Privacy Statement

Privacy Statement

We hereby inform you about the processing of your personal data and the data protection claims and rights to which you are entitled. In the context of your educational relationship, the data you provide as well as those that arise as a result of your studies (examinations, (academic) leave of absence, payments, etc.) are processed.


Anton Bruckner Private University
Alice-Harnoncourt-Platz 1 | A-4040 Linz
T +43 732 701000
E datenschutzbruckneruniat

Data Protection Officer:

Dr. Albert Laimighofer, Rechtsanwalt
BEURLE Rechtsanwälte GmbH & Co KG, FN 532839m
A-4020 Linz, Landstraße 9

T: +43 732 77 16 53 27
E: albert.laimighoferbeurleeu

As a public body, the ABPU is obliged to appoint a data protection officer (point a of Article 37(1) GDPR in conjunction with § 2 Forschungsorganisationsgesetz - FOG).

1. Data processing (categories of personal data, purpose, lawfullness)

Anton Bruckner Private University (ABPU) processes the following categories of personal data, among others, in the context of your education and for the purpose of fulfilling the education contract as well as based on legal obligations:

  • Student‘s Master Data 1 (personal identifier, gender, name, title, date of birth, degree programme and form of organization, status), Student‘s Master Data 2 (place of birth, citizenship, ABPU e-mail address, student picture).
  • Social security number / substitute number, address data, contact data, additional information (occupation, additional certificates, remarks), work experience, study data, repeater/dropout/exemption data, enrollment data, bachelor's/pre-graduate access requirements, master programme access requirements, other education, education contract, study documents, final and other papers, final exam, final documents, other documents.

In addition, the following further categories of personal data are processed:

  • in the context of your application: application data, application documents, results of the theoretical and practical audition, data for statistical evaluations;
  • in the context of course organization and student evaluation: course data, assessment data, time recording data, enrollment data, learning products (e.g. photo protocols, video analyses), metadata for evaluation (e.g. evaluation date);
  • in the context of student association elections and administration of student association representatives: Register of voters for the student association election, student association representations (field of study/university representations);
  • in the context of the settlement of tuition fees, student association fees and library fees: prescription, payment and reminder data for tuition fees (possibly also invoice data as well as repayment data), applications for tuition fee waivers, lending data, payment and reminder data for library use;
  • in the context of the use of various IT services: user‘s master data, printer data (e.g. printing credits), log files.
  • in the context of Erasmus+ student mobilities: Data related to mobility modalities.

In the interest of the ABPU in the design and further development of modern interactive teaching and learning scenarios, as well as for the documentation and publication of examination concerts and other events in the context of teaching, admissions may also be made in images, sound and/or video. These are used and made available purely for documentation purposes or to fulfill the obligation to publish (§ 11 (4) Privathochschulgesetz - PrivHG). Use for marketing purposes is made on the basis of the declaration on the transfer of rights to performances and final works.

In principle, the data categories listed above are collected directly from you - however, these may be supplemented by system-generated data, by study data required for processing, and by performance assessment data. If you do not have an Austrian social security number and have not yet received a substitute number, we will request one from Statistics Austria on your behalf.

The processing of this data is based on the fulfillment of a contractual legal relationship pursuant to point b of Article 6(1) GDPR or on the basis of legal obligations pursuant to point c of Article 6(1) GDPR and is carried out for the purpose of fulfilling the education contract and processing the study operation. The disclosure and processing of the above personal data is voluntary and serves the purpose of fulfilling the contract. Without the disclosure and processing of your data, the conclusion and fulfillment of an education contract is not possible.

2. Transfer of personal data and recipients

All categories of data are processed internally by ABPU employees / staff members. Personal data of applicants will not be transferred to any recipient. Personal data of students are transferred to recipients under the maxim of data minimisation (Article 5 GDPR) in the following cases.

