Technical University of Applied Sciences Würzburg-Schweinfurt (THWS)

THWS is represented by its President.

Münzstraße 12
97070 Würzburg
Phone: +49 931 3511-0
E-mail: praesidialamt[at]thws.de

Data Protection Officer at the Technical University of Applied Sciences Würzburg-Schweinfurt (THWS)
Münzstraße 12
97070 Würzburg
Phone: +49 0931 3511-6094
E-mail: datenschutzbeauftragter[at]thws.de

Under the General Data Protection Regulation, you have the following rights:

• If your personal data is being processed, you have the right to obtain information about the data stored about you (Article 15 GDPR). Should inaccurate personal data be processed, you have the right to have it rectified (Article 16 GDPR).
• Provided the legal requirements are met, you may request the erasure or restriction of processing, and you may object to the processing (Articles 17, 18 and 21 of the GDPR).
• If you have consented to the processing of your data or there is a contract governing the processing of your data, and the processing is carried out using automated means, you may have a right to data portability (Article 20 of the GDPR).

Should you wish to exercise the rights set out above, the public body will assess whether the legal requirements for doing so have been met.

You also have the right to lodge a complaint with the Commissioner for Data Protection of the Free State of Bavaria.

Purposes & legal bases for processing

Your data is processed in order to provide you with a secure means of exchanging files and to enable you to collaborate on shared documents with other users.

Legal basis for the processing of personal data in relation to the provision of the service:

Your consent, given by registering with the THWS Cloud, forms the legal basis for the processing (Article 6 (1) lit. a) of the GDPR)

Personal data processed

In addition to the personal data processed as set out in the general data protection regulations of THWS, the following data is processed by the THWS Cloud:

General

• Activities (actions carried out within the system, e.g. uploading files)

Upon registration:

• THWS password
• k-number/user ID, THWS e-mail address
• Timestamp of the login

When uploading files and documents

• Content data (everything you upload to the THWS Cloud)
• Time of upload
• Total file size of the files in your directory & storage quota
• Date and time of the request

When collaborating on documents (optional)

• Time of editing
• User ID of the editors
• All changes made to the documents, with timestamps

When customising (optional*)

• Profile picture
• Telephone number
• Postal address
• Website
• Twitter handle
• Language
• Region code

*You can choose which groups of people are allowed to view your individual profile details. By default, your profile picture, e-mail address, and name are set to be visible to local users and trusted servers. Your telephone number, address, website, and Twitter handle are set to private.

Retention period for personal data

We do not retain your personal data for longer than is necessary for the specified purpose of processing.

Recipients of personal data

Your personal data will not be disclosed to third parties. However, the THWS ITSC may, in individual cases, use this data to investigate network disruptions and security threats.

Summary

At THWS, electronic remote examinations can be taken. This also involves the processing
of personal data. For remote examinations (including practice examinations), we use the
EvaExam system, with video supervision provided via Zoom.
We also use Zoom for remote oral and practical examinations.
Proctorio is used for monitoring purposes only for online degree programmes.

If you have any questions regarding data processing, please feel free to contact the following points of contact:

Responsibility	Contact point
Organisation and practical delivery of a specific examination	Your respective lecturers
THWS-wide framework conditions for digital examinations	Center for Digital Teaching (ZDL) zdl[at]thws.de
Data protection aspects of digital examinations	Data Protection Officer dsb[at]thws.de

 

Purpose, retention periods and legal bases for data processing

Purposes of processing

Purpose	Categories of personal data	Applications	Retention periods
Transfer and processing of examination questions and examination papers	Examination details, examination papers	EvaExam	In accordance with the examination regulations
Video supervision for distance-learning examinations and distance examinations, as well as authentication	Video and audio of the students taking the examination, photo ID	Zoom	No permanent storage.
Practice exams	Exam details, assessment results	EvaExam	Exercise results are stored until further notice or until consent is withdrawn
Communication regarding exam organisation	Video and audio recordings of the students taking the examination, communication data	Zoom	There is no permanent storage of the communication.
Browser shutdown and screen recording	Screen and technical log data of the students taking the examination	Proctorio	Deleted after 6 months

Archiving regulations remain unaffected.

