Data protection statement –moodle.daad.de

We – Deutscher Akademischer Austauschdienst e.V. (the German Academic Exchange Service), hereinafter referred to as
either “we” or “DAAD” – are pleased to see you visiting our platform. Thank you for your interest in our organisation andfunding projects. Your privacy is important to us. We take the protection of your personal data and their confidential
treatment very seriously. Your data will be processed exclusively within the legal framework of the data protection
provisions of the European Union, in particular the General Data Protection Regulation (hereinafter referred to as “GDPR”).
This data protection statement provides you with information about the processing of your personal data and your dataprotection rights when using our platform.
1.

Data Controller and Commissioner for Data Protection – contact details

The Data Controller as defined in data protection legislation is:
Deutscher Akademischer Austauschdienst e.V. (DAAD)
Kennedyallee 5053175 BonnGermany
Tel: +49 228 882-0

Email: datenschutz@daad.de
If you have any questions or suggestions about data protection, please feel free to contact us.
2.

Object of data protection

The object of data protection is personal data. Personal data means any information relating to an identified or identifiable
natural person (a so-called data subject). This includes details such as first name, surname and email address, though otherdetails are also necessarily registered during the use of the DAAD Moodle platform, such as the beginning, end and extentof use.

3.

Type, scope, purposes and legal basis for data processing

Below you will find an overview of the type, scope, purposes and legal basis of data processing on our platform.
3.1

Provision of our Moodle platform

When you access our platform on your device, we process the following data:-Date and time of access
Duration of visit
Operating system used
Volume of data sent
Type of eventIP address
Domain nameWe process this data on the basis of GDPR Article 6 (1) point f, as it is required for us to provide the service, to ensuretechnical operation and to investigate and remove malfunctions. It is in our interest to ensure the use and technicaloperability of our platform. This data is automatically processed when our platform is accessed. Unless it is provided, youcannot use our services. We usually delete this data after seven days unless, under exceptional circumstances, we need it
for a longer period for the above-mentioned purposes. In such a case, we delete the data as soon as it is no longer required
for the relevant purpose.

1

3.2

Contact form

You can contact us using a form to register on the DAAD Moodle platform if you wish. If you register in this way, we will
require the following mandatory details from you (marked as such): first name, surname, email, higher education
institution, city, country.
The data serves the purpose of meeting your request for contact and registration. We process this data on the basis ofGDPR Article 6 (1) point b. The purpose of processing your data is to handle your contact request so as to allow use of theplatform. Any personal data additionally collected during the sending process will be deleted if it is no longer required forthe purposes for which it was collected or otherwise processed.
You can view this data at any time after login by clicking on your name (at the top right of the screen). You can alter andmake additions to these details at any time as you wish. Apart from the course “Proposal writing for PhD projects inGermany”, which does not allow communication between course participants, the information you enter is visible to theother course participants. Additionally, it is also visible to other trainers and administrators. In your personal profile, youcan also choose whether and how you wish to receive emails from https://moodle.daad.de (e.g. individual emails or daily
summaries – so-called digests). You can change this setting at any time.

3.3

Google AnalyticsThis platform uses Google Analytics, a web analysis service of Google Inc. (hereinafter: “Google”). Google Analytics uses
cookies (see clause 5), i.e. text files which are saved to your computer and allow us to analyse your use of the platform. The
information that is created by cookies on your use of our platform is usually sent to a Google server in the USA, where it isthen stored. However, if IP anonymisation is activated for this platform, your IP address will not be sent without first being
truncated by Google within the Member States of the European Union or other parties to the Agreement on the European
Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and then truncatedthere. Acting on behalf of the site operators, Google will use this information to analyse your use of the platform, to create
reports on platform activities for us as site operators and to provide us with other services connected with platform andinternet use. The IP address which Google Analytics sends via your browser will not be linked with any other data Google
may have.
This platform uses Google Analytics with the extension “_anonymizeIp()”. This has the effect of truncating IP addresses
before further processing, so that the data cannot be related to any specific person. If the data that is collected about you
allows conclusions about you as a person, these are immediately prevented and the relevant personal data is thus deleted
immediately.
We use Google Analytics to analyse the use of our platform and to improve it at regular intervals. The statistical data we
receive in this way helps us to improve our platform and to make it more interesting for you as a user. For exceptional cases
in which personal data is transferred to the USA, Google has subscribed to the EU-US Privacy Shield(https://www.privacyshield.gov/EU-US-Framework).
The legal basis for the use of Google Analytics is GDPR Article 6 (1) point a, i.e. your consent. Any data that we send andwhich is linked to cookies, user IDs or advertising IDs is automatically deleted after 14 months. Any data that has reached
the end of its retention period is automatically deleted once a month.
You can prevent the storage of cookies through a suitable setting in your browser software. Please note, however, that ifyou do so, you may not be able to use all the functions of this platform in full. Furthermore, if you wish to prevent thecollection of data generated by cookies and related to your usage of the platform (incl. your IP address) and if you wish to
opt out of such data being processed by Google, you can download and install a browser plug-in from the following link:
http://tools.google.com/dlpage/gaoptout?hl=de.
Opt-out cookies prevent any future collection of your data when visiting this platform. To prevent collection via Universal
Analytics across multiple devices, you need to implement the opt-out on all the systems you use. Click here to set the optout cookie: <a href="javascript:gaOptout()"><strong>Disable Google Analytics</strong></a></p>.
Further details about Google and its use of personal data can be obtained from the following addresses:
Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

