Privacy policy

1 Responsible body

Reutlingen University
ESB Business School
Alteburgstr. 150
72762 Reutlingen, Germany
ESB email: bianca.fecker@reutlingen-university.de; carolien.van_der_hulst@reutlingen-university.de
Reutlingen University email: info@reutlingen-university.de
Tel. Career Center: 07121/271-3087/-3068
Tel. Reutlingen University: 07121/271-0

2 External data protection officer

Maximilian Musch
Deutsche Datenschutzkanzlei
Email: datenschutz@reutlingen-university.de
Tel.: 07121/271-1100

3 Data protection information for students of ESB Business School/ Reutlingen university regarding the use of CareerOS

We hereby provide you with information on data processing within the framework of the CareerOS career/networking platform provided by Reutlingen University.
CareerOS is a platform that helps students establish valuable relationships with employers, partners, career advisors, etc., build meaningful and long-term relationships, make contacts, and achieve better recruitment results. For the Career Center at ESB Business School, the platform is also a tool for better understanding and
supporting students in their application processes and providing tailored advice. The platform processes personal data for the creation and maintenance of user accounts, the display of relevant career content, and communication between students, career services, and potential employers.

The key features of CareerOS include:
- Creating and maintaining a personal career profile with details of your education, professional experience, preferences (e.g., industry, location, job type), and resume
- Saving and organizing interesting job ads, employer profiles, and contacts
- Systematic management of the application process (e.g., application status, deadlines, notes)
- Recommendations for suitable jobs, companies, and networking contacts based on the individual profile
- Access to curated content, application tips, interview guides, and other career preparation resources
- Analysis functions that enable career advisors to better understand students' activities (e.g., interests, application progress) and provide targeted support.

The staff at the ESB Business School Career Center use CareerOS to collect and process the following data as part of an anonymous analytical evaluation:
Tracking labor market trends from the students' perspective:
- Frequency of contact with specific employers
- Interest in roles and positions
- General analytical evaluation
Insight into application processes:
- Frequency of applications: where and how often do ESB students apply?
- At what stage of the process are they?
- What strategy do our students pursue when applying?
Alumni management:
- Evaluation of employer preferences
- Evaluation of positions and activities

ESB does not create analytical profiles. Instead, the data is aggregated and evaluated anonymously as part of
the evaluation process.

Below, we will briefly outline the individual processing steps involved in using the system:
- Registration and authentication
- Storage and display of career profiles
- Tracking of application processes
- Storage of usage interactions (e.g., clicks, search behavior) on an anonymous basis
- Aggregated (anonymized) data analysis to improve consulting and platform functions
- Storage and analysis of communication content (e.g., internal messages, LinkedIn communication via Chrome extension)
- Technical access logging (e.g., IP address, device information, timestamp) to ensure availability, security, and error analysis
- Session management and personalization through cookies (e.g., language settings, authentication)
- Storage of metadata (e.g., time of changes, profile creation history)

4 Type of data and data categories

Below, we provide information about the type of data and data categories that are processed in connection with the provision of CareerOS:
- Identity data: Last name, first name, email address, profile picture, LinkedIn account
- Demographic data: Gender, ethnicity (not mandatory)
- Education and career data: Education, professional experience, desired industry, other job search preferences, language skills, work permits
- Usage data: IP address, time of use, device type, browser type

5 Sources of data collection

Personal data is usually entered directly by the data subjects themselves when registering and using the platform.
Additional data (e.g., usage activities, technical connection data, communication history) is automatically collected and processed when using the platform.

6 Legal basis for data processing

The data is processed for the provision and operation of the CareerOS platform for users to provide individual support to students in their transition from university to professional life and to promote cooperation with employers, companies, and other practical partners of the university, and thus on the basis of Art. 6 (1) (b) GDPR (contract initiation/execution).