Legal basis

Generally speaking, no information is disclosed to third parties. However, when carrying out system maintenance, we are supported by service providers.

Application Recipient
EvaExam       evasys GmbH, Konrad-Zuse-Allee 15, 21337 Lüneburg
Zoom             Zoom Video Communications, Inc. and affiliated companies
as well as sub-processors
Proctorio       Proctorio GmbH, Lindleystr. 8 A, 60314 Frankfurt and affiliated companies
and sub-processors

 

International data transfer
Note: System notifications on Android and iOS, maintenance operations or the provision of
licences may require international data transfer.

Application	International data transfer	Safeguards and additional measures	Privacy policy
Telekom Deutschland GmbH operates Zoom X for DFN under  Zoom Video Communications, Inc.	Possible	https://media.zoom.com/download/assets/zoom-global-dpa.pdf/dd327ebea27e11efb613d6ba63ed4cee?cms_guid=false https://www.zoom.com/de/trust/	https://geschaeftskunden.telekom.de/business/loesungen/digitalisierung/zusammenarbeit-produktivitaet/zoom-x/dfn-zoom  https://geschaeftskunden.telekom.de/business/loesungen/digitalisierung/zusammenarbeit-produktivitaet  https://www.zoom.com/de/trust/privacy/privacy-statement/
Zoom sub-processors	Possible	Standardvertragsklauseln und Binding Corporate Rules mit zusätzlichen Maßnahmen	https://www.zoom.com/de/trust/subprocessors/
Proctorio	Possible	proctorio.com/privacy;	proctorio.com/privacy;

Right to choose when taking electronic remote examinations

In addition to the general rights of data subjects, under Section 8 of the Bavarian regulation for testing remote examinations (Bayerische Fernprüfungserprobungsverordnung, BayFEV), you have the right to choose between an electronic remote examination and a face-to-face examination held on the same date.

Information on integrating video conference services into teaching

Some lecturers use video conference software to support individual courses. Depending on how the lecturer uses this software to support their lecture, personal data may be collected.
For certain processing activities, your separate consent is required, which lecturers must obtain from you. This applies, for example, to the recording and publication of video and audio recordings of students.

In the privacy notice on the use of video conferencing software in teaching, we provide further information on this page under 'Video conference services in digital teaching'.

Purposes & legal bases for processing

Your data is processed in order to provide you with digital teaching materials.
This processing is carried out on the basis of Article 6 (1) lit. e) of the GDPR and Article 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Articles 2 and 55 of the Bavarian Higher Education Innovation Act (BayHIG) and the Act on Digitalisation in the Free State of Bavaria (Bavarian Digital Act - BayDiG); Article 32 of the Bavarian Data Protection Act (BayDSG);

Some of the services contained in e-learning.thws are offered on the basis of the users' consent. In this case, the legal basis for the processing is Article 6 (1) lit. a) of the GDPR.
Consent to the processing of personal data beyond the mandatory details may be withdrawn at any time by sending an e-mail to the administrator.

Links to and integration of third-party content

In our endeavour to offer you comprehensive and high-quality teaching at all times, we incorporate content from external service providers into certain teaching materials and courses. Accessing content from these external providers results in the transfer of personal data to them. The relevant service provider may also set cookies in your browser.

The data protection provisions of the respective third-party providers apply.

You can recognise that a third-party provider is involved by the link or the provider’s logo.

In this PDF, you will find the third-party providers regularly used on elearning.thws.de: List of third-party providers

Data processing on behalf of THWS (data processing by a processor)

In exceptional cases, we use data processors in certain courses who process personal data on our behalf. Where such processing of personal data takes place, you will be informed of this separately.

In this PDF, you will find a list of our data processors for elearning.thws.de: Data processors for elearning.

 

Retention period for personal data

We do not store your personal data for longer than is necessary for the specified purpose of processing.

