In short

• No account, no advertising, no tracking: Betula uses no analytics services and sets no cookies that recognise you. betula.app serves its fonts, icons and scripts itself; nothing is loaded from other servers.
• Your saved modules, your timetable and “My programme” are kept only in your browser.
• The server logs every request with its IP address, to run Betula and protect it from abuse, and deletes the entries after 7 days.
• Betula shows the names of lecturers that BTU publishes in its module descriptions.

Controller

The controller for the processing of personal data on betula.app within the meaning of the General Data Protection Regulation (GDPR; in German, DSGVO) is:

E-mail: info@betula.app

Where Betula runs

Betula runs on a rented server of Contabo GmbH, Welfenstraße 22, 81541 München, in a data centre in Germany. Everything that arises during a visit is processed there, including the logs and their analysis; no other services are involved.

Contabo provides the server and processes the data on it only on my behalf; there is a data processing agreement for this under Art. 28 GDPR (DSGVO). The connection between your browser and Betula is encrypted (HTTPS).

Access log

With every request, your browser sends information without which the server cannot deliver a page. The server records every request in an access log.

What data

• your IP address and the port of your device,
• date and time,
• the address requested, including the part after the “?”, which holds such things as search terms and filters,
• the kind of request and connection, the status code, size and duration of the response,
• your browser's identifier (user agent).

The page you came from, cookies and all other information from your browser are not recorded.

Purpose

To run Betula reliably and securely, to find errors, and to detect and fend off attacks and abuse. For this, the server also counts how many requests come from one IP address in a short time, and slows them down when there are too many; this count is kept only in memory.

Legal basis

Art. 6(1)(f) GDPR (DSGVO). My legitimate interest is secure and functioning operation.

Retention period

The entries are kept in the server's system log and in a log analysis on the same server, and are deleted automatically in both places after 7 days.

In addition, the application keeps a log of its own: which page was requested when, without the part after the “?”, with status code and duration, but without IP address and without browser identifier. In the log analysis it is deleted after 30 days.

Storage in your browser

Much of what you do in Betula happens directly in your browser. For this to work, Betula stores on your device, in the browser's storage (Local Storage, Session Storage, IndexedDB and Cache Storage):

• your saved modules,
• your timetable with planned modules, placeholders, what you have hidden and the dates you have selected, your saved plans and the addresses of your calendar subscriptions,
• “My programme” with study track, start of studies and location,
• settings, such as the language (on your first visit, your browser's), light or dark, the width of the sidebars and what “Fits my timetable” compares,
• for the current browser session, where you last were in each area and how far you had scrolled,
• a copy of the catalogue, the app's files and up to 60 recently visited pages, so that Betula starts quickly and also works offline.

All of this is kept only on your device; I cannot see it, and there are no accounts. Another device has its own data. The link that takes your saved modules to another device carries them after the “#”, and no browser sends that part of an address to a server.

Only what is in the address of a page reaches the server, when you open, reload or share it. An address says what is being shown, but never what is among your saved modules or in your timetable: for example the degree programme the catalogue is filtered by (also “My programme”, if you open the catalogue through it), the module open beside your saved modules or your timetable, or the semester and placeholder you are looking for modules for. Such addresses are in the access log like all others. The server only gets your timetable if you subscribe to it as a calendar, or pass on a link to share it and that link is opened.

Storing this is necessary for the functions you use and therefore requires no consent (§ 25(2) no. 2 TDDDG). You can delete all of it at any time in your browser's settings by deleting the site data of betula.app.

Calendar subscription

You can subscribe to your timetable as a calendar. For this, your calendar service gets an address that begins with betula.app/calendar/. As a code, it contains the semester, the planned modules, the degree programme whose module abbreviations the entries use, the location and what you have hidden or selected.

How it works

Your calendar, for example from Apple, Google or Microsoft, fetches the address regularly, depending on the service from your device or from the provider's servers. Betula creates the calendar anew from the code and the current dates on every request and stores nothing for it.

Logs

The access log records every request with the full address and the IP address it comes from; like everything there, it is deleted after 7 days. The application's log does not contain the code.

Legal basis

Art. 6(1)(f) GDPR (DSGVO). My legitimate interest is offering you the subscription you set up yourself.

Disclosure

If you choose “Google Calendar” or “Outlook”, your browser opens that service's page and hands it the address; from then on, its privacy policy applies. Betula itself passes nothing on. Anyone who knows the address can fetch the calendar too: only give it to people you want to show your plan to.

