Applicant management as part of the allocation of study places

Data protection information in accordance with Article 13 subsections 1 and 2 of the General Data Protection Regulation (GDPR) on the processing of personal data in the context of the application for and allocation of study places at the Zittau/Görlitz University of Applied Sciences (HSZG).

Person responsible for data processing

Zittau/Görlitz University of Applied Sciences
Theodor-Körner-Allee 16
02763 Zittau

Please send inquiries regarding data processing to
Your request will be forwarded to the responsible department and processed promptly.

Data Protection Officer (DPO) of the controller

The data protection officer can be contacted at

DID Dresdner Institut für Datenschutz
Hospitalstraße 4
01097 Dresden

Web.: www.dids.de
Phone: +49 (0)351 / 655 772 - 0
E-mail:

Purposes of data processing

The HSZG processes your personal data as part of your application for a study place for the purposes of admission, enrolment and further teaching and study organization.

Legal basis

Categories of personal data

In addition to the data entered by applicants into the applicant portal for the purpose of the award decision, HSZG processes the following personal data to provide its website (applicant portal).

 

Processing of Log Data (Access Data)

When using the website, the following information is collected to identify errors.

  • access to pages
  • whether the access was successful
  • the time
  • The volume of data transferred
  • the IP address of the requesting computer

The IP address is stored in a truncated form, so that identification is either impossible or would require an effort that is disproportionate to the benefit gained from identifying the requesting connection.

 

Account

A user account is required to access non-public areas of the website, such as the applicant and alumni management systems. The following personal data is required to create an account: title, last name, first name, email address, and a password of your choice.

Without providing all of this information, a user account cannot be assigned, and therefore the non-public sections of the website cannot be accessed. Data processing is based on Article 6(1)(e) of the GDPR for the purpose of restricting access to non-public, protected sections of the Zittau/Görlitz University website to registered users. Account data is not disclosed to third parties. Deletion occurs upon the user’s explicit request for deletion, or automatically at the latest upon disenrolment (from university) or upon detection of misuse.

 

Automatic Login on Smartphones

When using the website with an account, users have the option to remain logged in via their smartphone. To do this, a cookie containing the encrypted login credentials is stored on the device. At the same time, a digital fingerprint of the device is stored on the server. The digital fingerprint is calculated based on several parameters. The following information is evaluated for this purpose:

  • SCREEN_SIZE_AND_COLOR_DEPTH (Screen size and color depth)
  • DEVICE_ATTRIBUTES: id, model, vendor, build, device_os_version (Attributes of the device being used: model number [not IMEI], model name, manufacturer, build number, version of the operating system in use)
  • ACCEPT_LANGUAGE (language setting)
  • TIME_ZONE (time zone)
  • DEVICE_TYPE (Device type)
  • BROWSER_TYPE (Web browser used)

 

Cookies

This application uses cookies, which are small files containing short text strings for technical processing. Without cookies—for example, if they have been disabled in your browser—you will not be able to use this application to its full extent. Only essential cookies are used. Essential cookies enable basic functions and are necessary for the website to function properly. They cannot be disabled. Below is a list of these cookies.

 

Name Content (Example) Purpose Valid until
JSESSIONID R5E0F8CC126518A2FF92F4614XYZABC Identification of the user’s current session At the end of the session
lastRefresh 1406342235039 Timestamp of the last refresh or the last time this application was accessed At the end of the session
sessionRefresh 0 Enables the client-side display of the (remaining) duration of the current user session At the end of the session
download-complete The presence of this cookie indicates to the browser that an (internal) file download has been completed. At the end of the session
cs.sys.hisinoneAutoLogin abc1234___::___def5678 If automatic login is enabled, an access key is stored here. To log out on the respective device. The server-side data can also be deleted for other devices in Device Management.
cs.sys.requestPerformance a4d76e62-eb45-44df-ad7e-19b612f36956 If performance analysis is enabled, a mapping between server-side and client-side processing of the same browser request is performed here. At the end of the session

 

Processing of Log Data to Analyze User Behavior

To optimize the website, HSZG automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. The following data is processed:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request
  • IP address

This data is not combined with data from other sources.

Receiver

Log data, account data and data from automatic logins from smartphones are not transmitted.

Storage duration

The stored log data is automatically deleted after 7 calendar days.
If the applicant’s identity (account data) is not used for the application, if the application is unsuccessful, or if enrolment does not take place for any other reason, the data will be deleted as part of the semester cleanup 9 weeks after the start of the semester. Account data is deleted upon the user’s explicit request for deletion, or automatically at the latest upon disenrolment (from university) or upon detection of misuse. If the automatic login via smartphone has not been used for 4 weeks, it is automatically deleted. In addition, the user can disable automatic login at any time via the settings in their account, e.g., if their smartphone is lost. By storing the above data associated with each device, the user can also distinguish between multiple devices in their account and, if necessary, disable automatic login for individual devices.

Rights of the data subjects

As a person affected by the processing of your personal data, you have the following rights if the legal requirements are met.

  • You have the right to information about the processing of your personal data(Art. 15 GDPR).
  • You have the right to rectification of inaccurate personal data concerning you (Art.16 GDPR)
  • You have the right to erasure of your personal data (Art.17 GDPR).
  • You have the right to request the restriction of the processing of your personal data (Art.18 GDPR)
  • You have the right to data portability of your personal data (Art.20 GDPR)
  • You have the right to object to the processing of your personal data at any time (Art.21 GDPR)
  • You have the right to withdraw your consent to data processing at any time. The lawfulness of the data processing carried out on the basis of your consent until revocation remains unaffected(Art. 13 para. 2 lit. c GDPR).
  • You have the right to lodge a complaint with the Saxon data protection officer
    (for contact details, see https://www.saechsdsb.de/kontakt).

Provision of personal data

According to Art. 13 (2) lit. e GDPR, the provision of personal data of applicants is not required by law.

However, without the complete provision of the account data, no user account can be assigned and thus the non-public areas of the website cannot be used. Without the complete provision of the personal data required for admission and enrolment, an applicant cannot be considered for the allocation of a study place.

Decision-making and profiling

No automated decision-making or profiling in accordance with Art. 22 GDPR is carried out when allocating study places.