On this page you can register for access via Thoska for one or more doors or extend your access. After confirmation by us, the respective accesses are valid for one semester. Please remember to let us know at least 14 days in advance. We will then check your details and always let you know whether you still have access or not.
Anmeldung für Thoska-Zugang / Registration for Thoska access
"*" indicates required fields
Privacy policy (Englisch version)
After you have filled out the form to register or renew your Thoska account, please read the Terms of Use and Privacy Policy carefully! We will try to explain to you in detail how we handle your data. If you agree to this, you are giving your consent. The data processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Only then are we authorised to process your data for the specified purpose.
If you do not agree to this, please close this page. There are therefore no mutual obligations.
As with the mechanical keys, you will need to provide personal details if you want to gain access to the M18. These are as follows:
- Name
- Email address (we prefer university email),
- your telephone number,
- your affiliation to an initiative/department or student council,
and - if necessary – a reason why you are receiving access from us if you are not an honorary member of an M18 institution (information is provided externally by us and is only a note to your data). In this case, we ask for further communication.
- We also store the ID number and the expiry date of your Thoska. This data will be read when you visit our office to register. The hardware and software do not read any other data.
We store your data on our server via Nextcloud. Only a selected officer from the Infrastructure department and the StuKo management have access to the data you provide. These people are listed below and will be changed if you change.
The question of ‘why’?
We store the data used to identify the Thoska cards. The system makes a comparison with the ID number stored on the card and compares this information with our database on our server. The server gives the card access to the locking system or denies it.
We have no interest in checking who enters and leaves the M18 every day! This is none of our business – also because the protection of your data is very important to us and has recently been further expanded. However, should there be any criminal offences committed in or around our building, the data will help us to identify who might be responsible. In this case, a resolution of the entire StuKo is required to pass this data on to the authorities under investigation. The data will not be passed on without an obvious reason!
The data you provide, as well as your ID number stored on the Thoska, are stored on our server via Nextcloud. These can only be viewed by authorised persons. We assign each person an eleven-digit number. These are arbitrary and are not subject to any logical system. It is therefore not possible to assign them to specific persons or groups of persons.
We use the hardware and software provided by Primion Technology GmbH to read your ID card number. This is saved via the software with our server and stored with the eleven-digit number. External persons cannot do anything with either data and assign this information to persons or groups of persons.
The data is stored on our server for the duration of use (access to one of the M18 doors). As there is no legal retention period, we are obliged to delete or anonymise the data from our server immediately after you leave an M18 institution. In order to comply with data protection regulations, we therefore ask you to notify us as soon as possible (preferably by e-mail to schluesselverwaltung@m18.uni-weimar.de). We undertake to delete your data from our server immediately, but at the latest by the third working day after receipt of your e-mail.
If we do not receive any notification from you, your account will remain active until the end of the semester and we are only then obliged to delete your data. We therefore ask for your co-operation. Thank you very much.
As soon as you have submitted your data, it will be processed in accordance with the provisions of the GDPR (Art. 6 para. 1 lit. b and f). Two emails will be sent:
Email to the Infrastructure department
This email is sent to the Infrastructure Unit, which is responsible for data and key management and for managing your access as part of an order processing contract in accordance with Art. 28 GDPR. The email contains all the data you have entered on this page.
Email to the StuKo institution
A second email will be sent to your responsible StuKo institution. This will only contain your first name and surname to ensure that the institution can confirm your access. This serves to prevent unauthorised access and constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.
Forwarding and protection of data
Your data will remain within the StuKo and will not be passed on to third parties, unless disclosure is necessary to fulfil legal obligations (Art. 6 para. 1 lit. c GDPR). Such disclosure could, for example, be made to law enforcement authorities if required by law.
All data collected is processed in accordance with the principles of purpose limitation (Art. 5 para. 1 lit. b GDPR) and data minimisation (Art. 5 para. 1 lit. c GDPR). As soon as the purpose of processing no longer applies, the data will be deleted in accordance with Art. 17 GDPR, provided there are no legal retention periods to the contrary.
The software and hardware was developed by the service provider
Primion Technology GmbH
Steinbeisstr. 2-5
72510 Stetten am kalten Markt
and we receive updates from this company as well as maintenance work if required.
This company has no access to the data on our server! All data cannot be viewed by them either online or offline, as there is no active contract between StuKo and the company mentioned. The data is therefore not passed on.
In addition, the data you provide will be anonymised by us. We store your data in our network company Nextcloud and assign each person a number. This is the only information that is stored together with your Thoska on the external software of Primion Technology GmbH! These numbers cannot be assigned to specific persons or groups of persons and are used for additional protection of your data. In this way we try to ensure that data leaks or other malware that could attack the software are prevented from passing on your data to third parties!
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller, subject to statutory provisions that restrict these rights:
1. Right to information
In accordance with Art. 15 GDPR, you can request information from the controller as to whether and which of your personal data is being processed.
2. Right to rectification
You have a right to rectification and/or completion of your personal data in accordance with Art. 16 GDPR if they are incorrect or incomplete. The controller must carry out the rectification without undue delay.
3. Right to restriction and erasure of processing
You also have the right to restriction (Art. 18 GDPR) or erasure (Art. 17 GDPR) of your personal data. Please note that the use of your Thoska for our locking system will no longer work.
4. Right to information
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged under Art. 19 GDPR to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be informed of these recipients by the controller.
5. Right to data portability
If the data processing is based on your consent or on a contract, you have the right to transfer your data in accordance with Art. 20 GDPR.
6. Right to object
If the data processing is based on Art. 6 para. 1 lit. e GDPR, you have the right to object to the processing of your personal data at any time.
7. Right to revoke the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
8. Automated decision-making in individual cases, including profiling
Profiling does not take place.
9. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Competent supervisory authority:
Thuringian Ministry of Economic Affairs, Science and Digital Society
Max-Reger-Straße 4-8
99096 Erfurt
The controller pursuant to Art. 4 No. 7 GDPR is responsible for the processing of personal data:
The Executive Board of the Student Convention of the Bauhaus-Universität Weimar
Marienstraße 18, 99423 Weimar
Telephone: +49 3643 58 30 19
E-mail: stuko-vorstand@uni-weimar.de
The StuKo Executive Board remains legally responsible and has delegated data processing to the management and the Infrastructure Department in accordance with Art. 29 GDPR.
Management of the Student Convention of the Bauhaus-Universität Weimar
Simone Braun
Phone: +49 3643 58 30 19
E-mail: simone.braun@uni-weimar.de
Infrastructure Department
Phone: +49 3643 58 30 34
E-mail: infrastruktur@m18.uni-weimar.de
You can find the current responsible persons here.
The operational implementation of data processing has been delegated to the responsible institutions. The team acts under the strict instructions of the StuKo Executive Board in accordance with Art. 29 GDPR. Responsibility under data protection law remains with the StuKo Executive Board, which remains responsible for compliance with the requirements of the GDPR.
Processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR (consent of the data subject) and Art. 6 para. 1 lit. b GDPR (fulfilment of a contract, if relevant).
If you have any questions, comments, problems or wish to assert your rights, they are the right people to contact.
If you wish to lodge a complaint, you have the right to contact the responsible supervisory authority at any time.
Responsible supervisory authority of the StuKo:
Thuringian Ministry of Economic Affairs, Science and Digital Society
Max-Reger-Straße 4-8
99096 Erfurt
Terms of use and frequently asked questions:
Each initiative and each department may appoint two people who will be granted access to the M18 with their Thoska. Each FachschaftsRat may appoint one person in addition to its StuKo board. It does not matter how many doors you want to get access to.
There are internally discussed exceptions and in individual cases a temporary deviation from this rule is possible. Simply contact my infrastructure department or the StuKo management. We are always open to your enquiries.
You must be a member of an M18 institution (initiatives, departments, student councils) and provide us with credible evidence that you need access to the M18. As a rule, the use of a letterbox on the upper floor of the building is sufficient.
We no longer grant access to people who no longer have any (voluntary) connection to the M18. In other words, you will automatically lose your access authorisation at the end of the semester in which you finish your voluntary work. You can of course continue to use your Thoska for everyday university use.
Der oder die Nutzer*in erhält semesterweise einen ganztägigen Zugang zu den vereinbarten Türen. Diese Zugangsberechtigung muss immer zum nächsten Semesterbeginn, spätestens jedoch zwei Wochen nach Semesterbeginn seinen Zugang beim StuKo verlängern, da sonst der Zutritt automatisch vom System entzogen wird. Eine Verlängerung erfolgt über das oben stehende Formular.
Please note the following points
- Only members of your own initiative, your own department or your own student representation may pass on the Thoska for the purpose of opening and closing the doors in the M18. Passing it on to external third parties is not permitted!
- If the Thoska is lost, the StuKo must be informed in addition to the university. In this case, please inform us as soon as possible so that unauthorised third parties cannot gain access to the building.
- When leaving the institution or leaving office, the StuKo should also be informed. The Thoska can then be removed from the system.
- For all matters you can contact us at any time at the following e-mail: schluesselverwaltung@m18.uni-weimar.de
- The misuse or attempt to manipulate the locking system is expressly prohibited!
Your enquiry will now be forwarded to your institution, which must confirm your access in its name. This may take a few days. As soon as we have the confirmation, we will enter your data into our system or renew your access!
If you are registering your Thoska with us for access for the first time, we will need your Thoska card so that we can read out your ID number. We will also send you a document, which you should sign digitally if possible and send back to us as a PDF. If you do not have the option of signing digitally, you can also do this in analogue form at our office :)
If you have any further questions, please contact us at schluesselverwaltung@m18.uni-weimar.de
