Skip to content
Deutsche Fassung

Appointment portal of the Faculty of Law

Privacy policy (Datenschutzerklärung)

Last updated: November 2026·Information pursuant to Art. 13 and 14 GDPR

This translation is provided for convenience; the German version is legally binding.

At a glance

The Faculty of Law uses the portal to conduct appointment procedures (Berufungsverfahren) (Art. 66 BayHIG): it receives applications for advertised professorships and supports the appointment committees (Berufungsausschüsse) in preparing the appointment proposal (Berufungsvorschlag) – with meeting dates, attendance and transfers of voting rights (Stimmrechtsübertragungen), votes, declarations of bias (Befangenheitserklärungen) and the obtaining of expert reports and statements. It is aimed at applicants, at the members of the appointment committees and the administrators of the procedures, and at the appointed reviewers (Gutachterinnen und Gutachter).

Authorised persons only
Applications and procedural documents can only be seen by the members and the administrators of the respective appointment committee and – to a limited extent – by the reviewers.
Operated at the University
Servers and e-mail delivery of the University of Passau; no external service providers, no AI services.
No tracking
Only technically necessary cookies, no analytics services, no content delivery networks.
Humans decide
The portal does not evaluate applications. Selection and ranking are decided by the appointment committee and the competent bodies of the University.

Controller and data protection officer

Controller (Art. 4(7) GDPR)
Universität Passau (University of Passau)
Corporation under public law (Körperschaft des öffentlichen Rechts) and at the same time a state institution, legally represented by the President, Prof. Dr. Jan Hendrik Schumann
Innstraße 41, 94032 Passau, Germany
+49 851 509-0
praesident@uni-passau.de
Official data protection officer (Behördlicher Datenschutzbeauftragter)
Data protection officer of the University of Passau
c/o actago GmbH, Weidenstraße 66, 94405 Landau a. d. Isar, Germany
+49 9951 99990-500
datenschutz@uni-passau.de (confidential: uni-passau@actago.de)

The person responsible for the operation of the portal in terms of content is Prof. Dr. Michael Beurskens, michael.beurskens@uni-passau.de.

Processing operations in detail

The processing is based on the performance of a task carried out in the public interest (Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG). The task follows from Art. 66 BayHIG (appointment procedure, appointment committee, external and comparative expert reports, statements on teaching). For applications, the specific information below applies in addition. We do not ask for consent.

