Datenschutz
Data protection information according to Art. 13, 14 and 21 of the General Data Protection Regulation GDPR for the training platform „JuLearn”
„JuLearn” is based on the open source software Moodle (Modular Object-Oriented Dynamic Learning Environment). This enables web-based access to module- or course-related learning environments.
On the learning platform of Forschungszentrum Jülich, personal data entered by you or automatically generated by its use is processed from the first page view, but especially from the first login or registration. Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly - in particular by means of an association with an identifier such as a name, an identification number, location data, an online identifier. Your personal data will be processed in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG-neu) and other relevant data protection regulations such as the Telemedia Act (TMG).
The following information must be provided to you in accordance with Art. 13 of the General Data Protection Regulation (GDPR) when the personal data is collected:
Controller / Data Privacy Officer
Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:
Forschungszentrum Jülich GmbH
Wilhelm-Johnen-Strasse
52428 Jülich
Deutschland
Tel.: +49-2461-61-0
Website: www.fz-juelich.de / E-mail: info@fz-juelich.de
The Data Protection Officer of the controller is:
Frank Rinkens
Forschungszentrum Jülich GmbH
Wilhelm-Johnen-Strasse
52428 Jülich
Deutschland
Tel.: +49-2461-61-9005
Website: www.fz-juelich.de / E-mail: DSB@fz-juelich.de
General data processing
1.Scope of the processing of personal data
Forschungszentrum Jülich processes personal data of the users of the learning platform „JuLearn” only insofar as this is necessary for the provision of a functional website as well as the contents and services. The processing of personal data of the users is regularly only carried out with the consent of the user. An exception applies in those cases in which it is not possible to obtain prior consent for actual reasons and the processing of the data is permitted by legal regulations.
2.Legal basis for the processing of personal
Insofar as Forschungszentrum Jülich obtains the consent of the data subject for processing operations involving personal data, Art. 6 (1) a GDPR serves as the legal basis.
Insofar as the processing of personal data is necessary for the performance of tasks of Forschungszentrum Jülich which are in the public interest or for the purpose of performing the task assigned to us of supporting education and research, Art. 6 (1) lit. e GDPR serves as the legal basis. Art. 6 para. 1 lit. f GDPR is the legal basis for the data collection of the security of the information technology systems.
3.Processing of personal data
On the „JuLearn” learning platform, various data with a direct or indirect personal reference is stored and processed in different contexts. These can be divided into several data groups. The origin, scope, content, visibility, storage period of the data, access options to the data as well as the purpose and scope of the data processing, the legal basis for the data processing and the rights of the data subjects vary depending on the date, context and user group.
3.1 Data subject categories:
Teachers/Instructors
For teachers/Instructors, data is collected and processed within the framework of the employment relationship on the legal basis of Art. 6 (1) b) GDPR.
Trainees, dual students and intern
For trainees, dual students and interns, the data is collected and processed within the scope of the training relationship on the legal basis of Art. 6 (1) b) GDPR. However, Forschungszentrum Jülich, with its educational mandate, is safeguarding public interests and may be subject to specific provisions pursuant to Art. 6 (2) and (3) GDPR. In these cases, Art. 6 (1) e, the performance of a task in the public interest, would be relevant.
Employees
For employees, the data is collected and processed on the legal basis of Art. 6 (1) b) GDPR, as it cannot be assumed on a regular basis that they use the learning platform exclusively on a voluntary basis, but rather as part of their work for the controller and/or on the instruction of a teacher. Consent to the processing is not required and there is no right of revocation. This legal basis is also relevant if employees are interested in voluntary training content.
Guests
Data of guests of Forschungszentrum is collected in the course of a so-called self-registration and is entered by the guests themselves. However, the e-mail address must be an address that can actually be reached to complete the registration.
In principle, the provision and use of an operational learning platform is subject to Art. 6 (1) f, a legitimate interest of the controller.
3.2 Categories of personal data
3.2.1 Website/Webserver: Log Data
Each time „JuLearn” is called up, data and information is automatically collected by the computer system of the calling computer.
The following data is collected:
- Information about the browser type and version used
- Operating system of the user
- Internet service provider of the user
- IP address of the user
- Name, URL and transferred data volume of the retrieved file
- HTTP status code (requested file transferred, not found, etc.)
- Date and time of access
- Websites from which the user's system accesses the Internet site
- Websites that are accessed by the user's system via the website
This data is not stored together with other personal data of the user.
Purpose of data processing
The data is used to optimize the website and to ensure the security of the information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Normally, this is the case after 14 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is no longer possible.
