Privacy Policy
1. Name and address of the Controller
HWR Berlin
Badenstrasse 52
10825 Berlin
2. Name and Address of the Official Data Protection Officer
HiSolutions AG
Vitali Dick (data protection officer)
Badensche Str. 52
10825 Berlin
datenschutz@hwr-berlin.de
3. Data Processing in the “Recording of teaching using BigBlueButton” procedure
3.1. Purposes of Processing
Personal data is processed for the following purposes:
- Recording of courses or oral exams in online format using the BigBlueButton web conference system
- The recording is intended to enable students who are unable to attend the appointment for organizational or technical reasons to catch up on the subject matter covered. Students should be able to repeat the content taught in self-study and to prepare for exams. The recording of examinations is used to log the examination process and thus to preserve evidence for the examination procedure.
3.2. Legal Basis for Processing
The legal basis for processing is the consent of the lecturer or student whose personal data is contained in the recording to data processing in accordance with Article 6 (1) (a) GDPR. There is neither a contractual nor a legal obligation to provide the data. Consent is voluntary. It is deemed to have been granted to the lecturer if he uses the recording function of BigBlueButton after reviewing the information sheet. The lawfulness of the processing remains unaffected until the consent is revoked.
3.3. Types and Categories of Personal Data
We process the following categories and types of user data for the purposes stated in 3.1:
| Data categories | Data types | Required for |
| Records | Video, audio and text data | the provision of the recording to the students and use outside of the live session |
| Raw data | Video, audio and text data | The technical realization of the web conference |
3.4. Deletion Periods
We delete the personal data after the following periods:
| Data categories | Deletion period |
| Records | 12 months after the recording was created for recordings stored on the BBB server using an automatic deletion script |
| Raw data | Immediately after the end of the respective session |
In addition, the data will be deleted as soon as the user makes use of his right to delete the data according to Art. 13 (2) b DSGVO or revokes his consent.
3.5. Place of Processing
The BigBlueButton system is operated at the HWR Berlin. Data processing therefore takes place in Germany.
3.6. Recipients of the Personal Data and Transfer of the Data to a third Country or an International Organization
Within the university (internal recipients), the recordings can be processed by the respective lecturer and the students with access authorization. In addition, the IT department (administrators) has maintenance access to the records for maintenance and troubleshooting.
3.7. Profiling or Automated Decisions
HWR Berlin does not carry out any profiling or automated decisions.
4. General Information on Data Processing
4.1. Scope of Application
This data protection declaration applies to the processing of personal data in connection with the “Recording of online teaching” procedure at the HWR Berlin.
4.2. Scope of Processing of Personal Data
In principle, we only process the personal data of our users to the extent that this is necessary.
4.3. Rights of the Data Subject
The person affected by the processing has rights in accordance with Art. 13 – 23 GDPR, which can be asserted against the HWR Berlin. An overview of the most important rights is listed below:
- Information obligation when collecting personal data according to Art. 13 DSGVO
- Information obligation if the personal data was not collected from the person concerned according to Art. 14 DSGVO
- Right to information about data stored by the person responsible (HWR Berlin) according to Art. 15 GDPR
- Right to correction of data stored by the person responsible (HWR Berlin) according to Art. 16 DSGVO
- Right to deletion of data stored by the person responsible (HWR Berlin) according to Art. 17 GDPR
- Right to restriction of processing of data stored by the person responsible (HWR Berlin) in accordance with Article 18 GDPR
- Obligation to notify in connection with the correction or deletion of personal data or the restriction of processing according to Art. 19 DSGVO
- Right to data portability according to Art. 20 GDPR
- Right to object to data processing if processing is required under Art. 6 (1) e GDPR to perform a task that is in the public interest or in the exercise of official authority or processing under Art. 6 (1) f GDPR is necessary to protect the legitimate interests of the person responsible or a third party according to Art. 21 DSGVO.
- Right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.
- Right to notification according to Art. 34 GDPR of the person affected by a breach of the protection of personal data.
4.4. Right of Providing Information
You can request confirmation from the HWR as to whether personal data relating to you is being processed by us.
4.5. Exercise of Rights
You have the right to revoke your declaration of consent under data protection law at any time with effect for the future, whereby the revocation does not affect the legality of the data processing carried out on the basis of the consent up to the revocation.
To do this, the user sends an email to it-leitung@hwr-berlin.de or by post to
HWR Berlin
Badensche Str. 52
10825 Berlin
4.6. Right of Appeal
The person concerned also has the right to complain to a supervisory authority about the HWR Berlin. The competent supervisory authority in the state of Berlin is
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin
mailbox@datenschutz-berlin.de
4.7. Data Security
In order to protect the security of your data appropriately and comprehensively during processing and in particular during transmission, we use appropriate technical and organizational measures to ensure the security of your personal data, where necessary and based on the current state of the art. This includes in particular the restriction of access to the recording by logging in via the HWR account. The communication between the web browser and the server is encrypted via https.
5. Status, changes and validity of the general data protection declaration
This general data protection declaration is dated 06/2021. We reserve the right to regularly update this data protection declaration in order to take current legal requirements and technical changes into account and to implement our services and offers in compliance with data protection regulations. We will inform you in the event of significant changes to the legal framework. If there are changes that require renewed consent, we will send you an adapted consent and data protection declaration.