(Status December 16, 2024)
1. What is this privacy policy about?
"Personal data" is any information that can be associated with a specific person, and "process" means any handling of it, e.g. collection, use and disclosure. We therefore process personal data very often. We explain in this privacy statement how we do this in the context of our legal duties and in particular in relation to our website. If you would like more information about our data processing, please contact us (section 2).
2. Who is responsible for processing your data?
The University of Liechtenstein is the "data controller", i.e. the primary data protection authority (also "we") for data processing under this privacy policy. Our address is as follows:
Universität Liechtenstein (Foundation under public law)
Fürst-Franz-Josef-Strasse
9490 Vaduz Liechtenstein
E-Mail: info@uni.li
Tel.: 00423 265 11 11
If you have any questions about data protection, you can also contact our data protection officer by e-mail at datenschutz@uni.li or at the above postal address with the note "Data protection".
It may be that you provide us with data that also relates to other persons. If you do so, we will take this as confirmation that this data is correct. Since we often have no direct contact with these third parties, we ask you to inform them about our processing of their data (e.g. by referring to this privacy policy).
3. How do we process data within the scope of our legal duties?
3.1 Students, participants in continuing education and graduates
When we are in contact with you regarding your studies, we process personal data, e.g. if you have questions or would like to register. This mainly concerns data that you send us, e.g. name, contact details, date of birth, documents for the application for admission (certificates, passport copy, passport photo, etc.) and the date of contact.
During and after your studies, we process personal data in many different situations. This concerns e.g.:
- the handling of teaching and examination operations (data on grades and course achievements, etc.);
- Event and excursion handling within the scope of studies (data on participation, possibly travel data, etc.);
- Video and audio recordings if you are attending a conference or event that is being recorded. The camera is usually pointed at the speaker. Otherwise, the camera radius will be visible to you or you will be informed of this
- Invoicing and payment processing, e.g. for tuition fees (payment data, account data, possibly data on your entitlement to a reduction, etc.);
- Awarding of degrees and graduations and their publication (name, title, degree, predicate or other additions);
- Administration and support for activities abroad through programmes such as Erasmus+;
- Quality management and accreditations (e.g. sending evaluation surveys to your postal or e-mail address; evaluations for assurance of learning);
- Processing of discounts and other benefits that you claim (e.g. participation in an event with a discount for students).
- Organisation of residence permits
Study programmes and continuing education may be provided in cooperation with partners. In this case, certain personal data may also be made accessible to these partners, provided that this disclosure does not conflict with any confidential interests.
3.2 Alumni Club Membership
Alumni Club Membership
3.3 Lecturers (applications)
During the application process, in addition to salutation, surname, first name, and the usual correspondence data such as postal address, e-mail address, and telephone numbers, we also process application documents such as letters of motivation, curriculum vitae, picture data, professional, educational, and further training qualifications, references, and certificates of employments.
If an application leads to employment, it is necessary to retain certain documents from the application process (CV, certificates, degrees) as proof of professional qualifications on the basis of contractual or legal obligations (Art. 38 para. 2 HSG). This data can be processed by an accreditation organisation for review purposes over a period of 10 years. There are currently accreditations or accreditation processes with the organisations AAQ, AACSB and RIBA.
3.4 Beneficiaries in general
- If you make use of our services, e.g. if you use the library of the University of Liechtenstein (see section 3.4.2), obtain a place in a student residence or attend one of our events, we process data for the preparation of the conclusion of the contract and for the performance of the corresponding contract:
- If we are in contact with you with regard to a contract, e.g. when you register for events, rent accommodation in the student residence or register for the use of the library. This applies in particular to data that you provide to us, e.g. name, contact details or date of birth, details of services requested and the date of contact.
- If we conclude a contract with you, we process the data from the run-up to the conclusion of the contract (see above) and the information on the conclusion of the contract itself (e.g. on the conclusion date and the subject matter of the contract).
- We also process personal data during and after the term of the contract. This concerns, for example, information on the purchase of services, but also on payments, contacts with our administration, complaints, photographs at events, in the case of services available online also access data and logins, data on the termination of the contract and - if disputes should arise in connection with the contract - also on these and corresponding procedures. We use this data because we cannot process contracts without it.
