Information on data processing in research management

Personal data is processed for the purpose of conducting the survey on research and teaching interests.

Data controller

Hochschule München

34 Lothstr.

80335 Munich

Tel.: +49 (0) 89 12 65 0

Tel: +49 (0) 89 12 65 - 3000

Email: kommunikation@hm.edu

Website: www.hm.edu

Munich University of Applied Sciences is a public-law corporation. It is legally represented by its President, Prof. Dr Martin Leitner.

Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu or by telephone on +49 871 205494 - 0.

Purposes and legal basis of the processing

Hochschule München collects data on the research and teaching interests of its academic and non-academic staff and stores it in a database on an HM server. This data processing is carried out for the following purposes:

• Compliance with HM’s reporting obligations to the supervisory authority and, where applicable, to institutions appointed by it
• Preparations for the introduction of a research information system (RIS) at the university
• Improving the presentation, visibility and discoverability of research and teaching and research expertise on the HM website.

Through the SSO login, the data controller processes the surnames and first names of data subjects. These are stored together with the relevant details regarding their research and teaching interests.

The following details are requested and selected and entered by the data subjects themselves:

• First level: Classification within the subject classification system of the Federal Statistical Office’s personnel statistics (mandatory field)
• Second level: Classification of the academic activity according to the GND (Gemeinsame Normdatei) classification system of the German National Library (DNB) and, where available, a corresponding English-language classification based on the Library of Congress (LOC) (optional)
• Third level: Description of the research interest using up to five keywords of your choice. Hochschule München reserves the right to group together synonymous keywords (optional).

The data enables the research areas at Munich University of Applied Sciences to be categorised and is used to create a skills profile for Professors and academic and non-academic staff members. This information is displayed on individual profile pages and is also used for searches in the skills database on the Hochschule München website. In addition, the data is used for statistical analysis.

The legal basis for the processing of personal data is as follows:

• Article 6(1)(e) and (3) of the GDPR in conjunction with Section 3(4) of the Federal Statistics Act, Section 10(1) of the Federal Statistics Act in conjunction with Section 15 of the Federal Statistics Act regarding the collection of data for the purpose of classification within the subject classification system of the Federal Statistical Office,
• Section 4(1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Sections 2 and 7–10 of the Bavarian Higher Education Act (BayHSchG), Art. 6(2)-(3) in conjunction with (1)(1)(e) of the GDPR regarding the publication of the classification within the subject classification system of the Federal Statistical Office on researchers’ own competence profiles and within the framework of the HM Research Information System,
• Article 6(1)(a) of the GDPR regarding the collection and publication of data at the second and third levels (consent). You may withdraw your consent at any time by sending an email to the following address: bibliographie@hm.edu

The form can only be accessed via HM’s SSO (Shibboleth login). The database is processed on HM’s own servers.

Retention period for personal data

Data is only stored for as long as is necessary to fulfil the relevant tasks, in accordance with statutory retention periods. Where consent has been given for the processing of personal data, the data controllers will delete such data once consent has been withdrawn.

Rights of data subjects

Under the General Data Protection Regulation, you have the following rights:

• Where personal data is processed, data subjects have the right to obtain information about the data held about them (Article 15 of the GDPR).
• If inaccurate personal data is processed, you have the right to have it rectified (Art. 16 GDPR).
• Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR).
• Where consent has been given for data processing, or where a data processing agreement is in place and the data processing is carried out using automated means, data subjects may have a right to data portability (Article 20 of the GDPR).
• Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Art. 7 GDPR).
• Data subjects have the right to request information on whether automated decision-making, including profiling, is taking place (Art. 22 GDPR).
• Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is based solely on Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection.

You can contact them using the following details:

Postal address:

PO Box 22 12 19

80502 Munich

Address:

18 Wagmüllerstraße

80538 Munich

Tel.: +49 (0) 89 212672 - 0

Tel: +49 (0) 89 212672 - 50

Email: poststelle@datenschutz-bayern.de

Website: https://www.datenschutz-bayern.de/

Personal data is processed in connection with the storage, transmission and processing of ORCID data for the purpose of carrying out these activities.

The University of Applied Sciences Munich is responsible for collecting your personal data

Hochschule München

34 Lothstr.

80335 Munich

Tel.: +49 (0) 89 12 65 0

Tel: +49 (0) 89 12 65 3000

Email: kommunikation@hm.edu

Website: www.hm.edu

Munich University of Applied Sciences is a public-law corporation. It is legally represented by its President, Prof. Dr Martin Leitner.

Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu or by telephone on +49 871 205494 - 0.