User account and sign-in
Data
User name (e-mail address; for members of the University, the University ID), form of address, title, first name and surname, e-mail address, telephone number, official title (Amtsbezeichnung), unit, time of last access; password (only as a PBKDF2 hash) and time of the last change; link for setting the password (valid for 30 minutes, single use only) with the time it was sent; for self-registration, the time of registration and of confirmation of the e-mail address; for personal direct links in e-mails from the portal (see “E-mails”), only their hash, the procedure and the time of creation and expiry; if you set up two-step verification: the secret key of the authenticator app and your recovery codes (only as a hash); if you set up passkeys: their name, public key, identifier and signature counter as well as the time of setup and of last use. Biometric data (fingerprint, facial image) does not leave your device and is neither received nor stored by the portal.
Purpose
Access to the portal, assignment to appointment committees, contact
Source
Your own details provided during registration or in your profile; if you are added to an appointment committee or as a reviewer, the administrators of the procedure create your account with name, form of address, title and e-mail address (Art. 14 GDPR). You set your password, second factor and passkeys yourself and can change or remove them in your profile at any time.
Note
To protect against attacks, the portal counts failed sign-in attempts per user name and IP address for 15 minutes in working memory; this information is not stored permanently. Unconfirmed self-registrations are deleted after 7 days.
Membership of the appointment committee and declaration of bias
Data
Membership of an appointment procedure, function on the committee (such as chair, group of professors, external member, academic staff, students, Women's Representative (Frauenbeauftragte), deputy, rapporteur (Berichterstattung), administration, reviewer) and access right; the declaration of bias form pre-filled by the portal and the declaration you have signed and uploaded (PDF)
Purpose
Composition of the committee (Art. 66(4) BayHIG), determination of voting rights, examination of possible bias, management of access rights
Source
Entered by the administrators of the procedure (Art. 14 GDPR); the declaration comes from you
Note
The members of the committee can see in the list of members whether a declaration of bias has been submitted; the declaration itself can only be retrieved by you and the administrators of the procedure.
Meetings, attendance and transfer of voting rights
Data
Meeting dates (time, duration, title, location, if applicable a video conference link, explanatory note, person who created the entry) with documents such as the agenda; for each member and meeting: confirmation of attendance (present, absent, by video), note, if applicable the representative and the signed and uploaded power of attorney (Vollmacht) for the transfer of the voting right (PDF)
Purpose
Invitation to and organisation of the meetings, determination of the quorum, attendance list
Note
Invitations contain a calendar entry (ICS file). The power of attorney can only be retrieved by you and the administrators of the procedure. The portal itself does not provide video conferencing; the privacy information of the linked service applies to it.
Votes and circulation procedures
Data
Subject of the vote (title, description, documents, start, person who created it, type: vote or circulation procedure (Umlaufverfahren)); for each member entitled to vote, the vote cast (approval, rejection, abstention, in the circulation procedure also objection to the procedure) and a voluntary note on the vote
Purpose
Decision-making of the committee, in the circulation procedure outside meetings pursuant to § 22(4) of the Constitution (Grundordnung) of the University of Passau; documentation of the result
Note
Open votes: each member's vote and note are visible by name to all members of the committee; the administrators of the procedure can enter a vote cast by other means (e.g. by e-mail) on behalf of a member. Secret votes (determined for each vote by the chair or the administrators): only two things are stored, separately: the fact that a member has voted, and – without name, without time and in random order – the vote cast; the portal does not store any link between vote and person. The result (totals) is only displayed after the vote has closed; in very small bodies or with unanimous results, voting behaviour may be inferable from the result itself.
Expert reports and statements on teaching
Data
Appointment as reviewer (account data as above); uploaded expert reports (PDF) with time; statements by the Dean of Studies (Studiendekanin bzw. Studiendekan) and the student representatives on the applicants' teaching skills and experience (PDF)
Purpose
Obtaining external and comparative expert reports and the statements on teaching (Art. 66(5) sentences 1 and 5 BayHIG)
Note
Expert reports and statements contain assessments of the applicants. They are only accessible to the members and the administrators of the respective committee; reviewers can see their own reports.
E-mails
Data
E-mail address, name, form of address, content of the message and attachments; if applicable a personal direct link (for committee members and reviewers) or the personal link to the application
Purpose
Confirmation of registration, password change and application; invitations, votes, reminders and notifications from the administrators of the procedure to committee members, reviewers and applicants
Note
The e-mails are sent via a mail server of the University of Passau. The sender is the portal; replies go to the person who initiated the message. Messages to several persons are sent individually so that recipients cannot see the others' addresses. The portal keeps a delivery log only for automatic reminders (see below); it does not store the content of messages sent. Direct links: Instead of a permanent access code, e-mails to committee members and reviewers contain a personal direct link that is bound to your account and the respective procedure and is valid for 5 days, at most until the procedure is completed. Only a hash of the link is stored; expired links are deleted daily. If you have set up two-step verification or a passkey, or if you belong to the global administrators, a direct link does not sign you in; you are then redirected to the sign-in page.
Automatic reminders
Data
Name, form of address, e-mail address and function of the recipient; subject of the reminder (meeting, declaration of bias, vote, upcoming deletion); delivery log with type of reminder, procedure, subject, account and time of sending
Purpose
Proper and timely conduct of the appointment procedure: the portal reminds committee members and reviewers by e-mail of a missing response to an upcoming meeting, of a missing declaration of bias (at most 3 times at intervals of 7 days) and of open votes (first 2 days after the start, at most 3 times at intervals of 3 days). The administrators of the procedure and the global administrators receive reminders before a procedure is deleted automatically (28, 7, 1 days beforehand). The delivery log prevents duplicate reminders.
Legal basis
Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG, Art. 66 BayHIG
Note
The administrators of the procedure can switch off the reminders to the committee and reviewers for each procedure. No reminders are sent for completed procedures. The delivery log is deleted together with the data of the procedure.
Server logs (log files)
Data
IP address, date and time, requested address, status code, amount of data transferred, browser identifier (user agent), referring page (referrer), after sign-in your user name; in addition, an error and trace log of the application (without passwords and access codes)
Purpose
Delivery of the pages, detection and prevention of attacks and misuse, error analysis
Legal basis
Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG; Art. 32 GDPR
Note
Evaluation exclusively by the portal operators, not by external services
Film vote
Data
When voting on film suggestions for film evenings of the chairs: the suggestion or the films chosen, time and IP address; a cookie marking participation (see below)
Purpose
Limitation to one suggestion or one vote per participant
Note
Participation is voluntary and possible without signing in; the information has no connection with appointment procedures.

