DentroChat

tugraz.at Privacybeleid — 78/100 (Gemiddeld privacyrisico)

Laatst geanalyseerd

Voer een nieuwe analyse uit op een ander beleid

Technische Universität Graz (TU Graz) · tugraz.at

Rapportdetails

Gemiddeld privacyrisico

TU Graz verwerkt uw gegevens wettelijk met sterke privacycontroles, maar sommige tools van derden en logboekgegevenspraktijken zouden privacyvriendelijker kunnen zijn.

TU Graz's privacy policy is highly transparent and GDPR-compliant in many areas, particularly regarding user rights and consent mechanisms. However, gaps exist in data minimization (e.g., MAC addresses in logs), international transfer safeguards, and clarity on third-party data sharing. The use of US-based marketing tools, even with consent, introduces compliance risks under Schrems II.

We konden dit rapport nu niet vertalen, daarom staan de details hieronder in het Engels.

Laatst geanalyseerd
BronURL

Beoordeling per categorie

Uitsplitsing van het beleid over belangrijke compliancegebieden. Goed = sterk, redelijk = gemengd, slecht = zorgwekkend.

Data MinimizationRedelijk

Log data includes MAC addresses, which may exceed necessity; analytics data is anonymized (e.g., IP truncation in Matomo).

TransparencyGoed

Detailed breakdown of data categories, purposes, and legal bases, with clear references to GDPR and TKG 2021.

Third-party SharingRedelijk

Extensive use of third-party marketing/analytics tools (Meta, Google, LinkedIn, Reddit) with consent, but transfers to US raise concerns.

International TransfersRedelijk

Relies on Data Privacy Framework for US transfers but lacks explicit mention of SCCs or supplementary measures for non-DPF providers.

AI/Model TrainingGoed

No evidence of user data being used for AI/model training; analytics are aggregated and anonymized.

User RightsGoed

All GDPR rights are explicitly described, with a dedicated form for requests and clear instructions for cookie consent withdrawal.

Belangrijkste bevindingen

Opvallende clausules, problemen of positieve praktijken (kritiek eerst)

Kritiek

Ambiguity in International Transfer Safeguards

Third-party marketing tools (Meta Pixel, Google Ads, LinkedIn Insight Tag, Reddit Pixel) are used with user consent, but data may be transferred to the US. While the policy cites the Data Privacy Framework (DPF) for US transfers, it does not explicitly mention Standard Contractual Clauses (SCCs) or supplementary measures for non-DPF-certified providers, which could be a compliance gap under Schrems II.

Waarschuwing

Overbroad Log Data Retention

Log data (including IP and MAC addresses) is collected for system security and stored for up to 12 months, which is justified under Art. 6(1)(f) DSGVO (legitimate interest). However, MAC addresses are highly identifiable and their necessity for security logging is debatable under data minimization principles.

Waarschuwing

Unclear Necessity of Functional Cookies

The policy clearly states that functional cookies (e.g., session cookies) are exempt from consent under § 165 Abs. 3 TKG 2021, but it does not explicitly confirm whether these cookies are strictly necessary for the service, which is a GDPR requirement for consent exemption.

Waarschuwing

Potential Re-Identification Risk in Study Explorer

The Study Explorer tool uses functional cookies for basic functionality (e.g., storing anonymous user codes) and optional analytics cookies. The policy does not specify whether the anonymous user codes could be linked to other data, raising potential re-identification concerns.

Waarschuwing

Lack of Clarity on Payment Data Handling

The policy mentions that payment data is processed for electronic transactions (e.g., via PAYONE GmbH) but does not specify whether payment data is stored or shared with other third parties beyond the payment processor.

Info

Consent-Dependent Social Media Integration

Social media plugins (e.g., X, YouTube) require explicit user consent before activation, and data is only transmitted upon user interaction (e.g., clicking 'Video aktivieren'). This is a privacy-friendly approach, but the policy does not clarify whether third-party cookies from these plugins are blocked by default.

Info

Comprehensive User Rights Documentation

User rights (access, rectification, erasure, restriction, portability, objection) are explicitly listed, and a dedicated form is provided for exercising these rights. This is a strong compliance signal.

Samenvatting voor de gebruiker

TU Graz processes personal data lawfully under GDPR, with strong transparency and user rights, but some third-party transfers and marketing practices require scrutiny.

Nalevingshouding

GDPR-compliant with minor gaps

EU-overdrachten

Mixed: Data mostly processed in EU/EEA, but some third-party tools (e.g., Meta, Google, LinkedIn, Reddit) may transfer data to the US under Data Privacy Framework or SCCs.

