Data Protection
The protection of your data is important to us. As a result, and to comply with all legal information obligations, we will inform you below how we process your data and what rights you have with regard to data processing.
Our Online-Self-Assessment for a professorship at HTW Berlin, ‘online self assessment’ in the following, was developed by CYQUEST GmbH, Heußweg 25, D-20255 Hamburg, Germany, and is operated by CYQUEST GmbH on our behalf. As a result, we will hereby inform you about which data we collect via CYQUEST and how we, or the CYQUEST GmbH, process this data.
1. Subject of data protection
The subject of data protection is personal data. In accordance with Art. 4 GDPR personal data means all information relating to an identified or identifiable natural person. This includes e.g. information such as names, postal addresses, e-mail addresses or telephone numbers, but also usage data such as your IP address or content data such as the answers you provide within the online assessment and the resulting test results.
2. Scope and purposes of data collection, data storage and data usage
In the following, we will inform you about the scope of the data collection and storage as well as their use and the purpose of the respective data collection in the context of the online self assessment. (Hereinafter referred to as ‘data processing’, used within the meaning of Article 4 (2) GDPR)
2.1 Data processing in the context of taking the online self assessment
For us, CYQUEST GmbH does not process any personally identifiable data and data that can be traced to people within the online self assessment, as long as you use the anonymous start. The only exception is your IP address, which we need for a short time for technical reasons (please read section 2.1.1). As a result, we also process the content data from the online self assessment without any personal reference in this case. One exception is the use of the online self-assessment with registration. You can do this voluntarily with a valid email address and a personal password to save your progress, bookmarks and the results of the self-assessment tasks. When you register, the following data will be processed within your account:
- Email address
- Password
- Your progress
- Your entries in the self-assessment tasks
- Timestamp (time of last login including date and time)
Your email address will be used to send you information about the professorship at HTW Berlin and our current job vacancies. During the registration process, you will be asked to confirm your consent by clicking on a confirmation link that will be sent to your email address.
2.1.1 IP addresses
Without Internet protocol addresses, in short ‘IP addresses’, the Internet simply would not work. An IP address represents an address in computer networks so that web servers and / or individual end devices can be addressed and accessed. Without an IP address, the web server and the end device cannot communicate - and thus show no contents. The web server hosting the online self assessment will be pinged by a data request - from you, because you, after all, want to use the online self assessment. In order to provide you with the data, the web server needs to know your IP address. As a result, the web server must process your IP address at this moment of the data query. For this, the web server receives the information, which website or file is retrieved, which browser and which operating system was used. Normally, this data is stored long-term in the so-called web server log files. Usually. The CYQUEST GmbH does not store the IP addresses in the log files, except for the time of the necessary processing described above. Instead with IPv4 addresses the last block is replaced by ‘0’ and with IPv6 addresses only the first two blocks are stored and the last six blocks changed to ‘::’.
If you wonder why we explain this to you at all: The IP address is regarded as personal data, as defined by the General Data Protection Regulation (GDPR). And if the IP address qualifies as personal data, then we must inform you that we process it briefly for the purpose of you being able to use the online self assessment at all.
2.1.2 Google Analytics
As already mentioned, we have integrated Google Analytics into the application. The specific nature of the integration, use and functioning of this service is explained below.
Google Analytics is a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (henceforth Google). As a service provider, Google determines usage behavior of visitors to a website and makes it possible to see whether and how the website and its user navigation can be improved, which parts are particularly relevant, which less so. Thus, content and functions of the website can be optimized for you - and us. Google uses cookies for this purpose.
The following data is processed during your visit via Google Analytics:
- IP address (shortened)
- Browser type
- Duration of stay on the page
- used operating system
- Pages of the website accessed
- Click and scroll behaviour on the pages
- Source of origin of the visit (other website, advertising media)
- Time of server request
- Your rough location (based on IP address), roughly city/county level accurate
On our behalf, Google will use the above information to evaluate the use of the website and to compile reports on website activity.
No user ID is activated and used. Cross-device tracking via a user ID is therefore not possible.
In addition, Google was prohibited from using the data obtained as part of the commissioned data processing for its own analysis. Google cannot use our data to analyse and evaluate online behaviour for product improvement or benchmarking (industry analysis). Likewise, technical support and key accounts have been prohibited from accessing our data.
This data processing is based on legitimate interest within the meaning of Article 6 (1) (f) GDPR. We have a legitimate interest in being able to understand the basic usage behaviour on the application. This includes being able to recognize which features are particularly heavily or less heavily frequented by users or from where users access the application. These insights are needed to optimize the application according to user behavior. Since we - unlike, for example, service providers with a trade fair stand - do not visually observe the streams of visitors and can thus recognise which areas of our offer are particularly interesting, we make use of Google Analytics in order to be able to carry out this observation and evaluation of the streams of visitors (not: of the individual, identifiable visitor). An opposing legitimate, overwhelming interest of the users in having their non-personal usage behaviour on the website analysed is not apparent. The cookies are set on the basis of § 25 para. 2 TTDSG.
The data processed by Google Analytics is stored for two months and then deleted, unless you visit our website again during this period, in which case the two-month period begins again.
The cookies used are deleted after 13 months at the latest.
2.1.3 Youtube - embedded videos
YouTube videos are integrated into the online self-assessment. YouTube, LLC is a wholly owned subsidiary of Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. YouTube's ‘extended data protection mode’ is used to embed the videos. This means that a cookie is only stored on your computer when you play the video. According to YouTube, no personal cookie information is stored for playback of embedded videos with extended data protection. Further information on YouTube's official data protection policy can be found here.
If you want to make sure that none of your data is stored by Youtube, do not click on the embedded videos.
2.2 Cookies
3. Duration of processing of personal data
Compliance with the principle of data minimization is a matter of course.
As we already informed you above, we do not process any personal data with the exception of the IP address. However, we anonymise these immediately, as described above. Thus we do not process personal data of duration.
4. Assigned data use, recipient, transfer of data
The principle of assigned data use is strictly observed. All of the aforementioned data will only be processed for the purposes stated in this privacy statement.
5. Rights of affected persons (amongst others information, revocation, objection and cancellation)
Irrespective of the above, you can object to the use of your data at any time under the conditions of Art. 21 GDPR and revoke any consent given to the use of your data at any time. Furthermore, you can have the data collected and stored by us corrected, blocked or deleted at any time.
We expressly point out that there may be legal obligations to further store data. In this case, the data can only be blocked.
If you address your request for information, revocation and/or deletion directly to CYQUEST GmbH, the latter is obliged to inform us of this request and vice versa.
In addition, you also have the right to data portability according to Art. 20 GDPR and the right to complain to a supervisory authority within the meaning of Art. 77 GDPR.
Nevertheless, you can of course contact us at any time and we will be happy to help you with your data protection questions.
For this purpose and to exercise the aforementioned rights, please contact us at datenschutz@htw-berlin.de.
For technical support, please contact support@cyquest.net.