Data privacy information for TH Köln

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws and regulations is

TH Köln
Corporation under public law
represented by the President
Prof. Dr. Sylvia Heuchemer
Claudiusstraße 1
50678 Cologne
T: +49 221 8275 3101
Email: praesidium@th-koeln.de
Website: www.th-koeln.de

Bernadette Schmitz
Claudiusstraße 1
50678 Cologne
T: +49 221 8275 3994
E: datenschutzbeauftragter@th-koeln.de

State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia (LDI NRW)

Kavalleriestr. 2-4
40213 Düsseldorf
Telephone: 0211/38424-0
Fax: 0211/38424-10
Email: poststelle@ldi.nrw.de

1. Scope of personal data processing

TH Köln only processes the personal data of website users insofar as this is necessary for providing a functional website as well as the content and offers. The personal data of website users is consistently processed only in accordance with the consent given. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

2. Legal basis for using personal data

Insofar as TH Köln processes personal data on the basis of the consent given, the legal basis for this is Art. 6 (1) (a) GDPR.

The legal basis for processing personal data necessary for the performance of a contract to which the data subject is a party is Art. 6 (1) (b) GDPR. This also applies to processing activities for taking steps prior to entering into a contract.

Insofar as the processing of personal data is necessary for compliance with a legal obligation to which TH Köln is subject as a public corporation, the legal basis for this is Art. 6 (1) (b) GDPR.

If the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR constitutes the legal basis.

If the processing is necessary for safeguarding a legitimate interest of TH Köln or a third party and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, the legal basis is Art. 6 (1) (f) GDPR.

3. Data erasure and storage period

The personal data of the data subject will be deleted or blocked once the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislators in EU regulations, laws or other provisions to which TH Köln is subject. The data will also be blocked or deleted if a storage period required by the aforementioned standards expires unless there is a need for further storage of the data for the conclusion of a contract, fulfilment of a contract or to comply with a retention obligation.

1. Description and scope of data processing

TH Köln automatically collects data and information from the user’s computer system each time our website is accessed.

The following data is collected:

a) The IP address of the user
b) Date and time of access
c) Websites accessed by the user's system via our website
d) User operating system
e) Information about browser type and version used
f) Websites from which the user’s system accesses our website
g) The user's internet service provider

The data is also stored in the log files of the TH Köln systems. These data are not stored together with other user personal data.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR as there is a legitimate interest in optimizing the website and in detecting and eliminating faults.

3. Purpose of data processing

Temporary storage of the IP address by the system is necessary so that the website can be delivered to the user's computer. This requires the user's IP address to remain stored for the duration of the session.

The data are stored as log files to ensure the functionality of the website. Data is also used for website optimization and to ensure the security of TH Köln’s IT systems. The data is not analyzed for marketing purposes in this context.

The legitimate interest of TH Köln in data processing under Art. 6 (1) (f) GDPR is based on these purposes.

4. Storage period

The data are deleted as soon as they are no longer required for achieving the purpose for which it was collected. In the event of data being collected for the provision of the website, this is the case when the respective session has ended.

If the data are stored in log files, this is the case after seven days at the latest. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to identify the accessing client.

5.  Possibility of objection and removal

The collection of data for providing the website and the storage of data in log files is essential for operating the website. Consequently, there is no option to object for users.

1. Description and scope of data processing

Our website uses cookies. Cookies are text files stored in the Internet browser or in the user's computer system. When users access a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters which allows the browser to be uniquely identified when the website is accessed again.

2. TH Köln uses session cookies to ensure the functionality of the website during the session.

eTracker
TH Köln uses the services of etracker GmbH from Hamburg, Germany  to analyze usage data. We do not use cookies for web analysis by default. Detailed information is available on the etracker website: https://www.etracker.com/docs/faq/eu-dsgvo/daten-datenspeicherung/welche-daten-werden-von-etracker-erhoben/

The data generated using etracker is processed and stored by etracker on behalf of TH Köln exclusively in Germany and is therefore subject to strict German and European data protection laws and standards. In this regard, etracker has been independently audited, certified and awarded the data protection seal of approval.

Data is processed on the basis of the legal provisions of Art. 6 (1) (f) (legitimate interest) of the General Data Protection Regulation (GDPR). Our concern within the meaning of the GDPR (legitimate interest) is the optimization of our online offer and our website. Since the privacy of our visitors is important to us, data that may allow a reference to an individual person, such as the IP address, login, or device identifiers, are anonymized or pseudonymized as soon as possible. No other use, combination with other data or transfer to third parties occurs.

Further information on data protection at etracker can be found here: https://www.etracker.com/datenschutz/.

