1. Scope of Application
This data protection notice applies to the data collected as part of the study ReFuMoLab_Garching. Data processing is subject to the applicable data protection regulations, particularly the General Data Protection Regulation (GDPR) and the Bavarian Data Protection Act (BayDSG). Below we inform you about the type, scope, and purpose of the collection and use of personal data.

2. Name and Contact Information of the Responsible Parties

The following institutions are responsible for the study within the meaning of Art. 4 No. 7 GDPR:

Technische Universität München

Chairs of Traffic Engineering and Control

Arcisstraße 21, 80333 München

https://www.mos.ed.tum.de/vt/startseite/ 

refumolab.vtk(at)ed.tum.de 

3. Contact Information of the Data Protection Officer

Data Protection Officer of the Technische Universität München (TUM):

beauftragter(at)datenschutz.tum.de 

https://www.datenschutz.tum.de/datenschutz/startseite/ 

4. Categories of Data

5. Purpose and Legal Basis for Data Processing

The aim of the processing is to assess and better understand the current status of employee mobility at the Garching campus. The survey data is evaluated at the Chair of Transportation Engineering at the Technische Universität München.

The results are used to assess changes in mobility behavior over the project period and to enable continuous monitoring. The aggregated data will be used to prepare scientific reports and will form the basis for recommendations for the sustainable development of mobility at the Garching campus.

Unless otherwise stated in this data protection notice, the legal basis for processing your data is derived from Art. 4 (1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Art. 6 (1)(a) GDPR. This allows us to process data necessary for fulfilling a task assigned to us.

Data is processed solely to the extent necessary for conducting, evaluating, and analyzing the results of the survey on the current status of campus mobility in the ReFuMoLab_Garching project.

6. Data retention period

Personal data collected as part of the project will be completely deleted no later than 10 years after the end of the project (planned: October 2027).

7. Recipients of Personal Data

SurveyEngine GmbH

Viktoria-Luise-Platz 7

10777 Berlin

Deutschland

8. Automated Decision-Making

We do not use automated decision-making according to Art. 22 GDPR in the aforementioned data processing operations.

9. Data Sharing with Third Parties

Raw data collected in the study will not be passed on to third parties within the meaning of the GDPR and will only be used for the stated research purposes. All data collected during the study may also be used in anonymized form by the participating institutions for research purposes in accordance with Art. 89 GDPR, even after the end of the study. This may include anonymized evaluations of your data in theses. The participating institutions also reserve the right to use your data in anonymized and aggregated form in publications.

If we share data with other individuals or companies (processors or third parties), transmit it to them, or otherwise grant them access, this is only done on the basis of legal permission (e.g., if the transfer is necessary for the performance of a contract in accordance with Art. 6(1)(b) GDPR), if you have consented, if there is a legal obligation, or on the basis of our legitimate interests (e.g., when using service providers, web hosts, etc.).

If we commission third parties to process data based on a so-called "data processing agreement," this is done in accordance with Art. 28 GDPR.

10. Rights of Data Subjects

To assign your data, we will generate a pseudonym at the beginning of the survey using the following logic:

• First 3 letters of your mother’s first name
• Birth month of your father in digits (e.g., 04 for April)
• Number of letters in your father’s first name
• First letter of your favorite color

As a data subject, you have the following rights:

• Right to access the personal data stored about you (Art. 15 GDPR)
• Right to rectification if incorrect personal data is processed (Art. 16 GDPR)
• Right to erasure or restriction of processing if the legal conditions are met (Art. 17 and 18 GDPR)
• Right to data portability if processing is based on consent or contract and is carried out by automated means (Art. 20 GDPR)
• If you have consented to the processing, you may withdraw this consent at any time with effect for the future. The lawfulness of processing carried out based on consent until revocation remains unaffected.
• You have the right to object to data processing at any time on grounds relating to your particular situation, if processing is based solely on Art. 6(1)(e) or (f) GDPR (Art. 21(1) GDPR).

In case of revocation, you may request deletion of the collected data. If you agree at the time of revocation, the data may be further used in anonymized form (without personal identification).

Alternatively, you may submit your request in writing to the postal address provided above. Please include your pseudonym so we can identify your dataset.

11. Data Deletion and Right to Object (Art. 21 GDPR)

You have the right at any time to request the deletion or blocking of all your data or to object to the processing of your personal data, which is based on Art. 6(1)(a) and Art. 9(2)(a) GDPR. Simply send us an email with the subject "Data Deletion" to refumolab.vtk@ed.tum.de.

In the event of revocation, you can request the deletion of the collected data. If you agree at the time of revocation, the data may be used further in anonymized form (without personal identification). After deletion of the primary identification key (3 months after the end of the study), deletion of the data is no longer possible.

If you have any questions about data protection or the study process, please contact refumolab.vtk@ed.tum.de.