Privacy Policy

Data Protection Policy

Thank you for visiting our website. Data protection and data security are our top priority. For this reason, and to fulfil our duty to inform you, you can find out below how we process personal data, i.e., information relating to an identified or identifiable natural person (the “Data Subject”). In the following, as a user of our services, you can find details about, among other things, the nature, extent and purpose of our data processing (data collection, storage, etc.), such as during your visit to our website. If you have any questions regarding the data protection policy of the Chemnitz University of Technology, or if you want to exercise your rights, you can contact our Data Protection Officer (see below for contact details).

For the sake of simplicity, the data protection statement does not list personal designations for all genders. Grammatically masculine personal designations apply equally to the masculine, feminine and neuter genders.

I. Name and contact details of the Data Controller

The Data Controller within the meaning of the EU General Data Protection Regulation (GDPR), other national data protection legislation of the Member States of the European Union and other data protection regulations is:

Chemnitz University of Technology,
represented by the Rector: Prof. Dr. Gerd Strohmeier
Strasse der Nationen 62
09111 Chemnitz, Germany
Email: rektor@tu-chemnitz.de
Phone: +49 371 531-10000
Fax: +49 371 531-10009
Website: https://www.tu-chemnitz.de/

II. Contact details of the Data Protection Officer

The Data Protection Officer of the Chemnitz University of Technology is:

Gernot Kirchner
Strasse der Nationen 62
09111 Chemnitz, Germany
Email: datenschutzbeauftragter@tu-chemnitz.de
Phone: +49 371 531-12030
Fax: +49 371 531-12039
Website: https://www.tu-chemnitz.de/rektorat/dsb/

III. Technical implementation of the website

The website is technically implemented internally by the University Computer Centre (URZ) at the Chemnitz University of Technology, which can be contacted at the following email address: webmaster@tu-chemnitz.de

The website is supported by the webmaster. The webmaster can be contacted using the contact information in the footer of the website (to the left of the date of update).

IV. General information on data processing

1. Scope of the processing of personal data

We process our users’ personal data – including yours – only to the extent necessary to provide a functioning website as well as our content and services (including event registrations, evaluations, public relations, etc.).

Among other things, this can involve stock data (e.g., names, addresses), contact details (such as email addresses, telephone numbers, residential addresses), content data (such as text entries, photographs, videos, comments), usage data (such as websites visited, interest in content, access times) and meta-/communication data (such as device information, IP addresses).

As a rule, our users’ personal data is processed only after their prior consent. An exception applies in such cases in which it is not possible to obtain prior consent for practical reasons and/or the processing of data is permitted by law

2. Legal basis for the processing of personal data

Where we obtain a Data Subject’s consent for processing personal data, the legal basis is provided by Art. 6(1) Sentence 1(a) GDPR.

When processing personal data required for the fulfilment of a contract with the Data Subject as a contracting party, the legal basis is provided by Art. 6(1) Sentence 1(b) GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures.

If the processing of personal data is required to comply with a legal obligation to which the Chemnitz University of Technology is subject, the legal basis is provided by Art. 6(1) Sentence 1(c) GDPR. According to this, personal data can be stored, for example, if required by the European or national legislators in EU legal regulations, laws or other regulations to which the Chemnitz University of Technology is subject.

In the event that the vital interests of the Data Subject or another natural person require a processing of personal data, the legal basis is provided by Art. 6(1) Sentence 1(d) GDPR.

Art. 6(1) Sentence 1(e) GDPR is invoked for data processing where the processing is necessary to perform a task in the public interest or in the exercise of public authority vested in the Data Controller.

Where processing is necessary to safeguard a legitimate interest of the Chemnitz University of Technology or a third party, and unless our aforementioned legitimate interest is outweighed by the interests and the fundamental rights and freedoms of the Data Subject, the legal basis for the processing is provided by Art. 6(1) Sentence 1(f) GDPR. According to Art. 6(1) Sentence 2 GDPR, Art. 6(1) Sentence 1(f) GDPR does not apply to data processing conducted by authorities in discharging their duties. However, according to the wording, this only encompasses tasks conferred by force of law, in particular in the context of executive and performance administration. Therefore, if authorities are acting on an equal footing – i.e., under private law – an application of Art. 6(1) Sentence 1(f) GDPR cannot be excluded. This particularly applies to the public-relations work of the Chemnitz University of Technology.

3. Storage duration (data deletion)

The personal data we process will be deleted or blocked as soon as the purpose for the data processing (including storage) ceases to exist, i.e., the processing is no longer required for the purpose, and deletion does not conflict with statutory retention obligations.

If data is processed due to a legal obligation within the meaning of Art. 6(1) Sentence 1(c) GDPR, for example, the personal data will be blocked or deleted on expiry of the retention period prescribed in the aforementioned standards. For example, it is obligatory to store trading books, inventories, status reports, booking vouchers, etc., in accordance with Section 147(1) AO [German Tax Code], Section 257(1) Nos. 1 and 4 and (4) HGB [German Commercial Code] for 10 years, and received and sent commercial letters in accordance with Section 257(1) Nos. 2 and 3 and (4) HGB for 6 years. In these cases, the data is not deleted, but its processing is merely restricted, i.e., the data is blocked and not used for any other purposes.

