Privacy policy regarding the processing of personal data in the context of customer relationship management

Who is responsible for data processing and who can data subjects contact?

Contact person
Lucy Sonnet
Data Science Center ScaDS.AI Dresden/Leipzig
Humboldtstr. 25, 04105 Leipzig
Tel.: +49 (0)341 97-39310
E-Mail: lucy.sonnet.2@uni-leipzig.de

Leipzig University
Data Protection Officer at Leipzig University
04109 Leipzig
Tel.: +49 (0)341 97-30117
E-Mail: dsb@uni-leipzig.de

Basic information on data protection at Leipzig University can be found here.

Purpose of processing

As part of its public relations work, an internal customer relationship management (CRM) system is operated by the Data Science Center ScaDS.AI Dresden/Leipzig at Leipzig University. Personal data is processed for the following purposes in particular:

• Maintaining contact details of interested parties
• Managing newsletter subscriptions
• Sending newsletters and information about ScaDS.AI Dresden/Leipzig activities
• Managing unsubscriptions and revocations

What is the legal basis for the processing of personal data?

The processing of personal data is based on voluntary consent in accordance with:

• Art. 6 (1) (a) GDPR and Art. 7 GDPR

Consent is given by actively checking the corresponding box in the online newsletter registration form.

What personal data is processed?

The following personal data is processed when using the CRM system:

• First name, last name
• Email address
• Institution
• Field of activity/interests (e.g., science, industry, press)
• Internal, system-generated user ID (UID) in the CRM system
• Technical metadata (time of form submission)

The data entered in the form is automatically transferred to the CRM system via a programming interface (API) and assigned to a customer account there. The internal UID is used exclusively for the technical administration of the data records and does not allow any conclusions to be drawn outside the system.

Recipients of the data

Personal data will be:

• processed exclusively within Leipzig University,
• used only by authorized employees,
• not passed on to external third parties.

Storage period

Personal data will be stored:

• for as long as consent to receive the newsletter exists,
• until the data subject revokes their consent.

After revocation or unsubscribing, the data will be deleted from the CRM system. Data may still be available in backups of the CRM system for a period of time before it is automatically deleted.

Security of processing

Appropriate technical and organizational measures are used to ensure the security of processing, in particular:

• Role- and rights-based access restrictions
• Encrypted data transmission
• Operation on the university’s own servers
• Regular maintenance and security updates

Rights of data subjects

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

Withdrawal of consent

Consent to the processing of personal data may be withdrawn at any time with effect for the future. Withdrawal is possible:

• via the unsubscribe link in the newsletter or
• by sending an informal message to the above-mentioned contact options.

After withdrawal of consent, personal data will be deleted immediately, provided that there are no legal obligations to retain it.

Right to lodge a complaint

Data subjects have the right to lodge a complaint.
Please contact the data protection officers at Leipzig University.
You can also contact the competent data protection supervisory authority in accordance with Art. 77 GDPR.

Competent supervisory authority:

Sächsische Datenschutz- und Transparenzbeauftragte
Frau Dr. Juliane Hundert
Postanschrift:
Postfach 11 01 32
01330 Dresden
E-Mail: post@sdtb.sachsen.de
Tel.: +49 (0)351 85471 101
www.datenschutz.sachsen.de