Preambule
In accordance with Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as amended (the “GDPR”), Charles University informs data subjects about the conditions under which personal data are processed in connection with the Moodle e-learning platform.
Personal Data Controller
Your personal data controller is Charles University, Ovocný trh 560/5, 116 36 Prague 1, ID no. 00216208, Tax ID no. CZ00216208, Databox ID: piyj9b4 (“Charles University” or “CU”). Charles University is a public higher education institution, in accordance with Act no. 111/1998 Sb., on higher education institutions, as amended. As a part of its mission, CU freely and independently carries out educational activities, and in relation thereto, research, development, innovative, artistic, or other creative activities, and activities associated therewith. Charles University also cultivates international and European cooperation.
Data protection officer
The data protection officer at Charles University is Mgr. Petra Kubáčová, gdpr@cuni.cz, phone: +420771232578. Should you have any questions or requests concerning the processing and protection of your personal data, you may contact the data protection officer.
The principles for processing personal data at CU
We process your personal data only in the scope necessary in relation to the specific purpose of the data processing. We protect personal data in accordance with the valid legal regulations and principles arising from the GDPR, in particular, with respect to the principles of lawfulness, fairness and transparency, purpose limitation, data minimalization, accuracy, storage limitation, integrity and confidentiality, and accountability. More specific explanations about the principles of data processing can be found in the general information on processing and protecting personal data at Charles University, which is available here. The principles and rules for processing personal data at Charles University are also regulated by Rector’s Directive no. 16/2018 – The principles and rules for personal data protection.
Categories of persons whose personal data are processed and for which purposes
As a part of the e-learning agenda on the Moodle platform, Charles University processes the personal data of the following data subjects and for the specified purposes:
- a) Persons employed at CU
- Instruction at CU, operation of IT infrastructure, statistical purposes, modifying user profiles
- b) CU students
- Studies at CU, operation of IT infrastructure, statistical purposes, modifying user profiles
- c) Participants in short-term study stays at CU 1
- Studies at CU, operation of IT infrastructure, statistical purposes, modifying user profiles
- d) Participants in admission procedures at CU
- Carrying out admission procedures at CU, operation of IT infrastructure, statistical purposes, modifying user profiles
- e) Registered users who are not in a relationship with CU
- Providing public online educational courses, hosting online courses, operation of IT infrastructure, statistical purposes, modifying user profiles
Purposes of processing personal data
- Whose personal data are processed?
- CU students, participants in short-term study stays at CU
- What types of personal data are processed?
- Identification data (first name, surname, title, e-mail address, and the person’s ID number) and data relating to studies (records of studies and study activities, study results)
- What is the legal basis for processing the personal data?
- Participants in short-term study stays at CU – Processing is necessary for fulfilling the obligations in the contract concluded by the incoming student with CU.
- CU students – Fulfilment of legal obligations based primarily on Act no. 111/1998 Sb., on higher education institutions, as amended. The purpose of such processing is the provision of instruction at CU.
- How long are data stored?
- For a period of five years, in accordance with the document destruction and archiving regulations, if not otherwise stipulated by law
- Whose personal data are processed?
- Persons employed at CU
- What types of personal data are processed?
- Identification data (first name, surname, title, e-mail address, and the person’s ID number)
- What is the legal basis for processing the personal data?
- Processing is required for fulfilling the obligations in the contract, which can be an employment contract or a contract for work between the instructor and CU
- How long are data stored?
- For the duration of the contractual relationship and for the period required by law
- Whose personal data are processed?
- Participants in admission procedures at CU
- What types of personal data are processed?
- Identification data (first name, surname, title, e-mail address, and the person’s ID number) and data relating to studies (results of the admission procedures)
- What is the legal basis for processing the personal data?
- Fulfilling the legal requirements arising in particular from Act no. 111/1998 Sb., on higher education institutions, as amended
- How long are data stored?
- For a period of five years, in accordance with the document destruction and archiving regulations, if not otherwise stipulated by law
- Whose personal data are processed?
- Registered users who do not have a relationship with CU, CU students (if the course is outside their area of study)
- What types of personal data are processed?
- Identification data (first name, surname, title, e-mail address, and user name)
- What is the legal basis for processing the personal data?
- Processing is required for fulfilling the obligations in the contract. Without the personal data, it would not be possible to conclude a contract for the provision of e-learning services
- How long are data stored?
- The processing of personal data takes place for the duration of the contractual relationship and subsequently for a period of three years upon termination of the provision of services, if not otherwise stipulated by law.
- Whose personal data are processed?
- Registered users outside CU
- What types of personal data are processed?
- Identification data (first name, surname, title, e-mail address, and user name)
- What is the legal basis for processing the personal data?
