# **HLFF Inspiring Minds** c/o MCI Management Center Innsbruck\ Internationale Hochschule GmbH\ Universitätsstraße 15\ 6020 Innsbruck / Österreich In this privacy policy, we would like to explain how we process personal data and inform you about your rights. We are aware of the importance of the processing of personal data for you as a data subject, so observe all relevant legal requirements. The protection of your privacy is of the utmost importance to us. Our processing of your personal data complies with the General Data Protection Regulation as well as national data protection regulations. ### **Data processing controller** MCI Management Center Innsbruck\ Internationale Hochschule GmbH\ Prof. Dr. Peter Mirski\ [datenschutz@mci.edu](mailto:datenschutz@mci.edu)\ Universitätsstraße 15\ 6020 Innsbruck / Österreich ### **Definitions of Terms** This privacy policy uses the terminology of the General Data Protection Regulation (GDPR). “**Personal data**” is any and all information that relates to an identified or identifiable natural entity (hereinafter “data subject”); a natural entity is regarded as identifiable if they can be identified directly or indirectly, in particular by means of an identifier such as a name, an identification number, location data, an online identifier or one or more special features that express the natural entity’s physical, physiological, genetic, psychological, economic, cultural or social identity. “**Processing**” is any process carried out with or without the help of automated procedures or any series of processes in connection with personal data, such as collection, recording, organization, ordering, storage, adaptation or editing, reading, querying, use, disclosure by transmission, distribution or any other form of provision, comparison or linking, restriction, deletion or destruction. “**Restriction of processing**” involves the labelling of stored personal data with the aim of restricting its future processing. A “**file system**” is any structured collection of personal data that is accessible according to certain criteria, regardless of whether this collection is managed centrally, decentrally or according to functional or geographical criteria. A “**controller**” is the natural or legal entity, authority, institution or other body that, alone or jointly with others, decides the purposes and means of processing personal data; if the purposes and means of this processing are specified by union law or the law of member states, the controller or the specific criteria for their appointment can be provided for in accordance with union law or member state law. A “**processor**” is a natural or legal entity, authority, institution or other body that processes personal data on behalf of the controller. A “**recipient**” is a natural or legal entity, authority, institution or other body to which personal data is disclosed, regardless of whether this is a third party or not. Authorities that may receive personal data as part of a specific investigation according to union law or member state law are not considered recipients; these authorities process this data in accordance with applicable data protection regulations and the purposes of the processing. A “**third party**” is a natural or legal entity, authority, institution or other body, apart from the data subject, the controller, the processor and the persons authorized to process the personal data under the direct responsibility of the controller or the processor. Informed, unequivocal “**consent**” is granted by the data subject voluntarily for a particular case upon presentation of a declaration or any other unequivocal action with which the data subject states their agreement to the processing of their personal data. ### **Processing** We collect and process the following personal data about you: * Contact details and address insofar as you have provided us with your contact information or registered on our site, * Online identifiers (e.g. your IP address, browser type and version, the operating system used, referrer URL, IP address, file name, access status, the amount of data transferred, and the date and time of the server request), * Social media identifiers. * IP addresses are assigned to every device (e.g. smartphone, tablet, PC) that is connected to the internet. Which IP address this is depends on how your device is currently connected to the internet. * Application (by post, email or the application portal), * Carrying out of events, * Video conferencing * Management of the HLFF Inspiring Minds Platform ### **Purposes of data processing** * For contact requested by you, * For information about our services, * To process contracts, * For advertising purposes, * For press and communication purposes, * To send our email notifications if you have subscribed, * For quality assurance purposes, * For our statistics and * The preparation and carrying out of virtual and face-to-face events, recordings, especially live streams, and the publication of images, video and sound recordings on social media channels, our websites and print media. When you register as a member of HLFF Inspiring Minds, we collect data that is generated when you interact with our system. We save contact data and images that you enter or upload onto the system. We save messages that you send to other members, comments that you leave on the platform, rooms that you subscribe to, your posts and your participation in events. The purpose of data collection is networking among platform members, article 6 paragraph 1 sentence 1 b) of the GDPR. In order to fulfill our obligations, we need your name and an email address. Without the provision of this data, membership of our network is not possible. We may require additional mandatory information to authenticate members. All other data can be provided voluntarily; this makes it easier for us and other members to get in touch. You can see the data stored about you in the settings area of your profile; this allows you to find out about stored data. You also have the option of deleting your data in the settings area. Your data can be viewed by team members of the HLFF Inspiring Minds Team associated to the Heidelberg Laureate Forum Foundation, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg and MCI Management Center Innsbruck, Universitaetsstraße 15, 6020 Innsbruck, Austria, in order to ensure the administration and fulfillment of our purpose. Your data will be shared with other members for the purpose of networking (address book). Your profile settings let you control what data can be viewed by other members. From time to time, we will contact you by email to inform you about notices and