Privacy Notice pursuant Articles 13 and 26 of the Regulation (EU) 2016/679 (“GDPR”) regarding the processing of Project ATLAS Survey Participants' Personal
Thank you for your interest in participating in this survey conducted as part of the Erasmus+ project ATLAS – Assisting Teaching and Learning with AI-based Solutions. Before you take part in the survey, we would like to inform you, in accordance with Articles 13 and 26 of the General Data Protection Regulation (GDPR), about the processing of your personal data.
1. Joint Data Controllers
The joint controllers for the processing of personal data in the context of the ATLAS survey are:
University of Konstanz, based in Universitätsstraße 10, 78464 Konstanz
Università degli Studi di Roma Tor Vergata, based in Via Cracovia 50, 00133 Rome, email rettore@uniroma2.it, PEC rettore@pec.uniroma2.it
Universiteit Antwerpen, based in Prinsstraat, 2000 Antwerpen
Universidad Carlos III de Madrid, based in Calle Madrid 126, 28903 Getafe, Madrid
Universitetet i Sørøst-Norge, based in Postboks 4, 3199 Borre
Tallinn University, based in Narva mnt 25, 10120 Talinn
Universiteit Maastricht, based in Minderbroedersberg 4-6, 6211 LK Maastricht
and Universidade Nova de Lisboa, based in Campus de Campolide, 1099-085 Lisbon
As ATLAS is carried out as an Erasmus+ project involving eight European partner institutions, the processing of personal data is carried out under a joint controllership arrangement pursuant to Article 26 GDPR.
For questions concerning the processing of your personal data, you may contact the following local contact point:
University of Konstanz
Department of Economics
Universitätsstraße 10
78464 Konstanz
Germany
Luisa Ruhland
luisa.ruhland@uni-konstanz.de
2. Data protection officer
You can contact the Data Protection Officer of the Joint Data Controllers at the following email addresses:
University of Konstanz; Email: datenschutzbeauftragter@uni-konstanz.de; Website: Data protection officer;
Università degli Studi di Roma Tor Vergata, email rpd@uniroma2.it PEC: rpd@pec.torvergata.it;
Universiteit Antwerpen, email: privacy@uantwerpen.be;
Universidad Carlos III de Madrid, email dpd@uc3m.es;
Universitetet i Sørøst-Norge, email personvernombud@usn.no;
Tallinn University, email andmekaitsespetsialist@tlu.ee;
Universiteit Maastricht, email fg@maastrichtuniversity.nl;
Universidade Nova de Lisboa, email dpo@unl.pt
3. Purpose and Legal Basis of Processing
Personal data is processed from those who complete the questionnaire regarding the Erasmus+ Project ATLAS. Specifically: students, teaching staff and administrative staff of the Universities participating the Project in question.
Specifically, personal data is processed jointly by the Parties for the purpose of scientific research.
Data are collected, in pseudonymized form, via digital questionnaires at three times. The evaluation takes place in three waves (winter semester 2026/27, summer semester 2027 and winter semester 27/28).
Subsequently, personal data are anonymized. The anonymized data will be used in scientific publications, conferences, or other forms of dissemination for scientific purposes.
The processing is carried out for scientific research purposes and includes appropriate safeguards in accordance with the applicable provisions on processing for scientific research purposes, Article 6(1)(e), (3) GDPR in conjunction with the specific laws of the federal states, e.g. for University of Konstanz: § 13 of the Baden-Württemberg (Germany) State Data Protection Act, for Tor Vergata: Decreto Legislativo 30 giugno 2003 n.196 come da ultimo novellato dal Decreto Legislativo 10 agosto 2018 n.101.
Source of personal data
Personal data are collected directly from the data subject.
4. What Data Is Collected?
The data collected include the answers you provide in the survey, demographic information, information about teaching and learning, information about the use of generative AI, and information about your attitudes, experiences, and perceptions.
In addition, a participant ID is used to link your responses across multiple survey waves, conducted at the beginning and at the end of the semester.
5. Categories of recipients of personal data
The data will be processed by the staff and collaborators of the Joint Controllers, in their capacity as persons authorized to process the data, and/or by third parties expressly designated as data processors, in accordance with Article 28 of the GDPR.
Specifically, the survey is conducted using LimeSurvey software hosted on a server located in Germany. A data processing agreement pursuant to Article 28 GDPR is in place with the provider.
6. Storage Period
Your personal data will be stored in pseudonymised form, processed for the purposes of the research project, and retained for a period of ten years in accordance with the principles of good scientific practice.
7. Your Rights
Under the GDPR, you have the following rights:
- the right of access (Article 15 GDPR);
- the right to rectification (Article 16 GDPR);
- the right to erasure (Article 17 GDPR);
- the right to restriction of processing (Article 18 GDPR);
- the right to object (Article 21 GDPR); and
- the right to lodge a complaint with a supervisory authority (Article 77 GDPR).
If you have any questions regarding data protection, please contact Luisa Ruhland (luisa.ruhland@uni-konstanz.de).
University of Konstanz
Department of Economics
Universitätsstraße 10
78464 Konstanz
Germany
8. Obligation to provide personal data
Providing personal data is required to participate in the survey. Participation in this survey is voluntary. You will not experience any disadvantages if you decline to participate or withdraw at a later stage.
