The protection of your data is important to us. With this privacy policy, we therefore aim to provide you with an overview of how we ensure the protection of your personal data on the #Digitalkompetenz.nrw platform, as well as the type of data which is collected and used, for what purpose, and on what legal basis. Personal data refers to any data that can be linked to you personally, e.g. name, address, email address, user behaviour. Further information on the various areas of our service and on your rights will be displayed once you have selected one of the fields below.
As we continue to develop our platform and implement new technologies to improve our service for you, changes to our privacy policy may become necessary. We therefore recommend that you review the privacy policy from time to time.
Data Controller
The data controller within the meaning of the GDPR and other national data protection laws, as well as other data protection regulations, is:
Centre for Teaching and Learning Services at RWTH Aachen University
Prof. Dr Malte Persike
Kackertstr. 15
52072 Aachen
In certain cases, we may offer services under joint responsibility with one or more partners within the meaning of Article 26 of the GDPR. Should this be the case, we will indicate this in the details of the relevant service below and highlight the key points of the agreement. Even in these cases, you may contact us with any data protection concerns, in particular to exercise your rights as a data subject. Where we are not responsible for responding to your enquiry or are reliant on information from other data controllers, we will forward your enquiry to the relevant co-controller named in the offer.
Data Protection Officer
You can contact our Data Protection Officer by email at dsb@rub.de or by post at our address (see above), marking your correspondence ‘for the attention of the Data Protection Officer’.
As a general rule, we process your personal data only to the extent necessary to provide a fully functional website and our content and services.
Legal basis for processing
Where we seek your consent for the processing of personal data, Article 6(1), first sentence, point (a) of the GDPR serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which you are a party, Article 6(1), first sentence, point (b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1), first sentence, point (c) of the GDPR serves as the legal basis.
Where processing is necessary to safeguard a legitimate interest on our part or that of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Article 6(1), first sentence, point (f) of the GDPR serves as the legal basis for the processing.
In individual cases, Article 6(1), first sentence, point (e) of the GDPR, read in conjunction with paragraphs 2 and 3 of the GDPR / Section 3 of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Section 3 of the Higher Education Act of North Rhine-Westphalia (HG NRW) may also be considered as the legal basis, provided that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Use of service providers
Should we engage service providers for specific functions of our service or wish to use your data for advertising purposes, we will always select and monitor these service providers carefully and provide you with detailed information below regarding the respective processes. In doing so, we will also specify the criteria for the retention period.
Where our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the implications of this in the description of the service.
In operating the website, we work with an external hosting provider, Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, whom we have carefully selected and bound to comply with data protection legislation.
Disclosure of personal data to third parties
The data generated on the #Digitalkompetenz.nrw platform may be disclosed to third parties in anonymised or pseudonymised form for reporting or research purposes and may be analysed. It is not possible to trace this data back to individual persons.
Personal data in non-anonymised form, which has been logged when accessing the portal, will only be transferred to third parties where we are obliged to do so by law or by court order, or where such transfer is necessary for legal or criminal prosecution in the event of attacks on ORCA.nrw’s internet infrastructure. No non-anonymised data will be transferred for other non-commercial or commercial purposes.
Storage of personal data
Personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is provided for by European or national legislators in EU regulations, laws or other provisions to which the data controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.
Obligation to provide your data
Unless otherwise stated in this privacy notice, you are under no legal or contractual obligation to provide your data.
Encryption
For security reasons and to protect your personal data, our website is encrypted using SSL/TLS technology. You can recognise this encryption technology by the ‘https://’ and the padlock icon in your browser address bar.
Third-party links
You will find third-party links on our platform. This applies in particular to redirects to third-party websites in the context of assessments, courses, educational games and media. Although we carefully review the links provided, please note that we have no influence whatsoever over the design and content of the linked pages and do not endorse their content. We accept no responsibility for the handling of your data on these websites. Please familiarise yourself in advance with how these third parties handle personal data.