Privacy notice regarding the use of eLearning.thws.de

1. Using the service allows you to view course-related content. To take part in eLearning@thws, your personal data is collected and stored in an internal database; this includes, as a minimum, the mandatory details of first name, surname, e-mail address, and location (place of study), and username – without which an eLearning@thws account cannot be set up. In addition, you may voluntarily provide further details in a 'personal profile' and control their visibility to varying degrees, e.g. whether your e-mail address is visible to other users. eLearning@thws also enables you to publish posts under your name in forums, chats, blogs, wikis, etc., and to make files available for other participants to access. 2. When using eLearning@thws, your posts and activities are stored in server logs and within the Moodle software, insofar as this is necessary for the personalised features in Moodle. Neither course coordinators (e.g. in the role of 'lecturer') nor other course participants (e.g. in the role of 'participant') have access to this log data. Course coordinators (in the role of 'lecturer') have access to so-called activity reports for the purposes of teaching, organising teaching, and monitoring learning outcomes in the relevant course. These overviews display individual contributions to activities such as forums, wikis, blogs, or assignments. This data may be used exclusively for teaching purposes, insofar as this is necessary to fulfil the relevant tasks and the data processing, in accordance with the principle of data minimisation, is proportionate to the purpose for which it is carried out. 3. Persons entrusted with the technical administration of the eLearning@thws system (e.g. in the role of 'administrator') and of the database and web server have access to all personal data stored in the system. They may process this data only to the extent necessary to ensure the operation of eLearning@thws. They must neither disclose this data to unauthorised third parties nor make it accessible to them. 4. When using eLearning@thws, the data protection regulations and the provisions of the ITSC at the Technical University of Applied Sciences Würzburg-Schweinfurt (see itsc.thws.de/itsc/nutzung-der-it-infrastruktur/) must be observed. 5. The personal data processed in eLearning@thws will not be passed on to third parties or used for purposes other than those intended, unless permitted by law or where consent has been given. 6. You may request that your eLearning@thws account, including the mandatory details, be deleted at any time by contacting the administrator (elearning@thws.de) of the eLearning@thws system. Excluded from automatic deletion are any posts you have published on eLearning@thws in forums, chats, blogs, wikis, etc., or files made available for download, which will remain accessible until the relevant eLearning@thws course is deleted. If you also wish to have the content you have created deleted, please inform the administrator. 7. The publication of eLearning@thws courses for presentation purposes is permitted only by exporting the data contained in the course – excluding user data – into a new course. Personal data must be removed from the course content or anonymised prior to publication. The consent of participants is required for the presentation of their contributions.

Information on the transfer of personal data to Microsoft in light of the European Court of Justice's judgement in Case C-311/18 ('Schrems II')

THWS and Microsoft have entered into a data processing agreement. This agreement includes the Standard Contractual Clauses (SCCs) as well as additional safeguards. Furthermore, THWS uses Microsoft cloud products with great restraint. Care is also taken to ensure that the products used are configured to minimise data usage as far as possible. Further information can be found on the Microsoft 365 page of the IT Law Center for Bavarian universities and higher education institutions.

 

Alternative services

There are free open-source office suites such as LibreOffice or OpenOffice, which may offer an alternative for users at THWS.

Responsible body and contact details

In addition to the organisations mentioned above, the following entity is responsible for the processing of your personal data on the Microsoft website:

Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland

As well as

Microsoft Corporation
One Microsoft Way, Redmond, Washington 98052

Further information, answers, and contact details can be found on the Microsoft Learn page "Microsoft Privacy".

 

Purposes and legal bases for processing

At THWS, we use the Microsoft Office products from Microsoft 365 to work on teaching, research, and administration documents. This includes the use of licensed products and services, the provision of updates, ensuring information security and providing technical support.

For THWS and individuals who can be identified in communications and documents

Article 6 (1) lit. e) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) (in particular Section 3a of the Workplace Data Protection Regulation (ArbStättV), Article 13 of the Bavarian Public Administration Act (BayBGG), Article 11 (1) of the Bavarian E-Government Act (BayEGovG), Section 13 (7) of the Telecommunications Act (TMG), Article 6 (1) of the Bavarian Data Protection Act (BayDSG), Article 10 (1) of the Bavarian Higher Education Act (BayHSchG), Article 7 of the Bavarian Public Finance Act (BayHO), Article 20a of the German Basic Law (GG), Articles 3, 3a and 141 of the Bavarian Constitution (BayVerf))