2



3.4

http://www.google.com/analytics/terms/de.html, data protection overview:https://support.google.com/analytics/answer/6004245?hl=en
https://policies.google.com/privacy

Map service

Our platform uses Google Maps on some sub-pages to display interactive maps and generate travel directions. Google Maps
is a map service provided by Google Inc. (Google). The use of Google Maps can lead to information about the use of thisplatform, including your IP address and the (start) address entered in connection with the route planner functionality, beingtransmitted to Google in the USA. When you access a page that includes Google Maps, your browser connects directly with
the Google servers. Google directly transmits the map content to your browser, which integrates it into the platform. Forthis reason, we have no control over the amount of data collected in this way by Google. The legal basis for processing isGDPR Article 6 (1) point f. Our purpose in doing this is to provide you with this map service. You will find further informationon the purpose and scope of data collection and data processing by the plug-in provider in the provider’s data protection
statements. Here you will also find further information on the rights and setting options available to you in order to protect
your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has
subscribed to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

3.5 Moodle-specific tools for communication and collaboration
On Moodle, access is only provided to course materials and interactive instruments for those users who are enrolled on the1courses. The relevant tools are explained briefly below.
Posts/comments, evaluations, completion tracking
During the use of Moodle, other data is generated such as posts and comments on the individual activities as well as
evaluations of the latter by lecturers or trainers without editor’s rights. Posts and comments on activities are visible tocourse participants and lecturers’ guests. Evaluations are only visible to the individual evaluated participant(s) and thelecturer or trainer without editor’s rights.
Posts/comments on activities and evaluations are generally deleted from the course in question when the participant isunenrolled. In the case of activities where deletion involves removal of the context, such as in forums, chats and wikis, theposts made by the relevant participant are preserved. Not until the course is deleted are these posts/comments andevaluations permanently deleted from Moodle. In connection with conditional activities, use of completion tracking enables
course lecturers to view user-based completion status relating to the material and activities included.
Before being unenrolled from a course, participants can delete their own photograph; if they do so, the photograph nolonger appears in the posts previously made in the interactive tools.
ChatThe chat function allows real-time communication with other users. Messages posted in chats are visible to all course
participants, including the time and date of the message, your name and also a photograph if your profile contains one.
ForumsForums allow course participants to communicate with each other on a time-delayed basis. Posts are visible to all course
participants, including the time and date of the message, your name and also a photograph if your profile contains one.
Video conferences
Recordings of video conferences are also visible to all course participants.
Blogs
Blogs – except for personal blogs – can be read by all Moodle participants, including those not enrolled on a particular
course. Here it is possible to exchange information and views on particular courses or on general topics. Posts are visible toall Moodle users, including the time and date of the message, your name and also a photograph if your profile contains one.

1

Please note: The course „Research in Germany”-Proposal Writing does not allow communication between course participants or lecturers.
Therefore, there are not any interactive tools such as chats, forums or video conferences.

3

Messages
Messages can be sent to any Moodle user, regardless of course enrolment. For the purpose of messaging, Moodle providesa list of contacts containing Moodle users’ names only – not their email address or other details. However, the list ofcontacts is not visible to users as a list of all names: the name of a particular recipient first has to be entered in a search
field.
The name of every Moodle user is added to the list of contacts on registration.
All the names of course participants are made available to lecturers in the form of a course participant list for the purposeof group messaging.
WikiWiki posts are visible to all other Moodle users, including the time and date of the message, your name and also aphotograph if your profile contains one.
Own files/calendar
Details and files in the calendar or in “My files” are only visible to the individual user.
Log data
Log data collected in the background while Moodle is being used – including time, IP address, full name, action and object
information – shows at what time which elements of the teaching programmes and profiles of other users were accessed
and also, where relevant, whether set assignments have been completed and whether/how a user has participated in an
activity. Every participant can view their own log data. Lecturers are only provided with the data in aggregated andanonymised form; therefore, anonymous usage statistics are compiled.
The data saved is not shared with other individuals or agencies, not even in anonymised form.
H5P tools/interactive test formats
Courses can involve tests being set for the purpose of individual review of knowledge, text understanding etc. as well as forassessment purposes. Tests are evaluated automatically, and the relevant lecturer is responsible for developing them aswell as setting grade scales, pass marks etc. In certain circumstances, the use of these test formats involves automateddecision-making as defined by GDPR Article 22. Whether this produces legal effects as further addressed in Article 22 (1) (inthis case, grading, assessment of an academic achievement relevant to gaining a qualification or similar) is decided by thelecturer or department at the higher education institution in question. No profiling falling within the scope of Article 22 (1)is carried out as defined in GDPR Article 4 (4).