Your rights as a data subject
You have the following rights vis-à-vis a data controller with regard to your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to data portability (Art. 20 GDPR)
provided that these rights are not restricted by Section 11 et seq. of the Data Protection Act of North Rhine-Westphalia (DSG NRW) or other statutory provisions.
Your right to lodge a complaint
If you believe that data processing infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority of your choice (Article 77 of the GDPR in conjunction with Section 19 of the Federal Data Protection Act (BDSG) and Section 29 of the Data Protection Act of North Rhine-Westphalia (DSG NRW)). This includes the data protection supervisory authority responsible for us, which you can contact using the following details:
State Commissioner for Data Protection and Freedom of Information
North Rhine-Westphalia (LDI NRW)
PO Box 20 04 44
40102 Düsseldorf
Tel.: +49 (0) 211 38424-0
Fax: +49 (0) 211 38424-10
Email: poststelle@ldi.nrw.de
Right to withdraw consent
If you have given your consent to the processing of your data, you may withdraw this consent at any time. Such a withdrawal will affect the lawfulness of the processing of your personal data from the time you notify us of it. The lawfulness of the processing of your data up to the time of your withdrawal remains unaffected.
Right to object
Where we base the processing of your personal data on a balancing of interests, you may object to such processing. This is the case, in particular, where the processing is not necessary for the performance of a contract with you, as we will explain in each instance in the following description of the functions. Should you exercise such a right to object, we ask that you set out the reasons why we should not process your personal data in the manner we have been doing. Should you object, we will examine the circumstances and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.
You may, of course, object at any time to the processing of your personal data for the purposes of advertising and data analysis. The best way to exercise your right to object to advertising is via the contact details provided above.
Your right to object is subject to restrictions under Section 14 of the Data Protection Act of North Rhine-Westphalia (DSG NRW). Accordingly, your right to object does not apply where there is an overriding public interest in the processing that outweighs your interests, or where we are obliged to process the data by law.
Informational use of the website
When you use the website for informational purposes – that is, simply viewing it without registering and without providing us with any other information – we process the personal data that your browser transmits to our server.
The data described below is technically necessary for us to display our website to you and to ensure its stability and security, and must therefore be processed by us. The legal basis is Article 6(1), first sentence, point (f) of the GDPR:
- IP address
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (page visited)
- Access status/HTTP status code
- Amount of data transferred in each instance
- Previously visited page
- Browser
- Operating system
- Language and version of the browser software
The data is stored in our system’s log files. This data is stored to ensure the functionality of the website and the security of the IT systems. This data is not stored in conjunction with any other personal data. The legal basis for the temporary storage of the data and the log files is Article 6(1)(f) of the GDPR.
The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once the relevant session has ended. In the case of data stored in log files, this occurs after six months at the latest. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymised so that it is no longer possible to identify the client from which the request originated.
Login or registration is required to access and use certain content, features and services on our website.
Login via DFN-AAI
On this website, it is possible to log in as a member of a higher education institution in North Rhine-Westphalia via DFN-AAI. This is subject to your higher education institution participating in the scheme. When registering and using the website in this way, the following data is collected and stored for the duration of your use of the service:
- Name of your home institution
- Date and time of registration
- Type of affiliation with your home institution, plus domain name
- First name
- Surname
- Email address
- Display name
- Pairwise ID and/or Persistent ID
The user ID is generated by the home institution of which you are a member and transmitted to ORCA.nrw as part of the registration process. ORCA.nrw has no influence over the generation of the user ID. Your home institution bears the data protection responsibility for the transmission of data during the registration process for ORCA.nrw. If you experience any password issues, please therefore contact your home institution.
Local registration
It is also possible to register manually via a dedicated form on the portal. When registering and using the website in this way, the following data is collected and stored for the duration of your use of the service:
- The user’s IP address
- Date and time of registration and password creation
- Freely chosen username and password
- First name
- Surname
- Email address
Note: If you are a member of a higher education institution in North Rhine-Westphalia, it may be advisable to register via DFN-AAI, as certain rights are linked to the nature of your affiliation with your home institution, which is only disclosed through this procedure.
