Information in accordance with Art. 13 of the General Data Protection Regulation (GDPR)

for electronic data collection in accordance with § 6 of the Ordinance of the State Government on Infection Protection Measures against the Spread of the SARS-CoV-2 Virus (CoronaVO)

With the following information, KIT provides you with an overview of the processing of your personal data carried out within the scope of the electronic data collection according to § 6 CoronaVO.

1. Responsible Party

Responsible for data processing within the meaning of the General Data Protection Regulation (DS-GVO) and other data protection regulations is:

Karlsruhe Institute of Technology
Kaiserstrasse 12
76131 Karlsruhe
Phone: +49 721 608-0
Fax: +49 721 608-44290
E-mail: info∂

The Karlsruhe Institute of Technology is a public corporation. It is represented by the President Prof. Dr. Holger Hanselka. You can reach our data protection officer at datenschutzbeauftragter∂ or at the postal address with the addition "Die Datenschutzbeauftragte".

2 Type and scope of data processing

The data collected during a data collection pursuant to § 6 CoronaVO are personal data pursuant to Art. 4 No. 1 DS-GVO. You are not obliged to provide your personal data. However, without collection of your contact data (name, address, and, if applicable, telephone number), you cannot be granted access and you must be excluded from visiting or using the facility or participating in the event pursuant to Section 6(2) CoronaVO. KIT fulfils its obligation to collect data pursuant to Section 6 CoronaVO by means of electronic data processing (KONKIT). When providing your data via QR code, please note that you are obliged to provide accurate information pursuant to Section 6 (3) CoronaVO.

a. Data processing by means of KIT-Card

Electronic data processing can be carried out using your KIT Card. By holding your card to the device (KONKIT-Box), in addition to the box ID and a time stamp, your KIT-Card number is recorded each time you come and go and initially stored on the device. The data is transferred in encrypted form to an SQL database created for this purpose, supplemented with the room number and stored there for a period of four weeks in accordance with the legal requirements and then deleted. The data on the device is deleted daily after the data transfer. The database is hosted on KIT servers with restricted access. Access to the database is granted solely in order to comply with a request by the competent authorities and exclusively by employees authorized to do so by the KIT management.

Your data will be processed solely for the purpose of contact tracing by the relevant authorities. If you have not entered your data yourself, your KIT card number or KIT account collected on the date of the event will be queried in the SQL database upon request and if this is necessary for tracing possible infection routes. Based on this, your contact data (name, address, telephone number, if applicable) stored in the respective administrative systems will be determined and transmitted to the authorities responsible for contact tracing. The transmission takes place either in paper form or by means of password-protected electronic transmission. No personal evaluation and/or aggregation of residence data is carried out by KIT.

b. Data processing by means of a QR code

Another way of data processing may be by means of a QR code. The QR code or the box ID and, depending on which option you (can) use, either your KIT account (u1234) or the contact data entered by you yourself will be collected. Further processing is the same as described above.

3. Legal basis of the data processing

Data processing is based on Article 6(1)(c), (2) and (3) DS-GVO in conjunction with Section 32 and Sections 28 to 31 of the German Infection Protection Act (IfSG) as well as Section 12(4) and Sections 8, 6 CoronaVO. For the study operation, § 5 para. 1 Regulation of the Ministry of Science on infection control measures against the spread of the virus SARS-CoV-2 in the area of responsibility of the Ministry of Science (CoronaVO Study Operation) additionally applies.

4. Your rights

You have the following rights in relation to us in respect of personal data relating to you:

  • Right to obtain confirmation as to whether data concerning you are being processed and to obtain information about the data processed, further information about the data processing and copies of the data (Article 15 DS-GVO).
  • Right to rectification or completion of inaccurate or incomplete data (Article 16 DS-GVO)
  • Right to erasure of data concerning you without delay (Article 17 DS-GVO)
  • Right to restriction of processing (Article 18 DS-GVO)
  • Right to object to future processing of data concerning you, where the data are processed pursuant to Article 6(1)(e) or (f) of the GDPR (Article 21 of the GDPR).

You also have the right to lodge a complaint with the supervisory authority about the processing of personal data concerning you by Karlsruhe Institute of Technology (KIT) (Article 77 DS-GVO). The supervisory authority within the meaning of Article 51 (1) DS-GVO regarding KIT is pursuant to Section 25 (1) LDSG:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Address: Lautenschlagerstraße 20
70173 Stuttgart
Postal address: P.O. Box 10 29 32
70025 Stuttgart
Tel: 0711/615541-0
Fax: 0711/615541-15
E-mail: poststelle∂