4.

Links to third-party websites

If websites and services provided by other site owners are linked to this platform, they have been and will continue to bedesigned and supplied by third parties. We have no influence on the design, content or function of third-party services, andwe expressly distance ourselves from any content provided by linked third-party sites. Please remember that third-party
sites linked to this platform may have their own cookies, which are installed on your device to collect personal data. We
have no influence over this. In such cases, you may wish to obtain more information directly from the owners of the thirdparty websites linked to this site.

5.

Cookies

We use so-called cookies to provide you with extensive functions, to make our platform more user-friendly and to optimise
our platform. Cookies are small files, which are saved to your device via your web browser.
Categories of cookies
We use cookies for a variety of purposes and with different functions. We draw distinctions between cookies depending onwhether they are mandatory from a technical perspective (i.e. a technical requirement), how long they are stored and used(known as the retention period) and whether they are applied by our platform or by a third party and, if so, by whom (i.e.
by which cookie provider).

4Technical requirement and legal basis
Technically mandatory cookies: We use certain cookies because they are mandatory requirements to ensure that ourplatform and its functions are able to operate properly; these include cookies of the “Moodle Session” type. Such cookies
are applied automatically when the platform or a particular function is accessed, and they are necessary so that your login is
maintained as you access successive pages. If you wish to prevent the use of cookies in general via your browser settings,
we can no longer guarantee that you will be able to make full use of the platform. Any data collected through the use ofsuch cookies is processed by us on the basis of GDPR Article 6 (1) point f. Technically non-mandatory cookies: By contrast,
cookies which are not absolutely necessary (“MoodleID” cookies in this case) are used to improve the convenience andperformance of our platform or to save certain settings you have made, e.g. keep your login data in the web browser evenafter you have signed out. We also use this type of cookies to obtain information on the frequency with which certain partsof our platform are used so that we can tailor them more closely to your needs in the future. Any data collected through theuse of such cookies is processed by us on the basis of GDPR Article 6 (1) point a.
Retention period
Session cookies: Most cookies are only required for as long as you access the current service or continue your session. Theyare either deleted or lose their validity as soon as you leave our platform or your current session has expired (these are socalled session cookies).
Permanent cookies: Only “MoodleID” cookies are saved over a prolonged period of time in order to recognise your login
details when you return to access our platform again, for example, and access previously saved settings. Permanent cookies
are automatically deleted upon the expiry of a defined period of time following the date on which you visited the site or
domain where the cookie was set.
Cookie providers
Third-party cookies: So-called third-party cookies are applied and used by other providers or platforms, such as by operatorsof web analysis tools. Further details on web analysis tools and range measurement can be found below in this statement.
Third-party providers can also use cookies to display adverts or to integrate social media content, e.g. social plug-ins.
Deletion of and objection to the use of cookies
The acceptance of cookies is not mandatory for using our platform. If you do not want cookies to be saved to your device,
you can disable the relevant option in the system settings of your browser. Saved cookies can be deleted through thesystem settings in your browser at any time. Please note, however, that if you do not accept cookies, the services weprovide may be subject to functional limitations.
When you access our platform, the following cookies may be stored:
Name ofcookie

Technical
requirement

Retention period

CookieproviderPurpose of use and interest
This cookie is necessary in order to authenticate
users in various databases and to use Symfony
forms (such as a contact form).

PHPSESSID

Yes

Session cookie(end of session)

DAAD/Moodle

Moodle IDNo

Permanent cookie

In order to save the login name in the web
DAAD/Moodle browser.

_ga

No

Permanent cookie (twoyears)
Google Inc.

This cookie enables Google Analytics todistinguish between users.

_gat_UA100127283-1

No

Permanent cookie (oneGoogle Inc.
minute)This cookie has the purpose of limiting thenumber of requests sent to Google Analytics.

_gid

No

Permanent cookie(24 hours)

This cookie enables Google Analytics todistinguish between users.

