Information on the processing of personal data in the Graduate Centre for Medicine of the Medical Faculty Düsseldorf
in the registration of doctoral projects and the implementation of doctoral procedures as well as the organisation and implementation of events

With this data protection information, the Heinrich Heine University Düsseldorf (hereinafter referred to as HHU) complies with its duty to inform pursuant to Article 13 of the General Data Protection Regulation (hereinafter referred to as DSGVO) for the above-mentioned processing of personal data.

Additional information can be found in HHU's privacy policy.
(https://www.uni-duesseldorf.de/home/footer/datenschutz.html).
With regard to the terms "personal data", "processing", "controller", "third party", etc., please refer to the definitions in Article 4 of the DSGVO.

The HHU, a public corporation with legal capacity supported by the state of NRW, is responsible for the processing and use of personal data as well as audio/image and video recordings (hereinafter referred to as recording material). It is represented by the Rector Prof. Dr. Anja Steinbeck.

1.1. Contact details of the responsible person
Heinrich-Heine-Universität Düsseldorf
Universitätsstr. 1
D - 40225 Düsseldorf
Tel.: +49 211 81 10000
www.hhu.de

1.2. Contact person for data processing
Medical Deanery
Graduate Center Medicine
Dr. Ursula Kessen
Moorenstraße 5, D - 40225 Düsseldorf
Building: 17.11, floor/room: 03.11
Tel.: +49 211 81-08283
eMail: medRSD(at)hhu.de

1.3. Contact details of the data protection officer
You can contact the HHU data protection officer by post at the address of the responsible person given above or as follows:
eMail:
Tel.: +49 211 81 13060
www.hhu.de/datenschutz

2.1 Information on the personal data processed when registering doctoral projects and conducting doctoral procedures

As part of the registration of doctoral projects and the implementation of doctoral procedures by the Graduate Center Medicine, personal data from you is processed for various purposes. For this purpose, we use the software Machform by Appnitro, which is hosted on the servers of the HHU (ZIM).

Processing of personal data of doctoral researchers and supervisors:

• When registering a doctoral project, we collect the following personal data:
  Title, first name, surname, address, e-mail address, telephone number, date of birth, academic degree, names and contact details of the supervisors
• When you submit your application for admission, we collect the following personal data:
  Title, first name, surname, address, e-mail address, telephone number, date of birth, educational background, academic degree, names and contact details of supervisors

2.2 Information on the personal data processed in the organisation and implementation of events at the Graduate Centre in Medicine and the purposes of the processing
In the course of organising and running workshops and events, personal data about you will be processed for various purposes.

Processing of personal data of participants:

• If you participate in an event, we collect your personal data for the organisation of the event.
  When you register, your title, first name, last name, email address, affiliation to the Graduate Centre Medicine/medRSD as well as IP address and time of registration are stored. We collect this data in order to provide you with all the information you need to participate in the event, as well as for the internal organisation of our event and the billing of the event. After completion of the event, you will receive a personalised (title, first name, last name) certificate of attendance. For data management purposes, we use the university cloud sciebo.
• We use the video conferencing systems Webex, Zoom or alternatively jitsi Meet to hold the virtual events. When using these systems, your personal data (language, image and your name, which you provided during registration) are processed by this software. In addition, further data will be stored which is technically necessary for the implementation of the videoconference. You can find more details in the data protection declaration for Webex from Cisco https://www.cisco.com/c/de_de/about/legal/privacy-full.html or Zoom https://zoom.us/de-de/privacy.html or jitsi Meet https://jitsi.org/meet-jit-si-privacy/.
• We keep your first name, surname, e-mail address and affiliation to the Graduate Centre Medicine /medRSD in a list of participants, which we pass on to the lecturers for the implementation of the event.
• Our events are evaluated via the Evasys system. You will receive a link or QR code for this. You can find the data protection information on Evasys here.

Processing of personal data of lecturers:

If we have invited you as a lecturer to the event, we will process your data with your consent as follows:

• We will include your title, first and last name in the programme.
• The programme as well as the workshop content will be published on the HHU website.

Legal basis for the processing of personal data and the production and publication of recording material at virtual events
The collection of personal data for the stated purposes is based on the explicit or implied consent of the data subjects pursuant to Art. 6 para. 1 lit. a. DSGVO. When registering for events, you expressly express your consent to participation and the associated processing of your data by activating the "I agree" button. In the case of virtual events, by switching on the camera or your microphone, you implicitly consent to your voice and images being processed during the event. You can voluntarily provide information in the chat. Participation in the event and switching on the camera and microphone are voluntary. You will not suffer any disadvantages if you do not choose these forms of participation. The legal basis for the billing data for participants of the Faculty of Medicine is Article 6 (1) lit c DSGVO in conjunction with the HGB/AO.

We do not pass on your personal data processed by HHU for the above-mentioned purposes to third parties with the exception of the data mentioned under 2.2, which is passed on to the operator of the above-mentioned video platform. In order to invoice the participation costs of academics from other faculties, we pass on the data you provided under 2.2. to the respective submission [PB2] to document that the respective persons participated in the event.

We would like to point out that the IT departments or a service provider may have access as part of care and maintenance work.The video conferencing platform is Webex or ZOOM or Jitsi Meet. These companies have access to your data. As these are American companies, there is no adequate level of protection equivalent to the EU. Additional information can be found in the data protection policy of Cisco https://www.cisco.com/c/de_de/about/legal/privacy-full.html, ZOOM https://zoom.us/de-de/privacy.html or jitsi Meet https://jitsi.org/meet-jit-si-privacy/.

Your personal data will be deleted from the MachForm registration form two years after the end of the event. They will be deleted before that if you withdraw your consent. Except for the data mentioned under purpose 2.1 and 2.2, which will be kept for 50 years for promotion purposes and 10 years for billing purposes.

As a data subject, you can exercise the rights granted to you by the DSGVO at any time:

• the right to information as to whether and which of your data is being processed (Art. 15 DSGVO). The restrictions according to § 12 DSG NRW apply;
• the right to request that data concerning you be corrected or completed (Art. 16 DSGVO);
• the right to have the data concerning you deleted in accordance with Art. 17 DSGVO. The restrictions according to § 10 DSG NRW apply;
• the right to demand restriction of the processing of the data in accordance with Art. 18 DSGVO;
• the right to object to future processing of data concerning you in accordance with Art. 21 DSGVO;
• the right to revoke consent given at any time. The lawfulness of the processing carried out on the basis of the consent until revocation is not affected by this (Art. 7 (3) DSGVO).

In addition to the aforementioned rights, you have the right to file a complaint with the supervisory authority (Art. 77 DSGVO). The supervisory authority responsible for HHU is the

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2-4
D - 40213 Düsseldorf
Tel: +49 211 38424-0
eMail:

However, we would be grateful if you - before contacting the supervisory authority with your concern - would contact our data protection officer, see point 1.3. We will try to meet your concern.

We reserve the right to amend this Data Protection Notice to reflect any changes in relevant laws or regulations or to better meet your needs. This Data Protection Notice is the most recent version published by HHU as of July 2021.