Privacy policy

Data protection and data security for customers, partners, employees, and students of the Paracelsus Medical University Salzburg (PMU), as well as for interested parties and users of our website, are of paramount importance to our university. Transparency regarding the processing of your personal data and the protection of your data are therefore particularly important to us.

This statement provides an overview of how your personal data is collected and processed when you use our website and what you can do to better protect your data.

What is personal data?

Personal data is any information relating to an identified or identifiable natural person. The decisive factor is therefore whether the collected data can be used to identify a person. This includes information such as the name, address, telephone number, and email address. Information that is not directly related to a real identity—such as favorite websites or the number of users of a site—is not personal data.

How we collect and process your personal data

When you visit our websites, our web servers temporarily store the connection data of the requesting computer, the pages you visit on our website, the date and duration of your visit, the identification data of the browser and operating system used, and the website from which you visit us for the purpose of system security. Additional personal information such as your name, address, telephone number, or email address is not collected unless you provide it voluntarily, e.g., as part of a registration, a survey, to execute a contract, or to request information.

How we use your personal data and how we pass it on

If the website offers the option of entering personal or business data (email addresses, names, addresses), the disclosure of this data by the user is expressly voluntary. Emails are transmitted via a contact form. If you send us such a message, your personal data will only be collected to the extent necessary to respond to your message. The email is transmitted unencrypted.

We use the personal data you provide exclusively for the purpose of technical administration of the websites and to fulfill your wishes and requirements, i.e., generally to process the contract concluded with you or to respond to your inquiry.

Only if you have given us your prior consent or if you have not objected (insofar as this is provided for by law) will we also use this data for product-related surveys, marketing and statistical purposes.

Your personal data will not be passed on, sold, or otherwise transferred to third parties unless this is necessary for the purpose of contract processing or you have expressly consented to this.

Consent that has been given can be revoked at any time with effect for the future.

How long will your data be stored?

As a rule, we store all information that you provide to us until the respective purpose, e.g. contractual purpose, has been completed. For example, in the case of inquiries, this is until the inquiry has been resolved; in the case of newsletters, this is until you unsubscribe from the newsletter. If longer storage is required by law, the data will be stored within this framework.

If you no longer wish us to use your data, we will of course comply with this request immediately.

When will your data be deleted?

The stored personal data will be deleted if you revoke your consent to its storage, if knowledge of the data is no longer necessary to fulfill the purpose for which it was stored, or if storage is inadmissible for other legal reasons. Data for billing and accounting purposes is not affected by a request for deletion.

Use of cookies

We use so-called cookies when you visit our website. These are small text files that are stored on your computer. Cookies help us to determine the frequency of use and the number of users of our website, as well as to make our offers as convenient and efficient as possible for you.

On the one hand, we use so-called “session cookies,” which are stored temporarily for the duration of your use of one of our websites. On the other hand, we use “permanent cookies” to record information about visitors who repeatedly access one of our websites. The purpose of using these cookies is to offer you optimal user guidance, to “recognize” you, and to be able to present you with a website that is as varied as possible and new content when you return. The content of a permanent cookie is limited to an identification number. Names, IP addresses, etc. are not stored. No individual profile of your usage behavior is created.

It is also possible to use our services without cookies. You can deactivate the storage of cookies in your browser, restrict it to certain websites, or set your browser to notify you as soon as a cookie is sent. Please note, however, that if you deactivate cookies, you may experience a limited display of the page and limited user guidance.

Cookies that are necessary for the electronic communication process or for the provision of certain functions you have requested (e.g., shopping cart function) are stored on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in storing cookies for the technically error-free and optimized provision of its services. If other cookies (e.g., cookies for analyzing your surfing behavior) are stored, these are treated separately in this privacy policy.

When using certain advertising service providers, personal data is transferred to the USA. On

July 10, 2023, the European Commission issued the Adequacy Decision for the EU-US Data Privacy Framework. Based on the adequacy decision, which stipulates that the US ensures a

level of protection for personal data transferred from the EU to US companies within the new framework that is comparable to that of the EU, personal data may be transferred to US companies that are included in the Data Privacy Framework List

(https://www.dataprivacyframework.gov/s/participant-search; opens an external URL in a new window after self-certification (such as Google LLC)) without the need for further data protection measures.

