1. Introduction
2. Data Controller
3. Data Protection Officer
4. Legal Basis for Processing
5. Technology
6. Cookies
7. Content on Our Website
8. Our Activities on Social Media
9. Web analytics
10. Plugins and Other Services
11. Your Rights as a Data Subject
12. Routine Storage, Deletion, and Blocking of Personal Data
13. Duration of Storage of Personal Data
14. Updates and Changes to the Privacy Policy

With the following information, we would like to provide you, as a “data subject,” with an overview of how we process your personal data and your rights under data protection laws. In general, you can use our website without providing any personal data. However, if you wish to use specific services offered by our university via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally obtain your consent.

The processing of personal data—such as your name, address, or email address—is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the state-specific data protection regulations applicable to the “Ernst-Abbe University of Applied Sciences Jena.” Through this privacy policy, we would like to inform you about the scope and purpose of the personal data we collect, use, and process.

As the data controller, we have implemented numerous technical and organizational measures to ensure the most comprehensive protection possible of the personal data processed via this website. However, internet-based data transmissions may inherently involve security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, you are free to provide us with personal data through alternative means, such as by phone or mail.

The controller within the meaning of the GDPR is:

Ernst Abbe University of Applied Sciences Jena
Carl-Zeiss-Promenade 2, 07745 Jena, Germany
Phone: +49 3641 205 100
Fax: +49 3641 205 101
Email: praesidium@eah-jena.de
Representative of the data controller: Prof. Dr. Kristin Mitte (interim director)

You can contact the external data protection officer as follows:

frankenDSB DatenschutzManufaktur GmbH, Unterer Steinberg 11, 97453 Schonungen
Email: datenschutz@eah-jena.de

You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

As a general rule, the processing activities carried out by our university are based on Article 6(1)(e) of the GDPR, i.e., the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Article 6(1)(a) of the GDPR (in conjunction with Section 25(1) of the TDDDG) serves as the legal basis for our university’s processing activities in which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party—as is the case, for example, with processing operations necessary for the delivery of goods or the provision of other services or consideration, the processing is based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of precontractual measures, such as in cases of inquiries regarding our products or services.

5.1 SSL/TLS Encryption

This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential information—such as orders, login credentials, or contact requests—that you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser’s address bar displays “https://” instead of “http://,” and by the padlock icon in your browser’s address bar.

We use this technology to protect the data you transmit.

5.2 Data Collection When Visiting the Website

When you use our website solely for informational purposes—that is, if you do not register, do not otherwise provide us with information, or do not give consent to processing activities requiring consent—we collect only the data that is technically necessary to provide the service. This typically consists of data that your browser transmits to our server (in so-called server log files). Every time you or an automated system accesses a page on our website, our website collects a range of general data and information. This general data and information is stored in the server’s log files. The following may be collected:

1. browser types and versions used,
2. the operating system used by the accessing system,
3. the website from which an accessing system reaches our website (so-called referrer),
4. the subpages accessed on our website via an accessing system,
5. the date and time of access to the website,
6. a truncated Internet Protocol address (anonymized IP address),
and 7. the Internet service provider of the accessing system.

We do not use this general data and information to draw any conclusions about your identity. Rather, this information is needed to

1. deliver the content of our website correctly,
2. optimize the content of our website and the advertising on it,
3. ensure the continued functionality of our IT systems and the technology of our website, and
4. provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyberattack.

We therefore evaluate this collected data and information both for statistical purposes and with the aim of enhancing data protection and data security at our university, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

6.1 General Information About Cookies

Cookies are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our website.

The cookie stores information that is specific to the device you are using. However, this does not mean that we thereby gain direct knowledge of your identity.

We use cookies to make your experience on our website more convenient. For example, we use so-called session cookies to recognize that you have already visited certain pages on our website. These are automatically deleted when you leave our site.

In addition, to optimize user-friendliness, we also use temporary cookies that are stored on your device for a specific, predetermined period of time. If you visit our site again to use our services, the system automatically recognizes that you have previously visited us and recalls the entries and settings you made, so you do not have to re-enter them.

We also use cookies to collect statistical data on the use of our website and to evaluate our offerings for the purpose of optimization. These cookies allow us to automatically recognize that you have previously visited our website when you return. The cookies set in this way are automatically deleted after a defined period of time. The respective storage duration of the cookies can be found in the settings of the consent tool used.

7.1 Contacting Us / Contact Form

When you contact us (e.g., via the contact form or email), personal data is collected. The specific data collected when using a contact form is indicated on the respective contact form. This data is stored and used exclusively for the purpose of responding to your inquiry or for establishing contact and the associated technical administration. The legal basis for processing the data is Article 6(1)(e) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted once your inquiry has been fully processed; this is the case when it is evident from the circumstances that the matter in question has been conclusively resolved and there are no legal retention obligations preventing deletion.

