We take the data protection and privacy of our website users very seriously. We are therefore committed to protecting your personal data and to collecting, processing and using it only in accordance with the General Data Protection Regulation (GDPR) and national data protection regulations. The following Privacy Policy explains which of your personal data is collected on our website and how this data is used. Our Privacy Policy is regularly updated in line with legal and technical requirements. Please therefore refer to the current version of our Privacy Policy.
The following data protection provisions apply to the website of Rhine-Waal University of Applied Sciences at www.hochschule-rhein-waal.de, as well as to subdomains belonging to this domain that are operated by organisational units of Rhine-Waal University of Applied Sciences.
I. Name and address of the data controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws, as well as other data protection regulations, is:
Rhein-Waal
University of Applied Sciences Marie-Curie-Straße 1
47533 Kleve
Germany
Telephone: +49 2821 806 73 – 0
Email: info(at)
Website: www.hochschule-rhein-waal.de
II. Contact details of the Data Protection Officer
The Data Protection Officer appointed by the controller is:
Andreas Braam
Marie-Curie-Straße 1
47533 Kleve
Germany
III. General information on data processing
1. Scope of the processing of personal data
Your personal data will generally only be processed to the extent necessary to provide a fully functional website and our content and services. Processing generally takes place only with your consent, unless obtaining consent in advance is not possible for practical reasons and the processing of the data is permitted by law.
2. Legal basis for the processing of personal data
The legal bases for the processing of personal data are the provisions set out in Article 6(1) of the GDPR as follows:
a) Article 6(1)(a) of the GDPR, insofar as we obtain the data subject’s consent for the processing of personal data.
b) Article 6(1)(b) of the GDPR, where the processing of personal data is necessary for the performance of a contract to which the data subject is a party. This also applies to processing operations necessary for the implementation of pre-contractual measures.
c) Article 6(1)(c) of the GDPR, insofar as the processing of personal data is necessary for compliance with a legal obligation to which our university is subject.
d) Article 6(1)(d) of the GDPR, insofar as the vital interests of the data subject or of another natural person necessitate the processing of personal data.
e) Article 6(1)(e) of the GDPR, insofar as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
f) Article 6(1)(f) of the GDPR, insofar as the processing is necessary to safeguard a legitimate interest of our university or of a third party and this interest outweighs the interests, fundamental rights and freedoms of the data subject.
3. Data erasure and retention period
As soon as the purpose of storage no longer applies, your personal data will be erased or blocked. If European or national legislation provides for storage beyond the original purpose in EU regulations, laws or other provisions to which the controller is subject, this may take place until the expiry of the retention period prescribed by the aforementioned standards. Thereafter, the data will also be blocked or deleted, unless there is a need to continue storing the data for the conclusion or performance of a contract.
IV. Provision of the website and creation of log files
1. Description and scope of data processing
Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.
The following data is collected:
a) The user’s IP address
b) Date and time of access
c) Information about the browser type and version used
d) Your operating system
e) Websites from which your system accesses our website
This data is also stored in our system’s log files. This data is not stored together with your other personal data.
2. Legal basis for data processing
Articles 6(1)(e) and (f) of the GDPR provide the necessary legal basis for the temporary storage of the data and log files.
3. Purpose of data processing
Making the website available to your computer requires the system to temporarily store your IP address. To this end, your IP address must be stored for the duration of the session.
This data is stored in log files to ensure the functionality of the website and the security of our IT systems, as well as to optimise the website. In this context, the data is not analysed for marketing purposes.
4. Duration of storage
Once the data collection is no longer necessary to achieve the purpose, the data is deleted. In the case of data collection for the provision of the website, this occurs at the end of the respective session.
Where data is stored in log files, it is deleted after seven days at the latest. Storage beyond this period may also be possible. In such cases, users’ IP addresses are deleted or anonymised so that they can no longer be linked to the client making the request.
5. Right to object and right to erasure
You have no option to object, as the collection and storage of data in log files are strictly necessary for the provision and operation of the website.
V. Use of cookies
1. Description and scope of data processing
Our website uses so-called session cookies. These are small text files that are temporarily stored in or by your web browser on your computer system and are automatically deleted when you close the browser. We use session cookies to make our website more user-friendly. This is because some parts of our website require the browser being used to be identified even after changing pages. They serve to recognize the session and ensure that pages load smoothly.
2. Preventing the storage of cookies
Depending on the browser you use, you can set it so that cookies are only stored with your consent. If you wish to accept only the cookies we use, but not those of any service providers or partners, you can select the setting “Block third-party cookies” in your browser. You can usually find instructions on how to block new cookies and disable existing ones in the help section of your web browser’s menu bar. We recommend that, on shared computers set to accept cookies and Flash cookies, you always log out completely when you have finished using the site.
3. Legal basis for data processing
Article 6(1)(f) of the GDPR provides the necessary legal basis for the processing of personal data using cookies.
4. Purpose of data processing
Technically necessary cookies are used to simplify your use of our websites. Without the use of cookies, various functions of our website cannot be provided, as these require the browser to be recognised after a page change.
No user profiles are created using user data collected via technically necessary cookies.
Likewise, these purposes constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
5. Duration of storage, right to object and option to delete
A session cookie is stored only for the duration of your visit to our website and is automatically deleted when you close your browser. Cookies are stored on your computer. From there, they are transmitted to our website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your web browser. You can also delete cookies that have already been stored at any time. This can also be done automatically. If you disable cookies for our website, this may result in restrictions on the use of our website’s functions.
VI. Collection of statistical information
To compile visitor statistics, we collect relevant data when you visit our website using the Matomo tool. This includes information on the date and time of your visit, the duration of your visit, your geographical location (approximate resolution; exact localisation is not possible), the pages you have visited, information about your operating system and device, and a truncated version of your IP address. No cookies are set.