Your data will also not be deleted if there is a requirement for the further storage of data, such as for the conclusion or performance of a contract, and thus another legal basis for data processing exists, such as Art. 6(1) Sentence 1(b) GDPR.

4. Legal/contractual rules for the provision of personal data and the consequences of failing to do so

Please be aware that the provision of personal data is sometimes required by law or contractual arrangements. Thus, the conclusion of a contract generally requires the Data Subject to provide us with personal data that then has to be further processed by us. This is the case, for example, for the obligation to provide personal data in the context of the conclusion of a contract. The failure to provide personal data would otherwise have the consequence that the contract could not be concluded with the Data Subject.

Please do not hesitate to contact us – preferably via our above-mentioned Data Protection Officer – before providing personal data relating to the Data Subject within the above meaning. In each individual case, we will then clarify whether the provision of personal data is legally/contractually prescribed or required for the conclusion of the contract. We will also clarify whether there is an obligation to provide personal data, and will inform you of the consequences of failing to provide personal data in this case.

5. Disclosure of personal data to third parties

Personal data is processed by the following natural persons / legal entities: Chemnitz University of Technology. This also covers persons, such as employees of the Chemnitz University of Technology, who are authorised to process personal data under the direct responsibility of the Chemnitz University of Technology. However, disclosure of personal data to third parties – i.e., a natural person or legal entity, authority, agency or other body, with the exception of the Data Subject, Data Controller and, where applicable, Data Processor – will not generally occur, unless there is a legal obligation to do so, to which the Chemnitz University of Technology is subject (such as investigations by law-enforcement or state-security authorities).

V. Provision of the website and creation of log files

1. Description and scope of data processing

Whenever our website is accessed, our server systems automatically record data and information about the user’s computer system / the accessing computer, which also means your computer.

In principle, this relates to the following data:

• IP address of the accessing computer,
• host name of the queried web server,
• details of which document is requested,
• the encryption standard and algorithm used,
• any form inputs made*,
• any valid cookies*.

Depending on the configuration of your browser, the following data may also be transferred:

• browser name and version, as well as the user’s operating system,
• preferred language for content,
• possible data-compression methods,
• website from which the user’s system was forwarded to the requested document (so-called referrer URL or “Referer” in the HTTP standard).

The above data (apart from the fields marked with *) will also be temporarily – i.e., only transiently – stored in the log files of our systems. The log files also include the following information:

• any authenticated user (after logging into the Web Trust Center or via an application-specific procedure),
• date and time of access,
• query status, duration and amount of transferred data.

This data is not stored or merged with other personal data of the user.

2. Legal basis for data processing

The legal basis for the collection and temporary storage of data and log files is provided by Art. 6(1) Sentence 1(f) GDPR (safeguarding of a legitimate interest). In addition, the storage of data is also permitted by Art. 6(1) Sentence 1(c) GDPR in conjunction with Section 100 TKG [German Telecommunications Act].

3. Purpose of data processing

Temporary storage, for example of the IP address, by the system is necessary to ensure that it is possible to deliver our website to the user’s computer. In this case, the user’s IP address must be stored for the duration of the session.

Data is stored in log files to ensure that our website functions properly for you. In addition, we use the data to optimise the web pages and to maintain the security of our IT systems. Data is never evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing in accordance with Art. 6(1) Sentence 1(f) GDPR. In this respect, the interests or fundamental rights and freedoms of the Data Subject that require the protection of personal data do not prevail. The storage of data to prevent disruptions in the telecommunications system is also expressly permitted by Art. 6(1) Sentence 1(c) GDPR in conjunction with Section 100 TKG.

4. Security of Data Processing

In order to guarantee a risk-appropriate level of protection when providing the website, the Chemnitz University of Technology has taken suitable technical and organisational measures to protect your personal data, taking into consideration the state of technology, the cost of implementation and the type, scope, circumstances and purposes of the processing, as well as the various probabilities of occurrence and the severity of the risk for the rights and freedoms of natural persons.

For this purpose, our web servers enforce transport encryption via HTTP Strict Transport Security (HSTS). This is evident from the Hypertext Transfer Protocol Secure transmission protocol used (https:// in your address bar) as well as the lock icon in your browser bar, for example. TLS 1.2 is currently required as a minimum standard. By also supporting older encryption standards, we ensure that as large a group of users as possible can use our website. Encryption algorithms deemed insecure are and will be disabled.

5. Storage period

The data will be deleted as soon as it is no longer required in order to fulfil the purpose for which it was collected. Where data is collected to provide the website, this is the case when the respective session has ended. You end the session by completely closing your browser, i.e., not by merely closing the respective tab.

Where data is stored in log files, it will be deleted/anonymised after half a year. Further storage in a non-anonymous form, reduced to relevant data, only occurs for the fulfilment of investigation-related requests. In addition, further storage is possible, although in this case the IP addresses of the users are deleted or altered/anonymised so that they can no longer be assigned to the accessing client under any circumstances.

6. Objection and deletion options

Where personal data relating to you is processed on the basis of Art. 6(1) Sentence 1(e) (public interest or public authority) or (f) GDPR (legitimate interest), you have the right, in accordance with Art. 21 GDPR, to object at any time for reasons arising from your specific situation (see also under right of objection).

