Privacy Policy for Across eCampus

ecampus.across-alliance.eu

Last Updated: October 7, 2026

1. Introduction

We are pleased that you are using the Across eCampus (currently in Beta Version). The protection of your personal data is very important to us. With the following information, we would like to give you, as a “data subject,” an overview of the processing of your personal data by us and your rights under data protection laws. The processing of personal data is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to Chemnitz University of Technology.

As the data controller, we have implemented numerous technical and organisational measures to ensure that the personal data processed via this website is protected as completely as possible. Nevertheless, Internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed.

2. Data Controller

The data controller responsible for the processing of your personal data on this website is:

Technische Universität Chemnitz

Represented by the President:

Prof. Dr. Gerd Strohmeier

Straße der Nationen 62

09111 Chemnitz

Germany

Phone: +49 371 531-0 (switchboard)

Email: rektor@tu-chemnitz.de

Web: https://www.tu-chemnitz.de

Jurisdiction: Germany (Saxony)

Contact details of the Data Protection Officer:

Datenschutzbeauftragter

Technische Universität Chemnitz

09107 Chemnitz

Germany

Phone: +49 371 531-12030

Email: datenschutzbeauftragter@tu-chemnitz.de

3. What Are Personal Data?

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, your email address, your IP address, or your university affiliation.

4. Purposes and Legal Bases for Data Processing

We process your data for the following purposes based on the stated legal bases:

a) Provision of the Website and Log Files (Essential Cookies & Session Data)

  • Purpose: To display the website correctly, ensure its stability and security, and maintain user sessions during the federated login process (eduGAIN). For this purpose, technically necessary session cookies (e.g., Shibboleth session cookies) are stored on your device.
  • Data processed: IP address, date and time of the request, browser type/version, operating system, technically strictly necessary cookies.
  • Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in operating the website securely).

b) Federated Login (eduGAIN Authentication)

  • Purpose: To verify your identity, determine your role (e.g., student, staff), and provide you with access to restricted areas of the eCampus without requiring a separate account.
  • Data processed: When you log in via eduGAIN, your home university’s Identity Provider automatically transmits specific attributes to us:
    • A unique user identifier (pairwise-id, persistent-id, or ePPN)
    • Your name (displayName)
    • Your email address (mail)
    • Your university affiliation and role (eduPersonScopedAffiliation)
  • Legal basis: Art. 6(1)(b) GDPR (Performance of a contract/provision of requested services).

c) Form Data (Course and Thesis Creation, Registrations, and Attendance)

  • Purpose: To manage educational offerings within the Across Alliance. This includes the creation of courses and thesis projects by teachers/staff, as well as the registration for courses and documentation of attendance by students. System-generated emails (e.g., registration confirmations) are sent using the provided email addresses.
  • Data processed: Name, email address, university affiliation, and specific form inputs (e.g., selected course). These data are either automatically populated from your eduGAIN profile or entered manually.
  • Legal basis: Art. 6(1)(b) GDPR (Performance of a contract/provision of requested services) or Art. 6(1)(e) GDPR (Public task), depending on the specific administrative process.

d) Project Reporting and Indicator Logging

  • Purpose: To collect anonymous/pseudonymous statistics required by the European Commission for the evaluation of the Across project (e.g., number of logins, service accesses).
  • Data processed: Cryptographically hashed (pseudonymised) user IDs. No direct personal identification is possible from these logs.
  • Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in fulfilling reporting obligations of the EU grant agreement).

e) Survey Invitations for Teachers Attending TTA Courses

  • Purpose: To evaluate the TTA offer according to the Grant Agreement. Survey invitations are sent using the provided email addresses upon registration for a TTA course offer and at the end of the project for final assessment.
  • Data processed: email address.
  • Legal basis: Art. 6(1)(b) GDPR (Performance of a contract/provision of requested services).

f) Research Discovery Service (Research Outputs and Researcher Profiles)