- Certain services that you obtain from us can be provided in cooperation with partners / processors. These include, for example, Switch as an authentication service provider, SLSP AG for media loans in the library, the private and public cooperation partners for joint events or the processor for our internal billing system regarding i.e. printing, 3D-printing or laser cutting. In this case, your data may also be made accessible to these partners, provided that there is a legal basis and that this disclosure does not conflict with any confidential interests.
The data recipient and at the same time our contractually obligated processor for our internal billing system is KUARIO B.V. (Netherlands). For this purpose, user data (e-mail address, user account, location of the device), time stamp and the billing amount for the purchased product are processed for billing purposes. The legal basis for this is the contractual obligation for the purchase of the service. The account and billing data are deleted either until the membership is terminated or after 7 years of inactivity.
3.4.1 Switch edu-ID / AAI (authentication and autorisation service provider)
The Switch edu-ID service provides end users with a personal digital identity (edu-ID) that enables access to services of the Switch edu-ID federation in Switzerland, and via the Inter-Federation, with other international identity federations.
The use of Switch edu-ID is open to all natural persons who are interested in creating an edu-ID account to access services of the Switch edu-ID federation. The purpose is therefore the authentication and authorisation service for services of this federation. If you create an account with Switch, their terms of use must be observed.
The following categories of personal data are processed when using a Switch account: Personal contact data (first name, surname, email address, profile photo (optional), technical identifiers, attribute specification (e.g. date of birth, address, telephone number, SSH key, group information), authentication means (e.g. email address and password), log data (e.g. IP addresses, time, action), support data (surname, first name, email address and edu-ID identifier of the support requester), log data (e.g. IP addresses, time, action), support data (surname, first name, email address and edu-ID identifier of the support requestor (swissEduPersonUniqueID and eduPersonTargetedID), time, subject, problem description, attachments provided by the user).
The legal basis for the processing of your personal data is the performance of a contract pursuant to Art. 6 para. 1 lit. b GDPR. The transfer of your personal data to Switch is based on an adequacy decision pursuant to Art. 45 para. 1 GDPR.
As long as end users have an active affiliation with an organisation, Switch, as the organisation's contractor, is not authorised to delete the edu-ID account. The edu-ID account of all other end users can be deleted at any time via eduid-support@switch.ch. Deletion of the edu-ID account results in the loss of the rights to use the edu-ID account and the associated functionalities. When the edu-ID account is deleted, all personal data will be deleted. The deleted edu-ID account cannot be restored. The deletion of the edu-ID account does not automatically lead to the deletion of the data that the service operators process when using the services. Deletion of this data must be requested from the service operators.
The recipient of the personal data is Switch, Werdstrasse 2, 8004 Zürich, Switzerland.
3.4.2. Library System (Media Loans etc.)
To use our library services, such as borrowing media, you need to use swisscovery from SLSP AG (Swiss Library Service Platform). To log in to swisscovery (SLSP) and access library content, you need a Switch edu-ID account with which you register with SLSP (see section 3.4.1). Further information on data processing by the swisscovery service can be found in SLSP's privacy policy.
The purposes in relation to the processing of your data are as follows:
- Processing of media loans and bookkeeping
- Invoicing and processing of reminders (incl. processing of losses or damage)
- Registration on the SLSP registration platform by the user, including verification with the Switch edu-ID
- Organisation of access to/from affiliated libraries in the Institutional Zone (IZ)
In the course of lending media and the necessary platform registrations, the following personal data is processed by the University of Liechtenstein and SLSP (SLSP refers to this as ‘transaction data’): Information on orders for copies, reservations, acquisition proposals, interlibrary loans, bookings, fees, loan history over a defined period (completed loans, note fields in user data records), blocks, user groups. As registration via a Switch-edu-ID account is required to use swisscovery (SLSP), further personal data is required for processing. Beyond that, as an option the enduser can specify the following data: Barcodes from library cards, matriculation number, information on affiliation (assignment) to a university institution and preferred language. Further information on the authentication and authorisation service Switch can be found under section 3.4.1. The data processed by Switch will be transmitted to SLSP AG after registration of the account with your consent and synchronised on an ongoing basis. The transmission of this data is mandatory for the use of the service.