For individuals who use Office 365 in their capacity as employees

Furthermore, Article 6 (1) lit. b) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) (Section 106 of the Trade Regulation Act); for civil servants, also Article 6 (1) lit. c) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) (Article 33 (5) of the German Basic Law)
Legal bases for disclosure to Microsoft (beyond data processing on behalf of a controller)
For licensed individuals: Article 6 (1) lit. b) of the GDPR and Article 49 (1) lit. c) of the GDPR (no. 1 and 6)
For purposes not required by contract: Article 5 (1) Sentence 1 No. 2 of the Bavarian Data Protection Act (BayDSG), Article 49 (1) lit. d) of the GDPR (no. 2–5, 7, 8)

Description and scope of data processing

Operation of Microsoft 365 and its services

Data categories

1. Documents and files (use of Microsoft cloud services at THWS currently not intended)
2. Tasks and solutions (use of Microsoft cloud services at THWS currently not intended)
3. Communication data (use of Microsoft communication services currently not intended)
4. Basic personal data
5. Authentication data
6. Contact information
7. Profiling
8. Log files containing access records
9. System-generated log data

Categories of data subjects

• For data categories 1–9: individuals who use or administer Microsoft 365
• For data categories 3, 8 and 9: individuals who are identifiable in communications and documents

Provision of the Microsoft 365 service

To provide the Microsoft 365 service, data from the THWS user directory (MS Active Directory as an on-premises installation) must be synchronised with the THWS online user directory on Microsoft servers (Azure Active Directory), and a linked Microsoft account must be created.

The following data is synchronised:

• E-mail address
• Account name
• First name, surname
• Organisational affiliation (THWS, faculty / division / department)
• Telephone number at work

Recipient

• Microsoft Ireland Operations Limited, for the purposes of data processing on behalf of the controller and the performance of the contract
• Microsoft Corporation, for the purposes of data processing on behalf of the controller, contract performance and its own purposes
• As well as their sub-processors and support service providers

Deprovisioning and deletion of your accounts and data

On the date the contract ends, you leave THWS, or your guest account expires, use of the account ceases and it is prepared for deletion.

• 90 days after the account has been deleted upon request or following an objection (data categories 4-7)
• 90 days after the deletion of content data, once it is no longer required (data categories 1-3)
• 180 days for data categories 8 and 9

Description and scope of processing

At THWS, records are kept electronically (E-Akte). Consequently, documents received by post are digitised before being forwarded to the relevant recipients. Exceptions to this are irrelevant documents (e.g. advertising), as well as those marked as confidential or personal, or those intended for the THWS Human Resources department. Incoming post is accepted at THWS’s post offices and, unless otherwise marked, undergoes a visual inspection: it is opened, scanned, and the digitised version forwarded to the relevant recipient. The paper documents are stored securely for an appropriate period of time and subsequently destroyed using a suitable disposal method. The digitisation procedure complies with BSI TR-03138 (TR-RESISCAN).

Purposes and legal basis

The purpose of data processing is to fulfil legal obligations through the operation of a digital filing system.
Article 6 (1) lit. e) of the GDPR, Article 4 of the Bavarian Data Protection Act (BayDSG) in conjunction with the Bavarian Higher Education Innovation Act (BayHIG), and Article 6 (1) lit. c) of the GDPR in conjunction with Article 33 of the Act on Digitalisation in the Free State of Bavaria (Bavarian Digital Act - BayDiG)

Categories of data

• Work-related address details of the recipients
• Address details of the senders
• Any personal data contained in the documents, where applicable

Data subjects

Senders and recipients, as well as third parties whose data may be contained in the documents.

Recipients of the data

The data is stored at THWS.

In the process described here, service providers are engaged for system maintenance. Data processing agreements in accordance with Article 28 of the GDPR have been concluded with these providers.

Further information

Further information on the procedure is available, subject to verification of your legitimate interest, via the contact details of the THWS Data Protection Officer provided above.

General information on processing

E-mails are an important means of communication for THWS. To enhance data security in e-mail communications, THWS also implements technical measures. One such measure is the screening of e-mails. To this end, THWS works closely with trusted European partners with whom data processing agreements have been concluded in accordance with Article 28 (GDPR).

