Hint: This document has been automatically translated from German. The original version in German is legally binding. You can find the version here.

Data Protection Consent Declaration pursuant to Art. 7 GDPR

In order to diagnose a malfunction in the retrieval of university data, the controller (UniNow GmbH, headquartered in Magdeburg) requires diagnostic data from the user’s device.

By clicking the “Send diagnostic data” button, the user expressly declares their data protection consent that the controller may collect, store and process the personal data listed under item 2 for the purpose of error diagnosis.

The user agrees to the following procedure:

1. For the purpose of error diagnosis, the app compiles a diagnostic package on the user’s device. At the user’s instigation, this package is transmitted to the controller as an attachment to a message in the support chat.

2. In individual cases, the following data of the user may be affected:

   • Log data of the app (log entries at the levels Debug, Info, Warning and Error), including entries relating to operations in which no malfunction was detected
   • Information about the device and the app (e.g. device type, operating system and operating system version, app version as well as installation and user identifier)
   • Snapshots of those pages the app has loaded from the user’s university portal

   The snapshots of the pages from the university portal may contain, in particular, the following personal data:

   • Name of the university
   • Last name, first name
   • Enrolment number or university identifier
   • Subjects of study
   • Lectures and courses
   • Examinations and grades
   • Library data (e.g. loans, deadlines, fees)
   • Calendar and appointment data

   The controller has no influence over which data the university displays on the retrieved pages. Further personal data of the user not listed here may therefore be contained.

3. As the controller cannot control the content of the pages loaded from the university portal, the diagnostic data may in individual cases also contain special categories of personal data within the meaning of Art. 9 Para. 1 GDPR, such as information relating to health (e.g. withdrawal from an examination due to illness). The user’s consent expressly extends to the processing of such data, Art. 9 Para. 2 lit. a GDPR.

4. The diagnostic package is encrypted on the user’s device (asymmetric encryption using OpenPGP) and is transmitted exclusively via a TLS-encrypted connection. It is stored as a message attachment in the controller’s self-operated support ticket system based on Chatwoot and in the associated object storage. Both are operated in data centres within the European Union. No transfer to recipients in third countries within the meaning of Art. 44 et seq. GDPR takes place. Until decryption pursuant to item 5, the data remains encrypted throughout.

5. Decryption does not take place automatically, but only by employees of the controller and only insofar as it is necessary for diagnosing the reported malfunction. The private key required for this is kept separately from the data and is accessible only to a limited group of authorised employees. The diagnostic data is not used for any other purpose, in particular not for advertising purposes, profiling or product and usage analysis.

6. The controller assures that the user’s data protection concerns are guaranteed without restriction and that no transfer of data to unauthorised third parties takes place. Transfer occurs exclusively to the controller’s service providers, the hosting providers named in the privacy policy for the purpose of data hosting. For further information, please refer to our Privacy Policy.

7. Submitting this consent declaration is voluntary. Use of the app and the handling of the user’s request in the support chat are possible irrespective of this consent. If the user does not submit the consent declaration or withdraws it for the future, diagnosing the reported malfunction may take longer or remain unsuccessful; the user incurs no further disadvantages.

8. The diagnostic data is deleted as soon as the support case has been concluded, at the latest 90 days after transmission. Copies downloaded and decrypted for diagnosis are deleted immediately after the diagnosis has been completed.

The user may withdraw the above consent declaration in whole or in part at any time with effect for the future. Withdrawal is carried out by a message in the app’s support chat — for instance by asking for the message containing the diagnostic data to be deleted — or by email to datenschutz@uninow.de. The controller will then delete the message including the attachment as well as any copies already downloaded. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.