Purpose:

• Scientific research in the context of the project
• Contacting the data subject if they wish to receive information for further support or referral to other bodies
• Publication and use of the research results

Legal basis

• Consent of the data subject (Art. 6 I a GDPR)
• Scientific research (Art. 6 I c, e GDPR, Section 3 I Brandenburg Higher Education Act (BbgHG), Section 25 Brandenburg Data Protection Act (BbgDSG))

If BTU uses the support of processors for data processing, the disclosure to the processor to carry out the processing takes place on the basis and within the framework of Art. 28, 29 GDPR.

Processing in accordance with Art. 6 I f GDPR (Art. 13 I d GDPR)

Art. 6 I f GDPR does not apply to the fulfillment of public tasks of the BTU.

Recipients of the personal data (Art. 13 I e GDPR)

• BTU employees who are responsible for processing the case (project researchers, assistants, students, etc.)
• Employees of BTU who exercise control and management functions as part of their control and management tasks (data protection officer, internal audit, faculty and university management, etc.)
• If advice/support is required: external consultants, supporters, if applicable
• Processors, if applicable

Data is processed at BTU by the relevant departments, faculties and chairs. Data is disclosed within BTU to the responsible employees who, as public service employees or civil servants, are obliged to maintain confidentiality.

Transfer to third countries and international organizations (Art 13 I f GDPR)

BTU does not transfer personal data to a third country or an international organization.

Storage period of the data (Art. 13 II a GDPR)

The storage period is determined according to the following criteria

The data will only be stored at BTU for as long as is necessary for the purpose of processing, in particular for processing, legal documentation and as evidence of the transaction and there is a legal basis for storage. If the purpose of processing or the legal basis ceases to apply, the personal data will be deleted immediately (Art. 17 GDPR). If the processing is based on the consent of a data subject, the data will be erased immediately as soon as the data subject withdraws their consent and there is no other legal basis for the processing (Art. 17 GDPR).

In particular, the following criteria for determining the storage period and erasure are relevant for data processing in the above-mentioned procedure:

• Data that is relevant for scientific research is stored until the scientific evaluation and completion of the research project. The data is anonymized as soon as this is possible according to the research purpose. Until then, the characteristics with which individual details about personal or factual circumstances can be assigned to an identified or identifiable natural person must be stored separately. They must be deleted as soon as the purpose of the research permits. Statistics and publications are only made with anonymous data. Anonymous research data can also be permanently stored and published in research databases and scientific papers.
• Documents relevant to funding law are stored in accordance with the usage and funding requirements of the grant notifications.
• Technically necessary data will be stored for as long as is necessary for the technical processing of the procedure and the verification of errors/malfunctions.
• If further advice and support is requested, the data required for advice and support.

Rights of the data subject (Art. 13 II b GDPR)

Every person affected by data processing has the following explicit rights under the GDPR

• Right of access (Art. 15 GDPR): The data subject has the right to obtain confirmation from the BTU as to whether or not personal data concerning him or her are being processed, and, where that is the case, he or she has a right of access to those personal data and to the information to be provided in accordance with Art. 15 GDPR. If personal data is transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
• Right to rectification (Art. 16 GDPR): The data subject shall have the right to obtain from BTU without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure (Art. 17 GDPR): The data subject shall have the right to obtain from the BTU the erasure of personal data concerning him or her without undue delay where one of the legal grounds for erasure listed in Art. 17 GDPR applies.
• Right to restriction of processing (Art. 18 GDPR): The data subject has the right to obtain from the BTU restriction of processing where one of the conditions set out in Art. 18 GDPR applies.
• Right to object to processing (Art. 21 GDPR): The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 I e or f GDPR, including profiling based on those provisions. The BTU shall no longer process the personal data unless the BTU demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. The data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or on a contract, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the BTU, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the BTU, where the conditions of Art. 20 GDPR are met.

Right to withdraw consent (Art. 13 II c GDPR)

If the processing is based on consent (Art. 6 I a or Art. 9 II a GDPR), the data subject has the right to withdraw consent at any time. This also applies to consent given before the GDPR came into force. This does not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal; i.e. the withdrawal only applies to the future.

Right to lodge a complaint (Art. 13 II d GDPR)

A data subject has the right to lodge a complaint with a supervisory authority. This right to lodge a complaint exists, for example, under Art. 77 GDPR if the data subject considers that the processing of personal data relating to them infringes the GDPR. The supervisory authority of the state of Brandenburg is responsible for BTU in particular: