Information pursuant to Article 13 of the General Data Protection Regulation (GDPR)

During the employment relationship and also once it ends, HR at the University of Hamburg may process various personal data of its employees, including civil servants, pay-scale employees, and other data subjects.

This data processing is necessary to enter into, carry out, and end the employment relationship—for example, when hiring; when processing pay statements, holiday, statutory maternity leave, parental leave, professional development; or in connection with ending the employment relationship.

This data protection information explains:

1. Personal and contact information

a. The Controller as per the GDPR

The Controller according to the General Data Protection Regulation is the University of Hamburg, a legal entity under German public law. Contact details:

b. Contact person for questions about data processing

Questions about the data processing described below can be directed to daten-prozesse-abt6"AT"uni-hamburg.de.

c. Data protection officer

You can contact the data protection officer at:

Datenschutzbeauftragte/r der Universität Hamburg
Mittelweg 177
20148 Hamburg
dsb"AT"uni-hamburg.de

2. Purpose of data processing

Your personal data will be processed for the following purposes:

a. entering into, conducting, terminating, or concluding the employment relationship, including

• statement for comprehensive information on data protection in the selection procedure and the subsequent selection process
• management and use of personnel files, including the digitalization of personnel files and the use of digital personnel files (“DigiPA” within the software ELDORADO),
• salary/wage payment,
• working time management (including recording working time, which is currently done through digital or analog time cards but will be done through the eZeit app in the future),
• payment of benefits, bonus payments, and pension payments,
• accounting and changes to working hours, business trips, vacation, leaves of absence, further training, redeployments or transfers, secondments, appraisals, promotions, appointments, illness, changes to financing, preparation of references, restructuring, promotions,
• planning and organization of staff deployment and—particularly for academic staff—also research and teaching, conference management, and lecture hall planning,
• management and further business development measures (including conducting third-party-funded projects),
• occupational health and safety,
• measures for building safety and building-related operations (including permission for access) as well as fire safety,
• assertions of legal claims and defenses in legal disputes,
• measures to ensure domiciliary rights,
• implementation of measures under service or labor law,
• use of the IT systems required for the performance of the employment ,relationship, in particular within the framework of the central directory service for all M365 applications, both on-premise (Azure ID) and on-demand (Entra ID).

b. fulfillment of legal obligations

As a university, we are subject to a wide range of legal and regulatory requirements. This includes, in particular, provisions from the Hamburg higher education act (Hamburgisches Hochschulgesetz, HmbHG), the German Social Security Code, tax law, regulatory provisions, and other official requirements—for example, the employers’ liability insurance association. In this context, we process personal data in order to fulfill our legal obligations. This may relate particularly to the following purposes:

• calculation of contributions to social security providers,
• external income tax audits, tax reporting, and retention obligations,
• compilation of University (staff) statistics and other statistical evaluations as part of legal requirements,
• preparation and implementation of staff council elections (Sections 11 ff. HmPersVG) and judicial representative elections (Sections 28 f. HmbRiG),
• election of representatives for severely disabled persons,
• archiving for data protection and data security purposes,
• audits by supervisory authorities, 
• occupational health management.

c. fulfillment of public interest obligations, including:

• conducting elections,
• conducting internal audits and anti-corruption checks to ensure the legality, purpose, regularity, and efficiency of internal processes,
• quality assurance procedures,
• administration of third-party funds and implementation of research measures,
• review and processing of reports of possible violations of laws, official duties, or internal guidelines, for example, within procedures under the Act for the Better Protection of Whistleblowers (Hinweisgeberschutzgesetz, HinSchG),
• cooperation with internal control bodies and external auditing and investigating authorities,
• ensuring of IT security and IT operations: which includes, in particular, measures for ensuring comprehensive visibility with regard to potential attacks on networks or on the University’s infrastructure as well as the preparation, aggregation, refinement, and presentation in a portal as a basis for the work conducted by the University of Hamburg Security Operation Center.

d. further processing of data for other legally permitted purposes and with appropriate safeguards, including:

• archiving purposes in the public interest,
• historical research purposes,
• statistical purposes,
• scientific research purposes, in particular technological development, demonstration, basic research, applied research, and privately funded research as well as studies on public health and the creation of a European research area (Recital 159 GDPR),
• other purposes compatible with the original purpose (Article 6 paragraph 4 GDPR).

Irrespective of this, there may always be circumstances in which we process your personal data that are not mentioned here or whose purposes are not mentioned here (e.g., data processing when visiting our website or data processing when using M365). In such cases, separate information relevant to data protection for the processing will be available where required by law.

3. Legal basis for data processing

The legal basis for the processing of your personal data is as follows:

• Article 6 paragraph 1 letter b GDPR in conjunction with Section 10 subsections 1–5 HmbDSG in conjunction with Sections 85–92 Hamburg civil servants act (Hamburgisches Beamtengesetz, HmbBG) (in particular for the processing of the establishment, performance, and termination of the employment relationship). In addition, a collective agreement (e.g., a collective wage agreement) may be considered as a legal basis for data processing, or processing may be necessary for the fulfillment of claims derived from collective agreements. Furthermore, the service agreements concluded by the University of Hamburg may contain specifications for data processing based on one of the aforementioned legal bases. An overview of the Service Agreements (in German only) can be found in the Staff Service Portal.  
• Some data processing is based on Article 6 paragraph 1 letter c GDPR to fulfill our legal obligations as an employer (including as required by the university statistics act [Gesetz über die Statistik für das Hochschulwesen, HStatG]). Where specific kinds of personal data are affected (e.g. health data), processing is based on Article 9 paragraph 2 letter b GDPR to fulfill our obligations under labor law, social security law, and the welfare system.
• In addition, we process personal data when it is necessary for the performance of a task carried out in the public interest according to Article 6 subsection 1 letter e GDPR. This includes fulfilling university tasks pursuant to the Hamburg higher education act (Hamburgisches Hochschulgesetz), including data processing for conducting quality assurance procedures.
• The University of Hamburg processes your personal data also for the purposes of IT security, information security, data security, and ensuring the ongoing proper operation of IT services. In particular, processing for the purpose of detecting attacks on the University’s IT infrastructure and IT services. The legal basis for individual measures may be in either Article 6 paragraph 1 letters c and e GDPR, in conjunction with Article 32 of the GDPR, or Sections 4 and 6 subsection 1 HmbDSG, the fulfillment of which is served by the corresponding IT system, or in conjunction with measures ordered by special legislation.
• In certain cases, the University of Hamburg will process your personal data on the basis of consent in accordance with Article 6 paragraph 1 letter a GDPR. The legal basis for the processing of health data on the basis of consent is Article 9 paragraph 2 letter a GDPR. Examples are the participation in FHH-Bike, registration for newsletters, registration for talent pools, and the use of offers from external health or sports service providers (e.g., WellPass). You will be informed separately about the conditions of the data processing. Consent is granted voluntarily and may be withdrawn at any time with future effect. However, be aware that your withdrawal of consent cannot be applied retroactively. This means that all processing prior to your withdrawal of consent continues to be lawful.
• Data that the University of Hamburg has collected on the basis of the aforementioned legal grounds may also be processed by the University of Hamburg for other purposes, provided that such a change of purpose is legally permissible. Where necessary, guarantees for the rights and freedoms of the data subjects will be put in place for this purpose. These safeguards may include, for example, the anonymization or pseudonymization of the data records. Further processing may take place in particular for the purposes of scientific or historical research, for statistical purposes (see Section 11 subsections 1 and 2 HmbDSG and Section 6 subsection 2 number 9 HmbDSG; Article 89 GDPR). In addition, a change in the original purpose is possible under the conditions provided in Section 6 subsection 2 numbers 1–9 HmbDSG. Processing may also be carried out in accordance with Article 6 paragraph 4 GDPR in conjunction with Article 89 GDPR for archiving purposes in the public interest, scientific research purposes, and—in particular—technological development, demonstration, basic research, applied research and privately funded research, studies on public health, and the creation of a European research area (see Recital 159 GDPR). The additional purposes must not be incompatible with the original purpose of the processing (Article 6 paragraph 4 GDPR). If we intend to further process your data for a purpose that is not compatible with the original purpose, we will inform you in advance in accordance with the legal requirements and, if necessary, obtain your consent.