Applications

Application form and documents
Data
Person: gender, titles before and after the name, first name and surname, date of birth, place of birth, marital status, number of children, up to three nationalities, indication of a severe disability (Schwerbehinderung); Contact: e-mail address, telephone number, postal address; Qualifications: university degree (grade, date, place), Second State Examination in Law (Zweites Juristisches Staatsexamen) (grade, date, place), doctorate (topic, grade, date, university) or achievement equivalent to a doctorate, habilitation (topic, date, place, status), licence to teach (Lehrbefugnis), junior professorship (Juniorprofessur) or leadership of a junior research group (subject, institution, start, end), other equivalent achievements, current employment (title, employer, place, start), further university degrees, professional experience, awards, third-party funded projects, cooperation experience, stays abroad, other particulars; Documents: the uploaded PDF file with the application documents; Procedure: time of receipt, personal access code, status in the procedure (received, invited to give a presentation, for review, list position, withdrawn or rejected) and notes by the administrators of the procedure
Purpose
Conduct of the appointment procedure: examination of the requirements for appointment, comparative assessment of professional, pedagogical and personal suitability (Art. 66(5) sentence 6 BayHIG), selection for presentations, review and the appointment proposal, contact
Legal basis
Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG, Art. 103 sentence 1 no. 1 BayBG (for an employment relationship in conjunction with Art. 145(2) BayBG), Art. 66 BayHIG and Art. 33(2) GG (selection according to aptitude, qualifications and professional achievements)
Source
Your own details. Only name and e-mail address are marked as mandatory; without further details and documents, however, your application cannot be assessed, or only to a limited extent.
Your control
After submitting, you will receive a confirmation of receipt with a personal link. With it, you can view and change your details, replace the file or delete the application completely until the end of the application period. Please do not pass this link on.
Indication of a severe disability (special category)
Data
The voluntary indication that a severe disability exists; in addition, health data insofar as you include it yourself in free-text fields or documents. This data belongs to the special categories of personal data under Art. 9(1) GDPR.
Purpose
Safeguarding the rights of severely disabled applicants, in particular the invitation to an interview (§ 165 sentence 3 SGB IX)
Legal basis
Art. 9(2)(b) GDPR in conjunction with Art. 8(1) sentence 1 no. 2 BayDSG and Art. 103 sentence 1 no. 2 BayBG; suitable and specific safeguards pursuant to Art. 8(2) BayDSG (access for authorised persons only, encrypted transmission, no disclosure to third parties)
Note
Please do not enter any further health data or other special categories of personal data in free-text fields if they are not necessary for the application.

In addition, the privacy information of the University of Passau on application procedures (PDF; Deutsche Fassung) applies, in particular regarding further processing outside the portal after the appointment committee has completed its work. For the storage period in the portal, see Storage period and erasure.

Audit log (Revisionsprotokoll)

Data
Changes to the data (creation, modification, deletion) are logged automatically with the time, the data set and record concerned, the signed-in account – during view as another person additionally the acting administrator – and the former and new state of the record. Secrets (password hash, two-step verification key, recovery codes, access codes) only appear masked (“***”); direct links are not logged. Secret votes are not logged, neither the vote nor the participation; it is therefore not possible to link a vote to a person via the log either. Application events are logged as well (with time, account and IP address): sign-in and sign-out including failed sign-in attempts (user name, if the account exists, and type of sign-in; never the password entered), sign-in via direct link, changes to the password, two-step verification and passkeys, start and end of view as another person, data export, account deletion and request for erasure, ZIP download of applications and the deletion of procedures.
Purpose
Traceability of changes, investigation of errors and misuse, ensuring the integrity and confidentiality of the data (Art. 5(1)(f), Art. 32 GDPR)
Legal basis
Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG
Access
Exclusively the global administrators of the portal; members and administrators of the procedures have no access. You receive entries concerning your own account via the self-service access (see Your rights).
Storage period
6 months (rolling; older entries are deleted daily). If a procedure is deleted, the logged contents (former and new state) relating to that procedure are deleted as well; only the record of the change itself remains.

