This data protection declaration informs you about the processing of personal data in the context of evaluations and surveys at the university of Music Wuerzburg (e.g., teaching evaluations, evaluation of study programs, graduate surveys, other surveys) in accordance with article 13 of the General Data Protection Regulation (GDPR).

Surveys are conducted exclusively electronically using the EvaSyS software, which allows surveys to be created, published, and conducted using various survey media (online and/or paper-based) and survey modes (e.g., via online link or TAN procedure). The survey results are recorded on the servers of the university and can be evaluated and/or exported by the survey creators using internal functions.

The results will be processed using analysis programs (e.g. EvaSys, SPSS) for data analysis and presentation. The publication to be produced will include data in aggregated form, from which, however, no conclusions can be drawn about the individual participants.

1. Contact details of the controller

The controller, i.e. the organisation responsible for data processing as defined in data protection legislation, especially the General Data Protection Regulation (GDPR), is the:

University of Music Wuerzburg
Hofstallstr. 6–8
97070 Würzburg
Telephone: +49 (0)931–32187-0
Telefax: +49 (0)931–32187-2800

The University of Music Wuerzburg is an organisation under public law and a state institution (article 4 (1) of the Bavarian Higher Education Innovation Act (BayHIG)). It is represented by the president, Professor Dr. Christoph Wünsch.

2. Contact details of the Data Protection Officer

You can contact our official Data Protection Officer at:

Data Protection Officer of the University of Music Wuerzburg
Daniel Bachmeier
Hofstallstr. 6–8
97070 Würzburg
Email: datenschutz@hfm-wuerzburg.de

3. Purpose of and legal basis for the processing of personal data

The personal data are needed to ensure and improve the quality of studying and teaching at the university. The results of the analysis serve as a basis for the derivation of measures for the

• Further development and improvement of the quality of the study programs (e.g., study program evaluation),
• Further development and improvement of the study organization and the study environment (e.g., course evaluation, course evaluation),
• Further development and improvement of the teaching performance/competence of the lecturers in the courses (course evaluation),
• Improvement of study offerings and study conditions as well as the transition into the job market (e.g., graduate survey).
• Improvement of the university's event offerings.

The data collected in the system is processed for the following purposes in accordance with the respective legal basis (article 6 (1) of the GDPR).

Teaching evaluation:
The evaluation of teaching for the purpose of quality assurance of the work of the university is carried out within the framework of the fulfillment of the public task assigned to the university pursuant to article 6 (1) point e of the GDPR in conjunction with. article 7 (3) of the BayHIG (evaluation of teaching).

Evaluation of study programs:
The legal basis for the processing of personal data in the context of the study programs at the university is article 6 (1) point e of the GDPR. The invitation to participate in a survey for the purpose of quality assurance of the work is carried out within the framework of the fulfillment of the public task assigned to the university in accordance with article 7 (4) of the BayHIG, § 18 of the Bavarian Study Accreditation Ordinance (BayStudAkkV).

Graduate survey, evaluation of study conditions:
The evaluation of the study programs and study conditions as well as the transition to the labor market for the purpose of quality assurance is carried out within the framework of fulfilling the public task assigned to the university pursuant to article 6 (1) lit. e of the GDPR in conjunction with article 7 (2) of the BayHIG (quality assurance), article 76 (2) of the BayHIG (review of content and forms of study).

Other evaluations:
The legal basis for the collection of personal data in the context of participation in an (online) survey is usually the consent of the data subjects pursuant to article 6 (1) point a) of the GDPR. In the case of evaluations in the areas of studies and teaching, the legal basis is the fulfillment of the public task assigned to the university pursuant to article 6 (1) point e GDPR in conjunction with article 7 (2) of the BayHIG (quality assurance), article 76 (2) of the BayHIG (review of content and forms of study).

4. Categories of personal data

The following personal data is collected during the use of the system as well as during registration and application and is stored on secure systems at the University of Music Wuerzburg.

• Contact details of those questioned: name, e-mail address or postal address
• Log data of the participants: generated when participants use the web application (domain, IP address of users, requests, session ID, timestamp, status code)
• Survey content: Ratings of people and services
• Master data: For user accounts in the system, data transferred from the central administration of the university is stored (first and last name, title (e.g. Prof. or Dr.), e-mail address)

When conducting the student teaching evaluation, the salutation, title, first and last name, e-mail address and information of the courses to be evaluated are additionally processed by the teachers.

