Privacy Notice in accordance with Articles 13 and 14 of the GDPR

We would like to provide you with the following information regarding the processing of your personal data in connection with the digital application process for compensation for disadvantages.

Students may, on the basis of the SPO, make use of various arrangements designed to facilitate their studies whilst living with a disability and/or chronic illness (e.g. adjustments to exams to compensate for disadvantages, authorisation of support staff). This is done on the basis of expert reports submitted as evidence to the relevant chair of the examination board for the respective degree programme.

Student access to BIC: Students gain access to the BIC authentication system via a link on the homepage using their student email address. They log in using their student email address and student ID number and select the type of application. This data is transmitted to BIC. Students receive an email from BIC containing the access link to the application form in BIC. The access link is valid for one use only.

Submitting an application: Students complete the application forms in BIC. The application details are automatically forwarded to the designated representative for students with disabilities. Appointments for a consultation are arranged by email or in person. A consultation that has taken place can be documented via BIC. The designated representative makes a recommendation to the chair of the examination board. The decision on whether to grant adjustments is made by the relevant chair of the examination board. Disclosure of a severe disability is voluntary. The assessment report regarding adjustments and proof of a severe disability are not filed. The designated representative and the chair of the relevant examination board have access to the data in BIC in accordance with their respective roles and can view the specific details.

The student making the application will receive an email as soon as the decision is available in BIC. The decision does not contain any health data.

The decision is filed in the student’s file without any health data.

Below, we provide information on the type of data and data categories processed in connection with the digital ‘Application for Compensation for Disadvantages’ process:

The following general personal data is collected and processed as part of the digital ‘Application for Compensation for Disadvantages’ process :

• Master data (e.g. surname, first name, student number)
• Contact details (e.g. email address)
  
  

The following categories of personal data requiring special protection are also collected and processed as part of the digital process for applying for compensation for disadvantages:

• Health data as per the medical report 

We process the data provided to us in connection with the digital application process for compensation for disadvantages.

The legal basis for the processing of the data is Article 6(1)(c) of the GDPR in conjunction with the relevant provisions of higher education law and, insofar as health data is processed, Article 9(2)(b) and (g) of the GDPR.

We do not use any purely automated decision-making processes in accordance with Article 22 of the GDPR. Should we wish to use such a procedure in individual cases in future, we will provide separate information on this.

The provision of the necessary information and supporting documents is voluntary; however, it is necessary to enable the university to assess the application and take appropriate action.

The general retention periods apply to the erasure of data; see Section 25 of the Data Protection Regulations, as amended.

Within our university, your data will be received by those internal departments or organisational units that require it to fulfil our obligations or in the course of processing and implementing our tasks.
Your data will only be disclosed to external bodies:

• for the purposes of complying with legal requirements under which we are obliged to provide information, report or disclose data, or where the disclosure of data is in the public interest;
• where external service providers process data on our behalf as data processors or as entities assuming specific functions (e.g. external data centres, support/maintenance of IT applications, archiving, document processing, data destruction, press relations, media technology, risk management, telephony, website management, credit institutions, printing firms or data disposal companies, courier services, logistics, and video and web conferencing tool providers);
• on the basis of our public interest or the public interest of the third party for the purposes mentioned (e.g. to public authorities, courts);
• if you have given us your consent to transfer your data to third parties.
  
  

Where we engage service providers under a data processing agreement, your data is subject to the same security standards there as it is with us. In all other cases, recipients may only use the data for the purposes for which it was transferred to them. We will not disclose your data to third parties beyond this.

No data is transferred to entities in countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries).

You have the right to obtain information from us regarding the data we hold about you in accordance with the provisions of Article 15 of the GDPR (subject to any restrictions under Section 9 of the LDSG, where applicable).

• Upon your request, we will rectify the data we hold about you in accordance with Article 16 of the GDPR if it is inaccurate or incorrect.
• If you so wish, we will erase your data in accordance with the principles set out in Article 17 of the GDPR, provided that this is not precluded by other legal provisions (e.g. statutory retention obligations or the restrictions under Section 10 of the LDSG) or by an overriding interest on our part (e.g. to defend our rights and claims).
• Subject to the conditions set out in Article 18 of the GDPR, you may request that we restrict the processing of your data.
• Furthermore, you may object to the processing of your data under Article 21 of the GDPR, upon which we will cease processing your data. This right to object applies only where there are specific circumstances relating to your personal situation, although our organisation’s rights may, where applicable, override your right to object.
• You also have the right, subject to the conditions set out in Article 20 of the GDPR, to receive your data in a structured, commonly used and machine-readable format or to have it transmitted to a third party.
• Furthermore, you have the right to withdraw any consent you have given to the processing of personal data at any time, with effect for the future.
• You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR).

The competent supervisory authority in the State of Baden-Württemberg:
State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg
Email:poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de