Legal basis
The legal basis for the processing of data in connection with the registration is Article 6(1), first sentence, point (b) of the GDPR. In specific cases, the legal basis is Article 6(1), first sentence, point (e) of the GDPR in conjunction with paragraphs 2 and 3 of the GDPR / Section 3 of the DSG NRW in conjunction with Section 3 of the HG NRW, where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Obligation to provide your data
The provision of the aforementioned data is mandatory; you may provide any further information voluntarily by using our portal. For this service, we use the so-called double opt-in procedure, i.e. you will receive an email in which you must confirm that you are the owner of the email address provided and that you wish to register and receive any messages associated with this. You can unsubscribe from these notifications at any time, for example by clicking on the link in the email or by using the contact details provided. We will store the data you have provided, along with the dates and times of your registration for the service and your IP address, until you unsubscribe from the notification service.
Storage / Cancellation / Account Management
The skills assessment data is deleted after six months. This applies to data collected during the registration process if the registration on our website is cancelled or amended.
In the case of a local registration, you may cancel your registration at any time. You may have the data stored about you amended at any time. To cancel your registration (delete your account), please send an email to info@orca.nrw. To amend your registration details, please make the relevant changes via the ORCA account management section. In the case of a local registration, your account will be automatically deleted after two years of inactivity (i.e. a two-year period without logging in).
Via the account management section, you can manage your personal details (username, email address, first name, surname, language), configure your login settings (change password) and manage your linked accounts.
Course activities
The platform provides online self-assessments. When registered users access this content, the following data is collected and stored for the duration of their use of the service:
- the time elapsed since the last access to the course,
- date and time of the last access to a course,
- status,
- role in the course,
- group allocation, where course participants have been divided into groups,
- last IP address,
- activities within a course (events, e.g. viewing courses, course modules), including date and time,
- results of individual tests (last attempt),
- results of all attempts at individual tests and the respective date and time of each attempt.
The data is stored together with the profile data of the user account (username, first name, surname, email address, role at the university).
Legal basis
The legal basis for the processing of data in connection with login/registration is Article 6(1), first sentence, point (b) of the GDPR. In specific cases, the legal basis is Article 6(1), first sentence, point (e) of the GDPR in conjunction with paragraphs 2 and 3 of the GDPR / Section 3 of the DSG NRW in conjunction with Section 3 of the HG NRW, where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Storage / Cancellation
The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. This applies to the course data stored in the user account when the user’s registration on our website is cancelled or the course is deleted.
Access to our skills assessment is available without registration. When starting the skills assessment, a TAN (a random combination of alphanumeric characters) is generated, which allows you to access your personal feedback and enrolment certificate again.
The answers provided are always stored anonymously. They are used to provide participants with their results and, for example, to create comparison groups. Furthermore, this data is used in anonymised form to optimise the process through analysis, such as calculating the mean number of correct answers, creating comparison groups or assessing the tool’s susceptibility to errors across different browser types. The data is analysed in anonymised form and presented in summary form, but never in a way that identifies individuals. It includes the answers provided to performance tasks and personality questionnaires, as well as data on time-related behaviour, such as response duration or the time at which the test was completed.
In order to generate the certificate required for enrolment at RWTH Aachen University, you must provide your first name, surname and date of birth. This links the anonymous data to a specific individual. The certificate can also be generated at a later date using the TAN, at which point the necessary personal data can be entered.
In addition to the name and date of birth, the certificate also contains an alphanumeric ID. This is stored in RWTH Aachen’s campus management system upon enrolment. For the purposes of academic research, the data from the skills assessment can be linked to other datasets via the alphanumeric ID. The analysis of the data linked in this way is always carried out in anonymised form.
Use of cookies
In addition to the data mentioned above, when you use our website we employ technical tools for various functions, in particular cookies, which may be stored on your device.