Purposes and legal bases for processing

The purpose of the processing is to enhance security within THWS's IT infrastructure.
Legal basis
Compliance with legal obligations
Article 6 (1) lit. c) of the GDPR & Article 32 of the GDPR; Article 32 of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 43 (1) of the Act on Digitalisation in the Free State of Bavaria (Bavarian Digital Act - BayDiG); Article 6 (1) of the Bavarian Data Protection Act (BayDSG), §19 (4) of the TTDSG, § 4 of the THWS IT User Regulations.

Special note regarding training e-mails

In individual cases, it may be necessary to forward false-positive messages to our service providers in order to train the spam/phishing filter. These cases are based on your consent (Article 6 (1) lit. a) of the GDPR).

 

Description and scope of data processing

Incoming and outgoing e-mails are automatically analysed for
-    validity and legitimacy,
-    spam and phishing,
-    viruses and malware
and assessed accordingly.
A negative assessment may result, amongst other things, in e-mails being blocked, senders being blocked, e-mails being moved to quarantine, or e-mails being deleted.

Special feature: training e-mails

In individual cases, potential phishing e-mails that have been flagged as false positives may, at the recipient's request, be manually forwarded to a THWS staff member. As a result, similar messages or messages from similar senders will no longer be blocked by the spam and phishing protection system in future.

The training e-mails are stored to ensure the operation of the training database and are deleted after 3 years at the latest.

Data categories

-    Connection and metadata (sender's e-mail address, recipients' e-mail addresses, IP address of the e-mail servers, server name of the e-mail servers, timestamps of contact points, spam/e-mail check assessments, encryption algorithms used for data transmission between servers (TLS version, …)  …)
-    Content data (subject line, e-mail content, attachments)

Data subjects

All persons who send e-mails to or receive e-mails from THWS.

Recipients of the data

The data is processed as part of the procedure described above by trusted partners of THWS on its behalf. Further information on the procedure is available, subject to verification of your legitimate interest, via the contact details of the THWS Data Protection Officer provided above.

Data controller and contact details

Contact the MAINBEAT team: https://mainbeat.thws.de/
University Media Center as operator of the technical infrastructure: https://hmz.thws.de/

Purposes and legal bases for processing

MainBeat forms part of the practical training provided to students at THWS. As part of, or as a practical supplement to, various modules, students produce audio features and interviews and run a radio stream with an optional video stream or podcasts. These are published on the website https://mainbeat.thws.de/ as part of the students' practical training and the University's public relations work.

For individuals participating as guests and interviewees, as well as participating students

Consent pursuant to Article 6 (1) lit. a) of the GDPR 

For THWS

Article 6 (1) lit. e) of the GDPR and Article 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 2 of the Bavarian Higher Education Act (BayHSchG)

Furthermore

Article 6 (1) lit. c) of the GDPR in conjunction with Article 3 of the Bavarian Higher Education Act (BayHSchG), as well as Article 5 of the German Basic Law (GG) and Article 108 of the Bavarian Constitution (BayVerf)

Description and scope of data processing

Live audio recordings and recordings made during live interviews in radio streams, as well as interviews conducted in the run-up to publication, are published.

Data categories

• Personal details of the interviewee or participating students (surname, first name)
• Details of the reason for the interview
• Recording of the spoken word
• Optional and at the participant's own initiative: video stream of the student moderators

Data subjects

• Interviewees and guests
• Students conducting the radio streams

Recipients of the data

The data is published online as part of the release of the radio streams, video streams, programmes and recordings, and is accessible worldwide via the website mainbeat.thws.de, amongst other channels.

Purposes and legal basis for processing

Purposes

At THWS, we use video conference software to:

• support individual courses and facilitate interactive teaching sessions
• to hold digital one-on-one meetings and to support the efficient performance of THWS’s administrative, research, and teaching duties
• to enable THWS to carry out its duties in times of crisis, for example by organising hybrid events.

In doing so, personal data is processed through the use of video conference services.

For certain processing situations, your separate consent is required, which the meeting organisers or event organisers must request. This applies, for example, to the recording and publication of video and audio recordings of participants. The meeting organiser can provide you with details of the specific purposes.