Adobe Fonts
TH Köln uses web fonts provided by Adobe to display texts. When you call up a page, your browser loads the required web fonts into your browser cache and establishes a connection to the Adobe servers. This provides Adobe with information about the IP address from which the page was accessed. Adobe Fonts are used in the interest of providing a uniform and appealing presentation of our online offers. This is a legitimate interest within the meaning of Art. (6) (1) (f) GDPR.

Further information about Adobe Fonts can be found at https://fonts.adobe.com/ and in the Adobe Fonts privacy policy: https://www.adobe.com/de/privacy/policies/adobe-fonts.html

If your browser does not support web fonts, a standard font from your computer is used.

3 Legal basis for data processing

The legal basis for processing user personal data and the use of cookies is Art. 6 (1) (f) GDPR.

4. Storage period, possibility of objection and removal

The data is deleted as soon as it is no longer required for our recording purposes.

TH Köln has a presence on social networks such as Facebook, LinkedIn, and Instagram. The data collected about you when using social networks is processed by the provider and may be transferred to countries outside the European Union.

We would like to point out that you use social networks and their functionalities on your own responsibility. TH Köln has no influence on the nature and scope of the data processed by the respective provider, the nature of processing and use or the transfer of this data to third parties.

The use of social networks is not necessary for contacting us or for receiving information. The information we publish via social networks can also be accessed in the same or similar form via the websites of TH Köln at www.th-koeln.de.

TH Köln has also integrated buttons ("plugins") from various social networks on its websites so that users can also use the interactive features of the social networks on our websites. These plugins provide various functions, the subject matter and scope of which are determined by the social network operators. In order to use the functions, you can activate the respective plugin by clicking on a button. This sets a cookie in your browser via which personal data is passed on to the respective third-party provider in accordance with the nature and scope of the third-party provider.

Please note that TH Köln is not the provider of social networks and has no influence over data processing by the respective service providers. Insofar as personal data are processed, the legal basis for the transfer of data by activating the plugin is Art. 6 (1) (a) GDPR.

If you have consented to its use on one occasion, you can also delete the cookie at a later date:

If you do not activate the corresponding plugins, your data will not be passed on to the operators of the social networks.

On its websites and in its research portals, the TH Köln University Library offers access to a wide range of content such as databases, electronic journals and e-books. This allows the University to provide a wide range of information and services, in particular to support research and teaching.

When using licensed content offerings, data related to individuals may be collected and processed by the respective content provider. The nature and scope of this data depends on the particular service offering. The relevant privacy policies of the respective content providers will apply.

AI-based research tools may also be used by the respective content providers.

AI-based applications of this type are implemented and provided by the respective content providers. If you use AI-based applications, it cannot be ruled out that metadata or content from prompts from the use context will be transferred to the respective provider.

We would like to point out that AI-based applications are used on your own responsibility.

We use the podcast hosting service podcaster.de (Fabio Bacigalupo, Brunnenstrasse 147, 10115 Berlin).

The podcasts are downloaded from podcaster.de or transmitted to other streaming platforms via podcaster.de.

Podcaster.de processes IP addresses and device information (operating systems and applications such as Safari, Firefox, Chrome, etc.) to facilitate podcast downloads/playbacks and to obtain statistical data such as the number of downloads. This data is anonymized before being stored in the database.

The use is based on our legitimate interests, i.e. interest in secure and efficient provision, analysis and optimization of our podcast offer in accordance with Art. 6 (1) (f) GDPR.

Further information can be found in the privacy policy of podcaster.de . Our podcast is made available on other streaming platforms. These external providers process personal data. More information on this is available in the privacy policies of the respective providers:

• Deezer (Deezer Limited Company, 12 rue d'Athènes 75009 Paris, France):  Privacy policy of Deezer (as of June 24, 2025)
• iTunes, Apple Podcast (Apple Inc. One Apple Park Way, Cupertino, California, USA, 95014): Apple Podcasts privacy policy (as of June 24, 2025)
• Spotify (Spotify AB, Regeringsgatan 19, 11153 Stockholm, Sweden): Spotify privacy policy (as of June 24, 2025)

We would like to provide you with information below about the processing of your personal data in the context of the Technische Hochschule Köln (TH Köln) newsletter. Please also note any supplementary information or information which may deviate from this on the registration page of the desired newsletter.

1. Description and scope of data processing

You have the option of subscribing to one or more free email newsletters featuring news and current announcements from faculties, institutes, facilities, and university administration. Please refer to the registration page for the respective email newsletter for further specific information, in particular about the content and the mailing volume.

We use an external processor in accordance with Art. 28 GDPR for the administration of the newsletter service and the technical transmission of the newsletter mailings:

Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin

The specialized service company processes your personal data exclusively on our behalf and on our instructions and has taken appropriate technical and organizational measures to protect your personal data. These measures are regularly checked and certified by an independent data protection auditor. The transmission of your data is encrypted and your data will not be transferred on to third parties or used for other purposes.