Data transfers to US companies that are not listed in the Data Privacy Framework List cannot be based on the above adequacy decision. Compliance with European data protection requirements cannot therefore be guaranteed in these cases. The transfer of personal data to non-certified US companies is then carried out either on the basis of appropriate safeguards in accordance with Art. 46 GDPR (e.g., standard contractual clauses) or under the exception provision of Art. 49 (1) (a) GDPR (express consent).

You can revoke or adjust your consent to the use of cookies at any time in the cookie settings. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

Google Ads Conversion Tracking

The online advertising program “Google Ads” with its conversion tracking analysis service is installed on the PMU website. Google Conversion Tracking is an analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). When you click on an ad placed by Google, a conversion tracking cookie is stored on the computers of the website users, which expires after 30 days. This cookie does not contain any personal data, which means that personal identification is not possible. During the 30-day validity period of the cookie, Google and PMU can recognize that you clicked on the ad and were subsequently redirected to the PMU website. Since each Google Ads customer receives their own cookie, it is not possible to track cookies via the website of Google Ads customers.

The information collected by the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking. This allows Google Ads customers to see the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, it is not possible to personally identify users based on this information.

If you do not wish to participate in tracking, you can object to this use by deactivating the installation of Google conversion tracking cookies in your browser settings. This means that you will not be included in the conversion tracking statistics. Further information and Google's privacy policy can be found at: www.google.de/policies/privacy, (opens an external URL in a new window).

A contract for order processing has been agreed with Google.

Consent to the use of Google Ads conversion tracking can be revoked in the cookie settings by unchecking the “Marketing” box.

Google Analytics

Google Analytics is used to analyze the PMU website. This service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) uses cookies to analyze your use of this website. Cookies are text files that are stored on your device. The information generated by these cookies about your use of the PMU website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the website operator, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent the storage of cookies by adjusting your browser settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link tools.google.com/dlpage/gaoptout, (opens an external URL in a new window).

In addition, it is stated that the website uses Google Analytics in conjunction with the code “anonymizeIp()” so that IP addresses are only processed in anonymized form, thus avoiding any direct personal reference.

A contract for order processing has been agreed with Google.

Consent to the use of Google Analytics can be revoked in the cookie settings by unchecking the “Statistics” box.

Facebook Pixel and Custom Audiences

The PMU website uses the Facebook Pixel function without advanced data matching from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

We use the visitor access statistics (remarketing function) “Custom Audiences” from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), also known as Facebook Pixel. This feature allows us to target visitors to the website with advertising by displaying personalized, interest-based Facebook ads to visitors to this website when they visit the Facebook social network. The feature is only activated after you have given your permission. If the function is activated, a direct connection to a Facebook server is established when you visit this website. The Facebook server is informed which PMU web pages you have visited. Facebook assigns this information to your personal Facebook user account. Even if you are not registered with Facebook or have not logged in, it is possible that the provider may obtain and store your IP address and other identifying features.

Further information on the collection and use of data by Facebook, your rights in this regard, and options for protecting your privacy can be found in Facebook's privacy policy at www.facebook.com/about/privacy/ (opens an external URL in a new window).

We use Facebook Pixel for marketing and optimization purposes to show you interesting ads on Facebook and to make the website more attractive.

In principle, you can object to the collection of data by Facebook Pixel and the use of your data for the display of Facebook ads at any time. At www.facebook.com/settings, (opens an external URL in a new window) you can specify the types of advertisements you want to see on Facebook, regardless of the platform (settings are applied to all devices), by following the instructions on usage-based advertising settings.

Consent to the use of Facebook pixels and custom audiences can be revoked in the cookie settings by unchecking the “Marketing” box.

LinkedIn Insight Tag

The PMU website uses the conversion tool “LinkedIn Insight Tag” from LinkedIn Ireland Unlimited Company. This tool creates a cookie in your web browser that enables the collection of data such as IP address, device and browser properties, and page events (e.g., page views). This data is encrypted and pseudonymized within seven days. The pseudonymized data is deleted within 180 days. LinkedIn does not share any personal data with the website operator but provides anonymized reports on the website's target audience and ad performance. In addition, LinkedIn offers the option of retargeting via the Insight Tag. PMU can use this data to display targeted advertising outside of its website without identifying you as a visitor to the website. For more information on data protection at LinkedIn, please refer to the LinkedIn Privacy Policy (https://de.linkedin.com/legal/privacy-policy, opens an external URL in a new window). The contract for order processing can be found at de.linkedin.com/legal/l/dpa, (opens an external URL in a new window).

LinkedIn members can control the use of their personal data for advertising purposes in their account settings.