When using the platform, the provision of any additional information (images, personal details, career data) is voluntary and therefore based on your consent in accordance with Art. 6 (1) (a) GDPR. You have the option at any time to delete and modify information about yourself and thus revoke your consent to processing without giving reasons. You have the option of showing or hiding your profile separately from other users, university administrators, or employers. You can also delete your account at any time. Your data will then be deleted immediately in its entirety.

Furthermore, the university collects and processes personal usage data generated in the course of using CareerOS to create anonymized usage/behavioral analyses. In this process, the usage data of the persons concerned is evaluated, anonymized, and then provided to the university in aggregated form to improve the functions of CareerOS. Examples of this include bar charts of industries or companies that students are interested in, or what proportion of the total student population is actively networking. Aggregated evaluations are carried out to improve counseling services, study support, and career development. Processing is carried out on the basis of Art. 6 (1) lit. e GDPR in conjunction with § 4 LDSG BW and § 2 LHG BW and thus for the purpose of performing the public tasks of Reutlingen University, in particular in the areas of study counseling, career promotion, and university-related cooperation with external partners. Data processing thus serves to fulfill educational and support tasks (including academic success, career orientation, practical relevance), to improve the services provided, and is carried out exclusively within the scope of the university's purpose limitation. It is not possible to restrict the analysis function, but you can delete your account and all data at any time. No profiling or evaluation of individual data subjects takes place within the scope of the above analysis and evaluation.

CareerOS processes personal data exclusively on behalf of the university. When processing personal data in connection with the provision and operation of the platform and the functions made available, CareerOS acts exclusively as a processor in accordance with Art. 28 GDPR. Processing for its own purposes—e.g., for product development—takes place only in anonymized form and without reference to identifiable persons.

7 Further information on data protection

7.1 Existence of automated decision-making (profiling)

We do not use purely automated decision-making processes in accordance with Art. 22 GDPR.

7.2 Scope of obligations to provide us with data

Use of the platform is voluntary. You can also decide for yourself what information you provide in your profile and delete or change it at any time. You have the option of showing or hiding your profile separately from other users, university administrators, or employers.

7.3 Storage and deletion periods

We process your data for as long as you use the CareerOS platform. As soon as you log out and delete your account, all your data will be deleted immediately. We will also delete your account if you have not logged in for two years.

8 Recipients of the data within the EU

At our university, your data will be received by those internal departments or organizational units (ESB Career Center) that require it to fulfill our obligations or for processing and implementation purposes. These are exclusively the project managers at ESB Business School.

Your data will only be passed on to external parties within the scope of the order processing relationship with CareerOS for the provision of the platform.

Data will not be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries).

9 Your rights

Under certain circumstances, you can assert your data protection rights against us. Your requests to exercise your rights should, if possible, be sent in writing or by email to the above address or directly in writing or by email to our data protection officer.

- You have the right to obtain information from us about your data stored by us in accordance with the provisions of Art. 15 GDPR (with restrictions under § 9 LDSG, if applicable).
- At your request, we will correct the data stored about you in accordance with Art. 16 GDPR if it is inaccurate or incorrect.
- If you wish, we will delete your data in accordance with the principles of Art. 17 GDPR, provided that other legal regulations (e.g., statutory retention obligations or the restrictions under § 10 LDSG) or an overriding interest on our part (e.g., to defend our rights and claims) do not prevent this.
- Taking into account the requirements of Art. 18 GDPR, you can request that we restrict the processing of your data.
- Furthermore, you may object to the processing of your data in accordance with Art. 21 GDPR, on the basis of which we will cease processing your data. This right of objection only applies in the event of special circumstances relating to your personal situation, whereby the rights of our company may conflict with your right of objection.
- You also have the right to receive your data in a structured, commonly used, and machine-readable format or to transfer it to a third party under the conditions of Art. 20 GDPR.
- In addition, you have the right to revoke your consent to the processing of personal data at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). You can contact the supervisory authority responsible for us at:

The State Commissioner for Data Protection and Freedom of Information
Lautenschlagerstr. 20
70173 Stuttgart
Tel.: 0711/615541-0
FAX: 0711/615541-15
E-Mail: poststelle@lfdi.bwl.de