If you submit your newsletter registration online, you will immediately receive a confirmation email to the email address you have provided. This contains a personal activation link that is valid for 24 hours (activation period). By clicking on the activation link, you are confirming to us that, as the legal owner of this email address, you agree to receive the newsletter (so-called double opt-in procedure).

2. Legal basis for data processing

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 (1) (a) GDPR.

3. Purpose of data processing

For transmission and receipt of the newsletter, you must provide your email address when registering for the newsletter via the desired newsletter’s online input mask. Otherwise, it will not be possible to send or for you to unsubscribe from the newsletter.

When registering for a newsletter, you may voluntarily provide further information about yourself. This will be processed exclusively for addressing you in person in the newsletter mailings (such as title, first name, surname) or for sending an individual newsletter personalized for you in terms of topics  (e.g. interests, information about your relationship to TH Köln such as the degree program you attended, your faculty, etc.). Further information about this can be found on the registration page of the respective newsletters. There is no obligation to provide additional data and you will not suffer any disadvantages if you choose not to do so.

For protection against misuse and for data protection documentation purposes, your IP address and the time of registration and activation of your e-mail address are also processed as part of the registration procedure (so-called double opt-in procedure).

4. Storage period

Your personal data will be deactivated (blocked) if you unsubscribe from the newsletter or withdraw your consent. In the event of temporary undeliverability (so-called soft bounces), your data will be deactivated after the third unsuccessful delivery attempt. If your email address is permanently unavailable (hard bounces), your data will be deactivated immediately. Deactivated email addresses and any other data will be automatically deleted after 7 days at the latest.

5. The possibility of objection and removal

You can unsubscribe from the newsletter or withdraw your consent at any time. The quickest and easiest way to do this is to click on the unsubscribe link in the e-mail newsletter or go to the subscription and unsubscribe page of the respective newsletter and use the online input mask to unsubscribe. By clicking on the confirmation link, your e-mail address will be deactivated for the receipt of e-mail newsletters, and your data will be deleted.

Microsoft Teams data protection notice

Status: March 2025

Description of data processing

The "Microsoft Teams" cloud service is used for chat, file storage and sharing, collaboration on Office documents and for video conferencing at TH Köln. Microsoft acts as the processor in accordance with Art. 28 GDPR. In this context, Campus IT processes personal data in compliance with the applicable data protection regulations (GDPR).

The description of data processing by Microsoft is available in its current form here.

For what purpose and on what legal basis is personal data processed?

Data is processed for the purpose of enabling employees and students to chat, store and share files, collaborate on Office documents, and to access video conferencing.

Insofar as personal data of TH Köln employees is processed, the legal basis for the processing is Art. 6 (1) (e) in conjunction with paragraph 3 GDPR in conjunction with Section 18 of the North Rhine-Westphalia Data Protection Act (Datenschutzgesetz Nordrhein-Westfalen, DSG NRW).

Insofar as the personal data of students or external persons is processed, the legal basis for the processing is Art. 6 (1) (e) in conjunction with Art. 6 (3) GDPR in conjunction with Section 3 of the Higher Education Act of the State of North Rhine-Westphalia (Hochschulgesetz Nordreinwestfalen, HG NRW).

Otherwise, the legal basis for data processing when conducting online meetings is Art. 6 (1) (b) GDPR provided the meetings are conducted within the framework of contractual relationships.

Microsoft’s Online Service Terms (OST) and the Data Protection Addendum (DPA), including the standard contractual clauses, allow Microsoft to fulfil the requirements for commissioned processing within the meaning of Art. 28 GDPR.

Which personal data is used by MS Teams?

To use MS Teams, users need a valid TH Köln campus ID and the corresponding password.

When you register your user ID with Microsoft, your personal data will be transferred to the respective service provider, processed and may be stored by the service provider. This data includes personal data such as first name, surname, institution, TH Köln email address, campus ID and status (student/employee).

Further information about the processing of personal data can be found in Microsoft’s data protection information.

The passwords do not reach Microsoft. The campus ID and password are always checked by the TH Köln identity provider. All communication is encrypted without exception.

Is the data transferred to a third country or an international organization?

The data at rest (general user data) and data in transit are processed by Microsoft Ireland Operations Ltd. This data is transferred to Microsoft Corporation in pseudonymized form and processed by them, as well as by their support service providers and sub-processors. Further information about Microsoft’s support service providers and sub-processors can be found in the legal department.

How long will my data be stored?

Data retention (user accounts) ends with membership or employment relationship or, for students, with revocation, disenrollment or after the expiry of statutory retention periods.

To integrate and display interactive maps on this website, TH Köln uses map material from the free open-source project OpenStreetMap (OSM). The OSM  provider is OpenStreetMap Foundation, St John's Innovation Center, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

OSM maps are used for the interactive display of geodata of locations (such as printers ) at TH Köln.

