consent tool (Art. 6 para. 1 sentence 1 lit. a) GDPR). This is done only with your consent. This consent is voluntary. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages.

Third-Party Information

Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: https://marketingplatform.google.com/about/analytics/terms/us/, and privacy policy: https://policies.google.com/privacy?hl=en.

Third-Country Transfer

In the context of your use of Google, your personal data will also be transferred to a third country in compliance with the requirements of Art. 44 et seq. GDPR. Due to the third-country transfer, Google is currently subject to the EU adequacy decision of 10.07.2023, as Google is certified under the EU-U.S. Data Privacy Framework and is therefore lawful.

Despite this certification and other technical and organizational measures, the level of data protection in the USA does not match that of the European Union. There is a particular risk, especially in the case of data transfers to the USA, that your personal data may be processed by authorities for control and monitoring purposes, possibly without sufficient legal remedies and without us, as the data exporter, or you, as the data subject, being aware of it.

Matomo

This website uses Matomo, a web analytics service developed by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand. Matomo is based in New Zealand, a third country. The European Commission has determined, by decision, that New Zealand has an adequate level of data protection.

We use Matomo as an on-premises solution. The information is stored on a server we manage and located within the European Union.

Matomo uses so-called cookies, which are text files that are stored on your computer. These cookies help us track your visitor behavior on our website and aim to improve it continuously. You can prevent Matomo from installing cookies by setting your browser software accordingly or by rejecting them here in our cookie checkbox. It may then be that they cannot fully use all the website's features.

When using Matomo, we have activated the so-called IP anonymization, so that your IP address is only stored in a reduced form. The resulting pseudonymized usage profiles are not merged with personal data about the bearer of the pseudonym without separate, explicit consent.

Matomo collects the following data about user behavior on our website:

Cookies
Pseudonymized IP addresses by removing the last 1 byte (i.e., 198.51.100.0 instead of 198.51.100.54)
Pseudo-anonymized location (based on the anonymized IP address)
Date and time
Title of the accessed page
URL of the accessed page
URL of the previous page (if allowed)
Screen resolution
Local time
Files that were clicked and downloaded
External links
Duration of page load
Country, region, city (with low accuracy due to IP address)
Main language of the browser
User agent of the browser
Interactions with forms (but not their content)

You can subsequently object to the storage and use of your personal data (IP address) with one click. In this case, a so-called opt-out cookie is sent by Matomo, so that Matomo does not store any further data about your visit to the website.

Use of Sistrix

This website uses Sistrix, a web analysis service of SISTRIX GmbH, Thomas-Mann-Straße 37, 53111 Bonn, Germany.

This is an analysis tool to improve the searchability of our website in search engines. When creating this plugin, it was explicitly ensured that all data is encrypted (https). This plugin sends an affiliate code with every search request to sistrix.de to support our website developers. The developer, to the best of his knowledge, is under no circumstances able to view the requests made. Further information on the processing of data by Sistrix can be found at https://www.sistrix.de/sistrix/datenschutz/.

Use of Google Ads Conversion

We use the services of Google Ads to draw attention to our offers with the aid of advertising media (Google Ads) on external web pages. Based on the advertising campaign data, we can determine how successful each advertising measure is. The aim of this is to present advertisements that are of interest to you, to design our website in a way that is more relevant to you, and to attain a fair calculation of advertising costs.

Google supplies these advertising media via "ad servers". For this purpose, we use ad server cookies to measure certain performance metrics, such as ad display and user clicks. If you access our website through a Google ad, Google Ads will store a cookie on your PC. These cookies usually expire after 30 days and are not intended to identify you personally. Linked to each cookie are a unique cookie ID, the number of ad impressions per placement (Frequency), the last impression (relevant for post-view conversions), and opt-out information (a note that the user does not want to be addressed any longer).

These cookies allow Google to recognize your Internet browser. If a user visits certain pages of an Ads customer's website and the cookie stored on their computer has not yet expired, Google and the customer can detect that the user clicked the ad and was redirected to those pages. Each Ads customer is assigned a different cookie. Thus, cookies cannot be tracked on the websites of Ads customers. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We merely receive statistical evaluations provided by Google. Based on these evaluations, we can identify which advertising measures are particularly effective. We do not receive any further data from the use of advertising media; in particular, we cannot identify users on the basis of this information.

Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. We have no control over the extent and further use of the data collected by Google through the employment of this tool, and thus inform you according to our state of knowledge: By the incorporation of Ads conversion, Google receives the information that you visited the respective part of our website or clicked on one of our ads. Provided that you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered with Google or have not logged in, the provider may still learn and store your IP address.

Google also processes your personal data in the USA. Before you give your consent in accordance with Art. 49 para. 1 a GDPR, we would like to point out in particular that in the USA, there may not be an adequate level of data protection without a decision on appropriateness and without suitable guarantees, as data protection laws do not comply with the provisions of the GDPR, and in particular, the rights of data subjects may not be enforceable.

The above will only take place if you give us your consent. The legal basis is Art. 6 para. 1 sentence 1 lt. a GDPR ("Consent"). This consent is voluntary. You can refuse it without giving a reason and without fear of any disadvantages. You can also revoke this consent at any time with future effect here, without having to fear any disadvantages.

You can find further information on data protection at Google here: www.google.com/intl/de/policies/privacy and services.google.com/sitestats/en.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at www.networkadvertising.org.

Google Remarketing

In addition to Ad Conversion, we use the Google Remarketing application. This is a process we use to reach out to you again. The application allows you to see our ads after visiting our website as you continue to use the Internet. This is done by using cookies stored in your browser, which record and evaluate your usage behavior when visiting various websites.