Gedetecteerde signalen

Specifieke gegevens en praktijken geïdentificeerd in de tekst

Verzamelde gegevens
IP addressMAC addressBrowser and OS identification dataDate and time of accessURL of accessed resourceReferrer URLUsernameCookie identifiers (e.g., _ga, _fbp, pk_id)Form input data (e.g., name, email, payment details)Behavioral data (for analytics and marketing)
Verwerkingsdoeleinden
System security and error detectionWebsite functionality (e.g., session management)Analytics (Matomo, Google Analytics)Marketing (Meta Pixel, Google Ads, LinkedIn Insight Tag, Reddit Pixel)Social media integration (X, YouTube, Facebook, Instagram, etc.)Event registration and payment processingContact form submissionsElectronic signatures (via A-Trust GmbH)Study Explorer tool usage
Delen met derden
Data shared with third-party marketing/analytics providers (Meta, Google, LinkedIn, Reddit) under user consent.Payment data shared with PAYONE GmbH for transaction processing.Electronic signature data shared with A-Trust GmbH.No data shared with third parties for functional cookies (e.g., Matomo is self-hosted).Social media plugins may transmit data to their respective providers upon user activation.
Internationale overdrachten
Data primarily processed in EU/EEA (e.g., Matomo self-hosted on TU Graz servers).Transfers to US-based providers (Meta, Google, LinkedIn, Reddit) rely on Data Privacy Framework or user consent.No explicit mention of SCCs or supplementary measures for non-DPF providers.
AI / Modeltraining
No evidence of user data being used for AI or model training.Analytics data is aggregated and anonymized (e.g., IP truncation in Matomo).

Bewijsfragmenten

Directe citaten uit het beleid ter ondersteuning van deze bevindingen

Wir verarbeiten Ihre Daten ausschließlich auf Grundlage der gesetzlichen Bestimmungen zum Datenschutz und zur Datensicherheit, insbesondere nach dem österreichischen Datenschutzgesetz („DSG“), der EU-Datenschutzgrundverordnung („DSGVO“), sowie nach dem Telekommunikationsgesetz („TKG 2021“).

Die Logdaten werden nicht mit anderen personenbezogenen Daten verknüpft.

Wir verwenden den Advanced Consent Mode. Ohne Ihre Zustimmung werden keine Cookies gesetzt.

Die Übermittlung dieser Daten in die USA erfolgt auf Grundlage eines Angemessenheitsbeschlusses (Art 45 DSGVO) an Unternehmen, die nach dem Data Privacy Framework zertifiziert sind.

Sie haben das Recht auf Auskunft, Berichtigung und Löschung Ihrer Daten. Zusätzlich haben Sie das Recht auf Einschränkung sowie das Recht auf Datenübertragbarkeit der von Ihnen bereitgestellten Daten.

Ontbreekt of onduidelijk

  • Explicit confirmation that functional cookies are strictly necessary (GDPR requirement for consent exemption).
  • Details on supplementary measures (e.g., encryption, pseudonymization) for international transfers to non-DPF-certified providers.
  • Clarification on whether MAC addresses in log data are hashed or otherwise pseudonymized.
  • Information on whether payment data is retained by TU Graz or only processed by PAYONE GmbH.
  • Explicit statement on whether Study Explorer's anonymous user codes are truly unlinkable to other data.

Vragen om te stellen

  • Are MAC addresses in log data hashed or pseudonymized to comply with data minimization principles?
  • What supplementary measures (e.g., SCCs, encryption) are in place for international transfers to non-DPF-certified third parties?
  • Are functional cookies strictly necessary for the service, and if so, how is this documented?
  • Is payment data retained by TU Graz after transaction processing, and if so, for how long?
  • Can Study Explorer's anonymous user codes be linked to other data, and if so, under what circumstances?
  • Are third-party cookies from social media plugins blocked by default until consent is given?
Deze analyse is door AI gegenereerd en is geen juridisch advies. Raadpleeg altijd een gekwalificeerde jurist voor compliancebeslissingen.

Deel deze analyse

Iedereen met deze link kan het resultaat hierboven bekijken.

Gebouwd door DentroChat

100% Europese AI-chat voor iedereen

Chat met AI, werk met bestanden, genereer afbeeldingen en zoek op het web. Gegevens blijven in Europa.

Infrastructuur gehost in de EUTekst, bestanden, afbeeldingen en webzoekenSnelle, Denk- en Creatieve modiPrivacy-first als standaardGeen gegevens verlaten Europa
Gratis proberen →

Andere geanalyseerde privacyverklaringen

Alles bekijken