With the following information, we would like to inform you about the processing of your personal data as an applicant or tenant in accordance with Art. 13 and 14 DSGVO (Data Protection Regulation).

Further information can be found in our "General Privacy Policy".
 

1. who is responsible for data processing and who can you contact?

The responsible body is:

Studierendenwerk Stuttgart AöR

Rosenbergstraße 18

D-70174 Stuttgart

Telephone: +49 711 4470-1247

E-Mail: info@sw-stuttgart.de 

You can reach our data protection officer at:

Studierendenwerk Stuttgart AöR

- Datenschutzbeauftragter -

Rosenbergstraße 18

D-70174 Stuttgart

E-Mail: datenschutz@sw-stuttgart.de 

2. where do we get personal data from?

We receive personal data directly from you in most cases. For some processing, we also receive personal data from other entities:

• From universities we receive data on room requests for exchange students and students from contingent programs, as well as information on student status,
• from tutorials or housing departments,
• from main tenants the data of subtenants,
• authorities, banks, post office and other deliverers,
• Selfnet e.V.

3. what do we process personal data for and on what legal basis?

We process personal data in accordance with Art. 6 Para. 1 lit. e DSGVO in conjunction with § 4 LDSG (State Data Protection Act) for the fulfillment of our legal duties arising from the Studierendenwerksgesetz Baden-Württemberg (§ 2 StWG BW), in particular for the operation of student housing facilities, as well as for the fulfillment of legal obligations in accordance with Art. 6 Para. 1 lit. c DSGVO.

We also process personal data to carry out pre-contractual measures and to fulfill contracts in accordance with Art. 6 (1) lit. b DSGVO, in particular to check the requirements for a housing allocation.

In addition, we process data based on the legitimate interest of the Studierendenwerk (Art. 6 (1) lit. f DSGVO) by exchanging data (for example, with universities), or passing it on to third parties (for example, postal and other delivery services). The legitimate interest is the optimal implementation of the lease.

With the special consent of the data subjects, we process personal data - including health data - for the optimal support of students as well as for the support of special hardship cases, according to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a DSGVO.

4. to which recipients do we disclose personal data?

We share personal data with the following entities:

• Internally to the departments responsible for residential facility management,
• internal EDP and accounting, janitor,
• house bank (for direct debiting of rents), tax consultants, auditors,
• Universities, academic foreign offices (e.g. for exchange programs),
• Authorities (e.g. registration office, police for inquiries),
• postal and other delivery services (for optimal delivery of letters and parcels),
• Selfnet e.V. (if an Internet connection is requested from Selfnet),
• tutorial and housing departments,
• contracted craftsmen (in case of repairs), insurance companies (in case of damages),
• in cases of emergency (emergency situations such as illness or death of the tenant) to the relatives,
• Hochschulservice GmbH (if necessary, for the purpose of making an appointment for final cleaning).

In addition to the recipients mentioned above, we have commissioned specialized service providers to support us in the operation of our IT applications, including, for example, web hosts, software providers, system administrators and data center operators. These entities sometimes have access to personal data as part of the performance of their services. These include:

• tl1 GmbH, Freiburg (Hosting und Support Wohnverwaltungs-Software),
• 1&1 Telecommunication SE, Montabaur (Hosting Webseite),
• Mosaiq GmbH, Stuttgart (Webseiten-Support),
• Hochschulservice GmbH, Stuttgart (IT-Support).

5. How long is personal data stored?

In principle, we store personal data only until the purpose of the storage has been fulfilled. In doing so, we must comply with statutory retention periods, the expiration of which we must wait before deleting data.

• If the application leads to a tenancy agreement, the data must be retained for up to 10 years after the end of the tenancy agreement.
• Data from rejected or withdrawn applications is deleted after two years.

6. is the provision of personal data mandatory?

We need your data in order to check the basis for the conclusion of a rental contract and to be able to execute the contract. This includes information about your student status when applying and the presentation of your passport or ID card when moving in or out of the residence hall, so that we can check and prove your eligibility for a place to live. Without this information, we cannot process applications or execute the contract.

In some cases, we also ask for data in order to be able to offer our services in the best possible way, for example, questions about special wishes, disabilities or hardship cases. This information is always voluntary, but without this information we can not provide our services optimally.

7 Will personal data be transferred to a third country?

As a matter of principle, we do not transfer any personal data to third countries. Only in the context of communication with students who are abroad, the transmission to third countries is possible. In emergency cases, we also communicate with relatives or universities abroad.

8. security of your data

We process your personal data with the greatest possible care. In doing so, we use appropriate security procedures.

You can use our online portal to apply for a place in our residential facilities. For this purpose, we use the software of an IT service provider specializing in this area. The service provider's forms are embedded in our web portal. Your data will be processed by the service provider on our behalf.  We will send you your details by e-mail immediately after they have been entered so that you can check them again. This e-mail is unencrypted; if you do not want to communicate with us unencrypted, you are welcome to contact us by phone to receive a conventional application form.
 

9. what data protection rights do data subjects have?

Data subjects have the following rights with respect to the data concerning them:

• The right of access to their data in accordance with Art. 15 DSGVO,
• the right to rectification in accordance with Art. 16 DSGVO,
• the right to erasure according to Art. 17 DSGVO,
• the right to restriction of processing according to Art. 18 DSGVO,
• the right to data portability according to Art. 20 DSGVO,
•  the right to object to processing pursuant to Art. 21 DSGVO,
• the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 DSGVO.

In addition, you have the right to revoke a given consent with effect for the future at any time in accordance with Art. 7 (3) DSGVO. Consents given and their revocation do not take effect if and insofar as another legal basis for the processing exists.

Status of 16.12.2019