How we process your personal data in our surveys

Business Academy Aarhus is the data controller for the surveys and the subsequent processing of personal data.

If you have any questions about the processing of your personal data, you are welcome to contact us at persondata@eaaa.dk

You can also contact our Data Protection Officer through the joint DPO function:

E-mail: gdpr@efif.dk
Phone: +45 8936 3280
Address: Sønderhøj 28, 8260 Viby J, Denmark

We use the results to ensure the quality of our programmes and improve what we offer students at group, programme and institutional level. We may link responses from the Start of Studies Survey and the Internship Evaluation Survey with relevant study data, such as drop-out, exam attempts and marks, to monitor students’ progress and the quality of our programmes over time.

The Start of Studies Survey asks about your first weeks on your programme. Your responses help us assess and improve the activities, support, and academic and social environment at the start of your studies.

The Internship Evaluation Survey for students asks about your preparation, tasks and experiences during your internship, the supervision you receive, and your future plans. We use the responses to improve internships and our cooperation with internship companies. We may link your responses with those of the internship company if this is necessary to examine a specific internship. These experiences may inform our assessment of future cooperation with the company.

We process your responses and necessary data from our student administration systems, such as your name, student email address and programme, so that we can invite the relevant students and analyse the responses.

Participation is voluntary. You can always skip questions about sensitive matters. Free-text fields are also optional. Wherever possible, please avoid including names or other information that could identify you or anyone else in free-text fields.

If we need to link data from systems that do not share a less intrusive identifier, we may temporarily use your CPR number (Danish civil registration number) during the technical transfer. CPR numbers are not transferred to our analysis databases or reports.

Business Academy Aarhus processes general personal data as part of our public task of ensuring and developing the quality of our programmes. The legal basis is Article 6(1)(e) of the General Data Protection Regulation (GDPR). This task is described, among other provisions, in Annex 1, Criterion I, of the Danish Executive Order on Accreditation, which requires educational institutions to continuously monitor and assess the quality of their programmes, including on the basis of student evaluations.

Some surveys include questions about sensitive personal data. The Start of Studies Survey and the Internship Evaluation Survey do not include such questions, but sensitive personal data may appear in free-text responses. In other surveys, we may, for example, ask about disabilities to examine whether particular groups experience barriers in the learning environment. We may also ask about offensive behaviour to identify areas for improvement. We only process sensitive personal data when it is necessary for a specific quality assurance purpose, and we also aim to comply with the principle of data minimisation under Article 5(1) of the GDPR.

The legal basis is therefore also Article 9(2)(g) of the GDPR, read in conjunction with section 7(4) of the Danish Data Protection Act. Any necessary processing of CPR numbers is carried out under section 11(1) of the Danish Data Protection Act.

We collect responses in SurveyXact. When we transfer them to our databases, we only include necessary data and protect the data used to link responses. Only members of the analysis team who need access for their work, a maximum of three people, have access to the relevant data.

For a limited period, we may retain responses with a protected linkage key so that relevant surveys can be linked. Access is strictly restricted. Data used for standard reports and dashboards does not contain CPR numbers, email addresses or other direct identifiers.

We restrict access to free-text responses and review them to anonymise information that could identify individuals. To protect your personal data, we do not use SurveyXact’s AI function to summarise free-text responses. All AI plugins in SurveyXact are disabled.

When a survey with a fixed closing date has ended, the necessary data is transferred to our databases and deleted from SurveyXact no later than one month after the survey closes. For the Internship Evaluation Survey, the data is deleted from SurveyXact no later than one month after the end of the internship semester.

While you are a student, we may retain your responses with a protected linkage key (in pseudonymised form) so that relevant data can be linked. All data, including free-text responses and any means of linking the data to you, is anonymised no later than three months after your graduation. Anonymised analysis data is used to monitor developments at programme level and is deleted no later than the following deadlines, calculated from graduation:

• 12 years: The Student Environment Survey, which is conducted every three years.

• 5 years: The Internship Evaluation Survey and lecturer evaluations.

• 8 years: The Start of Studies Survey and Danmarks Studieundersøgelse (the national student survey), which are conducted every two years.

Once the data is fully anonymised, it can no longer be linked to you. Your rights continue to apply to any other personal data we retain about you.

SurveyXact and any other service providers process personal data in accordance with the data processing agreement between SurveyXact and Business Academy Aarhus.

We share analysis results with the employees and managers who use them in our quality assurance work. Results are shown at group level. Groups with fewer than five responses are not shown. We also restrict other views where individuals could be identified, and we manually check the filtering options before publishing the results.

For as long as we process data that can be linked to you, you have the following rights:

• Right of access - You can ask to see what personal data we process about you.

• Right to rectification - You can have inaccurate or incorrect personal data corrected.

• Right to erasure (the right to be forgotten) - In certain circumstances, you can ask to have your personal data deleted before our normal deletion deadline.

• Right to restriction of processing - In certain circumstances, you have the right to have the processing of your personal data restricted.

• Right to object - In certain circumstances, you can object to our cancellation or processing of your personal data.

• Right to data portability - In certain circumstances, you can ask to receive your personal data in a structured, machine-readable format.

Your rights depend on the specific circumstances. Please write to persondata@eaaa.dk and explain what your enquiry is about. We may ask for the information needed to confirm your identity. You will normally receive a response within one month. Once the data is fully anonymised, we can no longer locate your data or act on a request relating to it.

You can read more about your rights at datatilsynet.dk/english

You can also submit a complaint to the Danish Data Protection Agency:

Danish Data Protection Agency
E-mail: dt@datatilsynet.dk
Phone: +45 3319 3200
Address: Carl Jacobsens Vej 35, 2500 Valby, Denmark