View as another person (Ansicht als andere Person)

To provide support with questions and errors, the global administrators can view the portal from the perspective of a specific person and act on their behalf. The start and end are recorded with both accounts in the audit log; changes made during this time are logged with both accounts. Security settings (password, two-step verification, passkeys), data export, account deletion and the request for erasure are blocked during this time. The legal basis is Art. 6(1)(e), (3) GDPR in conjunction with Art. 4(1) BayDSG.

Access and recipients

The following may access the data of an appointment procedure – in each case only for that procedure:

  • the members of the appointment committee including the deputies, the Women's Representative and the rapporteur: the applications with all details and documents, the list of members, meetings, votes (for open votes with the votes of all members, for secret votes only participation and result), expert reports and statements;
  • the administrators of the procedure (Dean's Office, chair): in addition, for maintaining members, dates, votes and applications, for sending e-mails, for retrieving declarations of bias and powers of attorney and for exporting lists as Word files;
  • the appointed reviewers: only the applications with the status “Zur Begutachtung” (for review), with the details from the application form and the documents – without date of birth, place of birth, marital status, children and indication of a severe disability – and their own expert reports;
  • the global administrators of the portal: all procedures, in addition the audit log and view as another person.

External members of the committee and reviewers may be members of other higher education institutions; they access the data exclusively via the portal. Insofar as necessary for the further appointment procedure, the appointment proposal and the associated documents are forwarded outside the portal to the competent bodies and offices of the University (Art. 66(5) and (6) BayHIG).

The portal runs on a server operated in the Centre for Information Technology and Media Services (Zentrum für Informationstechnologie und Medienmanagement, ZIM) of the University of Passau. It sends e-mails via a mail server of the University of Passau.

Content from external servers, fonts, third-party scripts or content delivery networks are not embedded. There is no transfer to third countries, no profiling and no use for advertising purposes.

In individual cases, data, in particular log files, may be transmitted to law enforcement or supervisory authorities and, in the event of legal proceedings, to courts, insofar as there is a legal obligation or authorisation to do so.

Cookies and local storage

We only store information in your browser that is strictly necessary for the service you have expressly requested (§ 25(2) no. 2 TDDDG); no consent is required for this. The subsequent processing is based on Art. 6(1)(e) GDPR. No analytics, tracking or advertising cookies are set.

NamePurposeDuration
.ASPXAUTHSign-in (encrypted session identifier)until you sign out or close the browser, at most 120 minutes without activity
__RequestVerificationTokenProtection against forged form submissions (CSRF)until the browser is closed
ASP.NET_SessionIdSession identifier for short notices after submitting a form (e.g. “Ihre Stimme wurde gespeichert” – your vote has been saved)until the browser is closed
HasChosen, HasVotedFilm vote only: marks that you have already made a suggestion or voteduntil the browser is closed
bp-theme (local storage)Colour scheme you have chosen (light, dark, automatic)until you change or delete it

You can delete or block cookies and local storage in your browser at any time; signing in is then not possible.

Storage period and erasure

  • Applications and procedural data (applications with details and documents; appointment committee and rights, meeting dates, attendance, powers of attorney, votes, expert reports and statements, declarations of bias and the associated participation and reminder data and direct links): are deleted automatically 6 months after the appointment procedure has been completed (Art. 5(1)(e) GDPR). Retention until then serves to document the procedure and any legal disputes. The administrators of the procedure may extend the period in individual cases where necessary, for example for proceedings brought by a competing applicant (Konkurrentenstreitverfahren) or other legal remedies (Art. 17(3)(e) GDPR). Applicants are informed of the deletion by e-mail. Only an entry with the title, dates and a deletion note remains of the procedure. Until the end of the application period, you can delete your application yourself at any time.
  • User account: if you are not a member of any ongoing appointment procedure, you can delete your account yourself on the “Mein Profil” (My profile) page; otherwise on request (see Your rights). Accounts without their own password, two-step verification or passkey that are not assigned to any other procedure are deleted automatically together with the data of the procedure. Unconfirmed self-registrations are deleted after 7 days.
  • Direct links: become invalid after 5 days, at the latest when the procedure is completed, and are deleted daily.
  • Audit log: after 6 months (rolling); contents relating to a deleted procedure upon its deletion (see Audit log).
  • Links for setting the password: become invalid after 30 minutes and are deleted when used.
  • Log files: after seven days.
  • Film vote: as soon as the information is no longer needed for the respective vote.
  • Backups: deleted data may still be contained in backup copies until they are overwritten in the regular cycle.

