Notice on the handling in accordance with data protection law of personal data of students, training participants*, employees, guest lecturers, alumni, companies and partners of the Filmakademie Baden-Württemberg
We take the protection of your personal data very seriously and we comply strictly with the provisions of data protection legislation. Personal data shall only be collected to the necessary extent. Under no circumstances shall the collected data be sold or passed on to third parties for any other reason.
We shall process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (FDPA) and all other applicable laws (e.g. the German Works Constitution Act and Working Hours Act, etc.).
1. Controller's contact details
The controller within the meaning of the General Data Protection Regulation is:
Filmakademie Baden-Württemberg GmbH
Tel: 07141 969-82102
The following person has been appointed as data protection officer:
Mr. Stephan Hartinger
Tel: 08232 80988-70
2. Which sources are used to collect personal data?
We process personal data that we have received from you in order to provide the course/training (students, participants*), to carry out the employment relationship (employees*), to fulfil contracts (guest lecturers, companies, partners) or on the basis of consent you have given.
On the other hand, we process personal data that we have legitimately obtained and may process from publicly accessible sources (e.g. authorities, trade and association registers, press, media, internet).
Personal data relevant to us may be:
Surname, first name, address (street, postcode, city, country), date of birth, place of birth, contact data, tax ID, social security number, bank details, health insurance, etc.
3. What is your data processed for (purposes) and on what legal basis?
We process your personal data in compliance with the provisions of the EU General Data Protection Regulation (Articles 9 to 13 GDPR), the German Federal Data Protection Act (BDSG) and all other applicable laws (e.g. the German Works Constitution Act and Working Hours Act, etc.).
- First of all, the purpose of the data processing is to establish and implement our courses of studies/further training, employment relationships and teaching at the Filmakademie Baden-Württemberg and to carry out and perform our business activities.
- We also process your data in order to fulfil our legal obligations as an employer, especially in the area of tax and social security law.
- Where necessary, we also process your data to protect our legitimate interests or those of third parties (e.g. authorities). For public photographic reporting about any course and/or event and for promoting purposes, Filmakademie Baden-Württemberg or third parties it has specifically commissioned or otherwise authorized (e.g. broadcasters, the press) may each make their own separate visual and audiovisual recordings, which can contain images of the participant as a visitor to the corse and/or event. These audiovisual recordings can be processed, exploited and communicated to the public by Filmakademie Baden-Württemberg as well as by third parties which the latter has commissioned or otherwise authorized.
- Data processing for statistical purposes.
- If special categories of personal data are processed, the purpose of this processing is to exercise rights or to fulfil legal obligations arising from labour law, social security law and social protection within the framework of the employment relationship.
- In addition, the processing of special categories of personal data may be based on consent (e.g. company health management).
We will notify you in advance if we wish to process your personal data for a purpose not mentioned above.
4. Transfer of data to third parties
Within Filmakademie Baden-Württemberg GmbH, your personal data is only transmitted to the persons and positions (e.g. departments, works council, representatives of severely disabled employees) that require it to fulfil our contractual and statutory obligations.
In addition, we may transfer your personal data to other recipients outside the company if this is necessary to fulfil contractual and legal obligations. These could be, for instance:
- public authorities (e.g. pension insurance institutions, professional pension schemes of the liberal professions, social insurance institutions, tax authorities, courts)
- Banks (SEPA payment medium)
- Health insurance companies receiving offices
We transfer data to third parties if we need to do so to fulfil a contractual obligation. No transfers shall be made to third parties for purposes beyond those mentioned under point 3.
5. Transfer of data to third countries
We will notify you in advance if we transfer your personal data to so-called third countries outside the EU/EEA area.
6. Data storage period/Deletion periods
We will process and store your personal data as long as this is necessary for the fulfilment of our contractual obligations as well as for all other purposes mentioned under point 3 or as provided in the retention periods stipulated by law.
Normally, when data is no longer required for the fulfilment of contractual or legal obligations, it shall be blocked against further processing or erased in accordance with legal regulations.
7. Data subject's data protection rights (Articles 15 to 21 GDPR)
You can use the above-mentioned address to request information (Article 15 GDPR) about the data stored about you. Furthermore, you have the right to obtain the data you have provided in a structured, commonly-used and machine-readable format. You may also, under certain conditions, request the rectification (Article 16 GDPR) or erasure (Article 17 GDPR) of your data. You also have the right to restrict the processing (Article 18 GDPR) of your data, as well as the right to data portability (Article 20 GDPR).
You have the right, on grounds relating to your particular situation, to object at any time to the processing of data concerning your person that is done on the basis of Article 6(1)(f) GDPR (data processing for the purposes of legitimate interests). This also applies for profiling within the meaning of Article 4(4) GDPR that is done on the basis of said regulation and can be carried out e.g. in the context of customer advice and customer care and for marketing purposes.
If you file an objection, your personal data will no longer be processed unless proof is furnished of compelling legitimate grounds for processing it that override your own interests, rights and freedoms, or unless the data is processed for establishing, exercising or defending legal claims.
You have the right to object to the processing of your personal data for direct marketing purposes without giving reasons (Article 21 GDPR). This also applies for profiling to the extent that it is connected with such direct marketing. If you object to your data being processed for direct marketing purposes, then we will no longer process your personal data for these purposes. An objection can be filed without observing any particular form. Our contact details are provided in Item 1 above.
If we process your data to protect legitimate interests, you may object to such processing for reasons arising from your particular situation. In the event of an objection, we shall no longer process personal data unless we can prove compelling reasons worthy of protection for the processing that prevail over your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to revoke consent under data protection law (Article (7)(3) GDPR). You can revoke your consent to the processing of your personal data at any time and without giving reasons. This also applies to the revocation of declarations of consent given to us prior to the EU General Data Protection Regulation’s entry into force.
8. Statutory or contractual provisions concerning the provision of personal data and the possible consequences of non-provision
Please note that in specific cases (e.g. tax regulations) the provision of personal data is prescribed by law or may result from contractual regulations (e.g. information concerning the contractual partner(s)).
Where can you lodge a complaint?
You have the right to lodge a complaint with the data protection officer mentioned above or to a data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 of the FDPA). The data protection supervisory authority with jurisdiction for us is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
You can contact us at any time by email (datenschutz(at)filmakademie.de) if you have any questions about your personal data.