events on the platform. We also use your address, your status or your program affiliation to this end. ### **Legal Basis for Data Processing** Your data is processed on the following legal basis: * Your consent according to article 6 paragraph 1 a) of the GDPR, * To execute a contract with you in accordance with article 6 paragraph 1 b) of the GDPR, * To fulfill legal obligations in accordance with article 6 paragraph 1 c) of the GDPR or * Based on a legitimate interest in accordance with article 6 paragraph 1 f) of the GDPR. If we process your personal data for legitimate interests within the meaning of article 6 paragraph 1 f) of the GDPR, this may encompass * Improving our services * Preventing misuse or * Keeping internal statistics. ### **Data Sources** We receive data from you (including about the devices you use). If we do not collect the personal data directly from you, we will also inform you of the source from which the personal data originates and, if applicable, whether this originates from publicly accessible sources. **Transmission / Data Recipient** When processing your data, we work with the following service providers who have access to your data: * Our cooperation partner, the Heidelberg Laureate Forum Foundation, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg, * provider of web analysis tools, * Web hosting providers, * Administrative service providers, * Video conferencing service providers, * Social media. **Duration of Processing** We only store your personal data for as long as is necessary to achieve the processing purpose or for the duration of the statutory retention period if the data is subject to one. We store your data * Until you revoke your consent at the latest, if you have granted your consent, * Until the statutory retention period ends or for as long as we have a contractual relation-ship with you at the latest, if we need the data for the execution of a contract, * For as long as your interest in deletion or anonymization does not outweigh our interests, if we use the data based on a legitimate interest. **Your Rights** You have the right - although certain conditions apply in some cases - * To request **information** about the processing of your data free of charge and to receive a **copy** of your personal data. You can request information regarding the purposes of processing, the categories of personal data being processed, the recipients of your data (if it is passed on), the duration of storage or the criteria for determining such duration; * To **correct** your data. If your personal data is incomplete, you have the right to complete the data, taking into account the purposes of processing; * To have your data **deleted** or **blocked**. Reasons for the existence of a right to deletion / blocking may include the revocation of the consent on which the processing is based, the data subject’s objection to the processing or the unlawful nature of the processing of the personal data; * To have processing **restricted**; * To **object** to the processing of your data; * To **revoke** your consent for the processing of your data for the future and * To **complain** to the responsible supervisory authority about unlawful data processing. ### **Further Data Protection Information** **Data Security** We have taken extensive technical and organizational measures to protect your data from possible dangers such as unauthorized access, unauthorized disclosure, modification and distribution, as well as loss, destruction and misuse. In order to protect your personal data from unauthorized third party access during transfer, we secure data transmissions using SSL encryption where necessary. This is a standardized encryption method for online services, especially for the web. **Log Files** Every time our website is accessed, use data is transmitted by the respective internet browser and stored in server log files. The data records saved in this process contain the following data: domain from which the user accessed the website, date and time of retrieval, IP address of the accessing computer, website(s) that the user visited as part of the service, amount of data transferred, browser type and version, operating system used, name of internet service provider, notification as to whether the request was successful. These log file data records are evaluated in an anonymized form in order to improve our service and make it more user-friendly, to find and correct errors, and to control the load on servers. All personal data is automatically deleted after 24 months at the latest. **Cookies** See [https://www.mci.edu/en/privacy-policy](https://www.mci.edu/en/privacy-policy) **YouTube** Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: [https://www.youtube.com;](https://www.youtube.com;) privacy policy: [https://policies.google.com/privacy;](https://policies.google.com/privacy;) settings for the display of advertisements: [https://adssettings.google.com/authenticated;](https://adssettings.google.com/authenticated;) use is not mandatory. **Audio and Video Conferencing** Among other things, we use online conference tools to communicate with our target group. The individual tools we use are listed below. If you communicate with us online via video or audio conference, your personal data will be recorded and processed by us as well as the provider of the relevant conference tool. These conference tools collect all data that you provide/employ to use the tools (e.g. email address). The conference tools also process the duration of the conference, start and end (time) of participation in the conference, number of participants and other “contextual information” in connection with the communication process (metadata). We use the following conference tools: **Big Blue Button** Big Blue Button will be used as the primary video conferencing tool on the platform. Big Blue Button is managed by the IT Department at MCI and hosted on a dedicated server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; website: [https://www.hetzner.com/](https://www.hetzner.com/); privacy policy: [https://www.hetzner.com/legal/privacy-policy](https://www.hetzner.com/legal/privacy-policy) ### **More Online Tools and Providers** **Qualtrics** Qualtrics will be used in order to send out online surveys and forms. Service provider: Qualtrics LLC, 333 W River Park Drive, Provo, Utah 84604, USA; website: [https://www.qualtrics.com](https://www.qualtrics.com); privacy policy: [https://www.qualtrics.com/privacy-statement/](https://www.qualtrics.com/privacy-statement/) **Status of This Privacy Policy** September 2022\ We reserve the right to change this privacy policy at any time with future effect.