- Processing is required for fulfilling the obligations in the contract. Without the personal data, it would not be possible to conclude a contract for the provision of e-learning services and the hosting of courses.
- How long are data stored?
- The processing of personal data takes place for the duration of the contractual relationship and subsequently for a period of three years upon termination of the provision of services, if not otherwise stipulated by law.
- Whose personal data aParticipants in admission prre processed?
- All categories of data subjects
- What types of personal data are processed?
- Operational and localization data (location and time zone of the user, IP address, time of last login)
- What is the legal basis for processing the personal data?
- The processing takes place on the basis of legitimate interest, which is the required processing of personal data for the technical operation of the Moodle platform. The purpose of such processing is continuous improvements relating to the technical side of the platform and the provision of technical support for users.
- How long are data stored?
- The personal data is stored only for a period of time that is absolutely necessary, however, no longer than two months.
- Whose personal data are processed?
- All categories of data subjects
- What types of personal data are processed?
- Statistical data on the attendance and success of individual courses, data on the attendance of individual modules of the Moodle platform or data on the country where the data subject is logged in
- What is the legal basis for processing the personal data?
- The processing takes place on the basis of legitimate interest, which is the processing of personal data for the purposes of platform development and improving the quality of the course offerings on the Moodle platform
- How long are data stored?
- The personal data is stored only for a period of time that is absolutely necessary.
- Whose personal data are processed?
- All categories of data subjects/dd>
- What types of personal data are processed?
- Profile photos, hobbies, skills
- What is the legal basis for processing the personal data?
- he processing takes place on the basis of a contract, while the data controller is entitled to disallow personal data on a profile if the publication of this data would be in conflict with legal regulations or the rights of third parties.
- How long are data stored?
- The processing of personal data takes place for the duration of the contractual relationship and subsequently for a period of three years upon termination of the provision of services, if not otherwise stipulated by law.
- Whose personal data are processed?
- Participants in courses financed or co-financed from public budgets, for which fulfilment of the terms and conditions must be documented
- What types of personal data are processed?
- Identification data (first name, surname)
- What is the legal basis for processing the personal data?
- The processing takes place on the basis of fulfilling the legal obligations of CU as a recipient of financial support.
- How long are data stored?
- The personal data is stored only for a period of time that is absolutely necessary for fulfilling the legal obligations.
Transferring personal data
As part of the e-learning agenda on the Moodle platform, Charles University does not transfer your personal data, with the exception of special data processing for the purpose of fulfilling the obligations set out in the terms and conditions of the financial provider. In such cases, the data may be transferred to public administration or EU authorities.
Duration for storing personal data
Charles University stores your personal data for the period absolutely necessary in relation to the specified purpose of personal data processing, and in accordance with the applicable Record Management Rules of CU, they are then destroyed or archived. We only store personal data that we process with your consent for the duration of the purpose for which consent was granted. More detailed information on the duration of data storage is provided for the individual purposes of processing.
Rights of the data subjects
When CU processes your personal data, you are entitled to the following as data subjects:
- To received information about the processing
- To access to your personal data
- To modify and supplement data
- To delete data (the right “to be forgotten”)
- To restrict processing
- To decide on the portability of data
- To raise objections
- To review an automated decision
- To lodge a complaint or require protection
- To withdraw your consent if the processing of personal data is based on your consent; the legality of the processing before withdrawing your consent is not affected by the withdrawal.
More detailed explanations on the rights of data subjects with respect to processing personal data can be found in the general information on the processing and protection of personal data at Charles University, which is available here
Exercising the rights of data subjects
To exercise your rights with respect to processing personal data, contact Charles University by sending a request to the databox (databox ID: piyj9b4), by e-mail to the personal data protection officer at gdpr@cuni.cz, or by submitting your request to the personal data protection officer in person or electronically via the Charles University mailroom. More information on submitting a request is available at https://cuni.cz/UK-655.html. Before processing the request, Charles University has the right and obligation to verify the identity of the sender.
Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint regarding the processing of personal data at the supervisory authority, which is the Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Prague 7, web: https://uoou.gov.cz/en
Cookies
Cookies are very small text files that are stored on your device when you visit websites. On the Moodle platform, we only use technical cookies that are necessary for the proper operation of the website. We do not use other cookies that would require your consent on the Moodle platform. The following cookies are used on the Moodle platform:
- MoodleSession: This cookie file is used to ensure continuity so you stay logged in while browsing the site. When you log out or close your browser, this cookie is destroyed.
- MOODLEID: This cookie file remembers your user name in the browser for the purpose of simplifying login. The storage time of this cookie file on your computer is two months.