Brandenburg University of Technology Cottbus - Senftenberg (BTU)
Represented by its president Prof. Dr. Gesine Grande

Platz der Deutschen Einheit 1
03046 Cottbus
Phone +49 (0)355 69 2283
Fax: +49 (0)355 69 2156
Email: praesidentin(at)b-tu.de

BTU processes the personal data only for the fulfillment of its university tasks and its legal duties within the framework of the applicable data protection regulations.

The purpose and legal bases of the data processing result for the data processing from Art. 6 sec. 1 b) - e) GDPR and the respective federal and state law special regulations. 

So the BTU processes, for example, personal data on the basis of sec. 15 (11) Brandenburg Higher Education Act (BbgHG) in connection with sec. 1 Enrollment Regulations for applicants, students, doctoral students, examination candidates and external users of higher education institutions, which are in particular required for enrollment, re-registration, participation in courses, examinations, the use of higher education institutions, the participation in the evaluation of teaching and studies and for university planning.

Personal data of applicants and employees are processed on the basis of sec. 26 Brandenburg Data Protection Act (BbgDSG), if applicable for civil servants, in connection with sec. 94 Public Servants Act (LBGBbg), if this is necessary for the beginning, carrying out, termination or liquidation of the service or employment relationship, or to carry out internal, planning, organizational, personnel, social or budget and cost-calculation measures, in particular for the purpose of personnel planning and personnel allocation, or which are stipulated in a legal regulation, a collective agreement or an authority or company agreement (collective agreement).

In the context of research projects, BTU processes data for scientific and historical research purposes on the basis of sec. 25 BbgDSG if the data subject's legitimate interests are not impaired due to the nature of the data, due to their obviousness or due to the type of use or if the public interest for the carrying out of the research project prevails over the legitimate concerns of the data subject and the purpose of the research cannot be achieved in another manner.

As far as data is collected in connection with contractual relationships, data processing is carried out for the performance of the contract and necessary pre-contractual measures (e.g. responding to inquiries of the data subject, processing contract offers, etc.) according to Art. 6 sec 1 b GDPR).

In addition, BTU fulfills its data processing and documentation obligations in accordance with labor law, social security, tax and subsidy regulations (e.g. sec. 147 Tax Code (AO), sec. 14 b Sales Tax Act (UStG); sec. 257 (4) of the Commercial Code (HGB); sec. 257 HGB; sec. 94 et seq. State Civil Service Act (LBG Bbg), sec. 3 Collective Agreement Public Service of the States (TV-L), sec. 16 Working Hours Act (ArbZG), sec. 17 Minimum Wage Act (MiLoG)).

The collection of personal data with the help of optical-electronic equipment (video surveillance) and their further processing may be carried out at BTU if this is required for the fulfillment of the tasks of BTU, to exercise the house right, to protect the property or possession of BTU or the State of Brandenburg or for the control of access authorizations and if there is no indication that any predominant protectable interests of the data subjects outweigh (sec. 28 BbgDSG, sec. 4 House Rules of the BTU, sec. 903, 1004, 854, 858 German Civil Code (BGB)).

Statistical data are processed on the basis of the respective statistical laws (e.g. sec. 1 et seq. Higher Education Statistics Act (HStatG); sec. 1 et seq. Brandenburg Statistics Act (BbgStatG); sec. 1 et seq. Federal Statistics Act (BStatG)).

If voluntary information is provided by a data subject, it is assumed as a consent given to BTU and as a voluntary consent to the processing of this data. In this case, the processing is carried out on the basis of Art. 6 sec. 1 a) GDPR.

More details on the respective individual purpose of the data processing and the concrete individual legal basis can be obtained by datenschutz(at)b-tu.de.

In the context of the fulfilling of its public tasks, Art. 6 (1) f GDPR does not apply to the BTU.

The processing of the data is carried at BTU by the respectively responsible specialist departments, faculties and specialist areas. The disclosure of data within BTU is given to the professionally responsible employees, who are required to maintain confidentiality as employees of the public service or as civil servants.

If BTU uses data processing to assist processors, disclosure to the processor will be made on the basis of and within the framework of Art. 28, 29 GDPR.

Data is only forwarded to the recipients who are legally responsible insofar as there is a legal obligation (e.g. central employment office (ZBB) for employment and labor law tasks, health insurances within the framework and professional associations within the scope of their respective responsibilities, tax offices for tax information, statistical authorities for statistical data, funding providers and state supervisory authorities for funding evaluation).

Data is transmitted to service providers, vicarious agents, contractual partners and funding agencies as far as necessary to fulfill the contract or task (e.g. transfer of payment data to banks for the execution of bank transfers, billing, application and processing of scholarships, subsidies, etc.).