  • Purpose: The Research Discovery Service (https://ecampus.across-alliance.eu/research-discovery-service/) makes the research outputs of the nine Across partner universities searchable, together with the researchers currently employed at a partner university. It is a public bibliographic service of the Alliance, comparable to a library catalogue.
  • Data processed: Bibliographic metadata of research outputs, including author names, as published by the sources; and, for researchers whose public ORCID record shows a current employment at a partner university: name, ORCID iD, partner university and list of works. We do not process contact data, roles, CVs or photos. These data are not collected from you but from public sources: the institutional repositories of the partner universities (via BASE, the Bielefeld Academic Search Engine, or directly), OpenAlex, ORCID (public record content only), Zenodo and the OpenAIRE Graph. Subject areas are partly assigned automatically and are marked as such.
  • Legal basis: Art. 6(1)(e) GDPR (performance of a task carried out in the public interest: research, knowledge transfer and international cooperation of Chemnitz University of Technology within the Across Alliance).
  • Information of the persons concerned: Because the data are obtained from public sources and concern several thousand researchers, informing each person individually would involve a disproportionate effort (Art. 14(5)(b) GDPR). This section is the public information for all persons concerned.
  • Publication: The data are publicly accessible on the eCampus website and may be indexed by search engines. They are stored on a server of Chemnitz University of Technology that is not directly accessible from the Internet; the website retrieves them server side.

5. Data Transfer

Internally, your data is only accessible to those persons who need it to fulfill the purposes mentioned (e.g., teachers and coordinators receiving attendance lists for their specific courses, system administrators).

The eCampus platform is hosted on local servers operated directly by Chemnitz University of Technology. No external hosting providers are used. Data will only be transferred to third parties outside the Across Alliance if this is required by law or if you have expressly consented to the transfer.

6. Where Is the Data Stored?

Your personal data is processed exclusively on servers located within the European Union (EU) or the European Economic Area (EEA), ensuring compliance with European data protection standards.

7. Data Retention Period

Your data will only be stored for as long as is necessary to fulfill the purposes stated in this privacy policy or as required by statutory retention periods:

  • Server Access Logs (IP Addresses): The technical logs generated by our web server, which contain the actual IP addresses of website visitors, are automatically deleted after 7 days. A longer retention period is only applied if strictly necessary for investigating specific security incidents or technical errors.
  • Indicator Logging (Pseudonymised Statistics): Cryptographically hashed (pseudonymised) user IDs, which are collected exclusively for mandatory EU project reporting and do not contain IP addresses, are retained for 10 years after the end of the Across project, in accordance with EU funding regulations.
  • Form Data (Registration and Attendance): Are stored centrally for the duration of the course/semester and subsequent administrative processing.
  • Attendance Lists (Teacher Exports): Instructors who download attendance lists for their courses act under their own professional obligations. It is the responsibility of the respective teacher to handle this data responsibly and securely, and to delete it in due time once it is no longer needed for course administration or grading purposes.
  • Research Discovery Service: The data are refreshed from the public sources every night and rebuilt in full every week. A researcher is listed only while his or her public ORCID record shows a current employment at a partner university; after that, the profile is removed with the next weekly update. Raw harvest files are kept in two generations for recovery and then deleted; server backups are retained for up to one year.
  • Note on End of Affiliation: Please note that historical data (such as completed course registrations, course creation records, or attendance logs) may be retained for the periods specified above even if your affiliation with your home university ends (e.g., due to exmatriculation or change of employment), as this historical data remains necessary for academic documentation and mandatory EU project reporting.

8. Your Rights as a Data Subject

You have the following rights regarding your personal data:

  • Right of access: Information about what personal data we have stored about you (Art. 15 GDPR).
  • Right to rectification: Correction of incorrect or incomplete data (Art. 16 GDPR). Please note: To rectify personal data automatically released by your Home Organisation via eduGAIN (such as your name or email address), you must contact your Home Organisation’s IT helpdesk directly, as we cannot alter this federated data.
    Research Discovery Service: The data shown there are taken from public sources. To rectify them, please correct your ORCID record or the entry in the repository; the change is picked up with the next weekly update. If you object to being listed (Art. 21 GDPR), please contact the address in Section 10; your ORCID iD will then be placed on a permanent exclusion list so that your profile is not loaded again. Bibliographic records of your works remain listed with your name as author, as in a library catalogue.
  • Right to erasure: Deletion of your data, provided there are no legal retention obligations (Art. 17 GDPR).
  • Right to restriction of processing: (Art. 18 GDPR).
  • Right to data portability: (Art. 20 GDPR).
  • Right to object: (Art. 21 GDPR). If processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise your rights, please contact the email address provided in Section 10. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

9. Data Protection Code of Conduct

Your personal data will be protected according to the Code of Conduct for Service Providers, a common standard for the research and higher education sector to protect your privacy.

10. Topicality and Amendment of this Privacy Policy

This privacy policy is currently valid as of the date specified at the top. It may become necessary to amend this policy due to the further development of our website or due to changes in legal or official requirements.

Across

coordinating university of the alliance

Chemnitz University of Technology

Contact

Across eCampus Coordination Team

Email: across-ecampus@informatik.tu-chemnitz.de