Data Privacy Policies for German Courses Offered at the International Office by the German as a Foreign Language Section

These Terms and Conditions must be read and accepted every time when you register to take any German course offered at the International Office by the German as a Foreign Language section.

Information on data collection and data processing

We are pleased that you are interested in taking a German course at the International Office. In accordance with Art. 6, 13, 14 and 21 of the General Data Protection Regulation (GDPR), we are hereby advising you regarding the processing of personal data collected by the University of Bonn through use of the Lucom form server and of cRM customer relationship management software for purposes of conducting German courses and related administration.

Name and contact data for the controller and data protection officer

Official Data Protection Officer:
Dr. Jörg Hartmann
Genscherallee 3
53113 Bonn
Email: joerg.hartmann@uni-bonn.de

Represented by:
Eckhard Wesemann
Division 1, Section 1.0
Regina-Pacis-Weg 3
53113 Bonn
Email: wesemann@verwaltung.uni-bonn.de

Collection and storage of data, nature and purpose of data usage

Your personal data are processed in accordance with the stipulations and requirements per the European General Data Protection Regulation (EU GDPR) and with the Data Protection Act of North Rhine-Westphalia (Landesdatenschutzgesetz, DSG NRW) as necessary for cRM course administration at the University of Bonn.

Personal data are erased as soon as the purpose for their storage no longer applies. Storage for a longer period may occur in accordance with Union regulations, laws or other provisions adopted by European or national legislatures to which the data controller is subject. Data are furthermore erased upon elapse of a mandatory retention period under laws or regulations per the above, unless retention of these data is required as documentation of participation in internal continual professional development offerings and courses/ events. Otherwise, we will only store your personal data as required by law, or as necessary to exercise rights or assert or defend against legal claims, for the duration of the legal dispute in question.

The future course administration process

Interested individuals register for their selected course using a registration form created using the Lucom form server.

1. The form directly forwards the data of the interested individual to cRM, where it is kept on file.
2. An administrator handles the administrative process in cRM (confirmation email, course invitation, enrollment list, waiting list, evaluation). To this end, user responsibilities are specifically assigned, so an administrator can only access the courses falling within his/her area of responsibility.
3. CRM can generate controlling lists showing anonymized enrollment data.
4. Course participant data are erased in accordance with legal requirements. The software features integrated GDPR compliance functionality, enabling interested individuals to receive information at any time specifying what data of theirs is stored in cRM.

Personal data is not transferred to third parties.

The company responsible for maintenance of the cRM course administration system is:

Combit Software GmbH
Bücklestraße 3–5
78467 Konstanz
Germany
Phone: +49 7531 9060-10
Fax: +49 7531 9060-18
Email: service@combit.net
www.combit.net

Data subject rights

You have the following rights:

• The right to demand information regarding your personal data that has been processed by the controller named above, in accordance with Art. 15 GDPR. In particular, you can demand information on the following:

• The purpose of the processing
• The categories of personal data
• The categories of recipients to whom your data have been or will be disclosed
• The planned storage period, or, if not possible, the criteria used to determine the storage period
• The existence of the right to rectification, erasure, restriction of processing, or to object
• The existence of the right to lodge a complaint
• The collection source for your data, if not collected by the controller named above
• Whether automated decision-making takes place and meaningful, detailed information regarding such

• The right to demand that your personal data stored by the controller named above be immediately rectified if inaccurate or incomplete, in accordance with Art. 16 GDPR
• The right to demand the erasure of your personal data stored by the responsible party named above, in accordance with Art. 17 GDPR. The above does not apply if continued storage of the data is necessary for

• processing required for exercising the right of freedom of expression and information,
• compliance with a legal obligation to which the controller is subject,
• reasons of public interest,
• the establishment, exercise or defense of legal claims, or
• archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89, para. 1 GDPR, insofar as the erasure of the data is likely to render impossible or seriously impair the achievement of the objectives of that processing.

• The right to demand restriction of processing for your personal data in accordance with Art. 18 GDPR, under the conditions specified therein.
• The right to demand receipt of the personal data you have provided to us in a structured, commonly used and machine-readable format, and demand transmission of that data to another controller, in accordance with Art. 20 GDPR, under the conditions specified therein.
• The right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR, without prejudice to any other administrative or judicial remedy. The competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Germany
Phone: +49 211 38424-0
Fax: +49 211 38424-999
Email: poststelle@ldi.nrw.de

Duty to cooperate

You are obligated to provide us all data relevant for registration for purposes of cRM course administration. If you do not communicate or provide your data to the controller named above, it is not possible to attend a course offered by the University of Bonn.

Right to object

If your personal data is processed based on legitimate interests in accordance with Art. 6, para. 1, sentence 1, letter e GDPR, you have the right under Art. 21 GDPR to object to processing of your personal data on grounds relating to your particular situation.

To exercise your right to object, send a corresponding email to the controller named above.