Privacy statement relating to the use of the TU Kaiserslautern Alumni Network (TUKAN)

I. Scope

The following privacy statement refers to the website of the TU Kaiserslautern Alumni Network (TUKAN), accessible at www.alumni.uni-kl.de. For contents of other providers, to which reference is made, for example, via links, other conditions than those described in this privacy statement may apply.

II. Contact details of the controller

Responsible for the processing of your personal data is

Technische Universität Kaiserslautern
represented by the President Prof. Dr. Arnd Poetzsch-Heffter
Gottlieb-Daimler-Straße 47
67663 Kaiserslautern
Tel.: +49 631 205 0
E-mail: president[at]uni-kl.de

III. Contact details of the data protection officer

Technische Universität Kaiserslautern
Der Datenschutzbeauftragte
Postfach 3049
67653 Kaiserslautern
Telefon: +49 631 205 4434
E-Mail: datenschutz[at]uni-kl.de

IV. Purpose of data processing

The Alumni Network TUKAN serves the exchange of information and contact between TU Kaiserslautern and its alumni as well as between the alumni themselves. To maintain contact with alumni and consequently to manage contact and address data, the contact data of these as well as information about their studies is stored. TU Kaiserslautern Alumni Network TUKAN will regularly inform alumni about news as well as events of TU Kaiserslautern. Furthermore, a personal exchange/contact between the alumni and the alumni coordination as well as between the alumni themselves is made possible.

V. Recipients of personal data

Processor of the personal data is the alumni coordination (Corporate Communications) and contact persons of the faculties who have reading and search rights within the portal.

Processors used:
We are using the alumni management system NDAlumni of NewDefinition GmbH, Wilhelmstraße 60a, 65183 Wiesbaden (hereinafter: ND).

The processing is carried out on our behalf and according to our specifications. We have concluded a data processing agreement in accordance with Art. 28 GDPR with ND, according to which ND has to take the measures, for example, required for the security of processing under Art. 32 GDPR (cf. ND Data protection concept).

ND uses Hetzner Online GmbH, Industriestraße 25, 91719 Gunzenhausen, as an additional processor for hosting and storing your data.

Furthermore, ND uses the Amazon Cloud of Amazon Web Services (AWS) as processor for sending e-mails. The data transmitted to AWS includes your e-mail address and will only be processed temporarily in order to deliver an e-mail communication; data processing takes place at the server locations in Frankfurt am Main and Ireland. More information about AWS and data protection can be found at https://aws.amazon.com/compliance/gdpr-center/.

VI. Collection of general information when visiting our website

Each time you visit our website, our system automatically collects data and information from the computer system of the accessing computer. This information (server log files) includes, among other things, the type of web browser, the operating system you are using, the domain name of your internet service provider, your IP address, and the like.
This information is technically necessary to correctly provide website content requested by you and is mandatory when using the Internet. In particular, such information is processed for the following purposes:

• to maintain the connectivity of our website,

• to ensure the flawless functioning of our website,

• analysis of system security and stability,

• other administrative purposes.

We do not use your data to draw conclusions concerning your personal identity. Data of this type may potentially be subjected to statistical analysis to help us improve our website and the technology that underpins it.

The legal basis for the temporary storage of data is Art. 6 para. 1 (e) in conjunction with Art. 6 para. 3 (b) General Data Protection Regulation (GDPR) in conjunction with section 3 Data Protection Act Rhineland Palatinate (Landesdatenschutzgesetz, LDSG).

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data is collected for the provision of the website, this is the case when the respective session has ended.

VII. Registration on our website

When registering with the Alumni Network TUKAN the user creates a personal user profile. The registration requires some minimum information (mandatory fields), which can be supplemented by further optional information.

The user has to fill in the following mandatory fields:

• salutation

• first name

• name

• e-mail address

• details about the education at TUK:
  department
  field of study
  degree
  end of study

Salutation, first name, last name and department are always and unrestrictedly visible to other members of the network logged in with their personal credentials. Concerning the contact data, the user themselves can decide which data can bee seen by other users in the network. At the time of registration, the following data is stored:

• the user’s IP address

• date and time of registration

As part of the registration process, the user's consent to the processing of this data is obtained. To verify that the consent is given by the owner of the e-mail address, we use the double opt-in procedure. To do so, we log the consent, the sending of a confirmation email and the receipt of the response requested herewith. We also store your registration data (e.g. e-mail address, date and time of registration/confirmation of opt-in) as part of your consent.

The processing of data entered during registration is based on the data subject’s consent (Art. 6 para. 1 (a) GDPR).
When processing personal data which is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 (b) GDPR serves additionally as legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.

If you are registered, you have access to contents and services that we only offer registered users. Registered users also have the option of changing or deleting the data provided during registration at any time. Furthermore, you can withdraw your consent to receive newsletters at any time and with future effect by clicking on the unsubscribe link at the end of a received newsletter. If the data is required to fulfil a contract or to implement pre-contractual measures, early deletion of the data is possible only to the extent that no contractual or statutory obligations prevent such deletion.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for data collected during the registration process and required to fulfil a contract or to implement pre-contractual measures if the data is no longer required to fulfil the contract. Even after the conclusion of the contract, it may be necessary to store personal data of the contractual partner to comply with contractual or legal obligations.

VIII. Cookies

The website uses so-called "cookies". Cookies are small text files that are stored by your browser on your device. These serve to make the offer more user-friendly and effective for the user. The legal basis for this is Art. 6 para. 1 (e) in conjunction with Art. 6 para. 3 (b) GDPR in conjunction with section 3 LDSG.

The following cookies are set:

• session cookie, which records the status of the registration

You can deactivate or restrict the storage of cookies on your system by the settings in your Internet browser. It is also possible to specify in the browser whether information should be provided about the setting of cookies and whether cookies should only be permitted in individual cases, and whether the acceptance of cookies should be excluded for certain cases or even generally. Cookies can also be automatically deleted when the browser is closed.

IX. Comment feature

When users post comments on our website, in addition to this information, the time of their creation and the user name previously selected by the person visiting the website are also stored. This serves to protect us, as we could be held responsible for any illegal content uploaded to our website even if such content is generated by users. We provide the comment feature to enhance interaction through our website.

The processing of content entered as comments is based on your consent (Art. 6 para. 1 (a) GDPR), which you declare by uploading the content and which you can revoke at any time without affecting the lawfulness of the processing until revocation.

X. Social media plugin

We do not use social media plugins on our websites. If our websites contain symbols of social media providers (e.g. Facebook, Twitter, Xing, LinkedIn, Instagram, YouTube), we only use these for passive linking to the pages of the respective providers.

XI. Contact form

If you contact us by e-mail or contact form regarding questions of any kind, you give us your voluntary consent for the purpose of contacting you. To do so, you must provide a valid e-mail address that is used for the assignment of the enquiry and the subsequent response to it. The provision of further data is optional. The information you provide will be stored for the purpose of processing the enquiry and for possible follow-up questions.

The legal basis for the processing of the data is Art. 6 para. 1 (a) GDPR if the user has given their consent. The legal basis for the processing of data transmitted when sending an e-mail is Art. 6 para. 1 (f) GDPR. If you contact us to request an offer, the data provided is processed to carry out pre-contractual measures (Art. 6 para. 1 (b) GDPR).

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended and no contractual or legal obligations prevent deletion. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified.

XII. General information on data processing

As a matter of principle, we process personal data of our alumni only to the extent necessary to provide a functional website and our contents and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies in those cases in which obtaining prior consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

Possible legal bases of the processing
The legal basis is Art. 6 para. 1 (a) GDPR, if the data processing of TUK is based on your consent as a data subject.
When processing personal data which is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 (b) GDPR serves as the legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.

Insofar as processing of personal data is necessary for compliance with a legal obligation to which the TUK is subject, Art. 6 para. 1 sentence 1 (c) in conjunction with Art. 6 para. 3 (b) GDPR in conjunction with section 3 LDSG serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 (d) GDPR serves as the legal basis.

If the processing is necessary for the performance of a task of the TUK which is in the public interest or is carried out in the exercise of official authority, Art. 6 para. 1 (e) in conjunction with Art. 6 para. 3 (b) GDPR in conjunction with section 3 LDSG serves as the legal basis for the processing.

If the processing is necessary to safeguard the legitimate interest of the TUK or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 (f) GDPR serves as the legal basis for processing this data; unless the TUK is obliged to perform as a public authority in the processing.

Duration of storage
The personal data will be stored until the processing is completed. It is deleted immediately when the stated purpose is achieved or the procedure concerned is completed and there is no obligation to archive them. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU ordinances, laws or other regulations to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires.

XIII. Rights of the data subject

According to the GDPR, every person affected by data processing has the following rights in particular:

• The right to obtain information about the personal data stored and its processing (Art. 15 GDPR).

• The right to rectification if the personal data processed is incorrect or incomplete (Art. 16 GDPR).

• The right to request erasure of the personal data, if one of the conditions according to Art. 17 GDPR applies. However, the right to erasure under Art. 17 para. 1 and 2 GDPR does not exist, inter alia, if the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 17 para. 3 (b) GDPR).

• The right to restrict processing, in particular where the accuracy of the data is disputed, for the duration of the verification of its accuracy, if the data is processed unlawfully but the data subject requests that the processing be restricted instead of deleted, if the data subject needs the data in order to assert or exercise legal claims or to defend himself against such claims and the data cannot therefore be deleted, or if, in the event of an objection under Art. 21, it is not yet clear whether the legitimate interests of the controller outweigh those of the data subject (Art. 18 GDPR).

• The right to object to the processing of personal data on personal grounds, unless there is an overriding public interest in processing which outweighs the interests, rights and freedoms of the data subject, or the processing is necessary for the assertion, exercise or defence of legal claims (Art. 21 GDPR).

Right of revocation in case of consent
You have the right to revoke your consent to data processing at any time. The revocation is only effective for the future; i.e., the revocation does not affect the lawfulness of the processing already carried out based on the consent given until the time of revocation.

XIV. Right of appeal to the supervisory authority

You have the right to complain to the Rhineland-Palatinate State Commissioner for Data Protection and Freedom of Information (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) if you believe that your personal data is being processed unlawfully by TUK.

Postal address:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Postfach 3040
55020 Mainz
Website: www.datenschutz.rlp.de

XV. Changes to the TUK data protection declaration

In order to take into account current legal requirements and technical changes, as well as to implement our services and offers in compliance with data protection, we reserve the right to update this privacy statement regularly. The current status is December 2020.

Please note that only the German version of this data protection declaration is legally binding. The English version is for information purposes only.