The legal basis for the processing of your personal data is the fulfilment of a contract pursuant to Art. 6 para. 1 lit. b GDPR. The transfer of your personal data to Switch and subsequently to SLSP AG (both Switzerland) is based on an adequacy decision pursuant to Art. 45 para. 1 GDPR.
The so-called SLSP transaction data (loans, fees, etc.) is anonymised after two years. The remaining SLSP account data (Swisscovery) is deleted after 10 years of inactivity. You can also request the deletion of your personal data from Switch at any time via your personal account with Switch or directly via SLSP AG (provided your data does not still need to be processed for an active transaction).
In addition to the University of Liechtenstein, the recipients of your personal data are
- Switch, Werdstrasse 2, 8004 Zurich, Switzerland
- SLSP AG, Kasernenstrasse 77A/B, CH-8004 Zurich, Switzerland, info@slsp.ch - www.slsp.ch
- Libraries of the Institutional Zone (IZ) (see link)
4. How do we process data in connection with our public relations work?
4.1 Newsletter
We also process personal data to promote our services, in particular with our newsletters. These contain information on events, invitations, information on further education offers and on developments at the university. The content of the newsletters is also aimed at the respective target group and may be based on our overriding legitimate interest, especially in the case of beneficiaries (contract fulfilment), e.g.:
- Prospective students: Information on info events, fairs and degree programmes;
- Students: Information about career services and campus life;
- Alumni / Alumnae: Information on portraits or events in which alumni / alumnae can participate;
- Those interested in further education and lectures: Information on events and further education.
If you register for one of our newsletters, we will immediately send an e-mail containing a hyperlink to the e-mail address you provided. By clicking on this link, you confirm your newsletter registration (double opt-in procedure). If this confirmation of registration is not received within 30 days, we will delete your data from our temporary list and registration will not have taken place. If you confirm the newsletter registration, you consent to the storage of your e-mail address including the date of registration.
We use the provider CleverReach (CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany) to organise the mailing of our newsletter. We have concluded a data processing agreement with CleverReach - you can find out more about the data protection policy at the following address: https://www.cleverreach.com/en-de/privacy-policy/. The newsletter can also be sent via the provider "The Rocket Science Group LLC d/b/a MailChimp, (675 Ponce De Leon Ave NE, Suite 5000, Atlanta, Georgia 30308 USA, privacy@mailchimp.com), in short "Mailchimp". Further information can be found at https://mailchimp.com/legal/. The data transfer takes place based on standard contractual clauses - an adequacy decision of the European Commission for the USA is existing.
In this context, in addition to your name and email address, we also process information about which services you have already used, whether you open our newsletter and which links you click on. For this purpose, our email delivery service provider provides a function that essentially works with invisible image data that is loaded from a server via a coded link and thereby transmits the corresponding information. This is a common method that helps us to assess the effect of newsletters and to optimise our newsletters. You can avoid this measurement by setting your email programme accordingly (e.g. by switching off the automatic loading of image files).
4.2. Photo and video recordings
In some cases, we take photos and videos of teaching and training events for the purposes of public relations, marketing and documentation. The recordings are used on our website and for reporting in the press, print media and social media (see also section 9).
If you are the focus of these recordings, we usually ask for your consent. In other cases, especially in the case of photographs of larger groups of people, we base this processing on our legitimate interest in public relations (see also section 13 for the legal basis). You can object to the publication of your image or withdraw your consent at any time (see also section 14).
4.3 Audio recordings (Podcasts)
As part of our public relations work, we also offer audio content in the form of podcasts for listening and downloading. Based on your consent, usage data, audio content, contact or identification data and, if applicable, image data are processed for a contribution.
We use the podcast hosting service Anchor.fm of the provider Spotify USA, Inc, 150 Greenwich St, New York, NY 10007, USA. In the European Union or the European Economic Area, the data controller is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. The podcasts are loaded by or transmitted through Anchor.fm. Anchor.fm processes IP addresses and technical data in order to enable podcast playback and downloads and to determine statistical data, such as access figures. This data is anonymised or pseudonymised before being stored in the database unless it is necessary for the provision of the podcasts. Privacy policy: https://anchor.fm/privacy.