In this way, Google can detect your previous visit to our homepage. A combination of the data collected during the remarketing with your personal data, which Google may store, does not occur, according to Google. In particular, pseudonymization is used in remarketing according to Google.

Feedback cookies

We want to continuously improve our website, for example, by identifying and optimizing content that is of particular interest. This allows us to make our website more accessible and interesting for our users. For this purpose, we use cookies to collect user feedback and improve the website.

We use the services of Usersnap GmbH, Industriezeile 35, 4020 Linz (Austria), a provider of website widgets, to collect user feedback on our website. Usersnap enables us to collect precise, actionable visual feedback and measure visitor satisfaction on our website. Usersnap, as an Austrian company, is legally subject to the GDPR's data protection provisions. Usersnap uses cookies to determine to which node requests are forwarded during a website visit. The cookie's lifetime is currently 7 days. Usersnap's privacy policy can be found at https://usersnap.com/privacy-policy. We only use these cookies if you consent to this use. Then the legal basis for data processing is your consent (Art. 6 para. 1 lit. a GDPR). You can deactivate data collection by Usersnap at any time by opening the cookie settings and changing the corresponding selection there.

Seminars / Webinars / Events

We regularly organize seminars, webinars, and events for students and interested parties, as well as other groups, on current topics at WHU (e.g., degree programs).

You can register for these seminars, webinars, and events online via our portal, by mail, or by email.

We process the following mandatory data in this context: the participant's first name, last name, email address, and, if applicable, the participant's address. This enables us to assign your registration to the specific person and to send you information on the date and content of the seminar, webinar, or event, as well as a participant certificate, if requested. If it is a seminar, webinar, or event for which a fee is charged, we also need your contact information to send you an invoice.

All other requested data (title, function, telephone number, and how you heard about our event) can be provided voluntarily. However, you are not obliged to do so.

If you do not provide the above-mentioned mandatory information, we will not be able to grant you access to our seminars, webinars, and events, as this information is required for the performance of a contract.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR ("Necessity for the performance of the contract").

Duration of data processing

The maximum storage duration depends on the purpose of the data processing. The duration of storage depends in particular on the period for which processing is necessary to fulfill the purpose or comply with legal obligations. The statutory storage obligations, in particular under § 257 HGB and § 147 AO (6 or 10 years), remain unaffected.

Recipient of personal data

We transmit your data to the specialist departments within WHU to the extent necessary and legally permissible.

If we use a commissioned processor to process your personal data, we conclude a commissioned processing contract with this processor, which fulfills all the requirements of Art. 28 GDPR.

Your personal data will not be transferred beyond this, unless this is expressly stated in this document.

Place of data processing

As a general rule, we process your personal data in Germany or in Member States of the European Union, unless, in the cases described above, your personal data is transferred to countries outside the Member States of the European Union (so-called third countries) or to other international organisations. In such cases, the applicable requirements of Articles 44 et seq. GDPR are complied with. Where, for example, the integration of third-party services on our website results in the transfer of personal data to the United States of America, we verify whether the recipient of the personal data is certified under the Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework ("EU-U.S. Adequacy Decision"), or whether the recipient provides other appropriate safeguards in accordance with Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. Where this is the case, the transfer of personal data is lawful. At present, the services integrated into this website that are covered by the EU-U.S. Adequacy Decision include services provided by Google LLC (YouTube, Google Maps, Google Analytics, Google Ads Conversion, Google Remarketing), Meta Platforms Inc. (Facebook and Instagram), LinkedIn Corporation (LinkedIn), SmugMug (Flickr), and Salesforce (Marketing Cloud Account Engagement).

Safety / Technical and organizational measures

We take all necessary technical and organizational measures in accordance with Articles 24, 25, and 32 of the GDPR to protect your personal data from misuse, loss, destruction, unauthorized access, modification, or disclosure.

In this way, we comply with the legal requirements for pseudonymizing and encrypting personal data, the confidentiality, integrity, availability and resilience of systems and services related to processing, the availability of personal data and the ability to rapidly restore them in the event of a physical or technical incident as well as the establishment of procedures for periodic tests, assessment and evaluation of the effectiveness of technical and organizational measures to ensure the safety of processing.

Furthermore, we also comply with the requirements of Art. 25 GDPR regarding the principles of "privacy by design" (data protection through technical design) and "privacy by default" (data protection through privacy-friendly default settings).

Your rights

You have a right to free information (right of access) about your personal data, as well as, subject to the relevant conditions, a right to rectification, blocking, and erasure of your data, to the restriction of processing, to data portability, as well as a right of objection.

If we base the processing of your personal data on weighing of interests, you can object to the processing. This is the case if the processing is, in particular, not necessary for the fulfillment of a contract with you. If you do so, please explain why we should not process your personal data as we have done. In the event of your justified objection, we will examine the facts of the case. We will either stop the data processing, adapt it, or present you with compelling reasons worthy of protection for which we will continue processing.

You also have the opportunity to complain to a competent supervisory authority (e.g. Landesbeauftragter für den Datenschutz und Informationsfreiheit Rheinland-Pfalz, Prof. Dr. Kugelmann, Hintere Bleiche 34, 55116 Mainz, Germany).

Please get in touch with us or our external data protection officer if you have any questions regarding the processing of your personal data, as well as questions relating to the above-mentioned rights and their assertion, or if you have any suggestions:

Mr. Ralf Wickert
c/o Dornbach GmbH Rechtsanwaltsgesellschaft
Anton-Jordan-Straße 1
56070 Koblenz
Email: datenschutz(at)whu.edu
Phone: 0261 9431-434

As of July 2026

The English version serves for informational purposes only. The German version is legally binding.