Privacy Policy for Infinity X — Technology platforms — Office of the Chancellor

For what purpose will personal data be processed?

Personal data is processed exclusively for the provision and use of the Core Facility Management System Infinity X in the following scenarios:

• Management of equipment and services in the research context
• Management of budgets for the use of infrastructure provided by the TUD Dresden University of Technology
• Provision of data to prepare the billing of services used
• Creation of anonymized reports on the use of the infrastructure provided

This offer is a contractually bound service of a commercial software provider (IdeaElan)

Who is responsible for data processing and to whom can data subjects turn?

Responsible in the sense of Art. 4 No. 7 GDPR is TUD Dresden University of Technology.

Responsible Department

TUD Dresden University of Technology
Office of the Chancellor
Technology platforms

Tel.: +49 (0)351 463-39423
Email: technologieplattformen@tu-dresden.de

Data Protection Officer

Data Protection Officer of the TUD Dresden University of Technology
Mr Jens Syckor
01062 Dresden

Tel.: +49 (0)351 463-32839
Email: informationssicherheit@tu-dresden.de

Which personal data will be processed?

Depending on the type and scope of use of the Research Corefacility Management Software, the following categories of personal data may be processed:

• Account information (surname, first name, work email address)
• Contacts and calendar integrations
• Assignment of the person to booking data
• Contact person (person responsible for invoicing or person in charge)
• optional: photo

What is the legal basis for processing personal data?

The legal basis for data processing for the purposes stated here is § 11 of the Saxon Data Protection Implementation Act (SächsDSDG).

In individual cases, e.g. for the photo, processing takes place on a voluntary basis, i.e. on the basis of Article 6(1)(a) GDPR (consent).

How long is personal data stored?

The “Infinity X” access account will be blocked after 12 months of inactivity and reactivated on request.

The photo is stored until revoked and can be deleted by the data subject at any time.
Taking into account the purposes of the software, personal data and associated services of users remain anonymized even after leaving the TUD Dresden University of Technology, or are retained in the software for bookings on a long-term or permanent basis.
The deletion of personal data and associated services takes place after specified deadlines in accordance with the data protection and logging concept set out in the security concept. These are only deleted after the specified periods have expired, as the data processing departments no longer require knowledge of them.

Will personal data be transferred to third parties?

The TUD Dresden University of Technology uses a processor to provide the IT service:

Idea Elan LLC
13800 Coppermine Rd.
Herndon VA 20171
United States of America

What are the basic rights of data subjects?

• Right to voluntary nature and revocation (Art. 7 (3) GDPR)

  If the use of the services is based on consent, this consent can be revoked at any time in accordance with Art. 7 (3) GDPR with the consequence that the personal data of the person concerned will not be further processed. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

• Right to information (Art. 15 GDPR)

  Data subjects have the right to obtain at any time information on the data processed concerning them and on the possible recipients of such data. They are entitled to receive a reply within a period of one month after submitting the request.

• Right of correction, deletion and restriction (Art. 16 - 18 GDPR)

  The persons concerned may at any time request TUD Dresden University of Technology to correct or delete their personal data or to restrict the processing of such data.

• Right to data transferability (Art. 20 GDPR)

  The persons concerned can demand that TUD Dresden University of Technology transfers their personal data to them in a machine-readable format. Alternatively, they may request that the personal data provided by you be transferred directly to another responsible party, as far as this is possible.

• Right of appeal (Art. 77 GDPR)

  Data subjects can contact the Data Protection Officer of TUD Dresden University of Technology at any time and, in the case of a complaint under Art. 77 GDPR, a supervisory authority for data protection. The responsible supervisory authority for TUD Dresden University of Technology is:

  Sächsische Datenschutz- und Transparenzbeauftragte
  Frau Dr. Juliane Hundert
  Maternistraße 17
  01067 Dresden
  Email: post@sdtb.sachsen.de
  Telephone: +49 (0)351 85471-101
  www.datenschutz.sachsen.de

To exercise these rights, notification in text form (letter or email) to the controller is sufficient.