6.

Google Inc.

Recipients of personal data

Internal recipients: Within the DAAD, access is limited to persons requiring it for the purposes specified under clause 3.
External recipients: We only share your personal data with external recipients outside the DAAD if this is required for
managing or processing your request, if some other statutory authorisation exists or if you have given us your consent forthis purpose.
External recipients may be:5a) Order processors
External service providers which we use for the provision of services, such as for the technical infrastructure andmaintenance of the DAAD’s own services or in order to provide content. We carefully select such processors and regularly
check them to ensure the safeguarding of your privacy. Service providers may only use the data for the purposes wespecify.
b) Public authorities
Public authorities and state institutions, such as public prosecutors, courts of law and fiscal authorities, to which we need tosend personal data for mandatory legal reasons.
c) Private agencies
Cooperation partners and assistants, to whom data is transmitted on the basis of consent or a mandatory requirement.

7.

Data processing in third countries

If data is transmitted to bodies that have their head offices or data-processing locations outside EU member states andoutside states forming part of the EEA, we ensure before disclosure that – except in the case of certain legally permitted
exceptions – those bodies either have your adequate consent or they provide an adequate level of data protection (e.g.
through an adequacy decision taken by the European Commission, through suitable guarantees such as the recipient’s selfcertification for the EU-US Privacy Shield or the agreement of so-called standard EU contractual clauses with the recipient).
You can request from us a list of recipients in third countries and a copy of the provisions that have been agreed in eachcase to ensure an adequate level of data protection. To do so, please use the contact details given in clause 1.

8.

Retention period

The data collected on registration (first name, surname, email, higher education institution, city, country, see above 3.2) issaved for as long as required to fulfil the relevant purpose, in this case use of the platform. If you revoke your consent, wedelete your personal data, unless further processing is permitted under the relevant applicable statutory provisions. We
also delete your personal data if we are under obligation to do so on legal grounds.
Users’ accounts on the DAAD Moodle Moodle are deleted after one year of inactivity. Any profile you enter yourself tofreely create your profile can be deleted by you at any time. Lecturers can have a course deleted at any time. This also
results in students’ posts within a course being deleted. Posts and comments in forums, wikis and the glossary as well as
files provided can still be retrieved after deactivation of your Moodle access until the relevant course or the relevant
activity has been deleted.

9.

Rights of data subjects

As a person affected by data processing, you are entitled to a number of rights. These are in detail:Right to information: You have a right to access the data we have stored about you as a person.
Right to rectification and deletion: You can require us to correct inaccurate data or – provided that the legal grounds are inplace – to delete your data.
Restriction of processing: Provided that the legal grounds are in place, you can require us to restrict the processing of yourdata.
Data portability: If you have provided us with data on the basis of a contract or your consent, and as long as there are legal
grounds, you can require us to send you the data you gave us in a structured, commonly used and machine-readable
format, or you can require us to send your data to a different controller.
Objection to data processing on the legal basis of “legitimate interest” under GDPR Article 6 (1) point f: If there arereasons arising from your specific situation, you are entitled to object to our processing of your data at any time, provided
that such an objection has its legal basis in a “legitimate interest”. If you make use of your right to object, we shalldiscontinue the processing of your data, unless we can – within the parameters of the law – demonstrate compelling
legitimate grounds for further processing, outweighing your own rights.
To make use of your right to object, please use the contact details specified in clause 1.

6

Objection to cookies: You can also object to the use of cookies at any time. You will find the relevant details in our notes on
cookies in clause 5.
Revocation of consent: If you have given us your consent to the processing of your data, you can revoke this at any timewith future effect. This, however, does not affect the legitimacy of processing your data until the date of revocation.
Right to lodge a complaint with the supervisory authority: You can also lodge a complaint with the competent supervisory
authority if you believe that the processing of your data has breached the latest applicable law. To do so, you can contact
the data protection authority responsible for your place of residence or country or the data protection authority
responsible for us.
Your contact with us: In addition, if you have any questions about the processing of your personal data, your rights as adata subject or any consent you may have given, please feel free to contact us without incurring any charges. To exercise
any of the aforementioned rights, please contact datenschutz@daad.de or write to the postal address specified in clause 1.
When you do so, please make sure that we can clearly identify you.

10. Commissioner for data protection
Contact details of our commissioner for dataprotection: Dr Gregor Scheja
Scheja und Partner Rechtsanwälte mbB
Adenauerallee 136
53113 Bonnwww.scheja-partner.deContact via https://www.scheja-partner.de/kontakt/kontakt.html

11. Update status
The latest version of this data protection statement shall be applicable. Last updated: 30/08/2018.

7