Vollständige Richtlinie

 

(Translated Version from 20.07.2023)

(Please note: legally, the German data protection declaration / Datenschutzerklärung applies)
This privacy policy describes the processing of your data in the examination system Prüfung@UPB. Prüfung@UPB is the central system for online examinations at the University of Paderborn and is operated as a Moodle instance at the Ruhr University Bochum.

With this privacy statement, the University of Paderborn fulfils its duty to inform in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). With regard to the terms used in the following, e.g. "personal data", "processing", "controller" etc., reference is made to the definitions in Article 4 of the GDPR.

Names and contact details

Responsible for the operation of the system is the University of Paderborn, a public corporation with legal capacity supported by the state of North Rhine-Westphalia. It is represented by the President.

Name and contact details of the person responsible

University of Paderborn
Warburger Straße 100
33098 Paderborn
Tel.: 0 52 51 / 60 - 0
Web.: http://www.uni-paderborn.de

Operator of Prüfung@UPB

If you have any questions that are not answered by this privacy statement, or if you would like more detailed information on individual points, the Centre for Information and Media Technologies (IMT) will be happy to provide further information.

Email:      imt@uni-paderborn.de
Phone:    0 52 51 / 60 - 55 44 (IT hotline)
ServicePoint des IMT: Gebäude I, Ebene 0, Raum I0.401

Postal:
University of Paderborn
Centre for Information and Media Technologies (IMT)
Warburger Str. 100
33098 Paderborn

Contact details of the Data Protection Officer

You can contact the official data protection officer of the University of Paderborn by post at the address of the data controller given above or as follows:

E-mail:   datenschutz@uni-paderborn.de
 Tel:       0 52 51 / 60 - 44 44
Web:      http://www.uni-paderborn.de/datenschutz/

Data categories, purposes and legal bases of the processing of your personal data

Users of Prüfung@UPB are students and teachers. Teachers are assigned the role of examiner, exam assistant or correction assistant in the examination courses they administer. Examiners and examination assistants have full editing rights in your course and can, for example, create activities and enrol participants. The role of correction assistant has limited access to the course and can assess students, but cannot make any changes to the course. Students are assigned the role of participant in the courses they have taken in Prüfung@UPB .

The data is processed for the purpose of organising, preparing, conducting and evaluating electronic examinations in accordance with the respective legal basis. Entries made by examiners and participants, configurations and materials and activities created are stored in Prüfung@UPB and are visible to examiners and participants in accordance with the respective access authorisations.

In addition to the actual content data, all materials and activities include so-called metadata (designations, descriptions, specific data and configurations as well as timestamps of creation/modification in order to determine the topicality of the materials and activities as well as manipulation of the system and the data).

Reviews

Examiners, examination assistants and correction assistants have the possibility to evaluate activities (assignments, tests) completed by participants in their courses. Assignments and tests are time-stamped so that examiners can see whether they have been submitted on time or whether activities have been completed.

Collection of data from the user

Each user is assigned a profile. When logging in to Prüfung@UPB for the first time, the surname, first name, email address and, in the case of participants, the matriculation number are entered into this profile.

Examiners, examination assistants and correction assistants can edit your profile; profile editing is blocked for participants.

As part of the use of Prüfung@UPB, content is added, as files, links or in the form of text input and assigned by the system to the person entering. The uploading and posting of content serves the purpose of conducting electronic examinations. The legal basis for processing the data is Art. 6 para. 1 lit. e DSGVO.

Data exchange with other systems at the university

Prüfung@UPB is a closed examination platform, i.e. authentication is required for use. This authentication takes place with the university-wide university account (access ID) and associated password. The login is done via Shibboleth and is checked against the central directory service (LDAP), which is operated at the Centre for Information and Media Technologies (IMT).

When registering for Prüfung@UPB for the first time, surname, first name, e-mail address, matriculation number and the university account are transferred from the central directory service to Prüfung@UPB. There is no data exchange with other systems.

The data required in the context of the examination will be processed within the framework of the University's task fulfilment in accordance with Art. 6 para. 1 UAbs. 1 lit. e), para. 3 DS-GVO in conjunction with § 3 para. 1 Landesdatenschutzgesetz Nordrhein-Westfalen (DSG NRW) in conjunction with § 3 para. 1 of the Gesetz über die Hochschulen des Landes Nordrhein-Westfalen (HG NRW) and the applicable examination regulations of the University of Paderborn.