When conducting the graduate evaluation, information on socio-demographics, information on the study situation, information on the course of studies, information on the acquisition of competencies and information on the transition to the professional world/the professional situation is also processed from the graduates.

5. Recipients of personal data

Only authorized persons who are directly involved in the evaluation and survey process have access rights to evaluation data.

We share the data within the university as follows:

• Teaching evaluation: Teachers, students, as well as deans of studies & university management receive the summarized student evaluations (evaluation data) per course from the (central) survey tool. Within the university, the personal data are disclosed to the respective body of the university, the students and the university management according to article 7 (3) 3, article 76 (2) 2 no. 2 of the BayHIG.
• Evaluation of study programs: The report on the results is sent to the university management, the deans of studies, the persons responsible for the study program or subject, and the student representatives. The students concerned are given an opportunity to view the results.
• Graduate survey: An anonymous report of the results is sent to the university management, the deans of studies, the study commissions and the student representatives.
• Evaluation of study conditions: The anonymized (partial) results reports are sent to the university management, the deans of studies, the study commissions and, if applicable, the subject groups and the student representatives. The overall results are also made available to all students enrolled at the university (see article 7 (3) sentence 3 of the BayHIG).
• Other evaluations: The persons conducting and participating the events receive the summarized evaluations.

6. Transferring Personal Data to a non-EU Country

In principle, data processed in the system will not be transferred to countries outside the European Economic Area and associated countries. If this should be necessary, separate information will be provided.

7. Storage period for personal data

We store your personal data only for as long as is necessary to fulfil our legal duties.

• Contact details of those questioned: The personal data used to send the survey will be deleted from the survey system and from the corresponding server of the university immediately after completion of the survey by employees of the Office for University and Quality Development.
• Protocol data of the participants: Storage for a maximum of 14 days.
• Survey content: The data generated by the responses in the questionnaire are anonymized promptly if necessary and stored in the system on the university's internal servers for at least the duration of an evaluation cycle (preparation, survey phase, follow-up and evaluation). However, this data can no longer be traced back to the individual, as the answers in the questionnaire are not linked to the contact details.
• Master data: User accounts remain in the system until the personal data record is deleted at the university or until the user authorization expires, after which they are deleted.

7. Rights of data subjects

Pursuant to articles 15 et seq. of the GDPR, you, the data subject, are entitled to the following rights concerning the processing of your data: 

• You can ask for information about whether data concerning you is being processed. If this is the case, you are entitled to information about which data is processed and other information relating to the processing (article 15 of the GDPR). Please note that this right to information can be restricted or excluded in certain cases (see in particular article 10 of the BayDSG).
• If the personal data concerning you is/has become inaccurate or incomplete, you can request that this data is rectified and/or completed (article 16 of the GDPR).
• If the legal requirements are met, you can request that your personal data be deleted (article 17 of the GDPR) or processing of your data be restricted (article 18 of the GDPR). The right to deletion pursuant to article 17 (1) and (2) of the GDPR does not apply in certain cases, however, such as if the processing of personal data is vital for the performance of a task that is in the public interest or is performed in the exercise of official authority (article 17 (3) point b) of the GDPR).
• If you have consented to data processing or there is a contract concerning data processing and data is processed automatically, you may be entitled to data portability (article 20 of the GDPR).
• You are entitled to file a complaint concerning the processing of your personal data with a supervisory authority as defined in article 51 of the GDPR. The pertinent supervisory authority for the Bavarian public service is the Bavarian Data Protection Commissioner, Wagmüllerstraße 18, 80538 München. 
• You may object to the processing of your personal data at any time due to reasons based on your personal circumstances (pursuant to article 21 of the GDPR). If the legal requirements are met, we will then not further process your personal data.

9. Right to object

Insofar as the data processing is based on your consent, you have the right to revoke your consent at any time. The data processing carried out until then remains lawful, the revocation applies only for the future. In this case, your personal data will be deleted immediately.

If you choose to exercise the rights stated above, the public office will check whether the legal requirements for doing so have been met.

10. Amendments to our data protection declaration

The University of Music Wuerzburg reserves the right to change this data protection declaration to accommodate changes to legislation or changes in the services we provide (e.g., if we introduce new services).

If you have any further questions, please feel free to contact the Data Protection Officer.