5. How do we cooperate with other authorities?
We are an independent foundation under public law (Art. 1 No. 1 LUG) and may be legally obliged to disclose personal data to other authorities or companies. For example, the University must disclose personal data to other authorities or commissioned research institutions for the purposes of educational controlling, statistics and research (Art. 34 LUG). In addition, the government or the education authority (‘Schulamt’) may process data of teaching staff or students (Art. 32 No. 2 and Art. 33 No. 2 in conjunction with Art. 33 No. 2 LUG).
Based on the IUV (‘Interkantonale Vereinbarung über die Beiträge an die Ausbildungskosten von universitären Hochschulen’), the University of Liechtenstein is obliged to transmit student data (e.g. identification data, residence data, study programme data and data on tuition fees) to the ‘Schweizerische Konferenz der kantonalen Erziehungsdirektoren’ (EDK) on the basis of legal obligations (Art. 25, IUV).
6. How do we cooperate with service providers?
6.1 IT service providers
We use various services from third parties, especially IT services (e.g. providers for hosting or data analysis services), shipping services and services from banks, the post office, consultants, etc.
- The University uses various Microsoft 365 applications. Information on the processing of personal data can be found separately under the following link.
- One of the main IT service providers is the ‘Amt für Informatik’ (Landesverwaltung des Fürstentums Liechtenstein, Amt für Informatik, Heiligkreuz 8, 9490 Vaduz, Liechtenstein). This service provider performs central tasks to provide our IT infrastructure and guarantee our IT security. The majority of personal data in information systems that are operated via our IT infrastructure are therefore also processed by this office.
You will find information on service providers for our website under section 8. These service providers may also process personal data to the extent necessary.
6.2 Conducting surveys
6.2.1 General information concerning the organisation of surveys
The University of Liechtenstein regularly conducts surveys, which are usually carried out with external IT service providers (software services). For this purpose, invitations with links to the survey are sent by e-mail to specific groups of people, whereby the survey is supported by an external IT service provider. These invitations are sent either via our internal mailing system, via MS Outlook as a blind copy (BCC) or directly via the external IT service provider. In doing so, we process your email address on the legal basis of our overriding legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. The actual participation in a survey is usually voluntary and is therefore based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Depending on the situation, the surveys can be conducted on a personalised or anonymous basis. In the case of personalised surveys, the survey results may allow conclusions to be drawn about your person; in the case of anonymous surveys, no further personal reference is possible.
Purpose of data processing
The purpose of the use of IT service providers by the University of Liechtenstein is to conduct surveys in an efficient and user-friendly manner. You will be informed of the purpose of a specific survey before it is carried out by means of the invitation or introduction. However, it can generally be stated that the majority of our surveys are aimed at identifying potential improvements to our services and offerings (e.g. study programmes, (teaching) events and the organisation of campus life). The university also conducts surveys for the purpose of research and knowledge generation.
6.2.2 Information on the use of SurveyMonkey
For individual surveys, the University of Liechtenstein uses the external IT service provider SurveyMonkey (SurveyMonkey Europe UC, 2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland). This is a web service for creating and analysing online surveys. The data protection information provided by SurveMonkey in English can be found at the following link: https://www.surveymonkey.com/mp/legal/privacy/.
What data is collected by SurveyMonkey?
If the invitation emails are sent via SurveyMonkey, the email address, IP address and tracking data (cookies or page tags) are processed by default.
Further processing of personal data by SurveyMonkey only takes place if you decide to participate in a survey and click on the link provided in the email. In this case, you will be redirected to an external SurveyMonkey website. There, contact is established with the SurveyMonkey servers, whereby SurveyMonkey automatically collects information about the end device used. This may include, in particular, the IP address, the version of your operating system, the device type, the device ID/MAC address, system and performance information and the browser type. If you use a mobile device, SurveyMonkey may also collect the UUID of this device. SurveyMonkey also sets cookies in the browser of your end device, which may also contain an individual identification value ("cookie ID"). The cookies are used, among other things, to determine who has already taken part in a survey, to prevent misuse and to correct errors. The cookies are automatically deleted after one year at the latest. SurveyMonkey also processes and stores the survey content before it is forwarded to the University of Liechtenstein.