However, the collection of data in order to provide the site and the storage of the data in log files – as described above – is essential for the operation of the website of the Chemnitz University of Technology. Therefore, if you exercise your right of objection but still access our website regardless, there are compelling legitimate grounds for the processing of data that outweigh the interests, rights and freedoms of the Data Subject – yourself – and thus result in a restriction of the option to object so that, in accordance with Art. 21(1) Sentence 2 GDPR, your personal data can still be processed.

VI. Contacting us

1. Description and scope of data processing

If a user takes the opportunity to get in contact with us, including via the e-mail addresses provided, by phone or via social media, the personal data provided within the framework of the contact will be sent to us and, where necessary, saved. To this end, our website sometimes contains a contact form that can be used to contact us online.

The processing of the contact via a contact form requires the following entries in the input screen:

• your email address,
• your inquiry,
• any additional mandatory fields, such as confirmation of the Data Protection Policy.

At the time of sending the message, these mandatory details, as well as further details in the contact form and the details already listed under “Provision of the website and creation of log files” will be transferred and may be stored in a database, or sent by email to the originator of the contact form.

Prior to or in connection with the sending of the respective contact form, the Data Controller for the relevant contact form will provide you with further information on the processing of your personal data relating to your contact with us using the contact form.

Before the contact form is transmitted, we will obtain your consent to the processing of your data and refer you to the Data Protection Policy. In this context, no data will be disclosed to third parties. The data will be used exclusively for the processing of the conversation, i.e., particularly for processing your contact request. In addition, your personal data may be stored in a customer relationship management system (CRM system) or another database.

2. Legal basis for data processing

Where the user has given his or her consent, the legal basis for the processing of the data is provided by Art. 6(1) Sentence 1(a) GDPR. The legal basis for the processing of the data transferred in the course of another contact (including via email, telephone, etc.) is provided by Art. 6(1) Sentence 1(f) GDPR (legitimate interest). If the purpose of the contact is the conclusion of a contract, the legal basis for the processing is provided by Art. 6(1) Sentence 1(b) GDPR.

3. Purpose of data processing

The purpose of processing the personal data from the communication is solely to handle your request. As a rule, this also includes the necessary legitimate interest in the processing of the data within the meaning of Art. 6(1) Sentence 1(f) GDPR. Your personal data will not be disclosed to third parties without your consent.

The purpose of the other personal data processed during the transmission of the contact form is to prevent misuse of the contact form and to ensure the safety of our IT systems.

4. Storage period

The data will be deleted as soon as it is no longer required in order to fulfil the purpose for which it was collected. With regard to personal data from your communication with us, this is generally the case when the conversation with the user is ended. The conversation is deemed to have ended when it can be seen from the circumstances that the issue in question has been conclusively resolved. In addition to this, other processing purposes can justify longer processing, including the storage in a customer relationship management system (CRM system) for ongoing updates of contacts, storage due to relevance under auditing law, etc.

The data will also be deleted if you assert your right of deletion or withdraw your consent, provided that consent was given for the data processing. The foregoing applies only if there are no mandatory legal provisions that also justify data processing in the future. In such cases, the statutory deletion deadlines / retention periods apply.

Where additional personal data is stored in log files during the transmission of the contact form, it will be deleted/anonymised after half a year. Further storage in a non-anonymous form, reduced to relevant data, only occurs for the fulfilment of investigation-related requests. In addition, further storage is possible, although in this case the IP addresses of the users are deleted or altered/anonymised so that they can no longer be assigned to the accessing client under any circumstances.

5. Objection/revocation and deletion options

Any consent is given voluntarily, i.e., without coercion or pressure, and may be revoked at any time with effect for the future, as a whole or separately, and without undue disadvantages. To exercise your right of revocation, please send us an email to the email address of our Data Protection Officer, for example. The withdrawal of consent, and the consequent deletion of all personal data stored upon contacting us, do not affect the legality of processing undertaken on the basis of your consent prior to its withdrawal.

If data processing is carried out for the performance of a task carried out in the public interest or in the exercise of public authority vested in the Data Controller (Art. 6(1) Sentence 1(e) GDPR) or by virtue of a legitimate interest within the meaning of Art. 6(1) Sentence 1(f) GDPR, you have the right, in accordance with Art. 21 GDPR, to object at any time for reasons arising from your specific situation (see also under right of objection). In this case, the Chemnitz University of Technology will no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms as Data Subject, or the processing serves to assert, exercise or defend legal claims.

In the case of a revocation or objection, the conversation with you cannot be continued, since, as a rule, all personal data stored in the course of contacting us will be deleted.

VII. Use of cookies

1. Description and scope of data processing

Our website uses cookies where necessary. Cookies consist of textual information that is stored in your browser so that user-related information can also be processed as desired at a later point in time. If a user accesses a given website, a cookie can be sent with it by the web server. In addition to information to be stored, this cookie also contains the field of validity (web server and path specification) and the validity period. When accessing addresses in the field of validity, the browser sends this information to the corresponding web server. GDPR treats any cookie information as personal data without further distinction, see Recital 30 GDPR.