Consent to the use of LinkedIn Insight Tag can be revoked in the cookie settings by unchecking the “Marketing” box.

Google Ads Remarketing

The PMU website also uses the remarketing function as part of the Google AdWords service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). By using the remarketing function, PMU advertisements can be displayed to users of the website as they continue to browse the internet. This is done using cookies stored in the browser, which Google uses to record and evaluate the usage behavior of users when they visit various websites. This enables Google to determine each user's previous visit to the website. These cookies are stored for 540 days. According to Google, the data collected as part of remarketing is not combined with the personal data of users of this website that may be stored by Google. In particular, according to Google, pseudonymization is used in remarketing.

Participation in this tracking process can be prevented in various ways:

by adjusting the settings of your browser software accordingly; in particular, suppressing third-party cookies means that you will not receive any third-party ads;
by installing the plug-in provided by Google at the following link: www.google.com/settings/ads/plugin, (opens an external URL in a new window).
by deactivating interest-based ads from providers who are part of the “About Ads” self-regulation campaign via the link www.aboutads.info/choices, (opens an external URL in a new window) whereby this setting is deleted when the cookies are deleted.
By permanently deactivating them in your browser at the link www.google.com/settings/ads/plugin, (opens an external URL in a new window).

A contract for order processing has been agreed with Google.

Consent to the use of Google Ads Remarketing can also be revoked in the cookie settings by unchecking the “Marketing” box.

Snap Pixel

The PMU website uses Snapchat's “Snap Pixel” for analysis and optimization purposes, which is operated by Snap Inc., 2772 Donald Douglas, Loop North Santa Monica, CA 90405, USA. With the help of the Snap Pixel, Snapchat is able to identify visitors to the website as a target group for the display of advertisements (known as “Snapchat Ads”). Accordingly, Snapchat Pixel is used to display Snapchat Ads only to those Snapchat users who have shown an interest in the website or who have certain characteristics (e.g., interests in specific topics or products, which are determined based on the websites visited) that PMU transmits to Snapchat (so-called “Custom Audiences”). With the help of the Snap Pixel, PMU wants to ensure that PMU's Snapchat ads correspond to the potential interests of users and do not appear intrusive. In addition, the Snap Pixel can be used to track the effectiveness of Snapchat ads for statistical and market research purposes by allowing PMU to see whether users were redirected to the website after clicking on a Snapchat ad (so-called “conversion”). These cookies are stored for 30 days. Snapchat processes the data in accordance with Snapchat's Data Use Policy. General information on the display of Snapchat ads can be found in Snapchat's Data Use Policy: www.snap.com/enUS/privacy/privacy-center, (opens an external URL in a new window).

Consent to the use of Snap Pixel can be revoked in the cookie settings by unchecking the “Marketing” box.

Adform

The PMU website uses conversion tracking from Adform A/S, Wildersgade 10B, 1. Sal. 1408 Copenhagen, Denmark (hereinafter referred to as “Adform”). Adform uses cookies that are stored on the end device to analyze user behavior on the website and to display ads that are relevant to users. Adform uses a cookie ID to record which ads are displayed in which browser and can thus prevent them from being displayed multiple times. Adform cookies do not contain any information that can be used to identify users. These cookies are stored for 13 months.

Further information about Adform and data protection can be found at: site.adform.com/privacy-center/platform-privacy/product-and-services-privacy-policy/, (opens an external URL in a new window). Users who do not wish to participate in this tracking have the option of deactivating the Adform cookie via their internet browser or directly via the link site.adform.com/privacy-center/platform-privacy/opt-out/, (opens an external URL in a new window). In this case, it may not be possible to use all functions of the website to their full extent.

Consent to the use of Adform can also be revoked in the cookie settings by unchecking the “Marketing” box.

Matomo/Matomo Tag Manager

The PMU website uses the web analytics service Matomo from InnoCraft, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand, an open-source software for statistical analysis of visitor traffic. The service is hosted on a PMU-owned server in Austria. No personal data is transferred to third parties or third countries. For web analysis, first-party cookies are stored on your device after you have given your consent. Cookies used by Matomo begin with “_pk_id”, ‘_pk_ses’ and “_pk_ref”. The stored data is anonymised and cannot be assigned to any individual.

The following data is stored when you visit the PMU site:

Anonymized IP addresses
Pseudo-anonymized location (based on the anonymized IP address)
Date and time
Title of the page visited
URL of the page visited
URL of the previous page (if permitted)
Screen resolution
Local time
Files that were clicked on and downloaded
External links
Duration of page loading
Main language of the browser
User agent of the browser

Matomo is used for the purpose of improving the quality of our website and its content, as well as for the ongoing optimization of our website performance.