7.2 Services / Digital Goods

We transfer personal data to third parties only if this is necessary for the performance of a contract, such as to the financial institution responsible for processing payments.

No further transfer of data will take place, or will only occur if you have expressly consented to such transfer. Your data will not be disclosed to third parties without your express consent, such as for advertising purposes.

The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

7.3 Application Management / Job Board

We collect and process the personal data of applicants for the purpose of handling the application process. Processing may also take place electronically. This is particularly the case when an applicant submits the relevant application documents to us electronically, for example via email. If we enter into an employment or service contract with an applicant, the data provided will be stored for the purpose of administering the employment relationship in accordance with applicable legal provisions. If we do not enter into a contract with the applicant, the application documents will be automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests on our part preclude such deletion. An example of such a legitimate interest is the burden of proof in proceedings under the General Equal Treatment Act (AGG).

The legal basis for the processing of your data is Art. 6(1)(b), Art. 88 of the GDPR in conjunction with § 26 of the BDSG.

7.4 Online Store

The University of Applied Sciences Jena shop (University of Applied Sciences Jena Shop) is provided by UNICUM Merchandising GmbH. When you use the link to the shop, you leave the University of Applied Sciences Jena website and are redirected to a website operated by UNICUM Merchandising GmbH. Consequently, the processing of personal data is the responsibility of UNICUM Merchandising GmbH.

To enable us to communicate with you on social media and keep you informed about our services, we maintain our own pages on these platforms. When you visit one of our social media pages, we are jointly responsible with the provider of the respective social media platform for the processing operations triggered thereby, within the meaning of Article 26 of the GDPR.

We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers.

Therefore, as a precaution, we would like to point out that your data may also be processed outside the European Union or the European Economic Area. Using these platforms may therefore involve data protection risks for you, as it may be difficult to exercise your rights—such as the right to access, erasure, or objection— etc., may be more difficult, and processing on social networks is often carried out directly by the providers for advertising purposes or to analyze user behavior, without us being able to influence this. When the provider creates user profiles, cookies are often used, or your usage behavior is linked to the social media profile you have created.

The described processing operations of personal data are carried out in accordance with Art. 6(1)(e) of the GDPR and the legitimate interest of the respective provider pursuant to Art. 6(1)(f) of the GDPR, in order to communicate with you in a modern manner and inform you about our services. If you are required to provide consent to data processing as a user with the respective providers, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Article 7 of the GDPR.

Since we do not have access to the providers’ databases, we would like to point out that it is best to exercise your rights (e.g., the right to access, rectification, erasure, etc.) directly with the respective provider. We have provided further information regarding the processing of your data on social networks below for each social media provider we use:

8.1 Facebook

(Joint) Data Controller in Europe:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Unless you object, Meta (Facebook) may process content from adult users in the EU—such as photos, posts, or comments—to train its own AI models. The legal basis for this is a legitimate interest pursuant to Art. 6(1)(f) of the GDPR. As a university, we have no influence over this specific data processing by Meta. Users can object to this via an online form on the Meta platforms.

Privacy Information (Data Policy):
www.facebook.com/about/privacy

8.2 Instagram

(Joint) Controller for data processing in Germany:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Unless an objection is raised, Meta (Instagram) may process content from adult users in the EU—such as photos, posts, or comments—to train its own AI models. As a university, we have no influence over this specific data processing by Meta. The legal basis is a legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Users can object to this via an online form on the Meta platforms.

Privacy Information (Data Policy):
instagram.com/legal/privacy/

8.3 LinkedIn

(Joint) Data Controller for data processing in Europe:
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Privacy Information:
www.linkedin.com/legal/privacy-policy

8.4 TikTok

(Joint) Data Controller in Germany:
TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. 

Privacy Policy:
www.tiktok.com/legal/page/eea/privacy-policy/de

8.5 X (Twitter)

(Joint) Data Controller in Europe:
Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland

Privacy Policy:
twitter.com/de/privacy

Information about your data:
twitter.com/settings/your_twitter_data

8.6 XING (New Work SE)

(Joint) Data Controller in Germany:
New Work SE, Am Strandkai 1, 20457 Hamburg, Germany

Privacy Policy:
privacy.xing.com/de/datenschutzerklaerung

Requests for information from XING members:
www.xing.com/settings/privacy/data/disclosure

8.7 YouTube

(Joint) Data Controller in Europe:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Privacy Policy:
policies.google.com/privacy

We have integrated the Matomo component from InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, into this website. Matomo is a web analytics software tool used to collect, gather, and analyze data on the behavior of website visitors. 