Purpose and legal basis of data processing

Personal data relating to members of the university community is processed for the purpose of compiling a university bibliography and a research information system for the university. In particular, the university processes the content of ORCID accounts held by members of the university community for this purpose.

University staff members who hold ORCID accounts can use the ‘HM FIS ORCID Connector’ to consent to the granting of read and write access. These rights relate to the personal data stored in their ORCID accounts and are managed by staff members at the Library and the Science Support Center (= the HM editorial team).

If we do not have your consent, depending on the visibility settings in your ORCID account, only publicly visible data—or, in some cases, no data at all—will be stored. This means that your publications will not be taken into account, or only to a limited extent, for the purposes of fulfilling reporting obligations, and no automatically generated list of publications will appear on your profile page at www.hm.edu.

The so-called “ORCID Member API” enables the HM editorial team, with the researchers’ permission, to add affiliations, external funds, works, peer reviews, research resources and biographical data to ORCID records, and to request access to the data from a record holder. In addition to all the functions of the Public API, the Member API can be used to:

• To access trusted data
• Entering data into ORCID records
• Synchronising ORCID with the HM system

Furthermore, once the data subject has given their consent, the trusted information (visibility: ‘Trusted Parties’) held by ORCID regarding the data subject is stored in a database on a server at Hochschule München (HM) via the Member API.

The Science Support Center and the University Library are responsible for the university bibliography at the departmental level.

The data is used for statistical queries, reports and analyses – including for third parties – as well as to enhance visibility on the HM website, in particular on the profile pages of Professors, academic and non-academic staff members, and Lehrkräfte für besondere Aufgaben (specialised instructors). This is intended to increase the visibility of research activities at the HM.

The legal basis for data processing in connection with the HM editorial team’s access to individual ORCID accounts is the consent of the relevant university member in accordance with Article 6(1)(a) of the GDPR.

Furthermore, the processing of personal data is based on Section 4(1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Sections 2 and 7–10 of the Bavarian Higher Education Act (BayHSchG), and Article 6(2) and (3) in conjunction with Article 6(1)(e) of the General Data Protection Regulation (GDPR). Accordingly, the University is permitted to process the data necessary to fulfil the University’s statutory duty to promote science, research and early career researchers.

Where external partners are involved, in relation to the associated cooperation agreements and all payment processing relating to a concluded contract, data processing is also based in part on Article 6(1)(b) of the GDPR.

Recipients or categories of recipients of the personal data

The above data will be disclosed to the following recipients or categories of recipients only if this is necessary for the specific processing:

• Research sponsors/cooperation partners
• External reviewers
• HM's website host
• Ministries of the Free State of Bavaria
• Where necessary, data may be transferred to the relevant supervisory and auditing authorities to enable them to exercise their respective supervisory powers, and may in some cases be stored on servers at the Leibniz Computing Centre (LRZ), Boltzmannstraße 1, D-85748 Garching.

Retention period for personal data

Data is only stored for as long as is necessary to fulfil our obligations, in accordance with statutory retention periods. Unless there are other purposes for retaining the data, it will be deleted eight years after the data subject leaves the organisation. This period begins at the end of the calendar year in which the data subject leaves.

Rights of data subjects

Under the General Data Protection Regulation, you have the following rights:

• Where personal data is processed, data subjects have the right to obtain information about the data held about them (Art. 15 GDPR).
• If inaccurate personal data is processed, you have the right to have it rectified (Art. 16 GDPR).
• Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR).
• Where consent has been given for data processing, or where a contract for data processing exists and the data processing is carried out using automated means, data subjects may have a right to data portability (Article 20 of the GDPR).
• Data subjects have the right to withdraw their consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR).
• Data subjects have the right to request information on whether automated decision-making, including profiling, is taking place (Art. 22 GDPR).
• Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is based solely on Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection.

You can contact them using the following details:

Postal address:

PO Box 22 12 19

80502 Munich

Address:

18 Wagmüllerstraße

80538 Munich

Tel.: +49 (0) 89 212672 - 0

Tel: +49 (0) 89 212672 - 50

Email: poststelle@datenschutz-bayern.de

Website: https://www.datenschutz-bayern.de/

Statutory Data Protection Officer

This Privacy Policy is regularly updated to ensure that it always complies with the latest legal requirements.

If you have any questions, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu ).

Further information

Further information on data protection, in particular regarding your rights, can be found at: www.hm.edu/datenschutz .

Personal data is processed for the purpose of conducting the survey on research and teaching interests.

