A. Privacy policy for the online survey

A. Privacy Policy for the online survey Privacy policy regarding the research “Using a teaching-assistant humanoid robot for young students learning English" This document is to be understood as a non-binding template for data processing by Chemnitz University of Technology (the responsible party) for scientific or historical research purposes. In any case, its use should be coordinated in advance with the data protection officer at Chemnitz University of Technology, as more or less extensive adjustments will need to be made prior to use. Regularly occurring adjustments have been marked in yellow so that the corresponding passages can be deleted or amended in the final declaration. Please read the document carefully and thoroughly, and check whether the information is accurate and has actually already been implemented. We are delighted that you are willing to provide us with your personal data for the purpose of conducting scientific or historical research. For this reason, it is very important to us to inform you fairly and transparently about data processing so that you are aware of the processing operations and the purposes for which they are carried out. In addition, we would also like to inform you about the risks, regulations, guarantees, and rights associated with the processing of personal data and explain how you can assert your rights in this regard. I. Name and Contact Details of the Controller Technische Universität Chemnitz represented by the Rector: Prof. Dr. Gerd Strohmeier Straße der Nationen 62 09111 Chemnitz, Deutschland E-Mail: rektor@tu-chemnitz.de Telefon: +49 371 531-10000 Telefax: +49 371 531-10009 Web: www.tu-chemnitz.de. If you have any questions regarding this privacy policy or the associated data processing procedures, or if you wish to make use of the rights granted to you, you are welcome to contact us at any time: Chemnitz University of Technology Mina Raeisi Nafchi Technical University of Chemnitz, Reichenhainerstr. 90 09126 Chemnitz, Deutschland E-Mail: mina.raeisi-nafchi@s2022.tu-chemnitz.de Phone: 15732364185 Web: https://www.tu-chemnitz.de/phil/english/sections/tesol/raeisi.php II. Contact details of the data protection office Andreas Tews (ecoprotec GmbH Paderborn) Data Protection Officer of Chemnitz University of Technology Straße der Nationen 62 09111 Chemnitz, Deutschland E-Mail: datenschutzbeauftragter@tu-chemnitz.de, Phone: +49 5251 87788-313, Web: www.tu-chemnitz.de/rektorat/dsb/ III. General information on data processing 1. Scope and purposes of personal data processing The processing of personal data describes any operation or set of operations performed with or without the aid of automated processes in connection with personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. We process personal data only to the extent necessary for the conduct of scientific or historical research. The processing of personal data for scientific research purposes is interpreted broadly and includes, for example, processing for technological development and demonstration, basic research, applied research, and privately funded research (Recital 159 of the GDPR). However, in many cases, the purpose of processing personal data for scientific research purposes cannot be fully specified at the time the personal data is collected (Recital 33 of the GDPR). Therefore, you are permitted to give your consent for specific areas of scientific research, which is of course carried out in compliance with the recognized ethical standards of scientific research. As part of the declaration of consent, you will have the opportunity to give your consent only for specific areas of research or parts of research projects to the extent permitted by the purpose pursued. The processing of personal data is regularly carried out only after the prior (express) consent of the data subject, unless, in exceptional cases, it is not possible to obtain prior consent for practical reasons and the processing of the data is permitted by other legal provisions. This applies in particular to the processing of special categories of personal data within the meaning of Art. 9 (1) GDPR, i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person's sex life or sexual orientation, whereby the use of the term “racial origin” does not imply approval of theories that attempt to prove the existence of different human races (Recital 51 of the GDPR, p. 2). Collection and Processing of Personal Data in the Context of the Experimental Study In order to carry out our project “Using a teaching-assistant humanoid robot for young students learning English” in the context of the experimental study, including interactions between students and the humanoid robot as well as interviews with the children and their legal guardians, the following categories of personal data are collected and processed: Data collected during the experiment and interviews Observations of the child’s interaction with the humanoid robot (behavioral responses, engagement, task performance) Children’s responses in structured tasks or exercises during the experiment Answers given during interviews with children and/or legal guardians English proficiency level School grade or class level Age Gender Mother tongue Previous experience with robots or educational technology Relevant learning difficulties or educational needs Background information relevant to language learning (e.g., stays in English-speaking