The data and evaluations are deleted after 3 years.

Consent to the use of Matomo can be revoked in the cookie settings by unchecking the “Statistics” box.

In addition, the “Do not track” function is activated in our Matomo installation. If your browser supports this function and you have activated it in your browser settings, Matomo will not collect any data, even if you have not deactivated the web statistics cookies; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

For more information on Matomo's data protection policy, please visit the following link: matomo.org/gdpr-analytics/, (opens an external URL in a new window).

This website also uses Matomo Tag Manager, an extension of the open-source web analytics software Matomo for managing website tags via a central user interface. Tags are small pieces of code (HTML or JavaScript) that are used on websites for analysis and marketing purposes. These include, for example, social media plug-ins, tracking pixels, or similar. For information on the data collected by PMU, its intended use, and legal basis, see Sections IV, V, and VI of the privacy policy. The Matomo Tag Manager merely implements tags and triggers or activates other tags, which in turn may collect personal data, but it does not access this data itself. This tool does not set cookies, create user profiles, or collect or store personal data. Matomo Tag Manager thus functions merely as an “administrator” of the implemented tags. For data protection reasons, Matomo with Tag Manager is hosted locally on PMU servers.

Further information on Matomo Tag Manager can be found at: matomo.org/guide/tagmanager/, (opens an external URL in a new window

Google Looker Studio

The PMU website uses Google Looker Studio, formerly Google Data Studio, a data management tool for data analysis and visualization. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be stored on servers in the US (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043). Data can be imported from various sources and converted into informative reports or interactive dynamic dashboards. Local application of the web tool is not necessary; access is via the browser. The use of this tool enables improved analysis and visualized representation of our online activities and thus contributes an indispensable component to the measurement of the success of our measures.

Google Looker Studio can access data collected by Google products such as Google Analytics, Google Ads, Google Search Console, YouTube Analytics, etc. For more information about these Google connectors, please visit the following link: support.google.com/lookerstudio/topic/9281288, (opens an external URL in a new window

In addition to Google Connectors, Google Looker Studio can also access data from third-party providers via an API programmed with Google Apps Script (known as partner connectors). PMU uses the partner connector “Catchr” to import data from Matomo to Google Looker Studio. For more information about Catchr, please refer to section IV.J.

Google Looker Studio only displays data visually/graphically that has been collected using

Google Analytics or Matomo because of the consent given in accordance with Art. 6 (1) lit. a GDPR. Google Looker Studio does not automatically activate when you visit the website. The data collected/evaluated via Google Analytics and Matomo is only transferred to Google Looker Studio after PMU has created reports. No personal data is passed on to Google Looker Studio.

If you deactivate the use of Google Analytics for the future at tools.google.com/dlpage/gaoptout (opens an external URL in a new window) or object to the use of Google Analytics and Matomo in our cookie settings, your data will not be used in Google Looker Studio. By clicking on the link, no information about your website visit will be transmitted to Google Analytics and the use of Google Analytics for your device will be prevented. Please note that you will have to repeat this process if you delete the cookies in your browser.

The terms of use and guidelines for Google Looker Studio can be found at: support.google.com/lookerstudio/topic/7156687, (opens an external URL in a new window).

Catchr

The PMU website uses catchr.io, an interface connector, to visualize marketing data with various tools such as Google Looker Studio, Google Data Studio, Google Sheets, Google Big Query, or other databases. Catchr.io is a service provided by Catchr, 14 Rue Domer, 69007 Lyon, France, Auvergne-Rhône-Alpes. No personal data is stored when data is transferred from Matomo to Google Looker Studio.

For more information about Catchr, please visit the following link: www.catchr.io, (opens an external URL in a new window)

Social media

Recommendation buttons for Facebook, Instagram, Twitter, LinkedIn, Xing, and YouTube are integrated into the website as direct HTML links. No data is transferred to external platforms when the page is displayed.

The PMU has no influence on the content and data protection standards of the linked websites.

PMU therefore accepts no liability for external links.

For information on the scope and purpose of data processing by the respective service, as well as the further processing and use of your data, please refer to the data protection information directly on the website of the respective service. There you can also find further information about your rights and setting options.