  • Processors: Processors used by us may process data for us in order to fulfill the purposes described, if they provide sufficient guarantees for the security of the data. The above categories of personal data are accessed and processed by external IT service providers in support cases, for example.
  • AQ Austria: Based on § 7 (2) PrivHG, personal data is transferred to the Agency for Quality Assurance and Accreditation Austria, Franz-Klein-Gasse 5, 1190 Vienna, in the course of the ABPU's annual report. This mainly concerns information on the following points according to
    § 6 Private Universities Annual Report Ordinance 2021 - PrivH-JBVO 2021:
  • Results of the monitoring of the development of graduates
  • Participation in mobility programs for students
  • Scholarships awarded or arranged by the private university
  • Student association at the ABPU: The Austrian Student Union receives personal data of students in accordance with the provisions of § 6 Hochschülerinnen- und Hochschülerschaftsgesetz 2014 - HSG 2014. For the proper execution of the ÖH elections, this data is additionally transferred to the election commission of the Austrian National Union of Students in accordance with
    § 43 (5) HSG 2014 as a basis for the creation of the voter list. The provisional electoral roll shall be available for inspection by all ordinary ÖH members (§ 19 (3) Hochschülerinnen- und Hochschülerschaftswahlordnung 2014 – HSWO 2014) during the period pursuant to
    § 19 (1) HSWO 2014. The members of the Election Commission of the Austrian National Union of Students at the ABPU have access to the final electoral roll.
  • Data network of universities and colleges: For the area of the universities, the University of Continuing Education Krems, the colleges of education, the degree programmes and universities of applied sciences as well as the private universities, a joint data network of the universities and colleges has been established for the enforcement of regulations under higher education law, study law, study promotion law and higher education student law
    (§ 10 (1) Bildungsdokumentationsgesetz 2020 - BilDokG 2020). This is currently used primarily for the regular allocation, administration and blocking of student numbers (§ 10 (3) BilDokG 2020). The personal data to be transmitted by the ABPU to the data network result from § 10 (4) in conjunction with Annex 7 line 2 and 3 BilDokG 2020.
  • Scholarship Office: Based on § 3 (1) in conjunction with § 40 (7) Studienförderungsgesetz 1992 – StudFG, the data of the applying students necessary for the verification of the eligibility criteria have to be transferred by means of automated data transfer upon request of the study grant authority.
  • Ouriginal: The ABPU transfers Bachelor's and Master's theses and dissertations submitted by students to the company Ouriginal, Gustavslundsvägen141, SE-167 51 Bromma (Sweden) for the purpose of carrying out a digital plagiarism check. The processing is carried out in the public interest (point e of Article 6(1) GDPR). Ouriginal is a processor for ABPU within the meaning of Article 28 GDPR and thus processes student work and all related personal data on behalf of ABPU in compliance with European data protection requirements (EU-GDPR). Students have the right to file a justified objection (Article 21 GDPR) against these processing operations at any time.
  • University Library, Library Network and Austrian National Library: Dissertations to be produced in the course of studies are made available to the public as publications in printed form in the ABPU university library as well as electronically in the library catalogue or in the institutional repository (§ 11 (4) PrivHG). In addition, positively evaluated dissertations are to be published by handing them over to the Austrian National Library (§ 11 (4) PrivHG).
  • Erasmus+ student mobilities: Personal data collected for the purpose of Erasmus processing will be used exclusively for the application and implementation of the mobility. When the mobility takes place, all personal data disclosed in the context of the application and the contractual relationship are transferred to the European Commission, the Erasmus+ National Agency / OeAD GmbH as well as to the Federal Ministry of Finance ("Transparency Database") for the purpose of mobility implementation and evaluation and are stored, processed and used by them with the help of automated systems.
  • Alumni Network: Students of the Anton Bruckner Private University are admitted to the ABPU Alumni Network in the course of their admission to the program. In the process, contact and study-relevant data are transferred to the Alumni Network. The transfer is based on the legitimate interest of the ABPU and the Alumni Network within the meaning of point f of Article 6(1) GDPR for the purpose of promoting students and graduates. Students have the right to file a justified objection (Article 21 GDPR) against the processing at any time.
  • Akademie für Begabtenföderung (ABF): Data of extracurricular students who are participants in the ABF are transmitted to the Upper Austrian State Music School Association (LMSW), the City of Linz Music School and the Upper Secondary School for Students of Music in Stifterstraße. Contact details and results of intermediate examinations are processed in order to ensure that the services of the ABF can be utilized. The data transfer is carried out for the fulfillment of the contract within the meaning of Art 6 para 1 lit b GDPR and is based on the cooperation agreement for the establishment of the Academy for the Promotion of Gifted Students.

In addition, the ABPU does not provide information to third parties. In this regard, reference is made to contacting the students directly.

3. Storage period

Depending on whether personal data of applicants or students with an education contract are processed, the data are processed and stored for different periods of time:

  • Applicants

Personal data of applicants who do not receive an education contract will be anonymized or erased three years after submission of their application documents.

The storage period is extended in all cases by any longer duration of the pendency of judicial or official proceedings in which the ABPU has party status and these data are the subject of the proceedings.

  • Students

Personal data of students will be erased after termination of the education contract, taking into account the applicable legal retention obligations.

The data categories listed above, which are processed by automated means for the purpose of fulfilling the education contract as well as based on legal obligations, are stored for a period of 80 years, calculated from the end of the academic year in which the education contract ends, in order to provide proof of degree completion in accordance with § 11 (7) PrivHG in conjunction with
§ 53 Universitätsgesetz 2002 – UG.

The social security number or the substitute number will be erased pursuant to § 4 (7) BilDokG 2020 already after two years, calculated from the end of the academic year in which the education contract ends.

The data obtained in the course of the ÖH election will be erased after two years, calculated from the last day of the election, in accordance with § 61 (2) HSWO 2014.

The erasure and destruction of documents from Erasmus+ student mobilities and mobility projects takes place within one year after the end of the calendar year ten years after the end of the project through which the mobility was handled.

The storage period is extended in all cases by any longer duration of the pendency of judicial or official proceedings in which the ABPU has party status and these data are the subject of the proceedings.

Scientific and artistic theses are made permanently available to the public due to the obligation to publish them. The author can exclude the use of the thesis for a maximum of five years after delivery
(§ 11 (5) PrivHG).

4. Rights of the data subjects

The data subject (i.e. the natural person whose personal data are processed) has various - very comprehensive - rights towards the controller (i.e. the organization, in this specific case Anton Bruckner Private University).

These rights serve to ensure the transparency of the processing of personal data. The data subject should be able to obtain information and should also know by whom, how, in what way, for which purposes and means, why the data is processed.

The data subjects have the following rights towards the controller:

  • Right to transparent information (Article 13 and 14 GDPR)
  • Right of access (Article 15 GDPR)
  • Right to rectification (Article 16 GDPR)
  • Right to erasure (Article 17 GDPR)
  • Right to restriction of processing (Article 18 GDPR)
  • Right to object to processing based on legitimate interest pursuant to point e and f of
    Article 6(1) GDPR (Article 21 GDPR)
  • Right to data portability in case of contractual relationship or given consent (Article 20 GDPR)
  • If the processing is based on consent pursuant to point a of Article 6(1) GDPR or point a of
    Article 9(2) GDPR, the data subject has the right to withdraw his oder her consent at any time. The withdrawal does not affect the lawfulness of processing carried out on the basis of given consent until the consent is withdrawn.
  • Right to lodge a complaint with a supervisory authority (Article 77 GDPR). The local supervisory authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna,
    phone: +43 1 521 52-25 69, e-mail: dsbdsb.gvat.

Data subjects may exercise all rights by sending an e-mail to datenschutzbruckneruniat or by any other means.

The data subjects must identify themselves and contribute to the identification in order to ensure that the data subject is actually addressed when responding to the exercise of the respective right.