Privacy Policy According to Article 13 GDPR for the Research Project “Adaptive Reporting of Emotions and the Use of Wearables in Everyday Life”

at the Institute of Information Systems of Karlsruhe Institute of Technology (KIT)

Controller

According to the General Data Protection Regulation (GDPR) (Art. 4, No. 7) and other data protection regulations, the Controller is:

Karlsruhe Institute of Technology (KIT)
Kaiserstraße 12, 76131 Karlsruhe
Germany
Phone: +49 721 608-0
Fax: +49 721 608-44290
Email: info@kit.edu

Karlsruhe Institute of Technology is a public corporation represented by its President.

Data Protection Commissioner

The Data Protection Commissioner of KIT is:

Ass. jur. Marina Bitmann

Address: Kaiserstr. 12
76131 Karlsruhe, Germany
Phone: +49 721 608-41057
Email: dsb@kit.edu

Data Categories Processed

Within the framework of the research project “Adaptive Reporting of Emotions and the Use of Wearables in Everyday Life“, we process your following personal data:

• Demographic data: gender, age, education
• Questionnaire responses: emotional competence and awareness, perceived ease of use
• Voice recordings and descriptions of emotions
• Emotion reports: Multiple-choice selections from standardized emotion models; multiple-choice selections from emotions chosen by the participant
• Self-defined emotion labels
• Application interaction data: Response times, changes in settings
• Audio/voice data: Qualitative interviews

Purpose of Data Processing

KIT processes your personal data for specified, clear, and legitimate purposes only. The purpose of data processing is the participation in and execution of the research project.

This also includes data contained in questionnaires, transcripts, User Data, and Behavior Data. They are required for executing the research project “Adaptive Reporting of Emotions and the Use of Wearables in Everyday Life“. Without them, participation in the research project is impossible.

Legal Basis

Processing of your personal data is based on:

• Your consent according to Art. 6, par. 1, sub-par. 1, a GDPR

Your consent is voluntary. It may be withdrawn anytime with effect for the future. Effect for the future means that a revocation of the consent does not affect legitimacy of processing until withdrawal of the consent.

Refusal or withdrawal of your consent will not result in any disadvantages.

• Art. 6, par. 1 c GDPR in conjunction with Articles 70 and 75 of the Baden-Württemberg Budgetary Regulations (Landeshaushaltsordnung).

Recipients

Your personal data will not be transmitted to third persons in principle.

If, by way of exception, external companies are required to process personal data under a contract on our behalf, these companies will be selected carefully and obliged under a contract. The companies will work according to our instructions exclusively. This will be ensured by strict contractual regulations, technical and organizational measures, and additional controls.

Personal data will not be transmitted to third countries outside of the EU or EEA or an international organization. No automated decision-making or profiling will be made.

When receiving a remuneration in cash, you will have to sign a receipt indicating the total amount paid, your name, and your address. This receipt will be forwarded to the Financial Management Business Unit (Dienstleistungseinheit Finanzmanagement).

According to archiving regulations, documents must be offered to the KIT Archives before they are deleted. They will decide on whether the documents will be kept by them. The KIT Archives will protect the justified interests of the data subjects according to the Baden-Württemberg Archiving Act (Landesarchivgesetz BW (LArchG) and other applicable provisions.

Data Retention Policy / Storage Period

• The allocation table, including the contact data and the declaration of consent, will be destroyed upon the completion of the project at the latest.
• All research data will be kept for a period of ten years upon completion of the project according to the Statutes for Safeguarding Good Research Practice at Karlsruhe Institute of Technology (KIT).
• This does not apply to first and last names and addresses which have to be stored together with the budgeting documents for six years due to budgetary reasons.

If applicable, the documents may be taken over by the KIT Archives where they will be kept permanently according to Art. 5, par. 1, e GDPR in conjunction with Art. 8, par. 2 of the Baden-Württemberg Archiving Act (LArchG) in conjunction with Articles 3 and 2 LArchG.

Your Rights

As far as your personal data are concerned, you have the following rights:

• Right to withdraw your consent with effect for the future, provided that processing is based on a consent according to Art. 6, par. 1, sub-par. 1, a GDPR (Article 7, par. 3 GDPR).
• Right to confirmation if data about you are processed and right to information about the data processed and about the data processing as well as right to obtain copies of the data (Article 15 GDPR).
• Right to rectification or completion of incorrect or incomplete data (Article 16 GDPR).
• Right to immediate erasure of your personal data (Article 17 GDPR).
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability in a structured, standard, and machine-readable format, if processing is based on a consent according to Art. 6, par. 1, sub-par. 1, a or Art. 9, par. 2, a GDPR (Article 20 GDPR).
• Right to object to the future processing of your personal data, if the data are processed according to Art. 6, par. 1, e GDPR (Article 21 GDPR).

In addition, you have the right to complain about the processing of your personal data by KIT with its supervisory authority (Article 77 GDPR). According to Article 25, par. 1 LDSG (State Data Protection Act), the supervisory authority of KIT in the sense of Article 51, par. 1 GDPR is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (Baden-Württemberg State Commissioner for Data Protection and Freedom of Information): (https://www.baden-wuerttemberg.datenschutz.de/, in German only).

Data Deletion Process

You have the right to refuse or withdraw (separately) without providing reasons and without any negative consequences. In the case of the withdrawal of my consent, the lawfulness of processing based on my consent until its withdrawal will not be affected. To withdraw your consent, you can simply email the contact person (Elias Müller;elias.mueller@kit.edu). The contact Person will then start the deletion process (Right to immediate erasure of your personal data (Article 17 GDPR)) for your personal data. The refusal or withdrawal of your consent will not result in any negative consequences for you.