When you visit our website, and at any time thereafter, you can choose whether to allow cookies in general or which specific additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager. Below, we first describe cookies from a technical perspective before going into more detail about your individual options, explaining technically necessary cookies and those you can voluntarily enable or disable.
Technical description
Cookies are text files or information stored in a database on your hard drive and associated with the browser you are using, so that certain information can be sent to the entity setting the cookie. Cookies cannot run programmes or transmit viruses to your computer; rather, their primary purpose is to make the website faster and more user-friendly. This website uses the following types of cookies, the functioning and legal basis of which we will explain below:
- Transient cookies: These, in particular session cookies, are automatically deleted when you close your browser or log out. They contain a so-called session ID. This allows various requests from your browser to be assigned to the same session, and your computer can be recognised when you return to our website.
- Persistent cookies: These are automatically deleted after a specified period, which varies depending on the cookie. You can view the cookies set and their expiry dates at any time in your browser settings and delete the cookies manually.
- Other technologies: These functions do not rely on cookies, but on similar technical mechanisms, such as Flash cookies, HTML5 objects or an analysis of your browser settings. The result is that we are also able to use the techniques described below. Here too, you can of course give your consent or object.
Essential cookies
Essential functions that are technically necessary for the website to be displayed: The technical structure of the website requires us to use certain technologies, in particular cookies. Without these technologies, our website cannot be displayed (correctly in full) or the support functions may not be available. These are generally transient cookies, which are deleted at the end of your visit to the website, or at the latest when you close your browser. You cannot opt out of these cookies if you wish to use our website. The individual cookies are listed in the Consent Manager. The legal basis for this processing is Article 6(1)(f) of the GDPR.
We currently use the following essential cookies and other technologies
| Name | Purpose | Expiry date |
| KEYCLOAK_3P_COOKIE KEYCLOAK_3P_COOKIE_SAMESITE | Identity and Access Management – Technical requirement for logging in | Session* |
*These cookies are valid for the duration of a current session and are therefore deleted when you log out or close your browser.
Optional cookies
Optional cookies subject to your consent: We set various cookies only with your consent, which you can select during your first visit to our website via the so-called cookie consent tool. These functions are activated only if you give your consent and may, in particular, enable us to analyse and improve visits to our website, facilitate your use of the site across different browsers or devices, or recognise you when you return. The legal basis for this processing is Article 6(1)(a) of the GDPR. You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to withdrawal.
These cookies are valid for the duration of a current session and are therefore deleted when you log out or close your browser.
If cookies are disabled for our website, it may no longer be possible to make full use of all the website’s functions. Please note that if all cookies are deleted, any opt-out cookies that have already been set will also be deleted, meaning that you will need to re-submit any objections you have previously made.
You can prevent data collection via cookies by managing, disabling or deleting cookies in your browser.
Eye-Able® Assist is software developed by Web Inclusion GmbH that enables everyone to access information on the internet with minimal barriers.
The necessary files, such as JavaScript, stylesheets and images, are loaded from an external server. When functions are activated, Eye-Able® Assist uses the browser’s local storage to save the settings. All settings are stored locally only and are not transmitted further. To ward off attacks and provide our service in near real time, Eye-Able® Assist uses the Content Delivery Network (CDN) provided by BunnyWay d.o.o. (Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). This is done for the purpose of fulfilling our contractual obligations to our customers (Article 6(1)(b) of the GDPR) and in the interests of ensuring the secure, fast and efficient provision of our online service by a professional provider (Article 6(1)(f) of the GDPR). All data transmitted and all servers remain within the EU at all times to ensure processing complies with the GDPR. Web Inclusion GmbH does not, at any time, collect or analyse personal user behaviour or other personal data. To ensure processing complies with data protection regulations, Web Inclusion GmbH has entered into data processing agreements with our hosting provider, BunnyWay. Further information can be found in the
privacy policies: