If personal data are processed, the data subject must be informed about certain aspects of the data processing at the latest when the personal data are collected.

If the data is collected from the data subject himself, Art. 13 GDPR applies.

According to this, the person must be informed about:

• Name and contact details of the persons responsible (i.e. the Presidential Board of the University of Oldenburg)
• Contact details of the university's data protection officer
• The purpose(s) of the processing
• Legal basis(s) of the processing
• Duration of the storage or criteria for determining the duration
• Data subject rights
• Right to complain to a supervisory authority
• The existence of automated decision-making - including profiling and meaningful information about the logic involved and the scope and intended effects of the processing for the data subject

• Where applicable, legitimate interests by the controller or a third party
• If applicable, recipients or categories of recipients of the personal data
• If applicable, the intention to transfer the data to a third country (outside the EU)
• If applicable, about the revocability of consent given (Art. 6 para. 1 lit. a DSGVO)
• If applicable, obligation of the data subject to provide personal data

If personal data are not collected from the data subject (for example in the case of a transfer from a third party), Art. 14 GDPR applies.

The data subject must then temporally:

• within a reasonable time after obtaining the personal data, at the latest within one month
• if the data are used to communicate with the data subject, at the latest at the time of the first communication to him or her
• if disclosure to another recipient is envisaged, at the latest at the time of the first disclosure.

informed.

The data subject must be informed of:

• Name and contact details of the responsible persons (i.e. the Presidential Board of the University of Oldenburg)
• Contact details of the university's data protection officer
• The purpose(s) of the processing
• Legal basis(s) of the processing
• Duration of the storage or criteria for determining the duration
• Data subject rights
• Right of appeal to a supervisory authority
• The source from which the data originates (if applicable, whether the data originates from publicly available sources)
• Existence or non-existence of automated decision-making - including profiling and, if applicable, meaningful information about the logic involved and the scope and intended effects of the processing for the data subject

• Where applicable, legitimate interests by the controller or a third party (Art. 6 para. 1 lit. f GDPR).
• If applicable, recipients or categories of recipients of the personal data (in the case of transfer to third parties)
• If applicable, intention to transfer the data to a third country (outside the EU)
• If applicable, about the revocability of consent given (Art. 6 para. 1 lit. a GDPR)
• If applicable, obligation of the data subject to provide personal data