Privacy policy for the use of the online services BigBlueButton, JitsiMeet and Zoom X

Personal data is processed exclusively for the provision and use of the BigBlueButton, JitsiMeet and Zoom video conferencing systems in the following scenarios:

• BigBlueButton
  • For videoconferencing, especially of a confidential nature, such as faculty council meetings, internal deliberations, for video proctoring or conducting remote digital examinations, and defenses. All data processing will be performed exclusively on servers of TU Dresden.
• JitsiMeet
  • For ad hoc video conferences in smaller groups for general meetings. Conditionally suitable for confidential video conferences such as faculty council meetings, internal consultations, examinations, defences. Data processing is carried out exclusively on servers of the TU Dresden.
  • The video conference can be protected by the organizer with a PIN. If this is done, conferences of a confidential nature are also possible.
• Zoom X

  • For seminars, lectures, events, etc. with a focus on presentation or discussion via audio/video, if BigBlueButton is technically not suitable.

  • For confidential meetings/conversations and for video proctoring or conducting remote digital examinations where BigBlueButton is technically not suitable.

  • This offer is a contracted service of a commercial telecommunications provider (Deutsche Telekom in cooperation with Zoom).

The legal basis for the processing of personal data for the above-mentioned purposes is Art. 6 para. 1 subpara. 1 lit. e, para. 2 and 3 GDPR in conjunction with. §§ 14 para. 1 and 3 SächsHSFG in conjunction with. §§ 2 to 18 SächsHSPersDatVO as well as the respective regulations of TU Dresden.

In special circumstances (e.g., conducting digital remote examinations, communication between students, events with guests), processing takes place on a voluntary basis, i.e., based on Art. 6 para. 1 subpara. 1 lit. a GDPR (consent).

The Zoom X video conferencing solution is a telecommunications service and is therefore subject to telecommunications secrecy pursuant to § 3 German Teleservices Data Protection Act (TTDSG). In this regard, the company Deutsche Telekom is solely responsible.

Depending on the type and extent of use of the video conferencing services, the following categories of personal data may be processed:

• Account information

• Information about profile and participants

• Contacts and calendar integrations

• Service settings

• Contents and contexts of videoconferences

• Data from the provision of the telecommunication service

The data will be stored for the period from the first use until the termination of the service provision. After the termination of the service provision, the data will be deleted.

When using Zoom, account information will be deleted 30 days after account deletion or termination of the contract. Profile and participant information is deleted 30 days after the end of the video conference or in aggregated form after 12 months. The chat messages in Zoom will be automatically deleted after 12 months. The deletion of data from the provision of telecommunications is the responsibility of Zoom.

Unless otherwise provided by law, no transmission to third parties in the legal sense is made by TU Dresden when using BigBlueButton or JitsiMeet.

The responsible recipient of the data when using Zoom X is the provider Deutsche Telekom.

• Voluntary nature and revocation according to Art. 7 (3) GDPR
  If the use of the services is based on consent, this consent can be revoked at any time in accordance with Art. 7 (3) GDPR with the consequence that the personal data of the person concerned will not be further processed. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

• Right to information (Art. 15 GDPR)
  Data subjects have the right to obtain at any time information on the data processed concerning them and on the possible recipients of such data. They are entitled to receive a reply within a period of one month after submitting the request.

• Right of correction, deletion and restriction (Art. 16 - 18 GDPR)
  The persons concerned may at any time request TU Dresden to correct or delete their personal data or to restrict the processing of such data.

• Right to data transferability (Art. 20 GDPR)
  The persons concerned can demand that TU Dresden transfers their personal data to them in a machine-readable format. Alternatively, they may request that the personal data provided by you be transferred directly to another responsible party, as far as this is possible.

• Right of objection (Art. 21 GDPR)
  Data subjects may object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.

• Right of appeal (Art. 77 GDPR)
  Data subjects can contact the data protection officer of the TU Dresden at any time and, in case of a complaint according to Art. 77 GDPR, the responsible supervisory authority for data protection, which is:
  
  Sächsische Datenschutz- und Transparenzbeauftragte
  Frau Dr. Juliane Hundert
  Devrientstraße 5
  01067 Dresden
  Tel.: +49(0)351/85471 101
  Fax:+ 49(0)351/85471 109
  E-Mail:

To make use of these rights, it is sufficient to notify the responsible person in text form (letter, e-mail or fax).