In this privacy notice, we explain how we process your personal data in connection with online surveys (using computer-based survey systems). For additional information on how we handle your personal data, please refer to the general privacy policy on our website: https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data controller within the meaning of Article 4(7) of the GDPR:
Ravensburg-Weingarten University of Applied Sciences
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
The university uses IT-based survey systems to conduct, create, evaluate, and, where applicable, publish web-based surveys. Online surveys may be conducted, in particular, in connection with academic studies and teaching, research projects, theses, evaluations, quality management, organizational inquiries, feedback formats, or other university-related projects.
The survey results are recorded in the respective survey system and can be analyzed, exported, and further processed for project-specific purposes by the individuals responsible for the survey. The evaluation is typically conducted in aggregated or anonymized form. To create and manage surveys, registration in the respective survey system is generally required. Participation in surveys, however, is generally possible without registration, unless the specific survey provides for a different arrangement.
Directly identifiable data, such as a name or email address, is generally not collected unless it is necessary for the specific purpose of the survey. Depending on the survey’s design, participation may be anonymous, pseudonymous, or personally identifiable. Even in surveys that are generally designed to be anonymous, the possibility of identifying an individual cannot be completely ruled out if individual pieces of information or combinations of characteristics—particularly in small participant groups—allow conclusions to be drawn about specific individuals.
Data Categories
Whether and which types of personal data are processed as part of an online survey depends on the specific design and purpose of the survey. Typically, the following categories of data may be processed:
- Information about the individual or status group, e.g., age, gender, degree program, academic department, semester, employee group, or other classifications
- demographic or general information, e.g., region of residence, educational level, professional background, or other sociodemographic characteristics
- Substantive responses provided as part of the survey, e.g., assessments, experiences, evaluations, usage information, interests, preferences, or other information related to the survey topic
- voluntary information provided in free-text fields, if such fields are provided
Depending on the subject of the survey, special categories of personal data as defined in Article 9 of the GDPR may also be involved, such as health data, information regarding ethnic origin, religious or philosophical beliefs, or other particularly sensitive information. Such data is processed only if it is intended for the specific purpose of the survey and is permitted under data protection law.
In addition, depending on the survey system used and its technical configuration, the following system data may be processed:
- IP addresses of participants
- Browser cookies, e.g., to prevent multiple entries
- Browser type, browser version, and operating system used
- Date and time stamps
- Technical log data related to the operation and security of the survey system
- CAPTCHA checks or comparable security mechanisms, if applicable
Legal Basis
The processing of personal data in the context of online surveys is generally based on the consent of the participants in accordance with Article 6(1)(a) of the GDPR. Participation in online surveys is voluntary. Consent that has been given may be withdrawn at any time with future effect. Where possible, the withdrawal of consent should be communicated directly to the person responsible for the respective survey. Alternatively, the withdrawal may also be directed to the contact information provided for the data controller or the data protection officer. Please note that revocation and the associated deletion or association of individual data records are only possible if the relevant information can be associated with a specific person or a specific data record. In the case of surveys conducted anonymously or largely anonymously, such association is generally not possible or only possible to a limited extent.
To the extent that special categories of personal data within the meaning of Article 9(1) of the GDPR are processed in the context of an online survey, the processing is based on explicit consent pursuant to Article 9(2)(a) of the GDPR, unless another specific legal basis applies.
If online surveys are conducted as part of the university’s statutory or higher education-related duties, particularly in connection with quality assurance, evaluation, research, student studies, teaching, or the organization of university operations, the processing may additionally or alternatively be based on Article 6(1)(e) of the GDPR in conjunction with the relevant university regulations.
To the extent that survey results are evaluated or published exclusively in anonymized form and it is not possible to identify individual persons, the data no longer constitutes personal data. In this case, individual pieces of information can generally no longer be attributed to a specific person.
Recipients and Transfers to Third Countries
The information collected through online surveys is generally not disclosed to uninvolved third parties, unless it is specifically intended for disclosure or publication or there is a legal obligation to disclose it. Please note that the content and results of online surveys typically constitute project-related data. They may therefore be disclosed to individuals involved in the implementation, supervision, evaluation, or other processing of the respective survey project. This may include, in particular, project managers, survey creators, supervisors, instructors, researchers, internal departments, or other units involved in the respective project.
To the extent that survey results are evaluated in an aggregated or anonymized manner and do not allow for identification of individual persons, these results may also be published or shared with internal or external project participants.
IT-based survey systems from external providers may be used for the technical provision and conduct of online surveys. To the extent that personal data is processed by the respective provider on behalf of the university, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR. Depending on the survey system used, the following providers, for example, may be considered:
LimeSurvey: When conducting surveys using the “LimeSurvey” software solution, data may be transferred to LimeSurvey GmbH, Papenreye 63, 22453 Hamburg, Germany.
SoSci Survey: When conducting surveys using the “SoSci Survey” software solution, data may be transferred to SoSci Survey GmbH, Erchanberstr. 6, 81929 Munich, Germany.
Microsoft Forms: When conducting surveys using the “Microsoft Forms” software solution, data may be transferred to Microsoft Ireland Operations Limited, South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland.
In the case of survey system providers with headquarters or corporate affiliations outside the European Union or the European Economic Area, the possibility of a connection to a third country cannot be completely ruled out. This may apply in particular if providers, parent companies, affiliated companies, support structures, or subcontractors are located outside the EU or the EEA. To the extent that personal data is transferred to a third country in this context or access from a third country cannot be ruled out, this occurs only under the conditions set forth in Art. 44 et seq. of the GDPR. The basis for this may include, in particular, an adequacy decision by the European Commission pursuant to Art. 45 of the GDPR or appropriate safeguards pursuant to Art. 46 of the GDPR, specifically the EU Standard Data Protection Clauses.
Retention Period
Personal data from online surveys is stored only for as long as is necessary for the conduct, evaluation, and documentation of the respective survey project.
To the extent possible given the purpose of the survey, the collected data will be anonymized or analyzed in aggregated form at the earliest possible time. Once anonymized, individual pieces of information can generally no longer be attributed to a specific person. Anonymized or aggregated results may be reused for analyses, reports, publications, research purposes, educational purposes, quality assurance, or to document the respective project.
The specific retention period depends in particular on the purpose of the survey, the nature of the project, scientific or organizational requirements, and any documentation or record-keeping obligations. Typically, personal survey data is stored for the duration of the respective project and a reasonable follow-up period. Depending on the project, this may range from a few months to several years.
If different or more specific retention periods apply to a particular survey, these will be specified separately as part of that survey.
Consequences of Non-Participation
Participation in online surveys is voluntary. You are under no legal or contractual obligation to provide personal data as part of an online survey. If certain information is required for the conduct or evaluation of the respective survey, participation without this information may not be possible or may be limited. This may apply in particular to required fields within the survey or to technically necessary system data.
If certain details are voluntary, you can generally continue the survey without providing them, provided the specific survey allows for this. Generally, there are no further consequences resulting from non-participation or the failure to provide voluntary details, unless otherwise specified in the context of the respective survey.
Automated Decision-Making
Automated decision-making within the meaning of Article 22 of the GDPR does not take place. Should we use automated decision-making processes in individual cases in the future, we will provide separate information about this, to the extent required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may request that inaccurate data be corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided the legal requirements are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object to the processing of your data at any time for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) of the GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the data protection officer or the data controller.
Timeframes for Complying with Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right of the data subject or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15