Social plugins YouTube

We have integrated YouTube videos into the website, which are stored at www.YouTube.com (opens an external URL in a new window) and can be played directly from the website. These are all integrated in “extended data protection mode,” which means that no personal data about you as a user is transferred to YouTube as long as you do not play the videos. Only when you play the videos will your IP address and, if applicable, activity data be transmitted to YouTube and cookies be installed on your computer. We have no influence on this data transfer.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and settings options for protecting your privacy: www.google.de/intl/de/policies/privacy, (opens an external URL in a new window). Google also processes your personal data in the USA.

The legal basis for the transfer of your personal data in connection with the playback of YouTube videos is your consent in accordance with Art. 6 (1) lit. a GDPR. You can revoke your consent at any time. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

Vimeo

The PMU website also uses plugins from Vimeo for the integration and display of videos. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit a page with an integrated Vimeo plugin, a connection to the Vimeo servers is established. The Vimeo server is informed which pages you have visited. Vimeo also obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA.

If you are logged into your Vimeo account, you enable Vimeo to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your Vimeo account.

At vimeo.com/privacy (opens an external URL in a new window), you will find further information on the collection and use of data, as well as your rights and options for protecting your privacy.

The legal basis for the use of Vimeo is Art. 6 (1) lit. f GDPR. The legitimate interest lies in improving the website by providing and presenting videos.

Spotify

We have integrated Spotify audio files into the PMU website, which are published at www.spotify.com (opens an external URL in a new window) and can be played directly from the website. Spotify AB is headquartered at Regerinsgatan 19, SE-11153 Stockholm, Sweden. No personal data about you as a user is transferred to Spotify if you do not play the audio files. Only when you play the audio files will personal data be transferred to Spotify and cookies installed on your computer. If you are logged in as a Spotify user, Spotify can assign your visit to our website to your Spotify account. We have no influence on this data processing.

For more information on the purpose and scope of data processing by Spotify, please refer to

Spotify's privacy policy at www.spotify.com/at/legal/privacy-policy/, (opens an external URL in a new window) and Spotify's privacy center at www.spotify.com/de/privacy, (opens an external URL in a new window).

The legal basis for the transfer of your personal data in connection with the playback of Spotify audio is your consent in accordance with Art. 6 (1) lit. a GDPR. You can revoke your consent at any time with effect for the future. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

LinkedIn

When you visit our LinkedIn page, LinkedIn collects, among other things, your IP address and other information stored on your device in the form of cookies. This information is used to provide us, as the operator of the LinkedIn pages, with statistical information about the use of the LinkedIn page. LinkedIn provides more detailed information on this at the following link: www.linkedin.com/legal/privacy-policy, (opens an external URL in a new window).

The data collected about you in this context is processed by LinkedIn Inc. and may be transferred to countries outside the European Union. LinkedIn describes in general terms what information it receives and how it is used in its data use guidelines. There you will also find information about how to contact LinkedIn and about the settings for advertisements. The data use guidelines are available at the following link: www.linkedin.com/legal/privacy-policy (opens an external URL in a new window).

LinkedIn does not conclusively and clearly state how it uses the data from visits to LinkedIn pages for its own purposes, to what extent activities on the LinkedIn page are assigned to individual users, how long LinkedIn stores this data, and whether data from a visit to the LinkedIn page is passed on to third parties, and we are not aware of this.

When you access a LinkedIn page, the IP address assigned to your device is transmitted to LinkedIn. According to LinkedIn, this IP address is anonymized (for “German” IP addresses) and deleted after 90 days. LinkedIn also stores information about its users' devices (for example, as part of the “login notification” feature); which may enable LinkedIn to assign IP addresses to individual users.

If you are currently logged in to LinkedIn as a user, a cookie with your LinkedIn ID is stored on your device. This enables LinkedIn to track that you have visited this page and how you have used it. This also applies to all other LinkedIn pages. LinkedIn buttons embedded in websites enable LinkedIn to record your visits to these websites and assign them to your LinkedIn profile. This data can be used to tailor content or advertising to you.

If you wish to avoid this, you should log out of LinkedIn or deactivate the “stay logged in” function, delete the cookies on your device, and close and restart your browser. This will delete LinkedIn information that can be used to identify you directly. This allows you to use our LinkedIn page without revealing your LinkedIn ID. When you access interactive features on the page (like, comment, share, messages, etc.), a LinkedIn login screen will appear. After logging in, you will once again be recognizable to LinkedIn as a specific user.

Information on how to manage or delete information about you can be found on the following LinkedIn support pages: www.linkedin.com/legal/privacy-policy (opens an external URL in a new window).

