Modul University Vienna GmbH ("MUV", "we", "us") is committed to protecting your personal data. This Data Privacy Notice explains how we collect, use, store, and protect personal data in connection with your use of our website, your enrolment or engagement with MUV, and your interaction with our services and platforms.

We process all personal data in strict compliance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz, DSG), and all other applicable Austrian and EU data protection law. This notice applies to all websites operating under the modul.ac.at domain.

This notice covers the general data processing activities of MUV. Where MUV processes personal data in specific contexts (for example, as part of an employment relationship), those data subjects receive a separate privacy notice for that purpose.

MUV does not make any solely automated decisions — including profiling — that produce legal or similarly significant effects on any data subject.

Data Controller

Modul University Vienna GmbH

Am Kahlenberg 1, 1190 Vienna, Austria

Business Register No.: FN 277162t  |  VAT: ATU 62643214

Managing Director: András Viszkievicz

Tel: +43 1 9280742  |  Email: privacy@modul.ac.at

Data Protection Officer

MUV has appointed a Data Protection Officer who can be contacted on any matter relating to this notice, your data subject rights, or data protection concerns:

DPO Name: Ganesh Yoganathan

Email: dpo@modul.ac.at

Tel: +43 1 9280742

Office Hours: Monday to Friday, 10:00–16:00 (appointments recommended)

Postal: Modul University Vienna GmbH, Am Kahlenberg 1, 1190 Vienna, Austria

2.1 Server Log Data

When you visit www.modul.ac.at, our web server automatically records the following technical data:

• IP address
• Date and time of your visit
• Pages and sub-pages visited
• Browser type and version
• Operating system
• Referring URL (the page from which you navigated to our site)

Legal basis: Article 6(1)(f) GDPR — legitimate interests in maintaining the security, availability, and proper operation of our website. Server log files are retained for a maximum of 30 days, after which they are automatically deleted or anonymised. In the event of a security incident, relevant logs may be retained for a longer period.

2.2 Tag Management

MUV uses Google Tag Manager (GTM) to deploy and manage third-party scripts based on your consent preferences as set through our cookie banner. GTM itself does not collect personal data. Two GTM containers are active on this website (GTM-MW4D5J and GTM-S4RR).

2.3 Cookies

We use cookies to improve your experience on our website and to collect visitor statistics. You can manage, disable, or delete cookies at any time through your browser settings or via our cookie banner.

The following cookies have been confirmed as active on www.modul.ac.at through a technical scan of the website. Where cookies require your consent, this is collected through our cookie banner before activation.

Category	Cookie	Provider	Purpose	Retention & Legal Basis
Necessary	__cf_bm	Cloudflare (via LinkedIn)	Bot management and abuse prevention. Distinguishes humans from automated bots to protect the website.	1 hour. Art. 6(1)(f) GDPR — strictly necessary; no consent required.
Functional	li_gc	LinkedIn Ireland Unlimited Co.	Stores visitor consent for non-essential LinkedIn cookies.	6 months. Art. 6(1)(a) GDPR — consent via cookie banner.
Functional	lidc	LinkedIn Ireland Unlimited Co.	Facilitates LinkedIn data centre selection for performance.	1 day. Art. 6(1)(a) GDPR — consent via cookie banner.
Analytics	_ga	Google Analytics (Google Ireland Ltd.)	Calculates visitor, session and campaign data. Assigns a randomly generated ID to recognise unique visitors and track site usage.	13 months. Art. 6(1)(f) GDPR — legitimate interests; IP anonymisation enabled. Data may transfer to the US under the EU–US Data Privacy Framework.
Analytics	_ga_*	Google Analytics (Google Ireland Ltd.)	Measures advertisement efficiency. Tracks conversions and ad campaign performance.	13 months. Art. 6(1)(f) GDPR — legitimate interests. Same conditions as _ga above.
Advertisement	_gcl_au	Google Tag Manager (Google Ireland Ltd.)	Measures advertisement efficiency. Tracks conversions and ad campaign performance.	3 months. Art. 6(1)(a) GDPR — consent via cookie banner. Data may transfer to the US under the EU–US Data Privacy Framework.
Advertisement	bcookie	LinkedIn Ireland Unlimited Co.	Browser ID for LinkedIn share buttons and ad tags. Recognises returning browsers for advertising.	1 year. Art. 6(1)(a) GDPR — consent via cookie banner. LinkedIn does not participate in the EU–US DPF; transfers via standard contractual clauses (Art. 46 GDPR).
Advertisement	_fbp	Meta Platforms Ireland Ltd.	Facebook tracking cookie. Stores and tracks interactions for advertising analytics and campaign measurement.	3 months. Art. 6(1)(a) GDPR — consent via cookie banner. Data may transfer to the US under the EU–US Data Privacy Framework.

