Privacy Policy

1. Controller

The controller for data processing within the application tool is:

Frankfurt School Business Forum
Student initiative of the Frankfurt School of Finance & Management
Adickesallee 32–34
60322 Frankfurt am Main, Germany

Contact for data protection matters: Datenschutz@fs-businessforum.com

We are not legally required to appoint a data protection officer, as the conditions of Art. 37 GDPR / Sec. 38 BDSG (German Federal Data Protection Act) are not met. Please direct any enquiries to the address above.

2. Purpose and legal basis of processing

We process your data exclusively to carry out the application and selection procedure for participation in the Frankfurt School Business Forum. This includes recording and reviewing your application, communicating with you by email, scheduling introductory/selection interviews, and deciding on your admission.

The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request). Where you have expressly consented to a processing operation, the legal basis is Art. 6(1)(a) GDPR; you may withdraw a consent you have given at any time with effect for the future.

3. Which data we process

• Master data: first and last name, email address, matriculation number
• Application content: your answers in the application form and your CV (as an uploaded PDF file)
• Procedural data: your personal access code, processing and status information, internal notes, selected or confirmed interview slots
• technically necessary data for the secure provision of the service (e.g. the time of actions within the system)

Access to the application tool is only possible with a personal access code. Providing the data listed above is required to process your application; without it we cannot consider your application.

4. Recipients and processors

Within the initiative, only the members entrusted with the selection procedure have access to your data. To provide the service we use the following service providers as processors (Art. 28 GDPR):

• Microsoft (Azure): hosting of the application and database (PostgreSQL). Processing in data centres within the EU/EEA.
• Microsoft (Microsoft Graph / Exchange Online): sending the emails in the application procedure.
• Microsoft (Entra ID): sign-in of authorised administrators via single sign-on.
• Microsoft Azure OpenAI Service: AI-assisted pre-structuring/pre-evaluation of applications (see Section 6). Processing takes place in a data centre within the EU (Sweden). Application content is not used to train AI models.

A Data Protection Addendum with Microsoft serves as the data processing agreement. No transfer to third countries outside the EU/EEA takes place for the processing operations mentioned.

5. Storage period

We store your application data only for as long as is necessary for the selection procedure. After the procedure has concluded (rejection or withdrawal of the application), your application data including the uploaded CV is automatically deleted or anonymised after six months at the latest, unless statutory retention obligations apply. If you are admitted, the data required for your continued participation is processed further in the context of that participation.

6. AI-assisted pre-evaluation; no solely automated decision-making

To support the selection team, incoming applications are pre-structured or pre-evaluated with the help of an AI system (Azure OpenAI, see Section 4). This evaluation serves solely as an aid — it produces an orientation (e.g. a short summary and a High/Mid/Low indication) and is expressly not the basis for the decision.

A decision based solely on automated processing that produces legal effects within the meaning of Art. 22 GDPR does not take place. The decision on your application is always made by humans.

7. Your rights

You have the following rights vis-à-vis us:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR) and withdrawal of a consent given (Art. 7(3) GDPR)

To exercise your rights, a message to Datenschutz@fs-businessforum.com is sufficient.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your place of residence. The authority responsible for the controller is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.

9. Data security

Transmission is encrypted (TLS/HTTPS). Access to the application tool is restricted; administrative access takes place exclusively via secured sign-in (single sign-on).