Data protection

The following information is intended to provide you with an overview of the processing of your personal data in the context of the preparation and implementation of the DFG Review Board election by our election office and your data protection rights.

The person responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is

Phone: +49 5323 72-0
Fax: +49 5323 72-3500
Email: praesidentin@tu-clausthal.de
Clausthal University of Technology
Adolph-Roemer-Straße 2a
38678 Clausthal-Zellerfeld
Germany

Data Protection Officer of Clausthal University of Technology:

Mr. Andreas Tews, M.A.
Email: dsb@tu-clausthal.de
Adolph-Roemer-Straße 2a
38678 Clausthal-Zellerfeld
Germany

Further and comprehensive information on the DFG Review Board Election and on data processing by the DFG in connection with the DFG Review Board Election can be found on the DFG homepage.

Your personal data will be processed by the election office in order to determine the number of academics entitled to vote (eligible voters). Subsequently, all those entitled to vote at the electoral office set up by us are kept in a list (list of those entitled to vote). We also process your data in order to send you the election documents. The purpose of data processing is therefore the proper conduct of the DFG Review Board election.

For these purposes, the following personal data of (potential) academics eligible to vote are processed:

• First name and surname
• academic qualifications
• Business contact details (address, e-mail address)
• Status of eligibility to vote (verification of the right to vote in accordance with Section 2 in conjunction with § Section 9 no. 2 of the election regulations for the election of members of the DFG review boards)

Data processing for the purpose of the proper conduct of the DFG Review Board election is carried out on the basis of Article 6 (1) sentence 1 letter b GDPR and Section 26 (1) sentence 1 Federal Data Protection Act (BDSG). Data processing is necessary to fulfill the obligations of the contractual / employment relationship between you and us. Our obligation to process your data arises from our membership obligations or contractual obligations towards the DFG.

We only store your personal data until the purpose of its processing has ceased to exist and, if applicable, beyond this period within the scope of the statutory retention periods. The data will then be deleted after this period has expired.

We only process the personal data that we have received directly from you as part of the contractual / employment relationship between you and us.

We do not use automated decision-making or profiling in accordance with Article 22 GDPR.

Data processing for the purpose of the proper conduct of the DFG Review Board election is based on the data we have about you, which you are generally already obliged to provide as part of the contractual/employment relationship between you and the controller. If the data required to check your eligibility to vote is not complete, failure to provide the relevant data could result in you being unable to participate in the election.

Within the organization of the controller, only those employees have access to your personal data who require such access for the proper preparation and implementation of the DFG Review Board election. These are, in particular, the person responsible for the election.

We only pass on your personal data to external recipients if there is a legal justification for doing so or if you have given your consent. External recipients may be

• Processors: service providers that we use to provide services in the area of human resources or who are entrusted with the maintenance of our IT systems. These processors are carefully selected and regularly checked by us to ensure that your personal data is in good hands. The service providers may only process your personal data for the purposes specified by us.
• DFG: In individual cases (e.g. suspected violations of the election regulations, election audits), it may be necessary to pass on personal data to the DFG, including the persons and bodies responsible for investigating such violations.

Your personal data will not be transferred to countries outside the EU/EEA (so-called third countries) without an adequate level of data protection as part of the preparation and implementation of the DFG Review Board election.

Data protection information for the electoral offices set up to conduct the DFG Review Board election (here: Clausthal University of Technology)

You have the following rights regarding the processing of your personal data:

1. Right of access, Article 15 GDPR
   You have the right to obtain confirmation from us as to whether or not we are processing personal data concerning you. If this is the case, you have the right to information about your personal data and to further information regarding the processing.
2. Right to rectification, Article 16 GDPR
   You have the right to request the rectification of your inaccurate personal data and to have incomplete personal data completed.
3. Right to erasure ("right to be forgotten"), Article 17 GDPR
   Under certain circumstances, you have the right to obtain from us the erasure of your personal data. This right exists, for example, if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed or if the personal data has been processed unlawfully.
4. Restriction of processing, Article 18 GDPR
   Under certain circumstances, you have the right to request that we restrict the processing of your personal data. In this case, we will only store the personal data for which you have given your consent or for which the GDPR permits processing. For example, you may have a right to restriction of processing if you have disputed the accuracy of your personal data.
5. Data portability, Article 20 GDPR
   If you have provided us with personal data on the basis of a contract or consent, you may request that you receive the personal data you have provided to us in a structured, commonly used and machine-readable format or that we transmit it to another controller if the legal requirements are met.
6. Withdrawal of consent
   If you have given us your consent to process your personal data, you can withdraw this consent at any time with effect for the future. This does not affect the lawfulness of the processing of your personal data until you withdraw your consent.
7. Objection to processing based on "legitimate interest"
   You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (data processing based on a balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
8. Right to lodge a complaint with the supervisory authority, Article 77 GDPR
   You also have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates applicable law. To do so, you can contact the data protection authority responsible for your place of residence, workplace or the location of a suspected infringement, or the data protection authority responsible for us. The competent authority is the supervisory authority of the federal state in which you live, work or in which an alleged infringement that is the subject of the complaint is alleged to have taken place.