If a survey is conducted anonymously, the university will not be able to draw any further conclusions about your person. ATTENTION: To ensure that the survey remains anonymous, we would ask you not to enter any personal data (e.g. names or contact details) in the free text fields of the survey. It is not possible to correct individual answers after the survey has been sent. In order to comply with the GDPR, we reserve the right to delete your entries in such a case or to have them deleted by SurveyMonkey. Further information regarding the anonymisation of survey results by SurveyMonkey can be found at: https://help.surveymonkey.com/en/surveymonkey/send/anonymous-responses/.
Transfer of data:
As SurveyMonkey Europe UC is a subsidiary of SurveyMonkey Inc. based in the USA, data collected by SurveyMonkey is also transferred to the USA. SurveyMonkey Inc. is currently an active participant in the Data Privacy Framework, which is why the transfer of data is based on the adequacy decision of the European Commission pursuant to Art. 45 para. 1 GDPR. In addition, appropriate safeguards were provided in accordance with Art. 46 GDPR; specifically, standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR were used for order processing.
Duration of storage:
SurveyMonkey stores respondents' IP addresses in backend logs and deletes them after 13 months. The cookies are automatically deleted after one year at the latest. Details on the storage of your data by SurveyMonkey can be found in the privacy policy at: https://www.surveymonkey.com/mp/legal/privacy/.
6.2.3 Information on the use of SoSci Survey
Another IT service provider whose services we use to conduct surveys is SoSci Survey (SoSci Survey GmbH, Erchanbertstrasse 6, 81929 Munich, Germany). Further information on how SoSci Survey handles data protection can be found at the following link: https://www.soscisurvey.de/en/data-protection.
What data is collected by SoSci Survey?
SoSci Survey does not store any IP addresses or other user activities regarding the implementation of the survey, but the IP address is temporarily stored in the event of error logs (use of invalid access data). No third-party or tracking cookies are used. In addition to the processed data, SoSci Survey may process the following personal data in various sub-processes:
- Survey data: Information provided by respondents in the questionnaire, which is stored directly in the data record.
- If applicable, files uploaded by the participants during an interview.
- If applicable, contact details entered by the respondents in the questionnaire, which are stored separately from the data set and from other address data.
- If applicable, address data (e-mail addresses) for sending serial e-mails, which are either entered by the project management or specified by respondents in an opt-in question. Depending on the data protection mode used, address data may or may not be linked to the respondent's details.
Transfer of data
The personal data from the survey is transmitted to SoSci Survey GmbH (Germany), which processes your data as a processor in accordance with Art. 28 GDPR.
Duration of storage
In addition to the manual option for the University of Liechtenstein to delete the survey data, SoSci Survey also deletes the data automatically. A survey object is automatically archived (deletion of all data from the database, storage of the questionnaire and its contents as a file) if the University of Liechtenstein has not logged into the survey object for 3 months and no new data has been collected during this period.
Further information on the handling of personal data by SoSci Survey can be found at: https://www.soscisurvey.de/help/doku.php/en:general:dsgvo.
7. Can we disclose data abroad?
The recipients of data are not only located in Liechtenstein. This applies in particular to IT service providers. These have locations both within the EU or the EEA (e.g. in Germany, but also in other countries worldwide, e.g. Switzerland or the USA). We may also transfer data to authorities and other persons abroad if we are legally obliged to do so or, for example, in the context of judicial proceedings (see section 9). Not all of these countries have adequate data protection. We compensate for the lower level of protection through appropriate contracts, in particular the so-called standard contractual clauses of the European Commission, which can be accessed here. In certain cases, we can also transfer data without such contracts in accordance with data protection requirements, e.g. if you have consented to the corresponding disclosure or if the disclosure is necessary for the performance of the contract, for the establishment, exercise or enforcement of legal claims or for overriding public interests.
8. How do we process data in connection with our website?
Every time you use our website, certain data is collected for technical reasons and temporarily stored in log files (log data), in particular the IP address of the end device, information about the Internet service provider and the operating system of your end device, information about the referring URL, information about the browser used, the date and time of access and the content accessed when visiting the website. We use this data so that our website can be used, to ensure system security and stability, to optimise our website and for statistical purposes.
