RUB » Bibliotheksportal » Privay Policy

Privacy policy

This privacy policy pertains to:

  • RUB Bib (the App of the library)
  • Alma (library management system)
  • Primo VE (siscovery system)

Scope: Central University Library and Faculty Libraries of Ruhr University Bochum (Version 07th July, 2023)

By means of this privacy policy, Ruhr University Bochum complies with its obligation of information with regard to the abovementioned processing of personal data as set down in article 13 of the European General Data Protection Regulation (GDPR). In what follows, the terms “personal data”, “processing”, “controller”, “third party” are used in accordance with the definitions set down in article 4 of the European General Data Protection Regulation.



Contact Information

Responsibility for processing of personal data rests with Ruhr University Bochum, a legal person under public law, sponsored by the German federal country of Northrhine Westphalia. It is represented by its director, Prof. Dr. Dr. h. c. Martin Paul.

Contact Data of the Controller

Director of Ruhr University Bochum
Prof. Dr. Dr. h. c. Martin Paul
Ruhr University Bochum
44780 Bochum
Germany

E-Mail: rektor@rub.de


Contact Person

The Director of the Central University Library
Dr. Jörg Albrecht
Ruhr University Bochum
Central University Library
44780 Bochum
Germany

E-Mail: joerg.albrecht@rub.de


Name and Contact Information of the Data Protection Officer

Letters to the Data Protection Officer may be addressed to the Controller’s address.

Dr. Kai-Uwe Loser
Ruhr University Bochum
Data Protection Officer
Wasserstr. 221
Room 4.09
44799 Bochum

E-Mail: kai-uwe.loser@rub.de




Data Processed and Purposes of Processing

The library management system (Alma) is the central administrative software performing workflows of the library. Among other things, this includes processing library patrons‘ data in the context of lending media, extensions of lending periods, reservation of checked-out media, processes related to fees and reminders and communication with patrons.

Primo VE is a library discovery system allowing patrons to perform searches of the media resources of the library via a search interface.

RUB Bib is a smartphone application developed by the Central University Library. It provides access to a user’s personal library account and serves as a means of authentication at media lending stations in the process of lending media.

The following personal data are processed:

RUB Bib (library app)

Patrons can install the app "RUB Bib" on their smartphones and can use it to access the features of their library account. It also serves as a means of authentication at media lending stations in the process of lending media.

In the process of authentication, a personal identifying item (bar code) is generated on patrons‘ smartphones. This bar code has limited durability. It is used to check out media at check-out machines and service counters and for payment of fees at the pay machine of the Central University Library.

Personal Data

No personal data is stored in the "RUB Bib" application. Rather, the app merely accesses the data described in the paragraph “Alma” below, in order to display this data. Duration of data retention is described in the paragraph "Duration of Processing/Deletion of Data".

Information on Development

The application "RUB Bib" was developed by the Central University Library of Ruhr University Bochum.


Alma (library management system)

A. Personal information

  • given name, middle name, preferred given name, preferred middle name, surname, preferred surname, title, date of birth
  • primary ID, patron group, status and date of status, date of latest activity, account expiry date, account deletion date, preferred language, user roles
  • contact information: e-mail-Address
  • contact information: address (except staff)
  • blocks, fees

B. User Data for the process of lending

  • loans (title, due date, date of lending, status of loan, [loan]notice)
  • returns (title, return date)
  • reservations (title, order date)
  • appendices and notices
  • proxy (where relevant)

This data is processed in order to make physical and digital media accessible to patrons and in order to be able to levy fees, as far as these become applicable.


Primo VE (discovery system)

Primo VE offers a user account that allows for viewing of ones own data. This data consists especially of the information mentioned unter the heading "Alma". In the course of authentification via Shibboleth, transmission of the LoginId has to be authorised. This LoginId serves as the primary identifyer for matching your data to you.


"1. What does ExLibris do with the data collected via Beacon?

The information sent is for proactive monitoring of end user performance and to enable future "feature" usage analysis. No personal information is transmitted to Ex Libris (e.g., no user id, user name, email, or telephone number).

Data sent to the center is turned into analytical (statistical) tables and all raw data is deleted after 30 days. The 30-day window is to ensure that operational issues in creating the analytical (statistical) tables can be overcome by rebuilding recent "history" if needed.

2. What kind of data is being collected?

The actual data passed depends on the “click” done by the user, though some standard information is always passed:

  • Server name
  • Server IP
  • Session ID
  • Institution
  • Application (e.g. Primo_Local)
  • Page
  • Operation
  • End user performance (not passed in all cases)"

(Source: https://knowledge.exlibrisgroup.com/Primo/Knowledge_Articles/Data_Collection_via_beacon01.hosted.exlibrisgroup.com, layout adapted)



top

Legal Grounds of Data Processing

Processing of the data occurs in accordance with article 6, paragraph 1, letter e) in conjunction with § 3, paragraph 1 of the Hochschulgesetz (HG NRW) of North Rhine Westphalia, as well as in accordance with the statutes (Verwaltungs- und Benutzungsordnung) of the Central University Library of Ruhr University Bochum dated 7th January, 2004 (see: https://www.ub.rub.de/imperia/md/content/benutzung/ab533.pdf) and the schedule of fees (Gebührenordnung) of library institutions dated 23rd February, 2010 (see: https://www.ub.ruhr-uni-bochum.de/imperia/md/content/benutzung/ab_827.pdf).