Your rights

You have the following rights vis-à-vis the University of Passau. Please send requests informally to ls_beurskens@uni-passau.de; you may also contact the data protection officer about this at any time.

You may request information about the data stored about you, the purposes, recipients, storage period and source, and receive a copy (Art. 15(3) GDPR). In the “Meine Daten” (My data) section of the “Mein Profil” (My profile) page, you can see for yourself which data is stored for your account (account, memberships and rights, attendance and representations, votes in open votes and participation in secret votes, valid direct links, reminders, audit log entries concerning your account, your own files) and download it as a ZIP file (data in JSON format and files). Not included are access secrets (password hash, two-step verification key, recovery codes, direct link codes, passkey keys) and audit log contents that concern only other persons (Art. 15(4) GDPR). Applicants can see their details until the end of the application period via the personal link in the confirmation of receipt; otherwise we provide information on request.

You may request the rectification of inaccurate data and the completion of incomplete data. You can change your form of address, title, name, e-mail address, telephone number, official title and unit yourself on the “Mein Profil” (My profile) page; application details until the end of the application period via the personal link, thereafter on request.

You may request the erasure of your data if it is no longer necessary for the purposes (Art. 17(1) GDPR). As long as you are a member of an ongoing appointment procedure, the processing is necessary for the performance of a task carried out in the public interest; to that extent, the right to erasure does not apply (Art. 17(3)(b) GDPR). The same applies insofar as the data is needed for the establishment, exercise or defence of legal claims (Art. 17(3)(e) GDPR). If you are not a member of any ongoing procedure, you can delete your account yourself in the “Meine Daten” (My data) section of the “Mein Profil” (My profile) page (account, passkeys, direct links and your own files); otherwise, you can submit a request for erasure there to the global administrators and the administrators of your procedures. Details relating to completed procedures (such as attendance, votes in open votes) are retained until the procedure is deleted automatically. You can delete your application completely yourself until the end of the application period via the personal link; you can remove passkeys and two-step verification yourself on the “Mein Profil” (My profile) page.

You may request that your data only be stored but not otherwise processed, for example while its accuracy is contested.

This right does not apply to processing necessary for the performance of a task carried out in the public interest (Art. 20(3) sentence 2 GDPR). Irrespective of this, you can download the data stored for your account in a structured, commonly used and machine-readable format (JSON) in the “Meine Daten” (My data) section of the “Mein Profil” (My profile) page.

You may lodge a complaint with the Bavarian State Commissioner for Data Protection (Bayerischer Landesbeauftragter für den Datenschutz, BayLfD): Postfach 22 12 19, 80502 München, Germany, telephone +49 89 212672-0, poststelle@datenschutz-bayern.de.

Online complaint to the BayLfD (in German)

Right to object under Art. 21 GDPR

On grounds relating to your particular situation, you may object at any time to the processing of your data based on Art. 6(1)(e) GDPR. We will then no longer process the data unless there are compelling legitimate grounds which override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Data security

All connections to the portal are encrypted in accordance with the state of the art (HTTPS); cookies are only transmitted over encrypted connections and cannot be read by scripts. Passwords are stored exclusively as a hash; links for setting the password are time-limited and can only be used once. Uploaded files are stored outside the publicly accessible directory; only PDF files are accepted. Direct links in e-mails are personal, bound to account and procedure and time-limited; only their hash is stored – please nevertheless do not forward such e-mails. If you have set up two-step verification or a passkey, direct links do not sign you in automatically. Changes are recorded traceably in the audit log. If you use the portal on private devices, please protect them with up-to-date software and a screen lock and sign out after use.

Version and changes

Version of this privacy policy: November 2026. We will adapt it if the portal or the legal situation changes. In addition, the general privacy policy of the University of Passau and the privacy information on application procedures apply. See also the legal notice and the accessibility statement.