4. Categories of personal data

The following categories of personal data will be processed:

• personal identification and contact information—for example, first name and last name, address, date and place of birth, nationality, family status, gender, tax ID number, tax bracket, and social security number, as well as additional data that you have shared with us,
• organizational affiliation—for example, staff number, place/unit of employment, staff code, professional contact information (email, telephone), supervisor,work-related emails and postal correspondence,
• employment status and duration—for example, civil servant / judge / pay-scale employee, official designation, salary group / pay grade, date of entry into and exit out of public service,
• for foreign nationals: residence permit, work permit,
• professional qualifications and professional development—for example, school and vocational training, professional activities, military/civil/federal volunteer service, previous employment agreements, advanced or continuing education, additional qualifications, language proficiency, assessment, promotions, transfers and secondments,
• information on recognition of severe disability or equal status with severely disabled persons,
• working times, leaves of absence, vacations, special leave, illnesses, workplace accidents—for example, full/part time, shift work, booked hours, applications for leaves of absence, vacation times, doctor’s notes, information on the course of events and parties involved in a workplace accident, injuries sustained and their treatment as well as any previous illnesses including medical findings, property damage,
• payment information, including salary/wage payments, identification of any family-related benefits and other benefits—for example, bank details, insurance data (e.g., proof of health insurance), capital accumulation benefits, Riester contracts; last name, first name, name at birth, date of birth, address, occupation, employer name of a spouse or partner; last name, first name, date of birth of child(ren), and parental relationship to child (e.g., biological, legal parent, stepparent), information on enrolment at a school or vocational training, information on applications for payment of child benefit, information on other income (e.g., pension, income for or in lieu of gainful employment, additional pension or allowance, survivor’s pension); information on religious affiliation; information on part-time work and honorary/volunteer public office—for example, information and documentation on the nature and scope of the additional gainful work, employer, remuneration, and pecuniary benefits as well as notification of the assumption of an honorary public office; tax information,
• information on work-related travel (e.g., travel periods, destinations, events, and visa dates),
• requests for your personnel file from your current human resources department if you are applying for a position in another department, a secondment, or a transfer from another public employer or another federal state,
• transmission of a certificate of conduct by the federal central criminal register act (Gesetz über das Zentralregister und das Erziehungsregister, BZRG) to the University of Hamburg upon request,
• data on breaches of duty—for example, allegations relevant to disciplinary proceedings and the findings and measures taken in the course of disciplinary proceedings (e.g., warnings and reprimands), which may be included in the personnel file in accordance with the statutory provisions or measures under labor law,
• final decisions from legal disputes against the employer,
• authorization of the Family Benefits Department to transfer data relevant to the respective child benefit payment to the responsible payroll office (Section 68 subsection 4 of the German Income Tax Act),
• university statistical data—for example, highest university qualification (e.g., year of award, subject, etc.), type of qualification position,
• photographs,
• protocol data (e.g., log data including IP address, ports, URLs, and URL parameters), communication and authentication data (log-in, log, and network data from the administrations), network flow data, and log data from various RRZ services,
• assignment of a user ID and its linking to access rights, additional licenses, and services,
• assignment of keys and access authorizations by the property department and specific access systems of the departments,
• in some cases, processing of personal data that we have not received from you but from third parties outside the University of Hamburg (e.g., health insurance companies, insurance companies, tax authorities).

5. Categories of recipients of your personal data

Your personal data will be transferred to the following categories of recipients:

a. recipients within the University of Hamburg

Only certain organizational areas have access depending on the type of personal data and to the extent that these are required for the fulfilment of their tasks. This includes, in particular, the human resources department, financial accounting, your supervisors, and to a limited extend the IT staff. Furthermore, in certain cases where it is necessary to fulfill specific tasks, your personal data may be transferred internally to other organizational units at the University of Hamburg, in particular:

• the University of Hamburg staff councils (where required by law),
• the equal opportunity commissioner or equal opportunity representatives (where required by law),
• representatives for disabled staff (where required by law),
• electoral boards (where required by law),
• University Archives,
• data protection officers, when carrying out their statutory duties and exercising their supervisory and advisory powers as well as the the internal auditing department, when carrying out its statutory duties and exercising its supervisory powers.
• University of Hamburg staff conducting scientific research (provided the conditions for a change of purpose are met and, in particular, appropriate safeguards for the rights and freedoms of data subjects are in place)

b. recipients outside the University of Hamburg

We engage external service providers with regard to calculating salary and remuneration as well as recording of working time and bonus payments, the digitalization and the use of digital personnel files (Zentrum für Personaldienste, ZPD) or other services (IT services, logistics, telecommunications, hosting, maintenance and support of IT systems, file and data shredding, consultants). Service providers acting under instructions for the University of Hamburg are engaged under appropriate processing agreements. Responsibility for the processing of this data remains with the University of Hamburg under the data processing agreement.

Your data may be shared with external parties such as:

• the human resources department of the City of Hamburg (Personalamt),
• staff medical service for the civil service (Personalärztlicher Dienst),
• Arbeitsmedizinischer Dienst (state occupational medical service),
• Return-to-Work Program (Betriebliches Eingliederungsmanagement),
• Integration Office,
• third-party-funding provider, particularly in assessing proof of use of costs,
• external experts,
• external security services,
• travel planning, billing, car rental, or leasing companies,
• health insurance providers and insurance companies if consent has been given or if there is a legal obligation to do so,
• private agencies in order to be able to pay out capital accumulation benefits,
• creditors and bailiffs in the event of wage or salary garnishments,
• insolvency administrators in the event of personal bankruptcy,
• external partners in the context of cooperation and third-party-funded projects,
• external service providers and cooperation partners for the detection of cyberattacks on the IT infrastructure and IT services (e.g., in the context of managed security services),
• external research partners if the conditions for a change of purpose are met and, in particular, suitable guarantees for the rights and freedoms of the data subjects are in place,
• other public bodies and institutions that may receive data from the University of Hamburg for the purpose of fulfilling their own tasks, provided that the relevant legal requirements are met (e.g., tax authorities, social security providers, police, customs, law enforcement agencies, regulatory authorities, courts, specific supervisory authorities such as data protection supervisory authorities and immigration authorities).

Your data may be shared with these external parties on a case-by-case basis where legal provisions do require a transfer or where the transfer is necessary for entering into, conducting, or concluding your employment relationship. Your data may also be shared with other recipients for whom you have granted prior approval elsewhere.

6. Übermittlung von personenbezogenen Daten an ein Drittland

Generally, we do not plan to communicate your personal data to a third country or international organization.

In exceptional cases where the transfer of data to a third country or access to the data from a third country cannot be ruled out (e.g., use of IT services), specific preventative privacy law measures will be taken. An adequacy decision for the recipient in a third country issued by the EU Commission ensures an appropriate level of data protection pursuant to Article 45 GDPR. In addition, an appropriate level of data protection can be provided by concluding standard contract provisions pursuant to Article 46 paragraph 2 letter c GDPR. These standard contract provisions are available on request.

Personal data may be processed in third countries without being transferred to other controllers or processors if University of Hamburg employees access personal data from work devices during a business trip in the course of their work. Appropriate measures, in particular within the meaning of Article 32 GDPR, will be taken to limit any additional risks that may arise.

7. Period of storage

Where necessary, we process and store your personal data for the duration of your employment. Due to legal obligations, processing may also take place beyond the period of employment.