The library can be accessed and its printed media read in the reading rooms without registration. In accordance with the bylaws of the library, lending media requires provision of data.




Consequences of not providing data/objecting to processing of data

If the technically required data is not provided, library services requiring this data cannot be used by patrons.




Transmission of Data

RUB Bib (library app)

Data is only transmitted to the library management system Alma.


Alma (library management system)

Data is transferred to the following parties outside the university:

  • under an agreement on processing on behalf of the controller (hosting & support) to the consortium “Cloudbasiertes Bibliotheksmanagementsystem der Hochschulen des Landes Nordrhein-Westfalen”,
  • under a sub-agreement on processing on behalf of the controller (support & individual tasks) to the Hochschulbibliothekszentrum (hbz) of North Rhine Westphalia
  • under a sub-agreement on processing on behalf of the controller (provision & hosting), data is processed by Ex Libris (Deutschland) GmbH. In turn, this company operates the technical infrastructure in a server farm in the Netherlands. In case of severe technical issues and as an exception to the situation in general, data may be accessible to the company Ex Libris in a third country (Israel) in the process of solving said technical issues. For the state of Israel as a third state, an adequacy decision according to article 45 GDPR is applicable.

Primo VE (discovery system)

Data is transferred to the following parties outside the university:

  • under an agreement on processing on behalf of the controller (hosting & support) to the consortium "Cloudbasiertes Bibliotheksmanagementsystem der Hochschulen des Landes Nordrhein-Westfalen",
  • under a sub-agreement on processing on behalf of the controller (support & individual tasks) to the Hochschulbibliothekszentrum (hbz) of North Rhine Westphalia
  • under a sub-agreement on processing on behalf of the controller (provision & hosting), data is processed by Ex Libris (Deutschland) GmbH. In turn, this company operates the technical infrastructure at a server farm in the EU (click here).
  • In case of severe technical issues and as an exception to the situation in general, data may be accessible to the company Ex Libris in a third country (Israel) in the process of solving said technical issues. For the state of Israel as a third state, an adequacy decision according to article 45 GDPR is applicable.

"1. What does ExLibris do with the data collected via Beacon?

The information sent is for proactive monitoring of end user performance and to enable future “feature” usage analysis. No personal information is transmitted to Ex Libris (e.g., no user id, username, email, or telephone number).

Data sent to the center is turned into analytical (statistical) tables and all raw data is deleted after 30 days. The 30-day window is to ensure that operational issues in creating the analytical (statistical) tables can be overcome by rebuilding recent “history” if needed.


2. What kind of data is being collected?

The actual data passed depends on the “click” done by the user, though some standard information is always passed:

  • Server name
  • Server IP
  • Session ID
  • Institution
  • Application (e.g. Primo_Local)
  • Page
  • Operation
  • End user performance (not passed in all cases)"

(Source: https://knowledge.exlibrisgroup.com/Primo/Knowledge_Articles/Data_Collection_via_beacon01.hosted.exlibrisgroup.com, layout adapted)



top

Duration of Processing/Deletion of Data

RUB Bib (library app)

No personal data is stored in the application.


Alma (library management system)

A. Personal Data

  • Data regarding persons who lose their status as a member of Ruhr University Bochum will be deleted at the beginning of the second year following their loss of status.
  • Data regarding persons who are neither members of Ruhr University Bochum, nor affiliated, will be deleted at the beginning of a year, provided these persons neither borrowed nor reserved media during the two years prior.

B. User Data for the process of lending

  • duration of retention of processes: data relating to patrons is anonymised 180 days after the process in question has been concluded (generally media returns, payment of a fee). If a default action requires longer retention of data, the data in question is deleted immediately upon conclusion of said action.
  • for statistical purposes, personally identifying markers are removed from the processes, before these are processed further.

Primo VE (Discovery-System)

Data sent to the center is turned into analytical (statistical) tables and all raw data is deleted after 30 days. The 30-day window is to ensure that operational issues in creating the analytical (statistical) tables can be overcome by rebuilding recent “history” if needed.

(Source: https://knowledge.exlibrisgroup.com/Primo/Knowledge_Articles/Data_Collection_via_beacon01.hosted.exlibrisgroup.com, layout adapted)




Rights of the Data Subject

You may excercise the rights granted by the European General Data Protection Regulation at any time. Data Subjects have the following rights of information:

  • confirmation as to whether or not personal data concerning him or her are being processed (art. 15 GDPR),
  • the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and the right to have incomplete personal data completed (art. 16 GDPR),
  • the right to obtain from the controller the erasure of personal data concerning him or her without undue delay (art. 17 GDPR),
  • the right to obtain from the controller restriction of processing according to art. 18 GDPR,
  • the right to data portability according to art. 20 GDPR
  • the right to object to processing of personal data concerning him or her in accordance with art. 21 GDPR.
  • In addition to the abovenamed rights, you have the right to lodge a complaint with a supervisory authority (according to art. 77 GDPR). For instance with the office responsible for the university:

    Landesbeauftragten für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
    Kavalleriestr. 2-4
    40213 Düsseldorf
    Germany

    https://www.ldi.nrw.de/ (German only)

    We reserve the right to modify this privacy policy in order to adapt it to changes in relevant legislation and regulations or to better adapt them to your needs. This privacy policy is valid in the latest version as published by Ruhr University Bochum.



    top