Privacy Policy for the use of a central groupware service — Center for Information Services and High Performance Computing (ZIH) — CIDS

For what purpose will personal data be processed?

Personal data is processed for the purpose of operating a groupware service for members, relatives, and, as needed, guests of TUD Dresden University of Technology as a tool for teaching, research, and administration. This includes the use of licensed products and services, the provision of updates, ensuring the security of processing in accordance with Art. 32 GDPR, and state-of-the-art information security. Further information on how processing security works can be found at:
https://faq.tickets.tu-dresden.de/v/ItemID=1302

Who is responsible for data processing and to whom can data subjects turn?

Responsible in the sense of Art. 4 No. 7 GDPR is TUD Dresden University of Technology.

Responsible Department

Technische Universität Dresden
CIDS - Center for Interdisciplinary Digital Sciences
01062 Dresden

Tel.: +49 (0)351 463-40000
Email: servicedesk@tu-dresden.de

Data Protection Officer

Data Protection Officer of the TUD Dresden University of Technology
Mr Jens Syckor
01062 Dresden

Tel.: +49 (0)351 463-32839
Email: informationssicherheit@tu-dresden.de

Which personal data will be processed?

1. Account data (e.g. ZIH login)
2. Log, traffic, and control data (e.g. IP addresses)
3. Groupware and communication content (emails with attachments, appointments, contacts, contact information and address book, tasks, notes)

What is the legal basis for processing personal data?

The legal basis for the processing of personal data is § 11 (1) of the Saxon Data Protection Implementation Act (SächsDSDG) for employees, Art. 6 (1) lit. e GDPR in conjunction with § 3 (1) SächsDSDG for students and guests, and Art. 6 (1) (e) GDPR in conjunction with § 3 (1) SächsDSDG.

The legal basis for data processing for the security of processing is Art. 6 (1) (f) GDPR in conjunction with Recital 49 GDPR.

How long is personal data stored?

The personal data referred to in 1 and 3 will be deleted in accordance with IT regulations no later than 15 months after the person leaves the TUD Dresden University of Technology.

The personal data referred to in 2 will be deleted after 3 months.

Processing for the security of processing at the service provider is carried out immediately and automatically. Personal data is not stored. If an email is rejected, the sender will be informed.

Will personal data be transferred to third parties?

TU Dresden uses the following service provider to ensure the security of data processing:

DFN-Verein
DFN-MailSupport
Alexanderplatz 1
10178 Berlin

What are the basic rights of data subjects?

• Right to information (Art. 15 GDPR)

  Data subjects have the right to obtain at any time information on the data processed concerning them and on the possible recipients of such data. They are entitled to receive a reply within a period of one month after submitting the request.

• Right of correction, deletion and restriction (Art. 16 - 18 GDPR)

  The persons concerned may at any time request TUD Dresden University of Technology to correct or delete their personal data or to restrict the processing of such data.

• Right to data transferability (Art. 20 GDPR)

  The persons concerned can demand that TUD Dresden University of Technology transfers their personal data to them in a machine-readable format. Alternatively, they may request that the personal data provided by you be transferred directly to another responsible party, as far as this is possible.

• Information on the right of objection (Art. 21 para. 1 GDPR)

  You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 subpara. 1 lit. e or f GDPR. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

• Right of appeal (Art. 77 GDPR)

  Data subjects can contact the Data Protection Officer of TUD Dresden University of Technology at any time and, in the case of a complaint under Art. 77 GDPR, a supervisory authority for data protection. The responsible supervisory authority for TUD Dresden University of Technology is:

  Sächsische Datenschutz- und Transparenzbeauftragte
  Frau Dr. Juliane Hundert
  Maternistraße 17
  01067 Dresden
  Email: post@sdtb.sachsen.de
  Telephone: +49 (0)351 85471-101
  www.datenschutz.sachsen.de

To exercise these rights, notification in text form (letter or email) to the controller is sufficient.