Legal basis

Processing is carried out on the basis of:

• For students:
  • Article 6 (1) lit. e) of the GDPR and Article 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 2 of the Bavarian Higher Education Act (BayHSchG), Article 55 (2) of the Bavarian Higher Education Act (BayHSchG), Article 11 (1) and Article 2 of the Bavarian E-Government Act (BayEGovG); Article 32 of the Bavarian Data Protection Act (BayDSG)
  • Article 6 (1) lit. c) of the GDPR and Article 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Article 61 (10) of the Bavarian Higher Education Act (BayHschG) in conjunction with the Bavarian regulation for testing remote examinations (Bayerische Fernprüfungserprobungsverordnung, BayFEV

• For employees and staff:
  • Article 6 (1) lit. c) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) and Section 3a (1) of the Workplace Regulations (ArbStättV)
  • Article 6 (1) lit. b) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) and Section 106 of the Trade Regulation Act (GewO)
  • Article 6 (1) lit. c) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) and Article 33 (5) of the German Basic Law (GG)

Some of the processing carried out using the video conference services is based on your consent (Article 6 (1) lit. a) of the GDPR). Consent is sought separately by the meeting organisers.

Recipients of personal data

Your personal data is collected and processed by the service providers in accordance with their privacy policies.

THWS has entered into appropriate contracts with the service providers.

Operator	Further information on processing
Zoom Video Communications, Inc. via DFN's Zoom framework agreement with Telekom	DFN & Telekom framework agreement: https://www.conf.dfn.de/aktuelles https://geschaeftskunden.telekom.de/magenta-business-collaboration/video-konferenzen/dfn-zoom?wt_mc=alias_dfn-zoom Homepage: zoom.us Privacy policy: zoom.us/de-de/privacy.html Terms of use: zoom.us/de-de/terms.html
DFN Conf	Homepage www.conf.dfn.de Privacy policy www.conf.dfn.de/datenschutz/

Retention period for personal data

We do not retain your data for longer than is necessary for the specified purpose of processing.

Alternative data controller:

The specific data controller is named on the notice board displayed at the surveillance location.

Purposes and legal bases for processing

Your data is processed for the purposes of fire safety and early fire detection.

Legal bases for the processing of personal data:

Article 6 (1) lit. c) of the GDPR in conjunction with Article 24 (1) No. 1 of the Bavarian Data Protection Act (BayDSG) and Section 3 and Section 9 (2) of the Occupational Safety and Health Act (ArbSchG)

Personal data processed

If you are within the camera’s designated monitoring area, your image will be recorded and stored.

Retention period for personal data

We store your personal data for 7 days. It is then automatically deleted.

Recipients of personal data

Your personal data will not be disclosed to third parties.

Purposes and legal basis for processing

Your data is processed to enable you to access teaching, research and administrative content securely from a remote location via a connection to the THWS university network. This includes dedicated IT services provided by THWS and external websites/services that can only be accessed from within the THWS network. Your data is also processed to help ensure the security of the THWS university network.

To this end, we use a Virtual Private Network (VPN).

Legal basis for the processing of personal data in relation to the provision of the service:

Article 6 (1) lit. e) of the GDPR in conjunction with Article 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Articles 2 and 55 of the Bavarian Higher Education Act (BayHSchG) and Article 4 (1) of the Bavarian E-Government Act (BayEGovG);

Legal bases for the processing of personal data in relation to network security:

Article 6 (1) lit. c) of the GDPR in conjunction with Article 11 (1) of the Bavarian E- Government Act (BayEGovG); Section 13 (7) of the German Telemedia Act (TMG); Section 100 (1) of the German Telecommunications Act (TKG); Article 32 of the GDPR; Article 32 of the Bavarian Data Protection Act (BayDSG);

Personal data processed

When using the THWS VPN, the following categories of personal data are processed.

In general:

• public IP address of the THWS member
• source port
• destination IP
• login time / logout time
• connection duration
• amount of data transferred
• account name

Additionally via the VPN client:

• VPN client IP

Additionally via the browser:

• Device data such as the web browser used, the browser version and the operating system used, as well as the screen resolution
• Access status
• Date and time of the request

Duration of storage of personal data

We do not store your personal data for longer than is necessary for the specified purpose of processing. Your data will be deleted after 90 days at the latest, unless there are compelling legal reasons not to do so.

Recipients of personal data

Your personal data will not be disclosed to third parties. However, the THWS ITSC may, in individual cases, use this data to investigate network disruptions and security threats.