Our website also uses cookies, i.e. files that your browser automatically saves on your terminal device. This allows us to distinguish individual visitors, but usually without identifying them. Cookies may also contain information about pages accessed and the duration of the visit. Certain cookies ("session cookies") are deleted when the browser is closed. Others ("persistent cookies") remain stored for a certain duration so that we can recognise visitors on a subsequent visit.
When accessing our websites, you usually have the option of activating or deactivating certain categories of cookies via a button displayed in the browser. We will also inform you about further details on the cookies, e.g. how long they are stored. Furthermore, you can configure your browser in the settings so that it blocks certain cookies or similar technologies or deletes cookies and other stored data. You can find more information on this in the help pages of your browser (usually under the keyword "data protection").
These cookies and other technologies may also come from third party companies that provide us with certain functions. These may also be located outside the EEA or Switzerland (see section 7 for details). For example, we use analysis services so that we can optimise our website. Cookies and similar technologies from third-party providers also enable them to target you with individualised advertising on our websites or on other websites and social networks that also work with this third party, and to measure how effective advertisements are (e.g. whether you arrived at our website via an advertisement and what actions you then take on our website). The relevant third parties may record website usage and combine their recordings with other information from other websites. In this way, they can record user behaviour across several websites and end devices in order to provide us with statistical evaluations on this basis. The providers may also use this information for their own purposes, e.g. for personalised advertising on their own website or other websites. If a user is registered with the provider, the provider can assign the usage data to the relevant person.
A key third party provider is Matomo, an analytics service provided by InnoCraft (7 Waterloo Quay P0625, 6140 Wellington, New Zealand). Matomo collects certain information about the behaviour of users on the website and about the terminal device used. The IP address is anonymised before it is stored by Matomo. Matomo provides us with analyses based on the recorded data. Information on Matomo's data protection can be found here, and if you no longer wish to be recorded by this service, you can unsubscribe as follows:
To integrate social networks on our website, we use so-called social plug-ins from various social networks (e.g. Facebook, Twitter, Instagram, YouTube, LinkedIn, Pinterest or Xing; "plug-in providers"). When you click on a social plug-in, a connection is automatically established between your browser and the servers of a plug-in provider. In the process, data (log files such as IP addresses) are transmitted to the servers of the respective plug-in provider. These servers may also be outside the EU or the EEA (e.g. in the USA). If you have an account on the respective social network, this data can also be linked to it. Furthermore, interactions, in particular the use of a comment function, the clicking of a "Like", "Share" or "Re-Tweet" button are also passed on to the plug-in providers.
If you do not want this data to be assigned to your account, please do not click on any plug-ins. It also helps if you deactivate or restrict cookies in your browser via your browser settings. Finally, you can completely prevent the loading of plug-ins by installing so-called script blockers on your browser.
We use the service "reCAPTCHA" (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on our website so that we can recognise whether, for example, online forms are filled out by humans and not by so-called "bots" (machine-controlled entries). This may include processing of device information (IP addresses, operating system, devices, etc.) as well as data on location, language, mouse movements, website activity and results of recognition processes. We use this service on the basis of legitimate interest. Privacy policy: https://policies.google.com/privacy?hl=en; Settings for advertising: https://adssettings.google.com/authenticated.
9. Chatbot as an Advanced Search
The University of Liechtenstein uses an open source model from Meta to provide a modern chat function. This is an artificial intelligence (AI) that finds answers to your questions from the content of our websites, together with publicly available content. Personal data is not collected explicitly, but may be transmitted implicitly, such as the IP address and a session ID, in order to distinguish the chat history of different users. These data are deleted at the end of the chat session. Enquiry content is stored in anonymous form and can be used for function control and further development of the chat functions. In order to formulate the answers, parts of the enquiries are also forwarded to a server of Onrender.com (Render Services, Inc., USA). The data transmitted to this provider does not contain any parameters with which the company can identify individual persons. It is therefore anonymous data. The responses are not assigned to users.
