ISMOS
Data retention summary
This summary shows the default categories and purposes for retaining user data. Certain areas may have more specific categories and purposes than those listed here.
Site
Category
- Technical and activity data
Logs, IP, sessions and browser information.
Purpose
- Security and operation
Keeping the platform secure, preventing abuse and troubleshooting.
- Retention period
- 1 years
| Lawful bases | |
|---|---|
| Legitimate interests (GDPR Art. 6.1(f)) | Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child |
Users
Category
- Identification and contact
Name, email address, username, profile information, language and country.
Purpose
- Educational service
Providing user accounts and access to the learning platform.
- Retention period
- 3 years
| Lawful bases | |
|---|---|
| Contract (GDPR Art. 6.1(b)) | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract |
Course categories
Category
- Academic records
Enrolments, course progress, submissions, grades and certificates.
Purpose
- Training and assessment
Delivering courses, tracking progress, assessing work and issuing certificates.
- Retention period
- 5 years
| Lawful bases | |
|---|---|
| Contract (GDPR Art. 6.1(b)) | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract |
| Legal obligation (GDPR Art 6.1(c)) | Processing is necessary for compliance with a legal obligation to which the controller is subject |
Courses
Category
- Academic records
Enrolments, course progress, submissions, grades and certificates.
Purpose
- Training and assessment
Delivering courses, tracking progress, assessing work and issuing certificates.
- Retention period
- 5 years
| Lawful bases | |
|---|---|
| Contract (GDPR Art. 6.1(b)) | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract |
| Legal obligation (GDPR Art 6.1(c)) | Processing is necessary for compliance with a legal obligation to which the controller is subject |
Activity modules
Category
- User-generated content
Forum posts, messages, comments and files uploaded by the user.
Purpose
- Training and assessment
Delivering courses, tracking progress, assessing work and issuing certificates.
- Retention period
- 5 years
| Lawful bases | |
|---|---|
| Contract (GDPR Art. 6.1(b)) | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract |
| Legal obligation (GDPR Art 6.1(c)) | Processing is necessary for compliance with a legal obligation to which the controller is subject |
Blocks
Category
- Technical and activity data
Logs, IP, sessions and browser information.
Purpose
- Security and operation
Keeping the platform secure, preventing abuse and troubleshooting.
- Retention period
- 1 years
| Lawful bases | |
|---|---|
| Legitimate interests (GDPR Art. 6.1(f)) | Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child |
BigBlueButton
Category
- Recordings
Audio and video recordings of live sessions.
Purpose
- Session recording
Recording live sessions so students can review them and, with consent, reuse them as course content.
- Retention period
- 2 years
| Lawful bases | |
|---|---|
| Consent (GDPR Art. 6.1(a)) | The data subject has given consent to the processing of his or her personal data for one or more specific purposes |