Information on Processing Your Personal Data Within the Scope of the “Survey on the Role of LLMs in Software Development (SURV-LLM)” study, Pursuant to Art. 13 of General Data Protection Regulation (GDPR)
Date of current version: 1st September 2025/ Version 1.0
This data privacy policy describes how your personal data is processed within the scope of the SURV-LLM studies. By issuing this policy, Paderborn University is complying with its duties to provide information pursuant to Art. 13 of the EU General Data Protection Regulation (hereinafter referred to as GDPR). With regard to the terms used in the following, e.g. “personal data”, “processing”, “controller”, etc., please refer to the definitions in Art. 4 of the GDPR.
1. Name and Contact Details
Paderborn University, which is a public law entity with legal capacity and is supported by the State of North Rhine-Westphalia, is responsible for the processing of your personal data within the scope of the aforementioned processing activity(ies). The University is represented by its President.
1.1 Name and contact Details of the controller
Paderborn University
Warburger Str. 100
33098 Paderborn
Tel.: 05251 / 60 – 0
Web: https://www.uni-paderborn.de/en
1.2 Contact Persons for SURV-LLM
Jun.-Prof. Dr. Mohamed Soliman
1.3 Contact details of data protection officer
The Data Protection Officer of Paderborn University can be reached by postal mail at the address of the controller listed above or as follows:
Email: datenschutz(at)uni-paderborn(dot)de
Tel.: +49 (0)5251 60-4444
Web: https://www.uni-paderborn.de/datenschutz/
2. Categories, Purposes and Legal Bases of the Processing of Your Personal Data
Within the scope of the SURV-LLM studies, data controller will process your personal data as follows for the following purposes and in line with the legal bases listed below:
For survey questionnaire
Technical background in questionnaire
Participants will be recruited via Prolific and social media
The studies will be conducted via LimeSurvey.
Note: LimeSurvey is hosted by Paderborn University.
Subsequent presentations and publications will only be made with anonymised data.
3. Recipients of Your Personal Data
In principle, data controller will not transfer your personal data that is processed within the scope of the SURV-LLM studies to third parties, subject to the data processing described below. If (technical) service providers have access to personal data, in case of need the data is processed on the basis of an arrangement in accordance with Art. 28 GDPR. In the event data is processed with other controllers, in case of need the data is processed on the basis of an arrangement in accordance with Art. 26 GDPR.
4. Transferring Your Personal Data Outside of the EU
In principle, no personal data is transferred to countries outside the European Economic Area and associated countries (no “third country transfer”). If such a transfer becomes necessary, the data controller will inform you of this separately.
5. Duration of Storage of Your Personal Data
Your personal data that process within the scope of the SURV-LLM studies from data controller as described above will generally be deleted as soon as it is no longer required for the purposes for which it was collected, i.e. we will delete it immediately after the study evaluation has concluded, latest by the end of 2026.
If and to the extent that the processing of your personal data is based on your consent, your data will only be stored until the time you withdraw your consent, unless there is also another legal ground for the processing (Art. 17 (1) (b) GDPR).
6. Your Rights as a Data Subject
As a data subject, you may assert the rights granted to you by the GDPR at any time; these are:
- the right to know if and which of your personal data is being processed in accordance with Art. 15 GDPR, Section 12 DSG NRW;
- the right to have any inaccurate personal data about you rectified or incomplete data completed in accordance with Art. 16 GDPR;
- the right to have your personal data deleted (erased) in accordance with Art.17 GDPR, Section 10 DSG NRW;
- the right to have the data processing restricted in accordance with Art. 18 GDPR;
- the right to transmit any data about you in accordance with Art. 20 GDPR.
7. Withdrawal of Consent
Any consent that may have been granted can be revoked (withdrawn) in whole or in part at any time without providing a reason. The withdrawal of consent shall not affect the lawfulness of processing based on the consent before its withdrawal (Art. 7 (3) GDPR). If you revoke your consent, Paderborn University will not be allowed to continue the data processing based on this consent in the future. If you want to revoke your consent in whole or in part, all you need to do is send an e-mail to mohamed.soliman@uni-paderborn.de
8. Right to Lodge a Complaint
In addition to the aforementioned rights, you also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) if you believe that the processing of personal data relating to you infringes the requirements of data protection law for example, the complaint can be submitted to the state commissioner responsible for overseeing the university: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany; phone: +49 (0)211 38424-0, e-mail: poststelle@ldi.nrw.de
9. Automated Decision-making / Profiling
Data controller does not use automated decision making or profiling according to Art. 22 GDPR.
10. Validity of Data Privacy Policy
Data controller reserves the right to amend this data privacy policy in order to revise it in compliance with any changes in relevant laws or regulations or to better serve your needs. The valid and applicable version of this data privacy policy is the latest version published by Paderborn University. Therefore, please note the current version number of the data privacy policy.