You may withdraw or adjust your cookie consent at any time via our cookie banner or by contacting privacy@modul.ac.at.

Note on LinkedIn and Facebook cookies

LinkedIn and Facebook advertisement cookies are set via social media scripts loading on this website. If you wish to prevent this, decline advertisement cookies via our cookie banner. LinkedIn transfers data to the US under standard contractual clauses (not DPF). Meta transfers data under the EU–US Data Privacy Framework. See linkedin.com/legal/privacy-policy and facebook.com/policy.php for details.

2.4 Social Media and Embedded Content

MUV maintains a presence on the following platforms, accessible via links in the website footer. When you follow these links, data including your IP address may be processed by the relevant platform:

• YouTube (Google Ireland Limited)
• LinkedIn (LinkedIn Ireland Unlimited Company)
• Instagram (Meta Platforms Ireland Limited)
• Facebook (Meta Platforms Ireland Limited)
• X, formerly Twitter (X Corp.)
• TikTok (TikTok Technology Limited)

Embedded YouTube videos use privacy-enhanced mode (youtube-nocookie.com) where technically possible — no cookies are set until you actively play a video. See policies.google.com/privacy.

2.5 Web Forms and Enquiries

If you submit a contact form or enquiry, the information you provide will be stored and used to respond to your request. Legal basis: Art. 6(1)(f) GDPR for general enquiries; Art. 6(1)(b) GDPR for contractual matters. Correspondence is retained for three years (ABGB) unless a longer period applies.

Personal Data Processed

• Name, date of birth, form of address, and academic title
• Contact details (address, telephone number, email address)
• Social security number and ZMR registration number for statutory identification
• Nationality and, where required for statutory reporting, country of origin and religion
• Enrolled or intended study programme and start date
• Academic records, certificates, transcripts, and entry qualifications
• Payment and bank details for tuition fees and related charges
• Correspondence including emails, meeting notes, and support requests
• Alumni status and engagement data (following graduation)

Purposes of Processing

• Management of study applications, enrolment, and student records
• Administration of tuition fees, payments, and financial support
• Library and research documentation management
• Issuing official transcripts, certificates, and degree qualifications
• Compliance with statutory reporting obligations to public authorities
• Alumni programme communications (with consent where required)
• Sending newsletters and marketing communications (with consent)

Legal Basis

Art. 6(1)(b) GDPR (performance of a contract) is the primary basis for study administration. Art. 6(1)(c) GDPR (legal obligation) applies to statutory reporting. Art. 6(1)(f) GDPR (legitimate interests) applies to alumni communications. Art. 6(1)(a) GDPR (consent) applies to newsletters and optional communications.