A transfer of personal data to a third country or to an international organization (e.g. for the purpose of facilitating stays abroad, conducting joint and international degree programs, foreign teaching and scientific events, foreign and international scholarship programs and other grants, order processing) will only be carried out by BTU only under the conditions of Art. 44 et seq.

According to Art. 45 GDPR, the transfer takes place on the basis of an adequacy decision for those countries for which an adequacy decision exists according to the publication of the European Commission (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

For other countries, transfer takes place on the basis of suitable safeguards, which can be obtained from datenschutz+recht(at)b-tu.de (Art. 46, 47, 49 (1) subparagraph 2 GDPR).

In the cases of Art. 49 (1) subparagraph 1 GDPR, a transfer of personal data can also take place under on one of the following conditions:

• the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
• the transfer is necessary for the performance of a contract between the data subject and the BTU or the implementation of pre-contractual measures taken at the data subject’s request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the BTU and another natural or legal person;
• the transfer is necessary for important reasons of public interest;
• the transfer is necessary for the establishment, exercise or defence of legal claims;
• the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;
• the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.

The data will be stored at BTU only as long as necessary for the processing, in particular for the handling, the legal documentation, and as evidence of the process and if there is a legal basis for the storage. If the processing purpose or the legal basis is finished, the personal data will be erased without undue delay (Art. 17 GDPR).

If the processing is based on the consent of a data subject, the personal data will be erased without undue delay if the data subjects withdraws its consent and there is no other legal ground for the processing (Art. 17 GDPR).

More detailed information on the respective individual deadlines can be obtained at datenschutz(at)b-tu.de.

Every data subject has expressly the following rights under the General Data Protection Regulation:

Right of access by the data subject (Art. 15 GDPR)

The data subject has the right to obtain from the BTU confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and to the information according Art. 15 GDPR.

Where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

Right to rectification (Art. 16 GDPR)

The data subject has the right to obtain from the BTU without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (Art. 17 GDPR)

The data subject has the right to obtain from the BTU the erasure of personal data concerning him or her without undue delay, provided that one of the legal reasons for erasure stated in Art. 17 GDPR applies.

Right to restriction of processing (Art. 18 GDPR)

The data subject has the right to obtain from the BTU restriction of processing where one of the legal reasons of Art. 18 GDPR is met applies.

Right to object (Art. 21 GDPR)

The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 sec. 1 e or f GDPR, including profiling based on those provisions. The BTU no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

The data subject has the right to object at any time to processing of personal data concerning him or her, on grounds relating to his or her particular situation, where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Art. 89 sec. 1 GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability (Art. 20 GDPR)

If the processing is carried out on the basis of a consent or on a contract, the data subject has the right to receive the personal data concerning him or her, which he or she has provided to the BTU, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the BTU, provided that the conditions of Art. 20 GDPR are given.

If the processing is based on consent (Art. 6 sec. 1 a or Art. 9 sec. 2 a GDPR), the data subject has the right to withdraw its consent at any time. This also applies to consent granted prior to the application of the General Data Protection Regulations. The lawfulness of processing based on consent before the withdrawal remains unaffected; i.e. the withdrawal impacts only to the future.

Every data subject has the right to lodge a complaint with a supervisory authority. This right of complaint is given, for example, pursuant to sec. 77 GDPR, if the data subject considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation. For BTU is in particular responsible the supervisory authority of the State of Brandenburg:

The Brandenburg Commissioner for Data Protection and Access to Information

Dagmar Hartge
Stahnsdorfer Damm 77, 14532 Kleinmachnow
Phone: +49 (0)33203 356-0
Fax: +49 (0)33203 356-49
E-Mail: Poststelle(at)LDA.Brandenburg.de

Insofar as the processing of personal data at BTU is carried out on the basis of legal reasons (Art. 6 (1) b-e GDPR in conjunction with the respective federal and state special regulations), the provision of personal data is required by law and the data subject is obliged to provide this personal information. Failure to provide it can mean that the data subject's request cannot be fully processed and / or legal obligations cannot be properly fulfilled. This may result in legal and actual disadvantages for the data subject, as well as delays, possibly even failure to comply with existing deadlines (e.g. no enrollment, no participation in BTU events, no granting of scholarships and grants, no accounting, payments, etc.).

The same applies in case of mandatory contractual information and data.

Purely voluntarily provided information is neither legally nor contractually prescribed. No one is required to provide them, and failure to provide them will result in no further consequences.

As a rule, no automated decision-making or profiling takes place at BTU in the context of data processing. Some automated processes may take place in special programs. You can find more information on this in the data protection notices of the respective programs.