Due to the truncation of the IP address and the non-use of cookies, it is not possible to link this data to you personally; the statistical measurement is carried out anonymously.
VII. Contact and registration forms, and email contact
1. Description and scope of data processing
We provide contact or registration forms on our website to enable electronic communication and the transmission of information and data for various purposes. To use these forms, you enter your details into the input fields. This data is then transmitted to us and stored. Depending on the form in question, the following data may be collected:
Surname, first name
Student ID/applicant number
Email address
Postal address
Details of your current studies
Further contact details
Nationality
Date of birth
The following data is also stored when the message is sent:
Your IP address
Date and time of your registration
You can also contact us via the email address provided. In doing so, the personal data you provide in the email will be stored.
The data is used exclusively for the processing of communication and for the organisational handling of the respective process, event or similar. The data is not passed on to third parties.
2. Legal basis for data processing
The user’s consent, as provided in accordance with Article 6(1)(a) of the GDPR, constitutes the necessary legal basis for the processing of the data.
Where personal data is transmitted via email, Article 6(1)(f) of the GDPR constitutes the necessary legal basis for the processing of the data. If the purpose of this contact is also to conclude a contract, Article 6(1)(b) of the GDPR additionally constitutes the necessary legal basis for the processing.
3. Purpose of data processing
We process the personal data collected via the input form exclusively for the purpose of handling the contact request. If you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data.
To prevent misuse of the contact form and to secure our IT systems and services, we use the other personal data processed during the submission process.
4. Duration of storage
Once the collection of data is no longer necessary to achieve the purpose, the data will be deleted. This applies to personal data from the contact form input field and data sent by email once the relevant communication with you has ended. This is the case when the circumstances indicate that the matter in question has been conclusively resolved.
Any other personal data collected additionally during the submission process will be deleted after a period of seven days at the latest.
5. Right to object and right to erasure
You may withdraw your consent to the processing of your personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. Please note that in this case, further communication with you can no longer be continued.
Both withdrawal and objection may be sent in writing to the following email address: datenschutz(at)
In this case, any personal data stored for the purpose of contacting you will be completely deleted.
VIII. Disclosure of your data to third parties
To ensure that our website is as user-friendly and convenient as possible for you, we occasionally use services provided by external service providers. Below, you can find out more about the privacy policies governing the use of these services and features, so that you may also exercise your rights with these service providers.
1. University Sports Course Administration
Students and staff can register to participate in University Sports courses via our website. The software “IbuSys Sport v6” is used for the registration and administration of the courses. Michael Schrader, Teschenhäger Weg 5c, 18439 Devin, is technically responsible. The data collected in connection with the use of this system is used exclusively for the organisation, delivery and billing of University Sports courses. The data is not passed on to other third parties and is deleted after a specified period following course participation.
The legal basis for the use of the data is your consent (Art. 6(1)(a) GDPR), which you give by using the system, and subsequently Art. 6(1)(b) GDPR.
IX. Rights of the data subject
If your personal data is being processed, you are a data subject within the meaning of the GDPR. You therefore have the following rights vis-à-vis the controller:
1. Right of access
You may request confirmation from the controller as to whether we are processing personal data relating to you.
If such processing is taking place, you may request the following information from the controller:
a) the purposes of the processing;
b) the categories of personal data being processed;
c) the recipients or categories of recipients to whom your personal data have been or will be disclosed;
d) where possible, the envisaged period for which your personal data will be stored, or, if this is not possible, the criteria used to determine that period;
e) the existence of a right to rectification or erasure of personal data concerning you, or to restriction of processing by the controller, or a right to object to such processing;
f) the existence of a right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You may also request information as to whether your personal data is being transferred to a third country or to an international organisation. If this is the case, you may request information regarding the appropriate safeguards relating to the transfer in accordance with Article 46 of the GDPR.
2. Right to rectification
You may request the controller to rectify any inaccurate personal data concerning you. You may also request that incomplete personal data be completed, taking into account the purposes of the processing, including by means of a supplementary statement. The controller shall carry out the requested rectification without delay.
3. Right to erasure (‘right to be forgotten’)
You may request that the controller erases personal data concerning you without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:
a) Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
b) You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
c) You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
d) Your personal data has been processed unlawfully.
e) The erasure of your personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
f) Your personal data has been collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.
Where the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replicas of such personal data.
However, the right to erasure does not apply where the processing is necessary
(a) for the exercise of the right to freedom of expression and information;
b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as the right to erasure described above is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
e) for the establishment, exercise or defence of legal claims.
4. Right to restriction of processing
You may request the controller to restrict the processing of your personal data if one of the following conditions applies:
a) you have contested the accuracy of your personal data, for a period enabling the controller to verify the accuracy of your personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of the use of your personal data;
c) the controller no longer needs your personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
d) you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override your own.
Where the processing of your personal data has been restricted, such personal data – apart from storage – may be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.
If you have obtained a restriction of processing in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
5. Right to be informed
If you have exercised the rights to rectification, erasure or restriction of processing described above against the controller, the controller must notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
At your request, the controller must inform you of these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that
a) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
b) the processing is carried out by automated means.
When exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, insofar as this is technically feasible.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Similarly, the right to data portability must not adversely affect the rights and freedoms of others.
7. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR.
The controller shall no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
8. Right to withdraw your consent
You may withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
9. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.
X. Validity and amendments to this Privacy Policy
This Privacy Policy is currently in force and is dated August 2026.
Further development of our website and its services, or changes to legal provisions, case law or regulatory requirements, may make it necessary to amend this Privacy Policy. You can view and print the current version of our Privacy Policy at any time on our website at https://www.hochschule-rhein-waal.de/en/privacy-policy.html.