Data Retention

Data Category	Retention Period
Academic records and study contracts	Permanent or as required by PUG §3(11) in conjunction with UG §53
Financial and tuition fee records	7 years (Austrian Federal Tax Code, BAO)
General correspondence	3 years (Austrian Civil Code, ABGB)
Unsuccessful application materials	6 months from notification of outcome
Alumni engagement data	Until withdrawal of consent or account deletion

Data Transfers

• Austrian Students' Union (ÖH) — as required by HSG 2014
• Statistics Austria — as required by the Education Documentation Act (BiDokG)
• Austrian financial and tax authorities — as required by the BAO
• Courts, legal counsel, notaries, and auditors — where required for legal proceedings
• IT service providers, postal and printing services — under Art. 28 GDPR Data Processing Agreements

Student data is not transferred outside the European Economic Area except where expressly required by law and with appropriate safeguards in place.

Automated Decision-Making

MUV does not make solely automated decisions with legal or significant effects in relation to student enrolment or study programmes.

Dispute Resolution

Study contracts are governed by Austrian law. Students may contact the EU Online Dispute Resolution platform at ec.europa.eu/odr. MUV is not legally obligated nor willing to participate in alternative dispute resolution proceedings under the Austrian AStG.

Job Applications

When you submit a job application to MUV, we process the following data:

• Name, title, and contact details
• Date of birth and nationality
• Desired position, earliest start date, and salary expectations
• CV, certificates, professional references, photograph (if provided), and other submitted materials

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent) where materials are retained beyond the statutory minimum.

Application materials of unsuccessful candidates are deleted six months after notification of outcome, unless written consent to longer retention is given. Application materials of successful candidates are incorporated into personnel files. Employees receive a separate Employee Privacy Notice upon commencement of employment.

Employee Data Processing

MUV processes employee personal data to fulfil obligations arising from the employment relationship and comply with applicable law including Austrian labour, tax, and social security law. Employees receive a comprehensive Employee Privacy Notice at onboarding covering all data processing in detail. For queries, contact dpo@modul.ac.at or hr@modul.ac.at.

In the context of business partnerships and service agreements, MUV processes: company and contact names, addresses, telephone numbers and email addresses, correspondence, payment and bank details, and information required to fulfil contractual obligations.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interests).

Business partner data is retained for seven years for fiscal compliance (BAO) and three years for general contractual correspondence (ABGB), or longer where legal proceedings require it. Data is not transferred to third countries. Processing is restricted to employees under confidentiality obligations and authorised data processors under Art. 28 GDPR agreements.

MUV does not make solely automated decisions with significant effects on business partners.

MUV employs appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction, in accordance with Art. 32 GDPR. These measures are continuously reviewed and updated in line with technological developments and applicable regulatory guidance.

All data processors engaged by MUV are required to maintain equivalent security standards under formal Data Processing Agreements. Data is stored on secure infrastructure within the EEA.

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, MUV will notify the Austrian Data Protection Authority within 72 hours (Art. 33 GDPR) and communicate with affected individuals where required (Art. 34 GDPR).

Under the GDPR, you have the following rights in relation to personal data held by MUV. We will respond to all valid requests within 30 calendar days (extendable to 60 days for complex requests, with prior notice). We may need to verify your identity before processing your request.

Right	What it means
Access (Art. 15)	Obtain confirmation of whether MUV processes your personal data and receive a copy of it.
Rectification (Art. 16)	Request correction of inaccurate or incomplete personal data.
Erasure (Art. 17)	Request deletion of your data where no legal obligation requires its continued retention. Data is automatically deleted after applicable retention periods.
Restriction (Art. 18)	Request that processing be temporarily limited while you dispute accuracy or lawfulness.
Portability (Art. 20)	Receive personal data you have provided to us in a structured, commonly used, machine-readable format.
Objection (Art. 21)	Object to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds.
No Automated Decisions (Art. 22)	Not be subject to decisions based solely on automated processing with legal or similarly significant effects.
Complaint (Art. 77)	Lodge a complaint with the Austrian Data Protection Authority or any competent EU supervisory authority.

To exercise any of the above rights, contact us at privacy@modul.ac.at or write to the Data Protection Officer at the address above.