However, it is not possible by technical means to filter out content that allows identification based on the data entered by the user. Therefore, when using the chat, please ensure that you do not enter any personal details such as your name, e-mail address, telephone number etc. in the chat window.
10. How do we process data via social media?
We operate our own websites on social networks and other platforms (e.g. Facebook fan pages). If you communicate with us there or comment on or disseminate content, we collect information that we use primarily for communication with you, for marketing purposes and for statistical evaluations (see sections 4 and 10). This mainly includes contact and content data. Please note that the provider of the platform also collects and uses data itself (e.g. user behaviour, meta and communication data, device information, IP addresses), possibly together with other data known to it (e.g. for marketing purposes or to personalise the platform content). Insofar as we are jointly responsible with the provider, we enter into a corresponding agreement, about which you can obtain information from the provider.
We use the services of the following social service providers on the basis of legitimate interests:
- Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland): we are jointly responsible with Meta Platforms Ireland Limited for the collection of data from visitors to our Facebook page. Privacy policy: https://www.facebook.com/policy; Contract addendum for the transfer of European data: https://www.facebook.com/legal/EU_data_transfer_addendum; Arrangement for joint controllers: https://www.facebook.com/legal/terms/information_about_page_insights_data;
- LinkedIn (LinkedIn Irland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Irland): Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://www.linkedin.com/legal/l/dpa; Standard Contractual Clauses (Ensuring the level of data protection in third countries): https://legal.linkedin.com/dpa; Option for objection (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out;
- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA): Privacy policy: https://privacycenter.instagram.com/policy/;
- Twitter (Parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA or for data processing of persons living outside the U.S.: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland): Privacy policy: https://twitter.com/privacy; Settings: https://twitter.com/personalization;
- Youtube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland): Privacy policy: https://policies.google.com/privacy?hl=en; Opt-Out: https://adssettings.google.com/authenticated.
- TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland bzw. Beijing Bytedance Technology Ltd., Peking, China): the social media platform TikTok is an "app" on which short videos or short video segments are created and distributed. The operator of the platform is the Chinese company ByteDance, which is why personal data is transmitted to or disclosed to the People's Republic of China when using TikTok. This country is considered a third country from the perspective of data protection - there is therefore no adequacy decision of the European Commission that guarantees an equivalent level of data protection with the EU/EEA area. Companies in China are obliged to disclose data to Chinese authorities under the Chinese Multi-Level Protection Scheme 2.0. This ensures unrestricted access to all data from Chinese companies. For this reason, European data protection requirements cannot be guaranteed when using the TikTok application. The transfer of this data to a third country for a specific purpose therefore takes place under the exceptional provision of Art. 49 Para. 1 lit. a GDPR, which presupposes your consent after clarification of the existing risks. We would like to point out that the University of Liechtenstein has no influence on the further processing of your personal data by TikTok. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en; Standard Contractual Clauses: https://ads.tiktok.com/i18n/official/policy/controller-to-controller.
11. Is there any further processing?
Yes, because very many operations are not possible without processing personal data, including common and even unavoidable internal operations. This cannot always be precisely determined in advance, nor the amount of data processed in the process, but you will find details of typical (though not necessarily frequent) cases below:
- Communication: When we are in contact with you (e.g. when you call the welcome desk or communicate with us on a social media platform), we process communication content information about the nature, time and place of the communication. For your identification, we may also process information for proof of identity.
- Compliance with legal requirements: We may disclose data to authorities as part of legal obligations or powers and to comply with internal regulations (see also section 5).
- Prevention: We process data to prevent criminal data and other violations, e.g. as part of the fight against fraud or internal investigations.
- Legal proceedings: Insofar as we are involved in legal proceedings (e.g. court or administrative proceedings), we process data e.g. about parties to the proceedings and other persons involved such as witnesses or respondents and disclose data to such parties, courts and authorities, possibly also abroad.
- Risk management, ICS and process management: Within the framework of legal obligations, the University of Liechtenstein also carries out processing in the area of risk management and ICS or process management (see Art. 16 para. 1 ÖUSG and No. 4.3 Owner's Strategy of 4 July 2019 for the University of Liechtenstein).