TikTok

Please carefully consider what personal data you share with us via TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland).

We would like to point out that you use TikTok and its features at your own risk. This applies to interactive features (e.g., commenting, sharing, rating). Therefore, in your own interest, please carefully consider what information you wish to disclose and share with other users on this platform.

We expressly point out that TikTok stores the data of users of its services (e.g., personal information, IP address, etc.) and may also use this data for business purposes. For more information on TikTok's data processing, please refer to TikTok's privacy policy at www.tiktok.com/legal/privacy-policy-eea (opens an external URL in a new window).

We have no influence on the collection and further processing of data by TikTok. Furthermore, we cannot determine the extent to which, where and for how long the data is stored, the extent to which TikTok complies with existing deletion obligations, what evaluations and links are made with the data, and to whom the data is passed on.

Insofar as the data you provide to us via TikTok is also or exclusively processed by TikTok, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is also responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) in addition to us.

The protection of your data is a top priority for PMU. All our procedures and processes comply with the applicable data protection regulations. In the privacy policy, we inform you, among other things, about the type, purpose, and legal basis of the processing of personal data in the context of using the social media platform TikTok. We process your data exclusively based on the legal provisions on data protection and data security, in particular in accordance with the Austrian Data Protection Act (“DSG”), the EU General Data Protection Regulation (‘GDPR’), and the Telecommunications Act (“TKG 2021”).

The TikTok app is a social media platform on which short videos or video snippets can be created and distributed. TikTok is operated by the Chinese company ByteDance and is therefore subject to access by Chinese authorities. When using TikTok, personal data may be transferred to the People's Republic of China (third country – no adequacy decision). Chinese companies are required to disclose data to Chinese authorities under the Chinese Multi-Level Protection Scheme 2.0. These authorities are granted unrestricted access to the servers of Chinese companies. Compliance with European data protection requirements cannot therefore be guaranteed. The transfer of this data to a third country for a specific purpose is carried out under the exception provision of Art. 49 (1) (a) GDPR, in that you give us your express consent after being informed of the risks. You can revoke your consent at any time.

You can contact TikTok's data protection officer using the online contact form provided by TikTok at www.tiktok.com/legal/report/DPO (opens an external URL in a new window).

We ourselves do not store or process any of your personal data.

Further information on data processing and contacting TikTok can be found on the following TikTok support pages: support.tiktok.com/de (opens an external URL in a new window).

You can find out more about the option of viewing your own data on TikTok here (with further links): support.tiktok.com/de/account-and-privacy/account-information (opens an external URL in a new window).

Information on the available personalization and privacy settings can be found here (with further references): support.tiktok.com/de/account-and-privacy/account-privacy-settings (opens an external URL in a new window).

You also have the option of requesting information via the TikTok privacy form or archive requests: www.tiktok.com/legal/report/privacy (opens an external URL in a new window).

What we do to ensure the security of processing

Our university takes all necessary technical and organizational security measures to protect your personal data from loss and misuse. Your data is stored in a secure operating environment that is not accessible to the public. In certain cases, your personal data is encrypted during transmission using Secure Socket Layer (SSL) technology. This means that communication between your computer and our university's servers takes place using a recognized encryption method if your browser supports SSL.

These are the legal bases:

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our university is subject, Art. 6 (1c) GDPR serves as the legal basis.

Art. 6 (1d) GDPR serves as the legal basis if vital interests of the data subject or another natural person require the processing of personal data.

If processing is necessary to safeguard a legitimate interest of our university or a third party and the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) f GDPR serves as the legal basis for processing. Legitimate interests include ensuring the operation and security of the website, investigating how visitors use the website, and simplifying the use of the website.

These are your data protection rights

Within the framework of the applicable legal provisions, you have the right to obtain information free of charge at any time about your stored personal data, its origin and possible recipients, and the purpose of data processing (Art. 15 GDPR) and, if applicable, the right to correct inaccurate data (Art. 16 GDPR), deletion of this data (Art. 17 GDPR), the right to restrict processing in accordance with Art. 18 GDPR, the right to object (Art. 21 GDPR), and the right to data portability of data provided by you in accordance with Art. 20 GDPR.

In addition, in the event of violations of data protection law, you have the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection issues is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.

How you can revoke your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke the consent you have already given at any time. To do so, simply send us an informal email (datenschutz(at)pmu.ac.at). The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Paracelsus Medical University (PMU)