Possibility of objection
The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility of objection on the part of the user.
3.2.2 Education and learning platform „JuLearn”: inventory data/access data
To use „JuLearn Plus” it is necessary to register by providing personal data. This is also the case if access is via the central LDAP. The following data is collected during the registration process:
- Username
- Password in encrypted form
- E-mail address
- Last name
- First name
- Moodle user ID
- Voluntary information in the profile (profile picture, own description, interests, contact data etc.)
3.2.3 Education and learning platform „JuLearn“: usage data
Usage data is generated by the activity of users in the system. The actions they can perform depend on their role. For each action within „JuLearn”, the system automatically logs the following data:
- First name, last name and Moodle user ID of the person acting
- If applicable, first name, last name and Moodle user ID of the person concerned
- IP address of the accessing computer
- Date and time of the access
- Source of the access
- Action (incl. description)
- Course concerned
In addition, „JuLearn” stores this data in the user's profile:
- Time of the first access to the website
- Time of the last access to the website
- Time of the last access to a course
- IP address last used
3.2.4 Education and learning platform „JuLearn“: Content data
Content data is also created by users themselves, depending on their role. For example, users can create content in polls, feedback surveys, hyperlinks, calendars, group management, tasks, tests, interactive content, ratings, forums, glossaries, or wikis. Uploaded files also count as content data.
This category of data also includes assessments that are given for assessed learning activities. Assessments can be either automatic, as with electronic self-tests, or manual, as with assignments, by the manager and instructor roles. When assessments are assigned automatically, managers or trainers make the defaults on which they are based and have the option to review and make corrections manually.
Purpose of data processing
The processing of personal data in „JuLearn” is carried out in accordance with Art. 5, Para. 1, lit. b and c GDPR for a specific purpose and in accordance with the principle of data minimization. Inventory, course, usage and content data are processed for the purpose of preparing, organizing and conducting courses, communicating course content and monitoring learning success. In addition, usage data is used for the purpose of administration and maintenance of the system, technical controlling, troubleshooting of technical problems or clarification of security incidents.
4. Recipients of the personal data
We only pass on your personal data within our company to those areas that require this data to fulfill contractual and legal obligations or to implement our legitimate interests. Within „JuLearn”, access takes place via a role concept with an ascending scope of rights.
5. Transfer of personaö data to a third country or an international organization
Data processing outside the EU or the EEA does not take place.
6. Duration of storage
We process and store your data as long as it is necessary for the fulfillment of the above purposes, in particular our contractual and legal obligations. If the data is no longer required for the fulfillment of these purposes and our obligations, it will be deleted on a regular basis.
Inventory data/access data remain in „JuLearn Plus” until they are deleted depending on the affected category.
Trainees: 6 months after completion of training.
Employees: 10 years after leaving the company
Guests: Account deletion after termination of guest status
Teachers: With deletion of the account
7. Usage of Cookies
Description, scope and purpose of data processing
„JuLearn” uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.
The following cookies are used and the following data is stored and transmitted in them:
- MoodleSession identifies logged-in users via an anonymous ID and stores their login for the current session in „JuLearn”. This must be allowed in order to maintain login and access permissions within „JuLearn” during the session. The cookie is automatically deleted as soon as users log out of the system or close the web browser.
- MoodleID stores the username in the web browser. The next time the user logs in to the system, it is automatically entered into the login screen to speed up the login process for users. Users can optionally activate the cookie when logging in.
- When logging in via Shibboleth, a "session cookie" with a token is set, which has a validity of approx. 13 hours, so that a renewed log-in in the browser for further service providers is not necessary during this period.
Legal basis for data processing
The legal basis for the processing of personal data using cookies is Art. 6 (1) lit. f GDPR. When processing consent in connection with the storage of cookies, this is based on Art. 6 para. 1 lit. a GDPR. The legitimate interests lie in maintaining the functionality and increasing the ease of use, as well as optimizing the learning platformfor different end devices, operating systems and browsers.
Duration of storage, possibility of objection and elimination
Cookies are stored on the user's computer and transmitted from it to the site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for „JuLearn”, it may no longer be possible to fully use all functions of the system.
8. Data transfers and integration of third party services
There is no targeted transfer of personal data to third parties. However, in accordance with the constructivist approaches in Moodle and comparable learning platforms based on web technologies, interfaces to other web-based services can be integrated via common interface technologies, e.g. links, APIs, frames. These are for example content from Youtube, Vimeo or other video platforms, Sciebo shares, communication channels like RocketChat, H5P elements or writing services like iffMD or comparable EtherPads. This is part of the learning process and can be done and used and integrated by both instructors and learners. Examples and further information:
H5PWe use the plugin "H5P" to deliver teaching/learning content as Open Educational Resources (OER). The provider is Joubel, Flow Coworking, Storgata 5, 9008 Tromsø, Norway.
