1 Name and Address of the Person Responsible

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States, and other data protection provisions is:

2 Name and address of the Data-Protection Officer

The Data Protection Officer of the controller is:

Kirstin Vedder
Technische Hochschule Lübeck Mönkhofer Weg 239
23562 Lübeck

E-Mail: datenschutz(at)th-luebeck.de

3 Legal Basis for Data Processing

Data processing is carried out in compliance with the European Union General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Schleswig-Holstein State Data Protection Act (LDSG), and the Schleswig-Holstein Higher Education Act (HSG).

The processing of personal data serves the preparation, administration, conduct, and evaluation of examinations. Your mandatory personal data are processed exclusively in connection with your participation in examinations on the basis of the following legal provisions:

• Article 6(1)(e) GDPR in conjunction with Sections 45 and 52 of the Schleswig-Holstein Higher Education Act (HSG)
• Sections 10 and 19 of the Schleswig-Holstein Ordinance on the Collection and Processing of Personal Data for Administrative Purposes of Universities and the Cooperative State Academy (StudDatenVO)
• Section 16 of the Examination Procedure Regulations (PVO) of Lübeck University of Applied Sciences in conjunction with Sections 3 and 5 of the Supplementary Regulations on Electronic Examinations (PVO Supplementary Statute for Electronic Examinations)

4 Purposes and Scope of the Processing of Personal Data

Personal data are processed for the purpose of organizing, preparing, conducting, and evaluating examinations.

When using the Examination Moodle platform, personal data of users are processed in the following categories:

Master Data

Access to the Examination Moodle platform requires a user account (THL IT account) issued by Lübeck University of Applied Sciences and inclusion in the university's central user management system (LDAP).

During the login process, information from the LDAP account is automatically transferred to the Moodle database or updated upon subsequent logins. The following information is processed:

• Username
• University e-mail address
• First name
• Last name
• Degree program abbreviation (not applicable to university employees)

Content and Examination Data

Content and examination data are generated when users enter information into the Examination Moodle platform. This includes, for example, activities within assignments and quizzes. Uploaded files also form part of the content and examination data.

Only the Moodle administrators of the Center for Digital Teaching (Zentrum Digitale Lehre – ZDL) have global access to content and examination data. Persons responsible for individual examinations have access to aggregated activity reports solely for the purpose of conducting and evaluating examinations within the respective course.

Course coordinators (examiners) supplement content and examination data with information relating to academic performance (assessment of examination results). These data are visible only to the persons responsible for the respective examination and to the Moodle administrators of the ZDL.

Data processing is carried out exclusively for examination purposes and in accordance with the principle of data minimization.

Log Data

When using the Examination Moodle platform, so-called log data are collected in the background. In particular, information is recorded regarding the time, IP address, and Moodle components accessed.

Only the Moodle administrators of the ZDL have access to these data.n.

5 Duration of Data Storage 

Data resulting from participation in examination courses (master data, content and examination data, and log data) are stored until the respective examination course is deleted. The examination course is deleted four years after the last student who participated in that course has been exmatriculated.

Other server log data are deleted after seven days.

6 Recipients of the Data

Recipients of the data include examiners and invigilators. Examination submissions are also processed by all offices and organizational units involved in the administration, assessment, and processing of examination results.

7 Transfer of Data to Third Countries or International Organizations

Moodle data processing takes place exclusively on servers operated by Lübeck University of Applied Sciences. No transfer of personal data to an international organization or a third country takes place.

8 Automated Decision-Making

No automated decision-making within the meaning of Article 22 GDPR takes place.

9 Use of Cookies

Moodle uses cookies. Cookies are text files that are stored in your internet browser or by your internet browser on your computer system. When accessing the website, a cookie may be stored on your system. This cookie contains a unique identifier that enables your browser to be recognized when the website is accessed again.

The following cookie is used:

The MoodleSession cookie identifies logged-in users through an anonymous ID and maintains their login status for the current session. This cookie is required for the operation of Moodle, ensuring that login information and access permissions remain valid throughout the session. The cookie is automatically deleted when you log out of the system or close your web browser.

10 Your Rights as a Data Subject

If your personal data are processed, you are a data subject within the meaning of the GDPR and have the following rights in relation to the controller:

10.1 Right of Access (Article 15 GDPR)

You have the right to obtain information from the controller about the personal data stored concerning you (Article 15 GDPR).

10.2 Right to Rectification (Article 16 GDPR)

If inaccurate personal data concerning you are processed, you have the right to obtain rectification under the conditions set out in Article 16 GDPR. Please contact the responsible offices to exercise this right.

10.3 Right to Erasure (Article 17 GDPR) and Restriction of Processing (Article 18 GDPR)

Under the conditions set out in Article 17 GDPR, you have the right to obtain the erasure of your personal data (for example, where the data are inaccurate or there is no legal basis for further processing). The right to erasure does not apply where the controller is authorized or legally obliged to continue processing the data, or where processing is necessary due to a legitimate interest.

Under the conditions of Article 18 GDPR, you may request the restriction of processing of personal data concerning you (for example, where the accuracy of the data is contested).

10.4 Right to Data Portability (Article 20 GDPR)

Under the conditions of Article 20 GDPR, you have the right to receive personal data that you have provided in a structured, commonly used, and machine-readable format.

10.5 Right to Object (Article 21 GDPR)

Where processing is based on Article 6(1)(e) GDPR or Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you (Article 21 GDPR, Section 36 BDSG). If you object, your personal data will no longer be processed unless compelling legitimate grounds for the processing can be demonstrated that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.

The objection may be submitted informally. For evidentiary purposes, we recommend that you submit your objection by post or e-mail using the subject line "Objection". For objections relating to examinations, please contact the Examination Board.

11 Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. If you believe that the processing of your personal data violates applicable data protection legislation, you may contact the competent supervisory authority:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein Postfach 71 16
24171 Kiel
Holstenstraße 98
24103 Kiel

Telefon: 04 31/988-12 00
Telefax: 04 31/988-12 23
E-Mail: mail@datenschutzzentrum.de
http://www.datenschutzzentrum.de/

12 The Data Protection Officer of Lübeck University of Applied Sciences

You may also contact the Data Protection Officer of Lübeck University of Applied Sciences at any time, including confidentially, regarding any questions related to data protection.