Technical data / log data

The examination system is hosted by the Ruhr-Universität Bochum and operated by the University of Paderborn. When you call up the web-based Prüfung@UPB system, your browser basically transmits data to the system. This includes:

• Web page/address accessed
• Date and time of access
• IP address of the user
• HTTP status code
• Volume of data retrieved

Browser type and version / operating system used by the user

 

For the technical operation, the detection of errors and their elimination, this so-called log data is stored on secured systems of the Ruhr-Universität Bochum. In addition, when using Prüfung@UPB, further log data (time of a logon to and logoff from the system, name, identifier, event context, component, event name, description, origin and IP address) are stored in Moodle; these are only used for troubleshooting. The data is not evaluated in connection with names or e-mail addresses and is not passed on to third parties.

The University of Paderborn processes the data required for technical and secure operation within the scope of the University's task fulfilment pursuant to Art. 6 para. 1 UAbs. 1 lit. e), para. 3 DS-GVO in conjunction with § 3 para. 1 DSG NRW in conjunction with § 3 para. 1 HG NRW. V. m. § 3 para. 1 HG NRW.

Use of cookies

When using Prüfung@UPB, so-called cookies are stored in the user's browser. These are files with which, for example, personal settings can be assigned. The storage of cookies can be switched off in the settings of your browser or provided with an expiry time. However, by deactivating cookies, some functions that are controlled via cookies can no longer be used.

Exam@UPB uses cookies for the following purpose:

• Session key, which is only used for unique assignment during the session. The cookie is created when the Prüfung@UPB homepage is called up and remains after logging in until the session expires (logout or timeout). After closing the browser, the cookie is automatically deleted.

The University of Paderborn uses the cookies required for technical operation as part of the University's task fulfilment in accordance with Art. 6 para. 1 UAbs. 1 lit. e), para. 3 DS-GVO in conjunction with § 3 para. 1 DSG NRW in conjunction with § 3 para. 1 HG NRW. V. m. § 3 para. 1 HG NRW.

Visibility of the data / transparency

The data in the profile is only displayed within Prüfung@UPB and is not visible to the other users* except for the names due to the deactivated visibility in Prüfung@UPB by default.

The attendance lists (first name, last name, email address and matriculation number) of courses can only be viewed by the examiners. Examiners can only list the participants in their own courses, i.e. in particular they cannot see in which courses participants are also registered.

Materials created by students are visible within a course for examiners, examination assistants and correction assistants. This also applies to some metadata linked to the content, e.g. time of creation.

Assessments in the examination course are visible for examiners, examination assistants and correction assistants. In addition, each participant can view the assessments entered for him/her.

The data processing required for an evaluation is carried out within the scope of the university's task fulfilment pursuant to Art. 6 para. 1 UAbs. 1 lit. e) para. 3 DS-GVO in conjunction with § 3 para. 1 DSG NRW in conjunction with § 3 para. 1 HG NRW. V. m. § 3 para. 1 HG NRW.

Recipients of your personal data

As a matter of principle, we do not transmit personal data processed in the course of using the system to third parties. In individual cases, this may be done on the basis of legal permission, for example, transmission to law enforcement agencies for the purpose of investigating criminal offences within the framework of the regulations of the Code of Criminal Procedure or for the purpose of asserting claims for damages in the event of copyright infringements.

As a hoster and (technical) service provider, the Ruhr-Universität Bochum may have access to personal data in Prüfung@UPB. An agreement on commissioned processing pursuant to Art. 28 DS-GVO has been concluded between the University of Paderborn and the Ruhr- Universität Bochum for this purpose.

As a matter of principle, data processed in the system is not transferred to countries outside the European Economic Area and associated countries (no third country transfer).

Examination results are passed on to the respective examination offices and examination boards.

Duration of the storage of your personal data

Deletion periods for user data:

A user is deleted from Prüfung@UPB when he/she leaves the university and his/her identity in the IMT directory service expires. The user will only be deleted if he/she is no longer enrolled in a course.

Server log data is deleted after 7 days.

We retain the data entries in the Examination@UPB log files for 365 days as evidence in the event of possible objections to examinations.

Deletion of examination courses:

Examination courses are automatically deleted from Prüfung@UPB 4 semesters after the examinations have been carried out in the course. Examination files are not kept in Prüfung@UPB but in the respective examination offices after relevant examination results have been submitted by the examiners.

