Privacy Policy

Privacy notice on online teaching

Data protection is a key priority for Hochschule München (HM) and a legal obligation. To ensure that personal data is adequately protected during transmission, HM uses state-of-the-art encryption methods (e.g. SSL/TLS) and secure technical systems.

Data controller

HM Hochschule München University of Applied Sciences

Lothstraße 34
D-80335 München
Tel.: +49 89 12 65 - 0
Fax: +49 89 12 65 - 3000
Email: kommunikation@hm.edu
Website: www.hm.edu

HM Hochschule München University of Applied Sciences is a public-law body. It is legally represented by its President, Prof. Dr Martin Leitner.

Please note: Whenever you access the website of ‘Jitsi Meet’, ‘Zoom’, ‘Webex’ or any other provider we use, that provider is responsible for data processing.

You will need to visit the website to use the relevant tool, so that you can download the software required to use the relevant tool application, if necessary.

However, each tool can also be used without the app by clicking on the relevant invitation and, if necessary, entering any further login details for the relevant online session directly in the browser version of the tool. The basic functions of each tool are available via the browser version, which can be found on the tool’s website.

Government Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu and by telephone on +49 9951 99990-500.

Purpose, scope and legal basis of the processing

Purpose

The purpose of the processing is to conduct and, where necessary, record video-based teaching sessions and other university events, in order to make these available online to members of the university community. The storage and publication of recordings of teaching sessions serves, in particular, to help students prepare again for examinations which they are required to retake after failing them.


Those affected

Lecturers, students and other participants in the online event.


Scope of data processing

When using a tool, various types of data are processed. The scope of the data also depends on what data is generated before or during participation in an online course.

The following personal data is subject to processing:

  • User details: first name, surname, email address, password, profile picture (optional) and telephone number (optional)
  • Meeting metadata: topic, description (optional), participants’ IP addresses, and participants’ device and hardware information.
  • For recordings (optional): e.g. an MP4 file containing all video, audio and presentation recordings; an M4A file containing all audio recordings; a text file of the online lesson chat.
  • Text, audio and video data: During an online event, participants may use the chat and question functions, and in some cases the poll function as well. In this regard, text entries are processed in order to display them during the event and, where applicable, to log them. To enable the display of video and the playback of audio, data from the end device’s microphone and, where applicable, its video camera is processed for the duration of the online event. Participants can switch their camera or microphone on or off, or mute them, at any time via the tool application.

In order to take part in an online course, students are required to provide the following details:

  • In Jitsi Meet, you are required to provide a name (nickname) if you wish to do so. Otherwise, no further details are required.
  • Zoom requires a name (nickname) as a minimum piece of information.
  • Webex asks for a name (nickname) and an email address as a minimum. However, the email address does not have to be a real one. It is not verified.

Students will be informed in advance and in a transparent manner that an online lecture is being recorded. By switching on your camera and microphone, you are deemed to have consented to the recording. The fact that the lecture is being recorded is also usually displayed in the relevant tool.

The software-based ‘attention monitoring’ (‘attention tracking’) feature available in the ‘online teaching’ tools has been disabled.

Automated decision-making within the meaning of Article 22 of the GDPR is not used.


Legal basis

Where personal data relating to students is processed, this is done in order to be able to offer the course online via the internet. For this purpose, the HM may also process personal data relating to students and teaching staff. This is permitted, amongst other things, by Section 76(2) of the Bavarian Higher Education Act (BayHIG) in conjunction with Section 4(1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 6(1), first sentence, point (e), and Article 6(3) of the General Data Protection Regulation (GDPR).

The legal basis for the recording of personal data is consent (Article 6(1)(a), Article 7 of the GDPR). Consent is implied by switching on the camera or microphone or by participating in personal chats during the recording. If you do not consent to being recorded via video, audio or chat, you should not switch on your camera or microphone, nor should you participate in personal chats. Questions regarding the course can be addressed to the lecturer at any time, anonymously, via chat or by email.

Withdrawal of consent

Data subjects have the right to withdraw their consent under data protection law regarding the recording of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR). Following withdrawal, the video recording will be deleted or your personal data will be edited out of the video footage.

Recipients or categories of recipients of personal data

The recipients of personal data during the online course are the participants in the online course and all university members who have registered for the course.

The following persons also have access to any video recordings and, consequently, to the personal data of the individuals concerned:

  • Students at HM who wish to use the recorded lectures to prepare for an exam or a resit
  • Event tutor

The data is stored in encrypted form on the university’s internal servers. However, if the video recording is carried out via service providers based in the USA, such as Webex or Zoom, data will be transferred to third countries. Appropriate data processing agreements have been concluded with the service provider, provided that the licence was obtained through Hochschule München. The data transferred includes traffic data, such as IP addresses, and, where provided, personal data such as the user’s name, email address, and first name and surname. Video content is transmitted in encrypted form. An adequate level of data protection is guaranteed by the conclusion of the so-called EU Standard Contractual Clauses.

Planned retention period for personal data

Video recordings of lectures will be stored from the time of recording until the end of the semester at the latest, plus a further year, and will be published as learning materials (including for resit examinations).

If the events are not recorded, no data is stored.

Rights of those affected

Under the General Data Protection Regulation, you have the following rights:

  • Where personal data is processed, data subjects have the right to obtain information about the data held about them (Article 15 of the GDPR).
  • If inaccurate personal data is processed, you have the right to have it rectified (Article 16 of the GDPR).
  • Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR).
  • Where consent has been given for data processing, or where a contract for data processing exists and the data processing is carried out using automated means, data subjects may have a right to data portability (Article 20 of the GDPR).
  • Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR).
  • Data subjects have the right to request information as to whether automated decision-making, including profiling, is taking place (Article 22 of the GDPR).
  • Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is carried out solely on the basis of Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

Should the rights set out above be exercised, the public authority will check whether the legal requirements for doing so have been met.

Furthermore, you have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection.

You can contact them using the following contact details:

Postal address:
Postfach 22 12 19
80502 München

Address:
18 Wagmüllerstraße
80538 München

Tel.: +49 89 212672 - 0
Fax: +49 89 212672 - 50

Email: poststelle@datenschutz-bayern.de
Website: https://www.datenschutz-bayern.de/

Further information regarding our Privacy Policy

Hochschule München reserves the right to amend the Privacy Policy from time to time to ensure that it always complies with the latest legal requirements or to reflect changes to the services described in the Privacy Policy, for example when new services are introduced. The new Privacy Policy will then apply to any subsequent visits to the website.

If you have any questions, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu) or send an email to: kommunikation@hm.edu.

Last updated: 10 March 2021

The information on this page was translated into English for your convenience. In case of any discrepancies between the English and German versions, the German version shall prevail.