Information on the collection and processing of personal data for the documentation and management of research data and use of an ELN within the framework of the service ELN@RWTH (Research).

Service

Collection and processing of personal data for documentation and management of research or laboratory data and use of an ELN within the framework of the service ELN@RWTH.

Description of the service

The service "ELN@RWTH" uses the product eLabFTW from Deltablot (elabftw.net), a web-based electronic lab notebook system that facilitates users in recording data in compliance with GLP (Good Laboratory Practice) standards. The system is provided by Deltablot as Software-as-a-Service (SaaS) for RWTH Aachen University and is supported by the IT Center, for example, regarding onboarding new user groups, answering user questions about the software, and serving as a point of contact to Deltablot.

Name and address of the responsible party

The controller in terms of data protection regulations and other national data protection laws of member states as well as other legal provisions is:

Rectorate of RWTH Aachen University
Templergraben 55
52062 Aachen (physical address)
52056 Aachen (mailing address)
Phone: +49 241 80 1
Fax: +49 241 80 92312
Email: rektorat@rwth-aachen.de
Website: www.rwth-aachen.de/rectorate

For implementing the service "ELN@RWTH":

IT Center RWTH Aachen
Seffenter Weg 23
52074 Aachen  
Phone: +49 241 80 24680 
Email: servicedesk@itc.rwth-aachen.de
Website: www.itc.rwth-aachen.de

Name and address of the data protection officer

Contact details for the appointed Data Protection Officer:

Data Protection Office at RWTH Aachen University:

Templergraben 83  
52062 Aachen (House address)  
52056 Aachen (Mailing address)  
Germany  
Phone: +49 241 80 94114
Email: dsb@rwth-aachen.de

Subject Matter Scope and Purpose of Processing Personal Data

The following mentioned data will be processed for documenting research activities and research data (cf. “Guidelines for Ensuring Good Scientific Practice”, DFG, August 2019), as well as for managing documentation related to centrally collected samples concerning environmental protection or similar applications. Additionally, they will be used to manage access rights to the service "ELN@RWTH".

If exports of data from the ELN take place in any form, e.g., for archiving entries and/or storing them on other platforms, the personal data mentioned below will generally also be exported. This can occur via the user interface or through the REST API. Systems and platforms outside of the ELN that utilize these exported data will thus store this personal data.

Type of personal data collected/Special categories of personal data

For the service "ELN@RWTH", processing and storage occur regarding the following personal data:

• Master data: including first name(s), last name, initials, email address, account creation date, last login, organization ID, ORCID ID (the latter is optional information)
• Metadata: including IP address, timestamp of entry change
• Research Data/Content Data: Name, first name referring to collaboration partners; depending on research project (e.g., interview data)

Recipients of the data

• Deltablot  

116 AV de Paris  
94800 Villejuif  
France  
Registration number: 922 205 109 R.C.S. Créteil  
Email: contact@deltablot.email
Website: deltablot.com

A contract processing agreement has been concluded with Deltablot.

• The IT Center of RWTH Aachen
• The respective RWTH department
• External users in the form of collaboration partners

Legal basis

The above-mentioned master data (including name, email address) are processed for employees at RWTH Aachen according to Art. 6 para.1 sentence1 lit.e), para.3 GDPR in conjunction with §18 para.1 DSG NRW; for external collaboration partners according to Art.6 para.1 sentence 1 lit.e), para.3 GDPR in conjunction with §3 para.1 HG NRW.

Metadata (including log files, timestamps, IP addresses) are processed according to Art.6 para.1 sentence1 lit.e), para.3 in conjunction with §3 para.1 DSG NRW in conjunction with §3 para.1 HG NRW.

Content data/research data (if personal) are processed according to Art.6 para.1 sentence1 lit.a GDPR based on consent or Art.6 para.1 sentence1 lit.e), para.3 GDPR in conjunction with §17 para.1 DSG NRW if applicable under research privilege.

Data deletion and storage duration

To comply with documentation obligations according to Good Scientific Practice, user accounts along with created entries within this service will be retained for a minimum period of ten years.

• Master Data: User information may be archived by administrators; thus all experiments from users are blocked along with their login access being disabled. Additionally, this personal information can be anonymized upon request through SysAdmins. Complete deletion is not provided within the ELN.
• Metadata and Research Data (if personal): To comply with documentation obligations according to Good Scientific Practice, user accounts along with created entries within this ELN will also be retained for a minimum period of ten years. As per current status, they cannot be deleted.

Rights of Affected Persons

If personal data is processed by users, they are considered affected persons under GDPR law and have certain rights against controllers.

According to Articles 15 et seq., affected persons have rights including access to their respective personal data from controllers under defined conditions therein as well as rights concerning correction or deletion or restriction on processing; a right to object against processing; and a right to portability.
Furthermore, they have a right under Article 77 GDPR to lodge complaints with a supervisory authority, if they believe that processing their personal information violates this regulation.
If processing is based on consent from affected persons (cf.Art .6 par .1 lit.a ,Art .9 par .2 lit.a GDPR ), they also have a right to withdraw consent at any time without affecting legality based on consent prior until withdrawal; this only takes effect prospectively.

To exercise these aforementioned rights, users should send an email to the IT-ServiceDesk.