The General Languages ​​team is committed to protecting your personal data during collection, processing, and use, especially when visiting our website. In accordance with the General Data Protection Regulation (GDPR), we process and use your inventory data and voluntary information exclusively to provide our services, to provide optimal support, and for the purpose of quality assurance for evaluation.

1. The cooperation partners, the University of Hamburg (UHH) and the Hamburg Adult Education Center (HHVHS), are jointly responsible under Art. 26 GDPR for the implementation of general language courses and the administration of language examinations for UHH students. UHH provides the HHVHS with the CommSy application as a learning management platform. The application is used in parallel for face-to-face events and to simplify organization and exchange. Furthermore, UHH provides the system with the role of portal moderator and provides subsequent support. HHVHS creates the rooms and instructor access itself during the course of creating the offer. Participant accounts are created during authentication; participants are assigned rooms by HHVHS. HHVHS verifies user registrations on the platform and user/course assignments. HHVHS provides quality assurance measures for language teaching modules and offers personal and online advice for students. The HHVHS processes personal data submitted during registration for the purposes of quality assurance – including customer surveys – on behalf of the University of Hamburg. The HHVHS also issues machine-generated, certified certificates of achievement to students upon successful participation in accordance with the ECTS standard and the University of Hamburg's requirements profile.

2. The purpose of processing personal data is to provide general language instruction. For this purpose, the following categories of student personal data are processed: identification data, communication data, course number, organizational data, course participation data, authentication data, and log data. The partners undertake to observe and comply with data protection regulations (in particular the GDPR).

3. Unless otherwise agreed below, each partner guarantees compliance with the statutory provisions, in particular the legality of the data processing carried out by them. Each partner is responsible for the processing it carries out. Actions and processing by a partner's processors are attributable to that partner.

4. The legal basis for processing personal data for contacting us via the electronic contact form is Art. 6 (1) (a) GDPR. For providing user IDs to students and using the electronic platform, this is Art. 6 (1) (e) and (2) GDPR in conjunction with Section 111 (1) and (7) HmbHG.

5. If the assertion of the data subject's rights cannot be exclusively assigned to the sphere of activity of one party, the parties are equally responsible for processing data subject requests. Responding to data subject requests to the data subject in accordance with Art. 12 GDPR is the responsibility of the party receiving the data subject request.

   If a data subject contacts one of the parties to exercise their data subject rights, in particular regarding access to, correction of, or deletion of their personal data, the parties undertake to forward this request to the other party without delay, regardless of their obligation to guarantee and respond to the data subject's rights. The parties are obligated to promptly provide the requesting party with the information from their sphere of activity necessary to process the request.

   The responsible contact persons and data protection officers of the parties are:

   Contact person of the HHVHS / Data Protection Officer of Party 1:

   Hamburger Volkshochschule, State Agency of the Free and Hanseatic City of Hamburg
   Data Protection Department
   Schanzenstraße 75-77, 20357 Hamburg
   E-mail: datenschutz@vhs-hamburg.de

   Contact person of the UHH / Data Protection Officer of Party 2:

   Data Protection Officer of the University of Hamburg
   Mittelweg 177, 20148 Hamburg
   E-mail: datenschutz@uni-hamburg.de

   If personal data is to be deleted, the parties must inform each other beforehand. The other party may object to the deletion for legitimate reasons, for example, if they are subject to a legal retention obligation.

6. Partners must inform each other immediately and fully if they discover errors or irregularities regarding data protection regulations when reviewing the processing activities and/or the order results.

7. The partners are each responsible for the technical and organizational measures (TOMs) within their area of ​​responsibility, including the infrastructure used at their respective locations for the purposes of the cooperation agreement. This also includes responsibility for a transmission path that complies with the requirements of Art. 32 GDPR. Each partner is responsible for the infrastructure used locally by that partner, including the databases. Existing statutory responsibilities remain unaffected.

8. The partners maintain a record of processing activities within the meaning of Art. 30 (1) GDPR for the processing they each carry out. They support each other in its preparation.

9. The partners are subject to the information obligations resulting from Articles 33 and 34 of the GDPR to the respective supervisory authority or to those affected by a personal data breach for the processing steps they perform. They will support each other in complying with the statutory deadline of 72 hours.

10. The partners are each responsible for preparing a data protection impact assessment in accordance with Art. 35 GDPR within their own area of ​​responsibility, if necessary.