When individual pages of our website are accessed, the following data is stored:

1. Two bytes of the IP address of the user’s system
2. The time the webpage was accessed
3. The webpage accessed (page title and URL)
4. The website from which the user accessed the visited webpage (referrer)
5. The subpages accessed from the viewed webpage
6. The duration of the visit to the website
7. The frequency with which the website is visited
8. The screen resolution used
9. The time in the user’s local time zone
10. Files clicked to download
11. Page load time
12. The user’s location (country, region, city, approximate longitude and latitude)
13. Language settings of the browser being used
14. Operating system, browser version, device (such as desktop, tablet, smartphone, TV, vehicle, console, etc.)

The software runs exclusively on our website’s servers. The user data listed above is stored only there. The data is not shared with third parties.

You can view Matomo’s privacy policy at: matomo.org/privacy/.

We have integrated map sections from the online mapping tool "OpenStreetMap" into our website. This is a so-called open-source mapping service that we can access via an API (application programming interface). This feature is provided by the OpenStreetMap Foundation, St. John’s Innovation Center, Cowley Road, Cambridge, CB4 0WS, United Kingdom. By using this service, we can, for example, display our location and make it easier for you to find us. 

When you visit the pages where OpenStreetMap is integrated, information about your use of our website (such as your IP address, browser data, device type, and operating system) is transmitted to OpenStreetMap and stored there.

To speed up the service, OpenStreetMap uses the Content Delivery Network (CDN) provided by Fastly, Inc., PO Box 78266, San Francisco, CA 94107, USA (Fastly). A CDN is a service that enables the content of our online offering—particularly large media files such as graphics or scripts—to be delivered more quickly using regionally distributed servers connected via the Internet. Your data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of the CDN.

Fastly, as a U.S. company, is certified under the EU-U.S. Data Privacy Framework. An adequacy decision pursuant to Art. 45 of the GDPR is hereby in place, meaning that personal data may be transferred even without further guarantees or additional measures.

For each data processing operation, Fastly transfers personal data from the log files (e.g., IP addresses) to the United States, as certain servers used to process the log files are located only in the United States. Fastly has therefore committed to complying with the standards and regulations of European data protection law. Fastly’s current Privacy Policy can be found at: www.fastly.com/de/privacy/.

If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR.

Detailed information about OpenStreetMap can be found at: wiki.osmfoundation.org/wiki/Privacy_Policy.

11.1 Right of Access, Art. 15 of the GDPR

You have the right to receive, at any time and free of charge, information from us regarding the personal data we have stored about you, as well as a copy of this data, in accordance with the provisions of the law.

11.2 Right to Rectification, Art. 16 of the GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

11.3 Erasure (Article 17 of the GDPR)

You have the right to request that we erase personal data concerning you without undue delay, provided that one of the grounds provided for by law applies and insofar as the processing or storage is not necessary.

11.4 Restriction of Processing (Art. 18 GDPR)

You have the right to request that we restrict the processing of your personal data if one of the legal requirements is met.

11.5 Data Portability, Art. 20 of the GDPR

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data was provided, without hindrance from us, provided that the processing is based on consent pursuant to Art. 6(1)(a) of the GDPR or Art. 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, provided this is technically feasible and does not infringe upon the rights and freedoms of others.

11.6 Objection under Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) (data processing in the public interest) or (f) (data processing based on a balancing of interests) of the GDPR.

This also applies to profiling based on these provisions within the meaning of Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

In certain cases, we process personal data for direct marketing purposes. You may object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.

In addition, you have the right, for reasons arising from your particular situation, to object to the processing of personal data concerning you that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures that use technical specifications.

11.7 Withdrawal of Consent Under Data Protection Law

You have the right to withdraw your consent to the processing of personal data at any time with future effect.

11.8 Filing a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

We process and store your personal data only for the period necessary to fulfill the purpose of storage or to the extent required by the laws to which our university is subject.

If the purpose of storage no longer applies or if a prescribed retention period expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

The criterion for the duration of personal data storage is the applicable statutory retention period. Once this period has expired, the relevant data is routinely deleted, provided it is no longer necessary for the performance or initiation of a contract.

This Privacy Policy is currently in effect and is dated April 2026.

Due to the ongoing development of our website and services, or as a result of changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. You can view and print the most current version of the Privacy Policy at any time at Privacy - https://www.eah-jena.de.

This privacy policy was created with the help of the data protection software: audatis MANAGER.