9. Data processing methods
Personal data is collected electronically through LimeSurvey and processed in pseudonymised form. A participant ID is used to link responses across the different survey waves. The pseudonymised data is analysed for scientific research purposes and are accessible only to authorised members of the ATLAS research team. Appropriate technical and organisational measures are implemented to protect the data against unauthorised access, alteration, disclosure, or loss.
10. Transfer of personal data to non-EU countries
Your data will not be transferred to countries outside the EU/EEA.
Privacy Notice Version 1.0
Date: 29 September 2026
ESSENCE OF THE ARRANGEMENT OF THE JOINT CONTROLLERSHIP AGREEMENT BETWEEN: UNIVERSITY OF KONSTANZ, UNIVERSITÀ DEGLI STUDI DI ROMA TOR VERGATA, UNIVERSITEIT ANTWERPEN, UNIVERSIDAD CARLOS III DE MADRID, UNIVERSITETET I SØRØST-NORGE, TALLINN UNIVERSITY, UNIVERSITEIT MAASTRICHT AND UNIVERSIDADE NOVA DE LISBOA
In accordance with Art. 26 par.1 of GDPR “Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14 […]”.
Art. 26 par.2 of GDPR provides that “The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject”.
Article 1 – Subject matter of the agreement
1. By this Agreement (hereinafter the “Agreement”), the Parties jointly determine the purposes and means of processing, as well as their respective responsibilities regarding compliance with the obligations arising from the applicable regulatory framework, with particular regard to the exercise of the data subject’s rights and their respective duties to provide information as set forth in the combined provisions of Articles 13 and 26 of the GDPR.
2. The joint controllership referred to in this Agreement relates to the processing of personal data carried out within the scope of the Erasmus+ Poroject ATLAS.
Article 2 – Data Processed, Purposes, and Legal Basis for Processing
1. The Parties jointly determine that the personal data collected is processed for Erasmus+ Project ATLAS, in accordance with the provisions of the Data Mangement Plan.
The processing is carried out for scientific research purposes and includes appropriate safeguards in accordance with the applicable provisions on processing for scientific research purposes, Art. 6(1)(e) in conjunction with Art. 6(3) and Art. 89 GDPR. Additional legal bases can be found in the sector-specific legislation of the country where each Party is based.
Article 3 - Division of Roles and Responsibilities
1. Each Joint Controller assumes responsibility, within the scope of its own jurisdiction, for processing personal data in accordance with applicable laws.
2. Specifically, personal data are stored for in pseudonymised form, for a period of ten years in accordance with the principles of good scientific practice.
3. Each Joint Controller shall provide training to its staff in accordance with Articles 29 and 32(4) of the GDPR.
Article 4 – Obligations Regarding the Security of Personal Data
The Joint Controllers are required to implement all appropriate technical and organizational security measures to protect the personal data processed in connection with the activities described in this Agreement, regularly verifying compliance with such measures to ensure the timely restoration of the availability of the processed personal data in the event of a physical or technical incident, and to periodically monitor the level of security achieved, in order to ensure that it remains appropriate to the risk at all times.
Article 5 – Responsibilities of the Joint Controllers
1. The Parties are responsible for complying with the measures applicable to them in order to ensure effective redress for the data subject in accordance with the provisions of the Applicable Law, Articles 26 and 82 of the Regulation, and, in particular, in accordance with the provisions of Articles 3 and 4 of this Agreement.
2. With regard to the processing of personal data provided for in the Agreement, the Joint Controllers shall be held jointly and severally liable to the data subjects, who may take action against any Joint Controller without distinction to protect their rights. Without prejudice to their joint and several liability toward the data subjects, it is hereby agreed that each Joint Controller shall have a right of recourse against the other Joint Controllers for any penalties, fines, or damages arising from the breach or improper performance of this Agreement.
Article 6 – Data Subjects’ rights
1. Data subjects, or their legal representatives, may at any time request access to their personal data and obtain a copy thereof, as well as request the correction or supplementation of such data if they consider them inaccurate or incomplete, as well as their erasure, provided that such erasure does not conflict with applicable laws regarding data retention and with any need to establish, exercise, or defend a legal claim in court.
2. Data subjects, as provided for in Article 77 of the Regulation, also have the right to file a complaint with the national supervisory authority in the event of unlawful processing or a delay in the data controller’s response to a request falling within the scope of the data subject’s rights.
3. To exercise these rights, please contact the following:
Luisa Ruhland: luisa.ruhland@uni-konstanz.de
University of Konstanz
Department of Economics
Universitätsstraße 10
78464 Konstanz
Germany
4. It is understood that, pursuant to Article 26(3) of the Regulation, regardless of the provisions of this Agreement, the data subject may exercise his or her rightswith respect to each Joint Controller.
Article 7 - Secrecy and Confidentiality
The Joint Controllers undertake to treat as strictly confidential all material that is not generally in the public domain and of which they may become aware by virtue of the joint controllership relationship, and they undertake to disclose and use such information solely for the purposes set forth in this Agreement.