Privacy Policy for Intranet — Projektleitung Intranet

For what purpose will personal data be processed?

The Intranet is the central internal communication and information platform of TUD Dresden University of Technology. It is used for the exchange of information and news as well as for cooperation between members of TUD Dresden University of Technology. With the help of personal data, the following intranet-specific functions in particular are guaranteed:

1. Authentication of TUD Dresden University of Technology members when accessing the intranet with ZIH login via associated IT services of TUD Dresden University of Technology
2. Collection and evaluation of log data
3. Assignment of user authorizations within the assigned areas
4. Profile management and individualization of notifications by the user
5. Employee search
6. Creation and editing of pages on the TUD Dresden University of Technology intranet (news, internal content or content for team collaboration)
7. Communication and collaboration between users
8. Communication between users and TUD Dresden University of Technology intranet
9. Task assignment and management
10. Notification of users by e-mail and in the system
11. Provision of the analytics function
12. Registration for events

In addition, cookies may be set to embed social media (YouTube) into the Intranet, i.e., to allow users to access it on a voluntary basis.

Who is responsible for data processing and to whom can data subjects turn?

Responsible in the sense of Art. 4 No. 7 GDPR is TUD Dresden University of Technology.

Responsible Department

Technische Universität Dresden
Directorate 7 - Communication and Marketing
01062 Dresden

Tel.: +49 (0)351 463-31628
Email: intranet@tu-dresden.de

Data Protection Officer

Data Protection Officer of the TUD Dresden University of Technology
Mr Jens Syckor
01062 Dresden

Tel.: +49 (0)351 463-32839
Email: informationssicherheit@tu-dresden.de

Which personal data will be processed?

The following personal data is processed:

• Surname, first name
• e-mail address
• Pages incl. texts, images, files, comments
• Analytics (number of page views per page / area) in pseudonymized form
• Notifications (internal system or comments)
• Collection of log data, such as IP addresses
• Profile information (telephone number, address, structural unit, job title)
• Optionally, the profile picture and other details (e.g. responsibility, expertise) can be entered in profiles to make employees easier to find on the intranet.
• YouTube cookies (when playing embedded YouTube videos)

What is the legal basis for processing personal data?

The respective legal basis for data processing is:

• for employees: Section 11 (1) of the Saxon Data Protection Implementation Act (SächsDSDG) or, in the case of optional profile information, Art. 6 para. 1 lit. a GDPR (consent)
• for guests: Art. 6 para. 1 lit. a GDPR (consent)

For the collection and evaluation of log data or for the provision of the analytics function: Section 3 (2) of the Saxon Data Protection Implementation Act (SächsDSDG)

The use of cookies to integrate social media into the Intranet is based on Article 6(1)(a) of the GDPR (consent).

How long is personal data stored?

The personal data will be deleted when consent is withdrawn as a legal basis, or after the person leaves TUD Dresden University of Technology. Existing content created by the person who has left will be anonymized.

Comments from anonymous users, i.e. students, in Confluence areas are deleted if they do not contain a clear name.

Log files required for operation are stored in the data center for 90 days. Audit logs are also stored for 90 days.

The retention period for YouTube cookies is specified here.

Will personal data be transferred to third parties?

No personal data is transmitted to third parties.

What are the basic rights of data subjects?

• Right to voluntary nature and revocation (Art. 7 (3) GDPR)

  If the use of the services is based on consent, this consent can be revoked at any time in accordance with Art. 7 (3) GDPR with the consequence that the personal data of the person concerned will not be further processed. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

• Right to information (Art. 15 GDPR)

  Data subjects have the right to obtain at any time information on the data processed concerning them and on the possible recipients of such data. They are entitled to receive a reply within a period of one month after submitting the request.

• Right of correction, deletion and restriction (Art. 16 - 18 GDPR)

  The persons concerned may at any time request TUD Dresden University of Technology to correct or delete their personal data or to restrict the processing of such data.

• Right to data transferability (Art. 20 GDPR)

  The persons concerned can demand that TUD Dresden University of Technology transfers their personal data to them in a machine-readable format. Alternatively, they may request that the personal data provided by you be transferred directly to another responsible party, as far as this is possible.

• Right of objection (Art. 21 GDPR)

  Data subjects may object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.

• Right of appeal (Art. 77 GDPR)

  Data subjects can contact the Data Protection Officer of TUD Dresden University of Technology at any time and, in the case of a complaint under Art. 77 GDPR, a supervisory authority for data protection. The responsible supervisory authority for TUD Dresden University of Technology is:

  Sächsische Datenschutz- und Transparenzbeauftragte
  Frau Dr. Juliane Hundert
  Maternistraße 17
  01067 Dresden
  Email: post@sdtb.sachsen.de
  Telephone: +49 (0)351 85471-101
  www.datenschutz.sachsen.de

To exercise these rights, notification in text form (letter or email) to the controller is sufficient.