- IT and facility security: We also process data for monitoring, controlling, analysing, securing and checking our IT infrastructure (e.g. access and entry authorisations by means of logins and badges), but also for backups and archiving data.
- Academic exchange: We process data about other universities and colleges. We may also process data about lecturers, students or alumni/alumnae who have a specific exchange with us (in particular name, contact details, role or function and public statements).
- Mobility: If e-bikes or parking spaces of the University of Liechtenstein are used, the following data may be processed: Name, registration number, date, parking fine if applicable. If you have purchased a reduced parking permit, we require data on your name, place of residence, length of journey, registration number and vehicle type.
- Research: in the course of research projects, we may also process personal data of research participants. As a rule, you as the participant will be informed separately about the specific data processing, which takes place on the basis of your consent.
- Other purposes: We process data to the extent necessary for other purposes such as administration (e.g. contract management or accounting), enforcing and defending claims, evaluating and improving internal processes, compiling statistics and evaluations; acquiring or selling receivables and ensuring other legitimate interests.
12. How long do we process personal data?
We process your personal data as long as it is necessary for the purpose of processing (in the case of contracts, usually for the duration of the contractual relationship), as long as we have a legitimate interest in storing it (e.g. to enforce legal claims, for archiving or to ensure IT security) and as long as data is subject to a statutory retention obligation (for certain data, for example, a ten-year retention period applies). After these periods have expired, we delete or anonymise your personal data.
13. How do we protect personal data?
We take appropriate security measures of a technical and organisational nature to maintain the security of your personal data, to protect it against unauthorised or unlawful processing and to protect it against the risk of loss, accidental alteration, unauthorised disclosure or access. However, we cannot exclude data security breaches with absolute certainty; certain residual risks are unavoidable.
Security measures on a technical basis include, for example, the encryption and pseudonymisation of data, logging, access or entry restrictions and the storage of backup copies. Security measures of an organisational basis include, for example, instructions to our employees, confidentiality agreements and controls. We also oblige our processors to take appropriate technical and organisational security measures.
14. Legal basis
Data processing is only permitted if the applicable law specifically allows it. As a public university, we base the processing of your personal data primarily on the fact that it is required or permitted by law. The relevant legal provisions can be found, for example, in Art. 50a of the ‘Hochschulgesetz’ (HSG) and Art. 32 et seq. of the ‘Gesetz über die Universität Liechtenstein’ (LUG).
However, we may also base the processing on your separate consent, e.g. if you ask us to pass on your data to third parties (e.g. in the context of a reference or because you wish to take advantage of third-party offers, e.g. a student housing exchange, or participate in student associations).
Furthermore, we may base the processing on the fact that it is necessary for the preparation and execution of contracts, that it is necessary for the legitimate interests of us or third parties, e.g. for statistical evaluations or for marketing purposes. You will find the relevant provisions on the legal basis in Art. 6 and 9 of the GDPR.
Incidentally, you are not always obliged to disclose data to us, with the exception of individual cases (e.g. if you have to fulfil a contractual obligation and this involves disclosing data to us). However, for legal and other reasons, we must process data when you use our services. The use of our website is also not possible without data processing (see section 8).
15. What are your rights?
You have certain rights under applicable data protection law so that you can obtain further information about and act on our data processing:
- You can request further information about our data processing. We are at your disposal for this purpose. You can also submit a request for access if you would like further information and a copy of your data;
- You can object to our data processing, especially in connection with direct marketing;
- You can have inaccurate or incomplete personal data corrected or completed or supplemented by a note of objection;
- You also have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, insofar as the corresponding data processing is based on your consent or is necessary for the performance of the contract;
- If we process data on the basis of your consent, you can withdraw your consent at any time. The withdrawal is only valid for the future and we reserve the right to continue to process data on a different basis in the event of a withdrawal.
If you wish to make use of such a right, please contact us (section 2). As a rule, we will have to verify your identity (e.g. by means of a copy of your ID card). You are also free to file a complaint against our processing of your data at the responsible supervisory authority - in Liechtenstein at the ‘Datenschutzstelle’ (DSS), Kirchstrasse 8, P.O. Box 684, FL-9490 Vaduz (T +423 236 60 90, e-mail: info.dss@llv.li).