Privacy Policy

Last updated: October 2026

1. Controller

Offenburg University of Applied Sciences
Badstraße 24
77652 Offenburg
Email: info@hs-offenburg.de

2. Data protection officer

Data protection officer at Offenburg University of Applied Sciences
Badstraße 24
77652 Offenburg
Email: datenschutz@hs-offenburg.de

3. Purpose of the application

Digital Labs is a learning platform provided by Offenburg University of Applied Sciences. It enables students to conduct virtual laboratory experiments in physics and engineering and is intended solely for teaching and learning as part of their studies.

The platform is part of the joint project SHELLS (Shared Excellence – Laboratory Learning Spaces 4.0), funded by the Foundation for Innovation in Higher Education .

4. Legal basis for processing

Personal data is processed pursuant to Article 6(1)(e) GDPR (performance of a task carried out in the public interest), in conjunction with Section 4 of the Baden-Württemberg State Data Protection Act and Section 12 of the Baden-Württemberg State Higher Education Act (the responsibilities of higher education institutions in research and teaching).

5. Data collected

This application collects and processes the following data:

  • Name: Entered during the experiment and used on the PDF report. For a saved workspace, the name remains on the platform server for its retention period.
  • Measurement data: Entered or simulated measurements and progress are processed within the session. Larger session data is held in server-side working storage; orphaned entries are removed at application startup after the configured retention period (seven days by default).
  • Saved workspaces: When you explicitly save, your name, actual task values, entries, answers, Python code, progress and any included measurement files, diagrams and analysis videos are stored on the platform server for 48 hours. Saving again starts a new 48-hour period. Loading alone does not renew it. Anyone who knows the randomly assigned token can open the workspace.
  • Abuse prevention for saved workspaces: To limit excessive requests, short-lived counters are kept under a pseudonym of the IP source derived using the app secret. The IP address itself is not stored in these counters. Counters expire within one hour and are cleaned up every minute while the server is running, or at the next startup after a shutdown.
  • Result PDFs from client-side experiments: To create the PDF, the currently visible measurements and selected graphics are transmitted to the platform server once and processed into the PDF immediately. For video analyses, a selected graphic can contain the current video frame. These result data and graphics are not stored separately on the server.
  • Verification data: When a PDF is exported, a verification token is generated containing the name, experiment title, date and assigned parameters. This token is stored on the server and is used to verify the authenticity of the report.
  • Experiment data in the laboratory database: In the materials testing laboratory, teaching staff can permanently store completed tensile tests in an internal university database protected by a password. Only technical data (testing machine, specimen, measurement series and material properties) is stored; no personal data is included.

6. Cookies and local storage in the browser

This application uses only one strictly necessary session cookie to maintain the experiment workflow across multiple page views. After university staff sign in to the internal area, one additional strictly necessary cookie is set (valid for 30 days). The application uses no tracking cookies, analytics tools or third-party cookies.

To operate the application, it also stores interface and working states in the browser's session storage (sessionStorage) — for example tour progress, completed exercises, entered answers, recorded measurement series and the last active view. This storage happens exclusively in the browser, is discarded when the browser is closed and can be deleted at any time via the browser settings.

7. Data sharing

There is no disclosure of personal data to third parties. Verification tokens remain on servers operated by Offenburg University of Applied Sciences.

8. Storage period

  • Session data in the browser: discarded when the tab is closed. Server-side working copies are subject to the session cleanup described above.
  • Saved workspaces: The token becomes invalid after 48 hours. While the server is running, expired workspaces are deleted every minute; after a shutdown, deletion takes place at the next startup. Working copies that have already been loaded remain session data.
  • Verification tokens: stored on the server and expire after 365 days.
  • Experiment data in the laboratory database: stored until deleted by laboratory staff (technical data only, with no link to an individual).

9. External Resources (CDN)

This application loads external resources through content delivery networks (CDNs) to display the experiments. Your IP address is necessarily transmitted to the respective provider:

  • Google Fonts (Google Ireland Limited, Ireland) – Fonts
  • Bootstrap CDN/MaxCDN – CSS Framework
  • jQuery, Popper.js, Font Awesome (Cloudflare/jsDelivr) – JavaScript and icon libraries
  • Chart.js, KaTeX, JSZip (jsDelivr/cdnjs) – Visualization, formula and export libraries
  • VTK.js (Kitware/jsDelivr) – 3D visualization

Some of these providers (particularly Google) may transfer data to third countries (such as the United States). Such transfers are based on standard contractual clauses pursuant to Article 46 GDPR or on the EU–US Data Privacy Framework.

10. Your Rights

You have the right to:

  • Access to the personal data stored about you (Article 15 GDPR)
  • Rectification of inaccurate data (Article 16 GDPR)
  • Erasure of your data (Article 17 GDPR)
  • Restriction of processing (Article 18 GDPR)
  • Objection to processing (Article 21 GDPR)
  • Data portability (Article 20 GDPR)

11. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint about the processing of your personal data with a data protection supervisory authority. The competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de