Teaching Competence Centre for Digital Testing

Privacy notice for participants in digital exams

Data protection is a key priority for Hochschule München and a legal obligation. To ensure that personal data is adequately protected during transmission, Hochschule München uses state-of-the-art encryption methods (e.g. SSL/TLS) and secure technical systems.

Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the University of Applied Sciences Munich, located at Lothstraße 34, 80335 Munich.

regulatory authority

Bavarian State Commissioner for Data Protection, Wagmüllerstraße 18, 80538 Munich.

Contact us regarding your rights

If you believe that the processing of personal data by Hochschule München contravenes data protection regulations, you may contact the Data Protection Officer. The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu or by telephone on (089) 6080 7600.

Purpose of the processing

We process your personal data for the purpose of conducting digital examinations. These may take the form of examinations with grading at the end of the semester, assessments carried out throughout the semester, or voluntary, ungraded examinations taken throughout the semester. We do not intend to change this purpose.

1. Legal basis for the processing of marked end-of-semester examinations and coursework

a.) Processing of students’ personal data

In the course of carrying out their teaching duties, as enshrined in the Bavarian Higher Education Act, higher education institutions are permitted to process personal data. (Art. 6(1)(e)(2) and (3) of the GDPR in conjunction with Art. 4(1) of the Bavarian Data Protection Act (BayDSG) and Art. 2 of the Bavarian Higher Education Act (BayHSchG)).

This task can only be carried out by collecting students’ personal data. Students are required to provide their personal data as part of the enrolment process and, consequently, also in connection with examinations (Section 42(4) of the BayHSchG). Examinations may be conducted digitally. This is regulated in Section 27 of the currently valid general study and examination regulations (ASPO) of Hochschule München.

The legal basis for the processing of information relating to existing reasonable adjustments is derived from Article 9(2)(g), Article 6(1)(e), (2) and (3) of the GDPR, in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG), in conjunction with Article 2 of the Bavarian Higher Education Act (BayHSchG), in conjunction with Section 5 of the Regulation on the Protection of Personal Data (RaPO).

b.) Processing of personal data relating to proofreaders

The obligation to process their data (correction) arises, for civil servant examiners, as a duty of office under the Bavarian Civil Service Act (BayBG); for non-civil servant staff, from their employment contract (Article 6(1)(b) of the GDPR); and for lecturers, from their special employment relationship under public law.

c.) Processing of log files, cookies and security updates

Log files, cookies and security updates are technically necessary for the “Digital Examination” service, for the testing or maintenance of the systems, and to ensure the network and information security of Hochschule München. The processing of personal data is carried out in accordance with Article 6(1)(c) and (e) of the GDPR in conjunction with Article 6(1) of the Bavarian Data Protection Act (BayDSG).

Where Hochschule München provides a telecommunications service, the data processing referred to above is necessary and is therefore lawful under Section 13(7) of the German Telecommunications Act (TMG). Where Hochschule München, as a public authority, provides services under the E-Government Act, this is done in accordance with Article 11(1) of the Bavarian E-Government Act (BayEGovG), and where Hochschule München provides telecommunications services, in accordance with Section 100 of the German Telecommunications Act (TKG).

2. Legal basis for voluntary, ungraded examinations held during the semester

The processing of personal data for the purpose of sitting voluntary, ungraded examinations held during the semester is carried out on the legal basis of consent in accordance with Article 6(1)(a) and Article 7 of the GDPR.

Recipients or categories of recipients of the personal data

The personal data provided will be processed solely for the purpose of conducting digital examinations and will be shared internally within the university with the following parties:

  • Examiner (first examiner; second examiner where applicable)
  • Digital Competence Centre of Excellence
  • on an ad hoc basis, members of examination bodies (Section 3 of the RaPO)

Data will only be disclosed to third parties as follows:

  • on an ad hoc basis to parties to proceedings in the context of legal proceedings
  • possibly to the relevant service provider for the maintenance of the examination server

Planned retention period for personal data

Personal data – relating to students taking digital examinations – is generally deleted after the retention period for examinations specified in Section 12 of the RAPO. According to this provision, examination results must be retained for two years. The retention period begins at the end of the calendar year in which the students were notified of the result of the relevant module examination. The retention period is extended if proceedings are pending. Contact details of invigilators, lecturers and members of the EXaHM competence team are retained for as long as they are involved, in order to ensure the smooth running of digital examinations.

What else you should know – your rights

You have the right to request confirmation as to whether the relevant data is being processed, and to request access to that data, as well as further information and a copy of the data, in accordance with Article 15 of the GDPR.

In accordance with Article 16 of the GDPR, you have the right to request that data concerning you be completed or that any inaccurate data concerning you be rectified.

If the legal conditions are met, you may request the erasure or restriction of processing, or object to the processing (Articles 17, 18 and 21 of the GDPR)

You have the right to request, in accordance with Article 20 of the GDPR, a copy of the personal data you have provided to us and to request that it be transferred to another data controller.

If you have consented to the processing and the processing is based on that consent, you may withdraw your consent at any time with effect for the future. The lawfulness of the data processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.

You also have the right, in accordance with Article 77 of the GDPR, to submit a complaint to the relevant supervisory authority.

The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection. You can contact them as follows:

  • at the following postal address: PO Box 22 12 19, 80502 Munich
  • at the following address: Wagmüllerstraße 18, 80538 Munich
  • by telephone on (089) 212672 - 0
  • by fax on (089) 212672 - 50
  • by email at: postoffice@datenschutz-bayern.de
  • online at: www.datenschutz-bayern.de

Further information regarding this Privacy Policy

Hochschule München reserves the right to amend this Privacy Policy from time to time to ensure that it always complies with current legal requirements or to reflect changes to the services described in the Privacy Policy, for example when new services are introduced. The new Privacy Policy will then apply to any subsequent participation in a digital examination.

Last updated: 20 April 2020