When the OSM map service is activated and used, map material is retrieved from an OpenStreetMap Foundation external server during the period for which the website is used. By using and interacting with the OSM, connections to the OSM servers are established and the following data are transferred from your device to the OSM when establishing these connections:

IP address, browser and device type used, operating system, date and day of the page view, and the website from which you retrieve the map material ("referring URL").

The use of this service is in the interest of improving the presentation and the ability to find locations at TH Köln specified on the website. This is a legitimate interest in data processing within the meaning of Art. 6 (1 ) (f) GDPR.

Further information about the processing of your personal data resulting from use of the map material can be found on the OpenStreetMap Foundation's data protection page.

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis TH Köln:

1. Right of access

You can request confirmation from TH Köln as to whether personal data concerning you is being processed by us.
If such processing is taking place, you can request the following information from TH Köln:

a) the purposes for which personal data are processed;

b) categories of personal data that are processed;

c) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;

d) the envisaged storage period of the personal data concerning you or, if specific information on this cannot be provided, criteria for determining the storage period;

e) the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by TH Köln, or a right to object to such processing;

f) the existence of a right to lodge a complaint to a supervisory authority;

g) any available information as to the source of the data, where personal data is not collected from the data subject;

h) the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information on the logic involved and the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information about whether the personal data relating to you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards under Art. 46 GDPR in connection with the transfer.

This right of access may be restricted to the extent that it is likely to render impossible or seriously impair the fulfilment of research or statistical purposes, and the restriction is necessary for the fulfilment of research or statistical purposes.

2. Right to rectification

You have a right to rectification and/or completion vis-à-vis TH Köln if the processed personal data about you are incorrect or incomplete. TH Köln must make the correction without delay.

Your right to rectification may be restricted to the extent that it is likely to render impossible or seriously impair the fulfilment of research or statistical purposes, and the restriction is necessary for the fulfilment of research or statistical purposes.

3. Right restriction of processing

Under the following conditions, the processing of personal data concerning you may be restricted if:

a) you contest the accuracy of the personal data concerning you for a period enabling TH Köln to verify the accuracy of the personal data;

b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use be instead;

c) TH Köln no longer needs personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims;

d)  you have objected to the processing under Art. 21 (1) GDPR and it is not yet certain whether the legitimate grounds of TH Köln override your grounds.

If the processing of your personal data has been restricted, this data, with the exception of its storage, may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If processing is restricted in accordance with the above conditions, you will be informed by TH Köln before the restriction is lifted.

Your right to restriction of processing may be restricted to the extent that it is likely to render impossible or seriously impair the fulfilment of research or statistical purposes, and the restriction is necessary for the fulfilment of research or statistical purposes.

4. Right to erasure

a) Obligation to erase

You may request that TH Köln erase personal data concerning you without undue delay, and TH Köln has the obligation to erase such data without undue delay where one of the following grounds applies:

• personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent under which the processing was based under Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and there is no other legal basis for processing;
• you object to the processing under Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR;
• the personal data relating to you have been processed unlawfully;
• the erasure of personal data relating to you is necessary for compliance with a legal obligation under Union or Member State law to which TH Köln is subject;
• the personal data concerning you were collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

b) Providing information to third parties

If TH Köln has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase this personal data, TH Köln shall take reasonable steps,  taking account of available technology and the cost of implementation, to inform other data processing controllers, which process the personal data, that you, as the data subject, have requested the erasure of all links to this personal data or of copies or replications of this personal data.

c) Exceptions

The right to erasure does not exist if the processing is necessary

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation that requires processing by Union or Member State law to which TH Köln is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in TH Köln;
• for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. (89)  1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• for the establishment, exercise or defense of legal claims.

5. Right to notification

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis TH Köln, the latter is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right vis-à-vis TH Köln to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to TH Köln, in a structured, commonly used and machine-readable format. You also have the right to transmit these data to another controller without hindrance from TH Köln, to whom the personal data was provided, where

a) the processing is based on consent according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or a contract under Art. 6 (1) (b) GDPR;

b) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from TH Köln to another controller, where technically feasible. This does not affect the freedoms and rights of other persons.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in TH Köln.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point Article 6(1) (e) or (f) GDPR, including profiling based on those provisions.

TH Köln will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

You also have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you, which is carried out for scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR.

Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the fulfilment of research or statistical purposes, and the restriction is necessary for the fulfilment of research or statistical purposes.

8. Right to revoke the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

a) is necessary for entering into or the performance of a contract between you and TH Köln;

b) is authorized by the Union or Member State law to which TH Köln is subject and which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests;

c) is based on your explicit consent.

However, these decisions may not be based on special categories of personal data under Art. 9 (1) GDPR unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms and your legitimate interests. With regard to the cases referred to in (a) and (c), TH Köln shall take suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of TH Köln, to state your own position and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 of the GDPR.