H5P processes and stores anonymized reporting data from your interactions with H5P elements via an xAPI interface. This data is used to receive feedback on the design of the interaction options offered. The feedback received is used by H5P to improve the usability of H5P's offering.
For details, please refer to the corresponding documentation of H5P, which is available at the following link:
https://h5p.org/tracking-the-usage-of-h5p
LearningApps.org supports learning and teaching processes with small interactive, multimedia building blocks that are created online and integrated into learning content. A number of templates (assignment exercises, multiple choice tests, etc.) are available for the building blocks (called apps).
More details at https://learningapps.org/rechtliches.php
We may have embedded videos. Some of our Internet pages contain videos from the provider Vimeo LLC, headquartered at 555 West 18th Street, New York, New York 10011 Vimeo. When you call up such a web page on our website, a connection is established to the Vimeo servers. This transmits to the Vimeo server which of our Internet pages you have visited. If you are logged in as a member of Vimeo, Vimeo assigns this information to your personal user account. When you click on the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo.
We use this service within our online offer on the basis of a legitimate interest - in the analysis, optimization and economic operation of our online offer. The legal basis is Art. 6 para. 1 lit. f.) GDPR.
For more information on data processing and privacy notices by Vimeo, please visit https://vimeo.com/privacy. In addition, Vimeo calls up the Google Analytics tracker via an iFrame in which the video is called up. This is Vimeo's own tracking, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some Internet browsers. Users can also prevent the collection of data generated by Google Analytics and related to their use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link:
http://tools.google.com/dlpage/gaoptout?hl=de
Content from YouTube may be integrated. YouTube is an Internet video portal that allows video publishers to post video clips free of charge and other users to view, rate and comment on them, also free of charge. YouTube allows the publication of all types of videos, which is why complete film and TV shows, but also music videos, trailers or videos made by users themselves can be accessed via the Internet portal.
The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
By each call of one of the individual pages of this website, which is operated by the controller and on which a YouTube component (YouTube video) has been integrated, the internet browser on the information technology system of the data subject is automatically caused by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information on YouTube can be found at https://www.youtube.com/yt/about/de/. Within the scope of this technical procedure, YouTube and Google receive knowledge of which specific sub-page of our website is visited by the data subject.
If the data subject is logged into YouTube at the same time, YouTube recognizes which specific sub-page of our website the data subject is visiting by calling up a sub-page that contains a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
YouTube and Google always receive information via the YouTube component that the data subject has visited our website if the data subject is logged into YouTube at the same time as calling up our website; this takes place regardless of whether the data subject clicks on a YouTube video or not. If the data subject does not want this information to be transmitted to YouTube and Google, he or she can prevent the transmission by logging out of his or her YouTube account before accessing our website.
The privacy policy published by YouTube, which can be accessed at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing and use of personal data by YouTube and Google.
9. Your Rights
You have the following rights vis-à-vis the controller with regard to the personal data concerning you:- Right to information, Art. 15 GDPR
- Right to rectification, Art. 16 GDPR
- Right to erasure, Art. 17 GDPR
- Right to restriction of processing, Art. 18 GDPR
- Right to object to collection, processing and/or use, Art. 21 GDPR
- Right to data portability, Art. 20 GDPR
- As the processing of personal data is based on your consent (Art. 6(1)(a) GDPR), you may revoke it at any time for the relevant purpose. The lawfulness of the processing based on your consent given remains unaffected until we receive your revocation.
You also have the right to lodge a complaint with the data protection supervisory authority (Federal Commissioner for Data Protection and Freedom of Information):
The Federal Commissioner for Data Protection and Freedom of Information Graurheindorfer Str. 153, 53117 Bonn, Germany E-mail: poststelle@bfdi.bund.de
10. Technical and organizational measures to maintain integrity and confidentiality
In accordance with Art. 5, para. 1, lit. f GDPR, various measures are taken to ensure the integrity and confidentiality of personal data in „JuLearn”. Access to personal data within the application is via user control (username and password). Access to the server is restricted by both user control and firewall regulations. Communication between the application and the servers is encrypted over a secure connection (HTTPS) to prevent unauthorized data processing.
11. Automated decision-making / profiling
Your data will not be used for automated decision-making or profiling.