Privacy Policy for the AStA Application Portal

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you use the AStA Application Portal. Personal data is any data with which you can be personally identified. For detailed information on data protection, please refer to our privacy policy listed below.

Data Collection on This Portal

Who is responsible for data collection on this portal?

Data processing on this portal is carried out by the website operator. You can find their contact details in the section "Information on the Responsible Party" in this privacy policy.

How do we collect your data?

Your data is collected in two ways: when you provide it to us by filling out an application in the portal, and through technical data that is required for the operation of the portal.

What do we use your data for?

The collected data is used exclusively for processing applications to the AStA of Technische Hochschule Lübeck. This includes displaying applications, processing them, forwarding them to the Flowwer approval system, and sending emails in connection with your application.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. Furthermore, you have the right to request restriction of processing of your personal data under certain circumstances. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time with questions about this or other data protection matters.

2. General Information and Mandatory Information

Data Protection

The operators of this portal take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet (e.g., communication by email) may have security vulnerabilities. Complete protection of data from access by third parties is not possible.

Information on the Responsible Party

The responsible party for data processing on this portal is:

Technische Hochschule Lübeck
Mönkhofer Weg 239
23562 Lübeck
Germany

Phone: +49 451 300 6
Email: [email protected]

The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

Storage Duration

Unless more specific storage periods are stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies or you request deletion of your account.

General Information on Legal Bases for Data Processing

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If your data is required to fulfill a contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of data processing carried out before revocation remains unaffected by the revocation.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work, or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

3. Data Collection on the Application Portal

Login via Moodle

To use the portal, you must log in via Moodle. The following data is transferred from Moodle and stored in the portal:

• Moodle identifier (iss, sub, client, deployment/course ID, roles)
• Name, email address, and possibly matriculation number (from your Moodle profile, only if it consists of 4 to 10 digits)

This data is used for identification and display in the portal as well as for your application. It is stored until your account is deleted.

Applications and Related Data

When using the portal, the following data is processed:

• Application data: Purpose, explanation, committee/budget item, amounts, links, dates
• Bank details: Account holder and IBAN. These are stored only in encrypted form and only until they are transferred to the Flowwer approval system. After transfer, they are deleted from the portal. Only the last digits of the IBAN are displayed in the overview.
• Reimbursement applications: For reimbursement applications (e.g., semester ticket, double payment), in addition to bank details, name, matriculation number, applicant number, university email address, and the reason for reimbursement are collected. The reason for reimbursement may include health data within the meaning of Art. 9 GDPR. These special categories of data are also stored only in encrypted form and only until transfer to Flowwer, after which they are deleted.
• Attachments and supporting documents: Uploaded files such as enrollment certificates, severe disability certificates, or other supporting documents are stored only until transfer to Flowwer and then deleted.
• Generated PDF: The PDF generated for transfer to Flowwer is also stored only until transfer and then deleted.

The remaining application data (without bank details and without special categories in plain text) is stored until the account is deleted.

Drafts

To allow you to continue incomplete applications, drafts are stored differently:

• General drafts: Information about an incomplete application is stored exclusively locally in your browser (localStorage), not on the server. They are automatically discarded after DRAFT_TTL_HOURS (default: 48 hours) from creation without extension. They are also removed when submitting, discarding, deleting your account, or manually deleting drafts.
• Bank details during input: IBAN and account holder are stored only in the browser tab (sessionStorage) during input and expire at the latest when the tab is closed.
• Reimbursement application drafts: All inputs for reimbursement applications (including reason, matriculation number, IBAN, file names of supporting documents) are stored exclusively in the browser tab (sessionStorage). They expire when the tab is closed or at the latest after DRAFT_TTL_HOURS. No storage on the server takes place.

Sessions

For login to the portal, only a hash of the session token is stored. The session remains active for a maximum of 8 hours but is deleted after 30 minutes of inactivity.

Server Log Files

The provider of the portal automatically collects and stores information in server log files. This includes:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR.

4. Disclosure of Data

Flowwer (AStA Approval System)

After submission, the generated PDF with attachments, as well as the name, amount, bank details, and purpose of the application, are transferred to the Flowwer approval system of the AStA. Flowwer's own privacy policy applies there. Deletion in the application portal has no effect on data already stored in Flowwer.

Email Dispatch

Emails related to applications are sent via the AStA's SMTP server. These emails contain only the case number, purpose, status, and a link to the portal. Bank details, sensitive information, or attachments are not sent by email.

No Other Disclosures

No data is passed to other third parties. No external fonts, scripts, or other resources from third-party providers are loaded in the browser.

5. Deleting Your Account

You can delete your account at any time via the "Delete account" link in the header under your profile picture. Deletion removes the following data in a single transaction:

• Identities, sessions
• Name, email address
• All uploads, PDFs
• Details and bank details of all applications
• Open notifications

After deletion, no one can log in with the previous account. A new login creates a new, empty account.

Only case numbers and events (type, amount, status history) remain. These are linked to a random, pseudonymous ID whose association with the account is removed upon deletion. The event account.deleted only stores the number of applications. It is no longer possible to trace them back to a person.

Drafts stored locally on the device used are removed after successful account deletion. On other devices, they expire after DRAFT_TTL_HOURS.

As long as an application has not yet been transferred to Flowwer (usually within a few minutes after submission), the account cannot be deleted. The deletion dialog will indicate this in such cases. Applications already transferred to Flowwer will continue to be processed there.

6. Your Rights

• Access: Via "My Applications" you can view all application data stored for your account. Bank details are only shown as the last digits.
• Correction: Applications cannot be edited after submission. If an application is incorrect, you can submit a new application.
• Deletion: You can delete your account completely at any time (see section 5).
• Restriction of processing: You have the right to request restriction of processing of your personal data under the legal conditions.
• Data portability: Where applicable, you have the right to receive the data concerning you in a structured, commonly used, and machine-readable format.
• Objection: You have the right to object to the processing of personal data concerning you at any time for reasons arising from your particular situation.

To exercise your rights, you can contact the responsible party named above at any time.

7. Backups

PostgreSQL backups and write-ahead logs may contain deleted data until they are rotated. The retention period is chosen to meet data protection requirements (recommendation: no longer than 30 days). Application logs do not contain personal data, but do contain technical IDs and timestamps; their retention is also limited.

Last updated: October 2026