Privacy Policy

Information on the processing of personal data in connection with the operation of the library management system (FOLIO) and the user catalog (Vufind) of the University Library of Regensburg

Current version of 1 July 2025

With this document, the University of Regensburg fulfils its obligation to provide information in accordance with Art. 13 GDPR for the above mentioned processing of personal data.

1. Responsible Party

The responsibility for the processing of personal data lies with the University of Regensburg, represented by its president. 

The President
University of Regensburg
93040 Regensburg
Phone 0941 943-2300
Fax 0941 943-3310
Email praesident@ur.de

2. Data Protection Officer

University of Regensburg
The Data Protection Officer
Landshuter Straße 4
93047 Regensburg
Phone 0941 943-5376
Fax 0941 943-5369
Email dsb@ur.de

3. Contact Person for the Library Management System (FOLIO) and User Catalog (Vufind)

André Schüller-Zwierlein
Director of the University Library
University of Regensburg
93040 Regensburg
Telephone 0941 943-3900
Fax 0941 943-5369
Email andre.schueller-zwierlein@ur.de

4. Purpose of the Processing of Personal Data

The library system of the University Library of Regensburg comprises the FOLIO library management system and the library catalog, which is based on VuFind. The FOLIO library management system is used by the University Library of Regensburg to coordinate and perform its essential work and administrative processes. It also includes the management of personal user data in the context of user registration and media use (loans, interlibrary loans, renewals, reservations, fees and reminders, user communication, handling of loss and damage cases). The library catalog (VuFind) enables users to search for literature and order media, as well as to access related services (e.g. viewing the loans registered to their account, creating watch lists, submitting acquisition suggestions). 

In order to facilitate these functions, personal data is collected and processed for the following purposes:

For user administration:

•    Surname, first name(s)
•    Address(es)
•    Date of birth
•    Telephone number (optional)
•    Mobile phone number (optional)
•    Preferred contact method
•    Email address(es)
•    User group
•    Folio ID / user number / RZ account
•    Password (in encrypted form)
•    Account suspensions
•    Status (active/inactive)
•    Expiry date
•    Date of last activity
•    Date of entry
•    Date of last change

In addition to the data in user management, further data is collected and processed depending on the activities of the users. 

For search queries and research:
•    Search history
•    Watch lists

For inventory queries (ordering media for loan):
•    Title
•    Barcode of the medium 
•    Processing status

For loans: 
•    Active loans
•    Loan history (title, barcode, loan date, return date)

For acquisition suggestions:
•    Acquisition suggestions and users who submit the acquisition suggestions

For the management of claims/reminders:
•    Outstanding fees
•    Settled fees
•    Suspended fees
•    Refunded fees 

The library catalog (VuFind) is a web application to which the privacy policy of the University of Regensburg (https://www.uni-regensburg.de/datenschutz/startseite/index.html) applies in the same way as it does for other web applications.

5. Legal Basis for the Processing of Personal Data:

The legal basis for the processing of personal data for the library catalog connected to the FOLIO library management system is Art. 6 (1) e) b) and c) and 32 GDPR with Art. 4 and Art. 5 BayDSG. The data processing is carried out within the scope of the tasks performed by the University Library of Regensburg in accordance with ABOB §2, §3, §4, §5 and §12.

6. Recipients or categories of recipients of personal data:

The library catalog based on VuFind and the FOLIO library management system are provided by the Bavarian State Library by way of order processing and hosted by the Leibniz Supercomputing Centre (LRZ) as a subcontractor of the Bavarian State Library. For the management of reminders issued to users, personal data (name, address, fees) is transferred to the Bavarian State Treasury.

We do not transfer your personal data to third parties other than the institutions mentioned above.

Data may be transferred to third parties on the basis of legal permission in individual cases, such as a transfer of data to law enforcement authorities for the purpose of an investigation of criminal offences under the provisions of the German Code of Criminal Procedure. 

University library staff have access to the personal data necessary for the fulfilment of their task. 

7. Transfers to Third Countries or International Organizations

No transfers are made to third countries or international organizations.

8. Storage Period

Your data will only be stored for as long as is necessary to fulfil the University Library’s obligations in compliance with statutory retention periods.

All data will be deleted upon termination of the user relationship, provided that there are no outstanding transactions (e.g. orders, returns or fees) and all claims have expired or are no longer enforceable, meaning that there is no obligation to retain the data. For students at the University of Regensburg, data will be deleted automatically at the beginning of the following semester if no re-registration has been received. Library accounts of other users with inactive status are deleted after 2 years at the end of the quarter.

Individual data categories are deleted or anonymised earlier:
Data on claims is deleted as soon as there are no overdue media or fees and all claims have expired or are no longer enforceable.
The borrowing history is anonymized after 7 days. 
The inventory query history is anonymized after 7 days.
Anonymization rather than deletion is implemented in order to enable statistical analyses.
Log files are deleted by the LRZ after 7 days.

9. Your Rights as a Data Subject

As data subject, you have the following rights towards the responsible party:
•    Information on the processing of your personal data and a copy of the data in              accordance with Art. 15 GDPR
•    Rectification of your personal data in accordance with Art. 16 GDPR
•    Deletion of your personal data in accordance with Art. 17 GDPR
•    Restriction of processing and objection to the processing of your personal data in        accordance with Art. 18 and 21 GDPR
•    Provision of a copy of your personal data in a structured, commonly used and              machine-readable format, which you can transfer to another responsible party            (data portability)

You have the right to lodge a complaint with the regulatory body. The appropriate regulatory body is: 
The Bavarian State Commissioner for Data Protection, PO Box 221219, 80502 Munich, poststelle@datenschutz-bayern.de.

10. Obligation to Provide Data

You are obliged to provide your data. This obligation arises from Art. 6 (1) e) b) and c) and 32 GDPR with Art. 4 and Art. 5 BayDSG. Processing is carried out within the scope of the tasks performed by the University Library of Regensburg in accordance with ABOB §2, §3, §4, §5 and §12. The University Library of Regensburg requires your data in order to grant you access to the University Library and to provide you with media for loan. If you do not provide the required data, a user card cannot be issued.

11. Automated Decision-making

No automated decision-making takes place when processing your personal data.

12. Further Information

Further information on the processing of your personal data can be found in the data protection regulations of the University of Regensburg at www.uni-regensburg.de/datenschutz. 

We reserve the right to periodically amend this privacy policy to ensure that it always complies with current legal requirements or to reflect changes to our services in the privacy policy, e.g. when introducing new functions and services. The new privacy policy will then apply to future use.