Your rights as a data subject

As a data subject, you can exercise the rights granted to you by the GDPR at any time; these are:

• the right to information as to whether and which of your data is being processed in accordance with Art. 15 DS-GVO, § 12, § 17 Para. 5 DSGNRW;
• the right to demand the correction or completion of the data concerning you in accordance with Art. 16 DS-GVO, § 17 Para. 5 DSG NRW;
• the right to have the data concerning you deleted in accordance with Art. 17 DS-GVO, § 10 DSG NRW;
• the right to restrict the processing of data concerning you in accordance with Art. 18 DS-GVO, Section 17 (5) DSGNRW;
• the right to data transfer of the data concerning you in accordance with Art. 20 DS-GVO.

Objection to the processing of your personal data and revocability of your consent

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) of the GDPR, in accordance with Article 21 of the GDPR. The right to object pursuant to Art. 21 DS-GVO vis-à-vis a public body does not exist insofar as there is a compelling public interest in the processing that outweighs the interests of the data subject, or a legal provision obliges the processing (Section 14 DSG NRW), or insofar as the exercise of the right to object is likely to render impossible or seriously impair the achievement of the statistical purposes and the restriction is necessary for the fulfilment of those purposes. If you would like to exercise your right of objection in accordance with Art. 21 DS-GVO, please write an email to
datenschutz@uni-paderborn.de.

Any consent given can be revoked in whole or in part at any time without giving reasons. The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation (Art. 7 (3) DS-GVO). This means that the University of Paderborn may no longer continue the data processing based on this consent in the future. If you wish to revoke your consent in whole or in part, please write an email to datenschutz@uni-paderborn.de.

Right to complain

In addition to the aforementioned rights, you have the right to lodge a complaint with the supervisory authority under data protection law (Art. 77 DS-GVO) if you are of the opinion that the processing of personal data concerning you violates the requirements of data protection law; for example, with the competent authority for the university

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
E-mail: poststelle@ldi.nrw.de

Validity of this privacy policy

The University of Paderborn reserves the right to amend this privacy policy in order to adapt it to changes in relevant laws or regulations or to better meet your needs. This data protection declaration applies in the version last published by the University of Paderborn. Please therefore note the current version number of the data protection declaration.

Vollständige Richtlinie

Die Universität Paderborn bietet mit Prüfung@UPB eine Moodle-Instanz für elektronische Prüfungen an. Die Moodle-Instanz wird an der Ruhr-Universität Bochum gehostet und von der Universität Paderborn betrieben. Nutzungsberechtigt sind Studierende, Mitarbeitende und Lehrende der Universität Paderborn. Die Nutzung von Prüfung@UPB geschieht ausschließlich im Rahmen der Durchführung von elektronischen Prüfungen an der Universität Paderborn.

Der Zugang zu Prüfung@UPB erfolgt mittels UNI-Account (Zugangskennung) der vom Zentrum für Informations- und Medientechnologien (IMT) für alle Mitglieder und Angehörigen der Universität Paderborn sowie ihre Gäste verwaltet wird. Die Nutzer*in verpflichtet sich, den persönlichen Zugang vor unbefugter Benutzung durch Dritte zu schützen. Auf keinen Fall darf das Passwort weitergegeben werden. Die Anmeldung und Registrierung erfolgt über Shibboleth (DFN-AAI – Authentifikations- und Autorisierungs-Infrastruktur des Deutschen Forschungsnetztes).

Nutzer*innen dürfen bei der Nutzung von Prüfung@UPB nicht gegen geltende Rechtsvorschriften verstoßen und müssen die Vorschriften der Nutzungsordnung des Zentrums für Informations- und Medientechnologien einhalten. Insbesondere haben sie

• das Urheberrecht einzuhalten und Dokumente, die nicht explizit für die weitergehende Nutzung freigegeben wurden, nur für Studienzwecke zu verwenden,
• in Prüfung@UPB keine rechts- oder sittenwidrigen Inhalte einzustellen oder aus Prüfung@UPB heraus zu verschicken,
• jegliche Werbe- oder Marketingaktivitäten in Prüfung@UPB zu unterlassen,
• die Privatsphäre anderer zu respektieren und keine belästigenden, verleumderischen oder bedrohenden Inhalte einzustellen oder zu verschicken,
• keine personenbezogenen Daten, von denen sie im Rahmen der Prüfung@UPB-Nutzung Kenntnis erlangen, außerhalb von Prüfung@UPB zu veröffentlichen oder an Dritte weiterzugeben.

Prüfende haben bei der Nutzung von Daten der Studierenden die geltenden datenschutzrechtlichen Vorschriften sowie die jeweiligen prüfungsrechtlichen Regelungen zu beachten. Insbesondere

• dürfen sie nur die für die Prüfung notwendigen personenbezogenen Daten verarbeiten und diese für keine anderen Zwecke verwenden,
• dürfen sie namentliche Teilnehmerlisten nur dann nutzen, wenn eine entsprechende Erforderlichkeit besteht.  
• dürfen sie Kurse, in denen eine aktive Mitarbeit in Prüfung@UPB (Dateneingabe durch die Studierenden) gefordert wird, nicht öffentlich anlegen (keine Freigabe für alle Nutzer*innen),
• müssen Gruppen, innerhalb eines Kurses so angelegt werden, dass eine wechselseitige Sichtbarkeit der Studierenden nur dann möglich ist, wenn dies für die Prüfung erforderlich ist,
• müssen Bewertungen gelöscht werden, wenn die Ergebnisse an die Prüfungsämter übermittelt wurden und deren Aufbewahrung in Prüfung@UPB nicht länger erforderlich ist.
• Bei der Durchführung von Prüfungen sind die Regelungen der „Ordnung zur Regelung von Online-Prüfungen und der elektronischen Abgabe von Abschlussarbeiten in allen Studiengängen der Universität Paderborn sowie Studienarbeiten in den Masterstudiengängen Maschinenbau an der Universität Paderborn“ sowie der für die jeweiligen Studiengänge geltenden Studien- und Prüfungsordnungen sind einzuhalten.
• Die Feststellung von Täuschungsversuchen darf nicht allein auf Metadaten von Prüfung@UPB erfolgen. Beispielsweise können Zeitstempel, die von Prüfung@UPB gesetzt werden, nur Hinweise auf Täuschungen geben. Die Feststellung und Bewertung von Täuschungen muss auf Basis der eigentlichen Inhalte erfolgen.

Nutzer*innen können für eventuelle Schäden, die durch Verstöße gegen geltende Rechtsvorschriften, die Nutzungsordnung des IMT oder einer sonstigen Ordnung der Universität Paderborn entstehen, haftbar gemacht werden.

Examination@UPB Usage information

(Translated Version 1.0 from 20.7.2023)

The University of Paderborn offers a Moodle instance for electronic examinations with Prüfung@UPB. The Moodle instance is hosted at the Ruhr University Bochum and operated by the University of Paderborn. Students, staff and lecturers at the University of Paderborn are entitled to use the system. The use of Prüfung@UPB is exclusively in the context of electronic examinations at the University of Paderborn.

Access to Prüfung@UPB is via a UNI account (access code) which is administered by the Centre for Information and Media Technologies (IMT) for all members and staff of the University of Paderborn and its guests. The user is obliged to protect the personal access from unauthorised use by third parties. Under no circumstances may the password be passed on. Login and registration is done via Shibboleth (DFN-AAI - Authentication and Authorisation Infrastructure of the German Research Network).

When using Prüfung@UPB, users must not violate applicable legal provisions and must comply with the regulations of the Centre for Information and Media Technologies. In particular they must

• to respect copyright and to use documents that have not been explicitly released for further use for study purposes only,
• not to post any illegal or immoral content in Prüfung@UPB or send it from Prüfung@UPB,
• refrain from any advertising or marketing activities in Prüfung@UPB,
• Respect the privacy of others and not post or send harassing, defamatory or threatening content,
• not to publish or pass on to third parties any personal data of which they become aware in the course of using Prüfung@UPB.

When using student data, examiners must observe the applicable data protection regulations as well as the respective examination regulations. In particular

• they may only process the personal data necessary for the examination and may not use them for any other purpose,
• they may only use lists of participants by name if there is a corresponding necessity. 
• they are not allowed to publicly create courses in which active participation in Prüfung@UPB (data entry by students) is required (no release for all users),
• groups, within a course must be created in such a way that mutual visibility of students is only possible if this is required for the examination,
• assessments must be deleted when the results have been sent to the examination offices and their storage in Prüfung@UPB is no longer necessary.
• When conducting examinations, the regulations of the "Regulations for the Regulation of Online Examinations and the Electronic Submission of Theses in all Degree Programmes of the University of Paderborn as well as Theses in the Master's Degree Programmes in Mechanical Engineering at the University of Paderborn" as well as the study and examination regulations applicable to the respective degree programmes must be observed.
• The detection of cheating attempts must not be based solely on metadata from Examination@UPB. For example, timestamps set by Prüfung@UPB can only indicate cheating. The detection and assessment of cheating must be based on the actual content.

Users can be held liable for any damage caused by violations of applicable legal regulations, the usage regulations of the IMT or any other regulations of the University of Paderborn.