However, to further understand how cookies work, a distinction has to be made between different types of cookie. With regard to the “lifespan” of cookies, there is a distinction between so-called “session cookies” (temporary cookies, transient cookies) and so-called “permanent cookies”, sometimes also referred to as “persistent cookies”. The former are automatically deleted when the browser is closed; the latter remain on the user’s terminal for the set period of time. In addition to this, a distinction is made between so-called “first-party cookies” and so-called “third-party cookies” based on which cookies belong to a certain server. The former are set by the web server from which the visited page is retrieved. The latter, on the other hand, are set by another web server, from which the content on the page visited is used or incorporated, and are not relevant for the use of our website.

2. Legal basis for data processing

The legal basis for the processing of personal data using cookies – especially permanent cookies, no matter whether first-party or third-party cookies – is provided by Art. 6(1) Sentence 1(a) GDPR (consent of the data subject).

When accessing our website, users are informed about the use of cookies for the purposes of analysis by means of a pop-up (a so-called “cookie overlay”) and are referred to this Data Protection Policy. At the same time, they are asked to give their consent to the use of cookies in the scope described above in the form of a clearly affirmative action, by which the Data Subject makes it clear that he/she consents to the processing of personal data relating to him/her (opt-in). The consent is voluntary and may be revoked at any time.

The legal basis for the processing of personal data by using so-called “first-party cookies” designed as technically essential session cookies, on the other hand, is provided by Art. 6(1) Sentence 1(f) GDPR (legitimate interests). As operators of this website, we have a legitimate interest in the storage of cookies for the technically error- and problem-free provision of our services. This applies, for example, in order to be able to provide you with functions you have selected (such as the language setting, registration status, etc.).

3. Purpose of data processing

Technically essential session cookies are used to simplify the use of web pages for the user. Some functions of our website are not available without the use of cookies. These functions require the browser to be recognised even after you have switched to a different page. The user data collected by technically essential cookies is not used to create user profiles, however, even though they could make the behaviour of the Data Subject traceable. Therefore, if you have objected to the use of these cookies, your use of our website may be limited in the future, for example, or may only be fully available after logging in again.

4. Duration of storage, objection/revocation and deletion options

Cookies are saved to the user’s computer and are transferred to us from there. You, as the user, therefore have complete control over the use and storage of cookies. The storage duration of cookies, i.e., the time before they are automatically deleted, depends on the respective settings of the cookies. You can find more detailed information on storage periods in the following table.

However, if cookies for our website are deactivated or later deleted due to the lack of or a revoked consent, or due to the browser settings, it may no longer be possible to use all of the features of the website to their full extent, with the result that the functionality of our website may be limited.

a) Revocation option

Consent to the use of cookies is voluntary and may be revoked at any time. In order to exercise your right of revocation, please send us an email to this effect, or delete the cookies by yourself in your browser or via the cookie overview at:

Cookie settings

You can find a helpful guide on how to delete cookies in different browsers from the NRW e. V. customer centre (https://www.verbraucherzentrale.de/wissen/digitale-welt/datenschutz/cookies-im-browser-einstellen-11996). The withdrawal of consent, and the consequent deletion of cookies already stored, do not affect the legality of processing undertaken on the basis of your consent prior to its withdrawal.

b) Objection option

Where we use cookies on the basis of Art. 6(1) Sentence 1(e) (public interest or in the exercise of public authority) or (f) GDPR (legitimate interests), you have the right to file an objection at any time, for reasons arising from your specific situation, to the processing of personal data relating to you; this also applies to profiling based on these provisions. In order to exercise your objection, please send an email to this effect to the webmaster of the respective website (contact details in the footer of the website – to the left of the date of update), or alternatively to the Data Protection Officer of the Chemnitz University of Technology, or delete the cookies in your browser by yourself. You can find a helpful guide on how to delete cookies in different browsers from the NRW e. V. customer centre (https://www.verbraucherzentrale.de/wissen/digitale-welt/datenschutz/cookies-im-browser-einstellen-11996). The Data Controller will then no longer process the personal data relating to you, unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing is used to assert, exercise or defend legal claims.

Where personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data relating to you for such marketing; this includes profiling, insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, personal data relating to you shall no longer be processed for such purposes.

In the context of the use of information society services – and notwithstanding Directive 2002/58/EC – you may exercise your right to object by automated means using technical specifications. You can find more information about this immediately below under “General deletion option”.

c) General deletion option

You can also monitor and regulate the storage of cookies in your browser, so that you can define the automatic deletion of all cookies at the end of a session (on closing the browser) or the general blocking of cookies of any kind, for example. By sending the “do-not-track” flag (“no-follow” request), no profile data will be collected on pages that implement local tracking. However, these settings are basically only browser/device-specific, so you will have to set them for all your devices. Please also note that blocking all cookies can result in the partial loss of the full functional scope of our website.

In addition, various service providers offer the option of lodging a general objection to the use of cookies for marketing purposes on the Internet: http://www.aboutads.info/choices/ (USA) or https://www.youronlinechoices.com/ (EU). We would like to explicitly point out that the Chemnitz University of Technology itself does not use cookies for user-based online advertising, but it cannot be ruled out for the external websites listed below.