Ending it

Remove the calendar in your calendar service; then the address is no longer fetched.

A downloaded .ics file is created in your browser and does not reach the server.

Sharing your timetable

You can copy a link to your timetable and pass it on. It begins with betula.app/studyplan?share= and contains, as a code, the semester, the planned modules in their order and the degree programme whose module abbreviations are used; it does not contain what you have hidden or selected.

How it works

Whoever opens the link sees the modules and can add them to their own timetable. If you send it via a messenger or a social network, that service fetches the page and its preview image, which shows the modules, depending on the service from your device or from the provider's servers. Betula creates the page and the image from the code and the current data on every request and stores nothing for it.

Logs

The access log records every request with the full address and the IP address it comes from; like everything there, it is deleted after 7 days. The application's log does not contain the code.

Legal basis

Art. 6(1)(f) GDPR (DSGVO). My legitimate interest is offering you the sharing you start yourself.

Disclosure

Betula itself passes nothing on. Anyone who knows the link sees the modules: only give it to people you want to show your plan to.

Ending it

A link that has been passed on cannot be taken back. But it only shows what was planned when it was copied; what you change afterwards does not reach it.

Cookies

Betula sets no cookies, with one exception: while Betula can only be reached with a password, for example during a closed test, the server sets a cookie named betula_access once the correct password has been entered.

It contains only when your access ends, and a signature by which the server recognises that it issued the cookie itself; nothing is stored for it. It is valid for 90 days, is sent to Betula only over encrypted connections and cannot be read by scripts. Because it is strictly necessary for the access you asked for, it requires no consent (§ 25(2) no. 2 TDDDG).

E-mail

If you write me an e-mail, I process your e-mail address, your name if you give it, and your message in order to answer you. The legal basis is Art. 6(1)(f) GDPR (DSGVO); my legitimate interest is answering enquiries. The messages are kept with my e-mail provider. I delete them as soon as your matter has been dealt with and they are no longer needed.

Names of lecturers

BTU's module descriptions and course catalogue name who is responsible for a module and who teaches a course. Betula takes this information and shows it with the modules and their dates; the catalogue can be filtered by it. The following information is addressed to the persons named, as Art. 14 GDPR (DSGVO) requires.

What data

Name, academic title and role (for example responsible or teaching), each with the module or the course.

Source

the publicly accessible pages of BTU Cottbus-Senftenberg, above all the module descriptions and the course catalogue in the QIS portal.

Purpose

Students should be able to see in one place who is responsible for a module and who teaches it, just as BTU publishes it itself.

Legal basis

Art. 6(1)(f) GDPR (DSGVO). The legitimate interest is making this information published by BTU accessible in a clear and searchable way. Betula shows it in the same context as BTU and adds nothing.

Recipients

everyone who visits Betula; with the catalogue, the information also ends up in the copy in their browser. The pages of the modules may be indexed by search engines.

Retention period

Betula builds its data from BTU's current state every time it reads it in. If BTU changes or removes an item, it changes or disappears here too with the next update of the data. Dates are deleted one month after their last occurrence, copies of pages BTU no longer lists after seven days.

Objection

You can object to the processing at any time under Art. 21 GDPR (DSGVO); an e-mail to info@betula.app is enough. If any information is wrong, please let me know.

Disclosure and links

I do not sell your data and do not pass it on. Others only receive it as described above: Contabo as the operator of the server, my e-mail provider when you write to me, and your calendar service when you set up a subscription. Betula itself transfers no data to countries outside the EU; for a calendar service you choose, its privacy policy applies. There are no automated decisions and no profiles.

You do not have to provide any data to use Betula. Without the information your browser sends with every request, such as the IP address, the pages cannot be delivered, though.

Betula links to the originals at BTU and to other pages. If you follow such a link, the other site only learns that you come from betula.app, not from which page; from then on, its privacy policy applies.

Your rights

Under the GDPR (DSGVO), you have the right of access to your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17) and to restriction of processing (Art. 18). You can object to processing based on Art. 6(1)(f) GDPR (DSGVO) – which is all the processing described here – on grounds relating to your particular situation (Art. 21). An informal e-mail to info@betula.app is enough.

Because Betula has no accounts, I can only find entries in the access log if you tell me from which IP address and when you visited Betula; see Art. 11 GDPR (DSGVO).

You also have the right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR (DSGVO), for example with the one responsible for Brandenburg: