Privacy Policy for Across eCampus

ecampus.across-alliance.eu

Last Updated: March 16, 2026

1. Introduction

We are pleased that you are using the Across eCampus (currently in Beta Version). The protection of your personal data is very important to us. With the following information, we would like to give you, as a “data subject,” an overview of the processing of your personal data by us and your rights under data protection laws. The processing of personal data is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to Chemnitz University of Technology.

As the data controller, we have implemented numerous technical and organisational measures to ensure that the personal data processed via this website is protected as completely as possible. Nevertheless, Internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed.

2. Data Controller

The data controller responsible for the processing of your personal data on this website is:

Technische Universität Chemnitz

Represented by the President:

Prof. Dr. Gerd Strohmeier

Straße der Nationen 62

09111 Chemnitz

Germany

Phone: +49 371 531-0 (switchboard)

Email: rektor@tu-chemnitz.de

Web: https://www.tu-chemnitz.de

Jurisdiction: Germany (Saxony)

Contact details of the Data Protection Officer:

Datenschutzbeauftragter

Technische Universität Chemnitz

09107 Chemnitz

Germany

Phone: +49 371 531-12030

Email: datenschutzb@tu-chemnitz.de

3. What Are Personal Data?

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, your email address, your IP address, or your university affiliation.

4. Purposes and Legal Bases for Data Processing

We process your data for the following purposes based on the stated legal bases:

a) Provision of the Website and Log Files (Essential Cookies & Session Data)

  • Purpose: To display the website correctly, ensure its stability and security, and maintain user sessions during the federated login process (eduGAIN). For this purpose, technically necessary session cookies (e.g., Shibboleth session cookies) are stored on your device.
  • Data processed: IP address, date and time of the request, browser type/version, operating system, technically strictly necessary cookies.
  • Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in operating the website securely).

b) Federated Login (eduGAIN Authentication)

  • Purpose: To verify your identity, determine your role (e.g., student, staff), and provide you with access to restricted areas of the eCampus without requiring a separate account.
  • Data processed: When you log in via eduGAIN, your home university’s Identity Provider automatically transmits specific attributes to us:
    • A unique user identifier (pairwise-id, persistent-id, or ePPN)
    • Your name (displayName)
    • Your email address (mail)
    • Your university affiliation and role (eduPersonScopedAffiliation)
  • Legal basis: Art. 6(1)(b) GDPR (Performance of a contract/provision of requested services).

c) Form Data (Course and Thesis Creation, Registrations, and Attendance)

  • Purpose: To manage educational offerings within the Across Alliance. This includes the creation of courses and thesis projects by teachers/staff, as well as the registration for courses and documentation of attendance by students. System-generated emails (e.g., registration confirmations) are sent using the provided email addresses.
  • Data processed: Name, email address, university affiliation, and specific form inputs (e.g., selected course). These data are either automatically populated from your eduGAIN profile or entered manually.
  • Legal basis: Art. 6(1)(b) GDPR (Performance of a contract/provision of requested services) or Art. 6(1)(e) GDPR (Public task), depending on the specific administrative process.

d) Project Reporting and Indicator Logging

  • Purpose: To collect anonymous/pseudonymous statistics required by the European Commission for the evaluation of the Across project (e.g., number of logins, service accesses).
  • Data processed: Cryptographically hashed (pseudonymised) user IDs. No direct personal identification is possible from these logs.
  • Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in fulfilling reporting obligations of the EU grant agreement).

5. Data Transfer

Internally, your data is only accessible to those persons who need it to fulfill the purposes mentioned (e.g., teachers receiving attendance lists for their specific courses, system administrators).

The eCampus platform is hosted on local servers operated directly by Chemnitz University of Technology. No external hosting providers are used. Data will only be transferred to third parties outside the Across Alliance if this is required by law or if you have expressly consented to the transfer.

6. Where Is the Data Stored?

Your personal data is processed exclusively on servers located within the European Union (EU) or the European Economic Area (EEA), ensuring compliance with European data protection standards.

7. Data Retention Period

Your data will only be stored for as long as is necessary to fulfill the purposes stated in this privacy policy or as required by statutory retention periods:

  • Server Access Logs (IP Addresses): The technical logs generated by our web server, which contain the actual IP addresses of website visitors, are automatically deleted after 7 days. A longer retention period is only applied if strictly necessary for investigating specific security incidents or technical errors.
  • Indicator Logging (Pseudonymised Statistics): Cryptographically hashed (pseudonymised) user IDs, which are collected exclusively for mandatory EU project reporting and do not contain IP addresses, are retained for 10 years after the end of the Across project, in accordance with EU funding regulations.
  • Form Data (Registrations): Are stored centrally for the duration of the course/semester and subsequent administrative processing.
  • Attendance Lists (Teacher Exports): Instructors who download attendance lists for their courses act under their own professional obligations. It is the responsibility of the respective teacher to handle this data responsibly and securely, and to delete it in due time once it is no longer needed for course administration or grading purposes.
  • Note on End of Affiliation: Please note that historical data (such as completed course registrations, course creation records, or attendance logs) may be retained for the periods specified above even if your affiliation with your home university ends (e.g., due to exmatriculation or change of employment), as this historical data remains necessary for academic documentation and mandatory EU project reporting.

8. Your Rights as a Data Subject

You have the following rights regarding your personal data:

  • Right of access: Information about what personal data we have stored about you (Art. 15 GDPR).
  • Right to rectification: Correction of incorrect or incomplete data (Art. 16 GDPR). Please note: To rectify personal data automatically released by your Home Organisation via eduGAIN (such as your name or email address), you must contact your Home Organisation’s IT helpdesk directly, as we cannot alter this federated data.
  • Right to erasure: Deletion of your data, provided there are no legal retention obligations (Art. 17 GDPR).
  • Right to restriction of processing: (Art. 18 GDPR).
  • Right to data portability: (Art. 20 GDPR).
  • Right to object: (Art. 21 GDPR). If processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise your rights, please contact the email address provided in Section 10. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

9. Data Protection Code of Conduct

Your personal data will be protected according to the Code of Conduct for Service Providers, a common standard for the research and higher education sector to protect your privacy.

10. Topicality and Amendment of this Privacy Policy

This privacy policy is currently valid as of the date specified at the top. It may become necessary to amend this policy due to the further development of our website or due to changes in legal or official requirements.

Across

coordinating university of the alliance

Chemnitz University of Technology

Contact

Across eCampus Coordination Team

Email: across-ecampus@informatik.tu-chemnitz.de