5. Use of individual cookies

In particular, the following are some of the cookies used to access our website:

VIII. Use of external websites

1. Description and extent of data processing

a) Social Media

Communication is changing, and with it the communication routes and options for reaching target groups. This is why, for a few years now, the Chemnitz University of Technology has set itself the task of using social media to reach and inform internal and external target groups, such as students, employees, family members, alumni and alumnae, prospective students and persons interested in science, research, campus and university development.

b) External data-processing procedures

When you visit our external web/social-media sites, various personal data will be processed by us, but also primarily by external providers. You can find more detailed information on this in the data protection provisions of the respective providers:

Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland): https://twitter.com/de/privacy;

c) Analysis purposes

We use the web analysis service WordPress Statistics for analysis purposes. WordPress Statistics doesn’t store any cookies on your visitors browsers.

You can the option of ‘anonymizeIP’ function (so-called IP masking): Due to the activation of IP anonymization on this website, your IP address will be shortened by WP Statistics within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address will only be transmitted to a WordPress server and stores locally and doesn’t share them with third-parties.

We collect this information from three sources: if and when you provide information to us, automatically through operating our Services, and from outside sources. Let’s go over the information that we collect.

• the pages you have visited, your “click path”
• Your user behavior (e.g. clicks, length of stay, bounce rates)
• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser, Search Engine, OS (e.g. language setting, screen resolution)
• Your Internet Service Provider
• The referrer URL (via which website / via which advertising material you came to this website)

More information about the GDPR Compliance of WP Statistics you can find here: https://wp-statistics.com/2018/08/16/wp-statistics-gdpr/ and their Privacy and Policy: https://wp-statistics.com/privacy-policy

2. Legal basis for data processing

a) Social Media

Press and public-relations work at the Chemnitz University of Technology includes precisely reaching as many target groups as possible, so that the use of different communication routes and options and, in particular, also of newer communication channels (social media) is indispensable. This is also precisely where our legitimate interests in being able to process your personal data in this context lie, Art. 6(1) Sentence 1(f) GDPR.

b) Security of our IT systems

As already described, the further integration of the external hCaptcha service guarantees the security of our IT systems. IMI acts as a “data processor” acting on behalf of its customers as defined under the GDPR, and a “service provider” for the purposes of the California Consumer Privacy Act (CCPA). For more information about hCaptcha and IMI’s privacy policy and terms of use, please visit the following links: https://hcaptcha.com/privacy/ and https://hcaptcha.com/terms.

c) Declaration of consent

If you have previously had to declare your consent to us or one of the above-mentioned external providers, such as by way of prior consent for web tracking by confirming a pop-up or upon being forwarded to our external search providers or map services, the data will be processed on the basis of Art. 6(1) Sentence 1(a) GDPR, particularly because of your consent.

3. Purpose of data processing

a) Social Media

The purpose of processing personal data from communication via external web/social-media sites is solely to process your contact to the Chemnitz University of Technology. As a rule, this also constitutes a legitimate interest, regardless of any consent granted, in the processing of the data within the meaning of Art. 6(1) Sentence 1(f) GDPR. Normally, we will not contact you proactively via social media. Exceptions can be queries from us about comments under posts or replies to these comments, or requests for feedback.

In addition to this, your personal data will generally be used by the above-mentioned external providers for market-research purposes and promotional offers. The above-mentioned external providers usually process personal data by observing your behaviour as a user of the sites. In other words, in many cases, your Internet activities as a user are traced in order to subsequently process the data obtained using a wide range of techniques in such a way that a user profile can be created for you. This, in turn, generally forms the basis for future decisions affecting you or is used as a basis for analysing or forecasting your personal preferences, behaviour or habits, cf. Recital 24 GDPR. The results can then be used – including by the Chemnitz University of Technology – to present you with personalised online advertisements, for example, depending on the personal interests identified or predicted for you. In addition to this, it is not possible to rule out the storage and processing by the above-mentioned external providers of further details of the devices used, especially if you have an account with the respective (social-media) platform and are logged in as a registered user. You can find details for this from the above links to the data protection provisions of the external providers.

b) Joint responsibility

The Data Controller for data processing in this respect within the meaning of GDPR and other national data protection laws of the Member States of the European Union, as well as other data protection regulations, is therefore primarily the external service provider in this case. You can find detailed information about the purposes of the data processing conducted by the above-mentioned external providers via the above links to the data protection policies of the external providers.

4. Recipients / categories of recipients

In principle, personal data is processed in connection with the use of external websites (including social media, search services, etc.) only by the following natural persons / legal entities: the Chemnitz University of Technology, particularly the employees of the University Computer Centre, as well as the press office and cross-media editing team. Depending on the external website you select/use, your personal data will also be processed by the above-mentioned external providers.

Your personal data will not be disclosed by us to third parties not mentioned here, nor will it be transferred to another EU country or to a third country or international organisation, unless otherwise specified below.

5. Transfer to a third country

Personal data may only be transferred to a third country or an international organisation if the European Commission, for example, has decided that the third country, a region or one or more specific sectors in that third country or the international organisation concerned offers an adequate level of protection. In this case, data transmission of this type requires no special permission. With regard to the companies mentioned above, an adequate level of protection is currently guaranteed on the basis of the US–EU Privacy Shield. According to this, it is initially presumed that such a level of protection is afforded by all companies that have been certified according to the requirements of the US–EU Privacy Shield:

Twitter International Company (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland): https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active#participation.

The prerequisites of Art. 45 GDPR (data transmission on the basis of an adequacy decision) are therefore met for the above-mentioned transmissions to third countries. The transfer of personal data to the above external providers and thus to third countries is therefore permissible, since the Data Controller and the Data Processor comply with the conditions set out in Art. 44 et seq. GDPR and also with the other provisions of GDPR. This ensures that the level of protection afforded by GDPR for natural persons is not undermined.

Purely as a precaution, we would like to point out, however, that the transfer of personal data to a third country or international organisation on the basis of the US–EU Privacy Shield is currently sometimes viewed critically. In accordance with Art. 49(1) Sentence 1(a) GDPR, data transmission is nevertheless permissible – even without certification according to the requirements of the US–EU Privacy Shields – if you have previously expressly consented to the proposed data transmission after you have been informed about the potential risks of such data transfers in the absence of an adequacy decision and without appropriate safeguards. These risks exist especially if the third country, a region or one or more specific sectors in the third country or the international organisation concerned does not provide an adequate level of data protection. This may have adverse effects for you especially in the following points:

• the rule of law; the respect for human rights and fundamental freedoms; the relevant legislation applicable in the country or international organisation concerned, of both general and sectoral nature – also with regard to public security, defence, national security and criminal law, as well as the access of authorities to personal data – as well as the application of this legislation, data protection regulations, professional rules and safety regulations, including the provisions for the further transfer of personal data to another third country or another international organisation; the jurisprudence as well as the effective and enforceable rights of the Data Subject and effective administrative and judicial remedies for the Data Subjects whose personal data is being transferred;
• the existence and the effective functioning of one or more independent supervisory authorities in the third country concerned or by which an international organisation is governed and that are responsible for compliance with and enforcement of data protection regulations, including appropriate enforcement powers, for supporting and advising Data Subjects in the exercise of their rights and for cooperation with the supervisory authorities of the Member States; and
• the international obligations undertaken by the third country or international organisation concerned or other obligations arising from legally binding agreements or instruments, as well as from the participation of the third country or international organisation in multilateral or regional systems, particularly in relation to the protection of personal data.

6. Storage period

The personal data we process in this context will be deleted as soon as it is no longer required in order to fulfil the above-mentioned purposes for which it was collected. You can find more detailed information on data erasure by the above-mentioned external providers via the above links to the data protection policies of the external providers.

7. Objection/revocation and deletion options

Any consent given in connection with the use of external websites is voluntary, i.e., without coercion or pressure, is therefore of no relevance to your participation in CUT websites, and may be revoked at any time with effect for the future, as a whole or separately, and without undue disadvantages. To exercise your right of revocation with regard to the social-media channels used by the Chemnitz University of Technology, please send us an email to info@dednaed.eu or use the cookie overview at:

Cookie settings

However, please note that withdrawing consent does not affect the legality of processing undertaken on the basis of the consent prior to its withdrawal.

If your personal data is processed on the basis of Art. 6(1) Sentence 1(e) (public interest or in the exercise of public authority) or (f) GDPR (legitimate interests), you have the right to file an objection at any time, for reasons arising from your specific situation, to the processing of personal data relating to you; this also applies to profiling based on these provisions. To exercise your objection in relation to the external providers used, please follow the opt-out options linked below:

• Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland): https://twitter.com/de/privacy .
• hCaptcha (Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110): https://hcaptcha.com/privacy/.

In this context, please also note the information above on the objection/revocation and deletion options regarding the use of cookies on our website or on the websites of the external services used.

8. Integration and representation of external content on our website

Our web pages sometimes integrate and display external content (such as Twitter Tweets) from the aforementioned third-party providers (Twitter). The protection of your data is also important to us in this context. Therefore, these services are generally integrated via the state-of-the-art data protection-compliant solution from the c’t Shariff project (https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html) or via similar technical procedures.

In this way, we ensure no type of (personal) data is transferred to the external providers when you access our website. Otherwise, the integration of this type of external content would lead to a connection being established to the external server directly on visiting the website and thus also to the transmission of your (personal) data to this external server, including your IP address, the browser type you use and your operating system, the websites from which your system is forwarded to the external embedded web pages, the time of visit, etc., so that your activity on the Internet can be logged by the external provider and tracked for statistical and marketing purposes. This connection to external servers, which is automatic and established in the background without any action on your part, is initially prevented by the above solutions. Thus you can decide for yourself, by giving your consent in accordance with Art. 6(1) Sentence 1(a) GDPR, whether to transfer data to the external servers, which may be located in non-European countries (e.g. the USA, see above). Once consent has been given – if this is what you require and expressly select – it will be saved in a technically essential cookie for a period of seven days.

You will only transfer (personal) data, including your IP address, by actively, independently and voluntarily, i.e., without coercion or pressure, clicking on the (“Shariff”) button to establish the connection to the external server. For this reason, we have no influence on the data collected and data processing operations at the external service provider, so that we can also provide no information about the purpose and scope of data processing or storage duration / deletion. Also, at this point, we would like to first of all refer you to the above-mentioned data protection policies and the objection/revocation and deletion options, etc., of the external providers used by us

We use so-called “Twitter social plug-ins” for the integration of Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Irland). You can find more detailed information about the display of such plug-ins at the following link: https://developer.twitter.com/en/docs/twitter-for-websites/embedded-tweets/overview. The plug-ins are identified by the Twitter logo. However, as described above, a connection with the Twitter server is not established directly, but requires your consent in accordance with Art. 6(1) Sentence 1(a) GDPR. Only then will your information / personal data be transmitted to Twitter due to the integration of the plug-in or any interaction you have with the plug-in (such as by clicking to like a post), further processed/stored there and – if you are a registered and logged-in Twitter user – also connected with your Twitter account. If you give your consent in the above-mentioned sense, even if you are not a registered Twitter user, personal data will nevertheless be transferred to Twitter and your IP address, among other things will be processed/saved. You can find more detailed information on this in the Twitter data protection provisions: https://twitter.com/privacy?lang=en.

As a registered Twitter user, to avoid the data transmission and linking with your Twitter account described above, please log out and delete your cookies. You can find more information on this in the statements above on the use of cookies, as well as on the existing objection/revocation and deletion options.

IX. Rights of the Data Subject

If your personal data is processed, you are a Data Subject within the meaning of GDPR, so you are entitled to the following rights vis-à-vis the Chemnitz University of Technology (Data Controllers). To assert your rights vis-à-vis the Chemnitz University of Technology or in case of further questions regarding data protection, you can contact our Data Protection Officer at any time.

All notices and actions in accordance with Art. 15–22 (e.g. information, correction, deletion, processing restriction, notification, data portability, right of objection) and Art. 34 GDPR (right of notification for data protection violations) are made available free of charge. However, for manifestly unfounded or – especially in the case of frequent repetition – excessive applications from one Data Subject, the Data Controller can either demand a reasonable fee, taking into account the administrative costs for the briefing or the notification or the implementation of the action requested, or it can refuse to act on the basis of the application. In such cases, however, the Chemnitz University of Technology must provide proof of the manifestly unfounded or excessive character of the application.

In addition, please note that there are restrictions on the rights of the Data Subject in accordance with Sections 7–10 SächsDSDG (Saxony Data Protection Implementation Act). Among other things, this affects the right to deletion and right to information, as well as the duty to provide information vis-à-vis Data Subjects.

1. Right to information

You can request confirmation from the Data Controller as to whether it is processing personal data relating to you. If such data is being processed, you can request the following information from the Data Controller:

• the processing purposes;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data has been disclosed or is yet to be disclosed, particularly for recipients in third countries or in international organisations;
• if possible, the planned period for which personal data is stored, or, if this is not possible, the criteria for determining that period;
• the existence of a right to rectification or erasure of the personal data relating to you or to restriction of processing by the Data Controller and the right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• if the personal data is not collected from you, i.e., the Data Subject, all available information on the source of the data;
• the existence of automatic decision-making including profiling in accordance with Art. 22(1) and (4) GDPR and – in these cases at least – meaningful information about the logic involved as well as the extent and the envisaged consequences for the Data Subject of processing of this nature.

However, as a Data Controller, the Chemnitz University of Technology naturally processes a large amount of information about Data Subjects, so that you as the Data Subject are required, when asserting your right to receive information, to specify the information or processing procedures to which your request for information relates, before information is issued to you (cf. Sentence 7, Recital 63 GDPR).

If personal data is transferred to a third country or an international organisation, as a Data Subject, you also have the right to be informed about the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to demand that the Data Controller immediately rectify inaccurate personal data relating to you. Taking into account the purposes of processing, as a Data Subject, you also have the right to demand the completion of incomplete personal data, including by means of a supplementary declaration.

3. Right to erasure

a) Right to deletion, Art. 17 GDPR (“Right to be forgotten”)

You can request that the Data Controller delete personal data relating to you without delay. The Data Controller is also obliged to delete this data without delay if one of the following reasons applies:

• The personal data relating to you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw the consent on which processing was based in accordance with Art. 6(1) Sentence 1(a) GDPR or Art. 9(2)(a) GDPR, and no further legal basis exists for processing.
• In accordance with Art. 21(1) GDPR, you object to processing and there are no overriding legitimate reasons for such processing, or you object to processing in accordance with Art. 21(2) GDPR.
• The personal data relating to you has been processed unlawfully.
• The personal data relating to you has to be erased in order to comply with a legal obligation under EU law or the law of a Member State to which the Data Controller is subject.
• The personal data relating to you has been collected in relation to the offer of information society services in accordance with Art. 8(1) GDPR.

b) Information to third parties

Where the Data Controller has made public personal data relating to you and is obliged to erase such data in accordance with Art. 17(1) GDPR, the Data Controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform Data Controllers who are processing the personal data that you as the Data Subject have requested that they – the other Data Controllers – erase all links to, or copies or replications of, such personal data.

c) Exceptions to the right to erasure

The right to erasure does not apply to the extent that processing is necessary

• for the exercise of the right to freedom of expression and information;
• for the fulfilment of a legal obligation that requires processing by Union law or that of the Member States to which the Data Controller is subject, or for the performance of a task in the public interest or in the exercise of public authority vested in the Data Controller;
• for reasons of the public interest in the area of public health in accordance with Art. 9(2)(h) and (i) GDPR and Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes in accordance with Art. 89(1) GDPR, insofar as the aforementioned “right to be forgotten” is likely to render impossible or severely impair the achievement of the objectives of that processing, or
• to assert, exercise or defend legal claims.