Withdrawal of Consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Email privacy@modul.ac.at to withdraw consent. Data processed solely on consent will be deleted on receipt of withdrawal, unless a legal obligation requires retention.

You have the right to lodge a complaint with the competent supervisory authority if you believe MUV's processing of your personal data infringes applicable data protection law. The competent authority in Austria is:

Datenschutzbehörde (Austrian Data Protection Authority) Address: Barichgasse 40–42, 1030 Vienna, Austria Phone: +43 1 52 152-0  |  Email: dsb@dsb.gv.at Website: www.dsb.gv.at

We encourage you to contact us directly in the first instance at dpo@modul.ac.at.

MUV operates an AI-powered chat assistant called MUVi, available on our website to answer questions from prospective students, current students, staff, and other website visitors.

Personal Data Collected

MUVi is designed so that questions may be asked without providing personal data. However, the following personal data may be collected during an interaction:

• Name and email address — collected if you request a follow-up response or wish to be connected with a member of the MUV team
• WhatsApp number — collected only if you opt in to be contacted via WhatsApp by a MUV representative
• Conversation content — questions asked and responses provided, logged to improve the accuracy of future responses

Purpose of Processing

• Responding to enquiries about MUV programmes, admissions, and services
• Connecting visitors with MUV staff where follow-up is requested
• Improving the quality and accuracy of MUVi's responses through analysis of conversation content
• Fine-tuning the MUVi model using anonymised conversation data to make the service more useful to future visitors

Legal Basis

Art. 6(1)(f) GDPR (legitimate interests) applies to anonymous interactions, conversation logging, and the use of anonymised conversation content for model improvement and fine-tuning. MUV's legitimate interest is in operating an accurate, helpful information service for prospective and current students and other visitors. Before any conversation content is used for model training or fine-tuning, personal identifiers — including names, email addresses, WhatsApp numbers, and any other directly identifying information — are removed. Model training is carried out on anonymised data only.

Art. 6(1)(a) GDPR (consent) applies where you voluntarily provide your name, email address, or WhatsApp number to request follow-up contact. You may withdraw this consent at any time by contacting privacy@modul.ac.at.

Data Storage

MUVi is a custom-built tool operated by MUV. All data, including conversation logs, is stored on MUV's own infrastructure within the EEA and is not shared with third-party AI providers or used to train any external model.

Note on WhatsApp

If you provide your WhatsApp number to be contacted by a MUV representative, that communication will take place via WhatsApp, a service operated by Meta Platforms Ireland Limited. Once your number is used to initiate a WhatsApp conversation, data processing within WhatsApp is governed by Meta's privacy policy, available at whatsapp.com/legal/privacy-policy. MUV does not store your WhatsApp number beyond the purpose of initiating that contact.

Data Retention

Anonymous conversation logs are retained for a maximum of 30 days and then deleted. Where you have provided personal contact details (name, email, or WhatsApp number), these are deleted once the purpose for which they were provided has been fulfilled, unless you subsequently enter into a relationship with MUV (for example, as a student or applicant), in which case the relevant data retention periods in Section 3 apply.

Your Rights

You may request deletion of any personal data submitted via MUVi at any time by contacting privacy@modul.ac.at. See Section 7 for your full rights as a data subject.

MUV operates a confidential whistleblowing channel for individuals with a current or previous connection to the university who wish to report suspected misconduct. Reports may be submitted anonymously via MUV's secure reporting portal: personiowhistleblowing.com.

Personal data submitted through this channel is processed solely for the purpose of investigating the reported matter, in accordance with the Austrian Whistleblower Protection Act (Hinweisgeberschutzgesetz). Details are available at www.ris.bka.gv.at.

MUV reserves the right to update this Data Privacy Notice to reflect changes in legal requirements, processing activities, or our organisational structure. The current version is always available at www.modul.ac.at/legal/data-privacy-notice. Material changes will be communicated to affected data subjects by email or prominent notice on our website.