I. The controller responsible for collecting your personal data is the University of Applied Sciences Munich

Hochschule München

34 Lothstr.

80335 Munich

Tel.: +49 (0) 89 12 65 0

Tel: +49 (0) 89 12 65 3000

Email: kommunikation@hm.edu

Website: www.hm.edu

Munich University of Applied Sciences is a public-law corporation. It is legally represented by its President, Prof. Dr Martin Leitner.

Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu or by telephone on +49 871 205494 - 0.

II. Data processing when registering for an event on eveeno.com

1. Scope, purpose and legal basis of data processing

If you use this form to register for an event or conference organised by Hochschule München (HM), we will process your personal data for the purposes of managing your registration, organising and running the event, and billing you for any participation fees.

Depending on the type of event, you can register either by personal invitation or simply because you are interested in the topic. As part of the ORCID workshops, we process personal data during the registration process.

When booking, you will be asked to enter the following details to complete your registration:

Mandatory fields:

1. Salutation

2. First name

3. Surname

4. Department

5. Email address

Optional field:

6. Title

You then select a date and accept eveeno’s Privacy Policy by ticking the relevant box. The Privacy Policy of Hochschule München is made available via a hyperlink before the booking is completed.

You can complete your booking by clicking the ‘Register now’ button. This completes the registration process. The participant will receive a confirmation email at the address provided during registration.

2. Retention period

The participation data is stored in the HM for further processing (utilisation of the VA, evaluation, review) and deleted after 3 years.

3. Legal basis

The legal basis for the processing is Article 4(1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 6(3) and Article 6(1), first sentence, point (e) of the GDPR for a free event, provided that it takes place within the scope of the university’s public duties.

For other events subject to a fee, Article 6(1)(b) of the GDPR for the purpose of taking (pre-)contractual measures at the data subject’s request.

4. Disclosure of data

Your data will not be passed on to third parties. Data processing is carried out by an external service provider (eveeno), with whom HM has entered into a data processing agreement.

III. Data processing in connection with the delivery of ORCID workshops via audio and video conferencing

1. Scope of data processing

The ORCID workshop will be streamed online for all participants. To this end, we will be using online conferencing tools, amongst other things. The specific tools we will be using are listed below. If you register to take part in the workshop and join the event via video or audio conference over the internet, your personal data will be collected and processed by us and by the provider of the relevant conferencing tool.

The conferencing tools collect all data that you provide or use in connection with the tools (email address and/or your telephone number). Furthermore, the conferencing tools process the duration of the conference, the start and end times of your participation in the conference, the number of participants, and other ‘contextual information’ relating to the communication process (metadata).

In addition, the tool provider processes all technical data required to facilitate online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

Where content is exchanged, uploaded or otherwise made available within the tool, it is also stored on the tool provider’s servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared whilst using the service.

Please note that we do not have full control over the data processing operations carried out by the tools we use. Our options are largely determined by the corporate policies of the respective providers. For further information on data processing by the conference tools, please refer to the Privacy Policies of the respective tools, which we have listed below.

2. Purpose and legal basis

The conference tools are used to make the programme available to all interested participants and to enable them to communicate with one another (Article 6(1)(b) of the GDPR).

The legal basis for the recording of personal data is consent (Article 6(1)(a) and Article 7 of the GDPR). Consent is implied by switching on the camera or microphone or by participating in personal chats during the recording. If you do not consent to being recorded via video, audio or chat, you should not switch on the camera or microphone or participate in personal chats. Questions regarding the event can be directed to the teacher by email at any time.

3. Retention period

Data collected directly by us via the video and conferencing tools will be deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected. We have no influence over the retention period of your data stored by the operators of the conferencing tools for their own purposes. For further details, please contact the operators of the conferencing tools directly.

4. Conference tools used

We use the following conference tools:

Zoom

We use Zoom. The provider of this service is Zoom Communications Inc., San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For details on data processing, please refer to Zoom’s Privacy Policy:

https://explore.zoom.us/de/privacy/

eveeno

We use the participant management tool provided by eveeno. The provider of this service is eveeno, Andreas Bothe, Ellenbogen 8, D-91056 Erlangen. For details on data processing, please refer to eveeno’s Privacy Policy:

https://eveeno.com/de/privacy

Conclusion of a data processing agreement

We have entered into a data processing agreement with the above-mentioned providers and fully comply with the strict requirements of the German data protection authorities when using Zoom and eveeno.

IV. Statutory Data Protection Officer

If you have any further questions, please feel free to contact HM’s Data Protection Officer (datenschutzbeauftragter@hm.edu ).

V. Further information

Further information on data protection, in particular regarding your rights, can be found at: www.hm.edu/datenschutz .