4. Right to restriction of processing

Under the following conditions, you can request the restriction of processing of personal data relating to you:

• if you contest the accuracy of the personal data, for a period that enables the Data Controller to verify the accuracy of the personal data;
• if the processing is unlawful and you decline the erasure of the personal data and instead request that their use be restricted;
• if the Data Controller no longer needs the personal data for the purposes of processing, but it is required by you to assert, exercise or defend legal claims, or
• if you have filed an objection against processing pursuant to Art. 21(1) GDPR, pending the verification of whether the legitimate interests of the Data Controller override your interests.

If the processing of personal data relating to you within the meaning above has been restricted, then such data may only be processed – with the exception of storage – with your consent or to assert, exercise or defend legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.

If processing has been restricted in accordance with the conditions above, you will be informed by the Data Controller before the restriction is lifted.

5. Right to information

The Data Controller is obliged to inform you of all recipients to whom your personal data has been disclosed, of any rectification or deletion of personal data or limitation of processing in accordance with Art. 16, 17(1) and Art. 18, unless this proves impossible or would involve a disproportionate effort. The Data Controller shall inform the Data Subject of these recipients if the Data Subject so requests.

6. Right to data portability

You have the right to receive the personal data relating to you, which you have provided to the Data Controller, in a structured, commonly used and machine readable format (e.g., PDF, CSV). You also have the right to transmit such data to another Data Controller without hindrance from the Data Controller to whom you have provided your personal data, insofar as

• the processing is based on consent in accordance with Art. 6(1) Sentence 1(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1) Sentence 1(b) GDPR, and
• the processing is carried out by automated means.

In exercising this right, you particularly have the right to cause the personal data relating to you to be transmitted directly from one Data Controller to another Data Controller, where this is technically feasible. The rights and freedoms of other persons may not be adversely affected by this.

Art. 17 GDPR (“Right to be forgotten”) shall remain unaffected by the right to data portability. It does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of public authority vested in the Data Controller.

7. Right to object

You have the right to object at any time, for reasons arising from your own particular situation, to the processing of personal data relating to you performed on the basis of Art. 6(1) Sentence 1(e) (public interest or in the exercise of public authority) or (f) GDPR (legitimate interests); this also applies to profiling based on these provisions.

The Data Controller will no longer process the personal data relating to you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless processing is necessary to assert, exercise or defend legal claims.

Where personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data relating to you for such marketing; this includes profiling, insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, personal data relating to you shall no longer be processed for such purposes.

In the context of the use of information society services – and notwithstanding Directive 2002/58/EC – you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw your consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The revocation of consent is just as simple as the granting of consent, in particular with regard to formal requirements, so that in principle, an informal notice by email is sufficient. Withdrawing your consent does not affect the legality of processing undertaken on the basis of your consent prior to its withdrawal.

9. Automated decision making in individual cases, including profiling

You have the right to not be subject to a decision based solely on automated processing – including profiling – which produces legal effects for you or significantly affects you in a similar manner. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the Data Controller;
• is permissible on the basis of European Union or Member State law to which the Data Controller is subject, and such regulations include appropriate measures to guarantee your rights and freedoms and your legitimate interests, or
• is made with your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR apply, and suitable measures to safeguard your rights, freedoms and legitimate interests are in place.

In the cases referred to previously in (1) and (3) above, the Data Controller shall take appropriate measures to safeguard your rights, freedoms and legitimate interests, which include as a minimum the right to obtain human intervention on the part of the Data Controller, to express your point of view and to challenge the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or legal remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you live or work or in which the alleged infringement took place, if you are of the opinion that the processing of personal data relating to you infringes legal provisions for data protection.

In accordance with Art. 51 GDPR in conjunction with Sections 14 et seq. SächsDSDG, the competent supervisory authority in the Free State of Saxony is:

Data Protection Officer for Saxony
Andreas Schurig
Devrientstraße 5
01067 Dresden, Germany
Email: saechsdsb@slt.sachsen.de
Phone: +49 351 85471-101
Fax: +49 351 85471-109
Website: https://www.saechsdsb.de/

The supervisory authority to which the complaint was submitted will inform the complainant about the progress and the outcome of the complaint, including the possibility of a legal remedy pursuant to Art. 78 GDPR.

X. Up-to-dateness/modification of this Data Protection Policy

This Data Protection Policy is currently in force and was last amended in July 2021.

It may become necessary to change or update this Data Protection Policy due to the further development of our website and products or due to legislative or administrative changes. A separate consent/permission for this on your part is generally not required by law.

You can view, print and save the current Data Protection Policy at any time on the website at https://dednaed.eu/privacy-policy/.