Personal data recorded in the personnel file must be retained by the authority responsible for maintaining the personnel file for five years after its closure—that is, at the end of the year of death, the year in which the standard retirement age is reached, or the year in which the pension or retirement allowance obligation (including survivor’s benefits) ceases to apply (Section 91 subsection 1 HmbBG). Shorter retention periods of three or five years after completion of individual processes may apply to certain types of documents and data (Sections 90 and 91 subsection 2 HmbBG).

The University of Hamburg is subject to various retention and documentation obligations that result from, among other things, the German internal revenue code (Abgabenordnung, AO), the Hamburg state budget regulations (Landeshaushaltsordnung, LHO), and the German Commercial Code (Handelsgesetzbuch, HGB). These regulations require storage or documentation periods ranging from 2 to 10 years. Some data will be deleted during the term of employment immediately on fulfillment of the task for which they were collected (e.g., time records, records of illness, communication data).

Furthermore, storage periods are also determined in accordance with applicable statute of limitations periods, which, for example, can be up to 30 years pursuant to Section 195 et seq. of the German Civil Code (BGB), Section 53 subsection 2 of the Hamburg administrative procedures act (Hamburgisches Verwaltungsverfahrensgesetz, HmbVwVfG), although the regular limitation period is three years.

An exemplary overview of the retention periods for different types of documents can be found in the retention period catalog for the University of Hamburg (excluding UKE): https://www.archiv.uni-hamburg.de/dokumente/fristenkatalog1.pdf.

After the retention period described, the personnel file and, if applicable, other documents containing employees’ personal data are offered to the University of Hamburg Archive for transfer in accordance with the legal obligation under Section 3 of the Hamburg archive act (Hamburgisches Archivgesetz, HmbArchG) and archived there in accordance with archival law provisions, if applicable.

8. Your rights under the GDPR

You have the following rights:

a. Right to withdraw consent

If the processing of your data is based on your consent, you may withdraw your consent at any time with future effect and without observing any formal requirements. Upon receipt of withdrawal of your consent, your data may no longer continue to be processed and must be deleted immediately if there is no other legal basis for their processing. This does not affect any previous processing of data and information.

b. Right to information

You have a right to information from the Controller pursuant to Article 15 GDPR.

c. Right to rectification

You may request that the Controller rectify any inaccurate data pursuant to Article 16 GDPR.

d. Right to erasure (“right to be forgotten”)

You have the right to have your personal data and information deleted by the Controller—that is, “the right to be forgotten” pursuant to Article 17 GDPR.

e. Right to restriction of processing

You have the right to restrict the processing of your personal data pursuant to Article 18 GDPR.

f. Right to data portability

If you have granted your consent to the processing of your data or an application for data processing has been made and the processing is conducted using automated means, you have a right to data portability (Article 20 GDPR).

g. Right to object

If the processing of your data is based on Article 6 paragraph 1 letters e or f GDPR, you have a right to lodge an objection to the processing of your personal data with the Controller pursuant to Article 21 GDPR.

h. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority against the processing of your personal data. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) is the data-protection supervisory authority responsible for the University of Hamburg.

9. Provision of personal data

The personal data described above are required to create and conduct an employment relationship between yourself and us, unless we have expressly stated otherwise when collecting the data. This applies particularly to data on identity, tax and social security obligations, and salary and remuneration.

The employment contract or employment relationship cannot be fulfilled without the provision of your data, and this may have further individual consequences. If the data is not provided, even though this is absolutely necessary for the proper execution of the employment or service relationship, this may result in consequences under labor and civil service law. This is based on the general principles of labor and civil service law and applicable regulations (e.g., examination of the significance of the breach of duty) as well as the circumstances of the specific case.

10. Advice on exercising your rights

To exercise your rights, contact datenschutz"AT"uni-hamburg.de.

In some cases, your request cannot or may not be complied with. If there are statutory grounds why your request cannot be complied with, you will be informed of the reason for denial. For example, according to Section 11 subsection 5 HmbDSG, your rights may be restricted in cases where data is further processed for scientific research, historical research, or statistical purposes and the exercise of your rights would likely render the purpose impossible or seriously impair it.