countries) This personal data is stored securely in our system. It is not combined with unrelated personal data of the participants. All data are processed exclusively for scientific research purposes, in accordance with applicable data protection regulations and ethical standards: Processing of Data from the Experimental Study: Child–Robot Interaction This part of the research involves collecting observational and performance data during children’s interactions with a humanoid robot as a teaching assistant while learning English. Then data will be processed as described below: Recording and coding: Each interaction session may be audio- or video-recorded and later transcribed or summarized. Observation notes and transcripts will be assigned random codes that serve solely as anonymous identifiers, without any information about the participants. The code key linking identities to anonymized data will be stored securely and separately. Anonymization and analysis: Only anonymized, coded data will be analyzed. Any personal identifiers will be removed before analysis. The analysis will focus solely on participants’ behavior, responses, engagement, and learning progress with the humanoid robot, without reference to the identity of the children. Scientific use and ethical compliance: The data will be used exclusively for scientific research purposes in accordance with LASUB, GDPR regulations, and relevant ethical guidelines. Access and confidentiality: The data from interactions will only be viewed and processed by Mina Raeisi, the researcher responsible for the study. Supervisors or authorized members of the ethics committee may access the data under strict confidentiality agreements if necessary. Retention and deletion: All original recordings and transcripts containing personal data will be deleted 5 years after the completion of data collection, in accordance with institutional data-retention regulations. Only anonymized data necessary for transparency and documentation of the research will be retained. All digital files will be stored securely on password-protected devices. Voluntary participation and consent: Participation is entirely voluntary, and legal guardians or their child may withdraw consent at any time without any disadvantage. By signing the Consent Form, legal guardians confirm that they have been informed about the study and agree to the anonymized processing of the collected data. Children will also be informed, in a child-friendly manner, that they may stop participation at any time. Contact: If there are any questions or concerns about the study or the data, participants or their guardians can contact the researcher directly: Mina Raeisi, email address: [mina.raeisi-nafchi@s2022.tu-chemnitz.de], Chemnitz University of Technology. Processing of the Interviews with Children and Their Parents: This part of the research involves collecting qualitative data through interviews with children and, where applicable, their parents regarding their ideas on the use of a humanoid robot as a teaching assistant in English learning on their children. The data will be processed in the further course of the research as described below: Each interview will be audio- or video-recorded and later transcribed. Transcripts will be assigned random codes, which will be used solely as anonymous identifiers without any information about the participants. The code key linking identities to anonymized data will be stored securely and separately. Only anonymized, coded data will be processed and analyzed. Any personal identifiers will be removed before analysis. The analysis will focus solely on participants’ responses, such as perceptions, experiences, and attitudes toward the robot, without reference to the identity of the children or their legal guardians. The data will be used exclusively for scientific purposes in compliance with LASUB regulations and relevant ethical guidelines. The data from the interviews will only be viewed and processed by Mina Raeisi, who is responsible for the research. Supervisors or authorized members of the ethics committee may access the data under strict confidentiality agreements if necessary. Five years after the data collection, all original recordings and transcripts containing personal data will be deleted and only the anonymized data necessary for transparency and documentation of the research will be retained. All digital files will be stored securely on password-protected devices. Participation is entirely voluntary, and the legal guardians or their child may withdraw consent at any time without any disadvantage. By signing the Consent Form, it is confirmed that the legal guardians have been informed about the study and agree to the anonymized processing of the collected data. Children will also be informed before the interview, in a simple and child-friendly manner, that they may stop the interview at any time. If there is any questions or concerns about the study or the data, it is possible to contact the researcher directly. 2. Legal basis for the processing of personal data At this point, reference has been made to essential legal bases, which can/must be supplemented/specified depending on the respective processing purpose. This applies in particular to the processing of particularly sensitive personal data within the meaning of Articles 9 and 10 of the GDPR. a) Consent Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 sentence 1 lit. a) or Art. 9 para. 2 lit. a) GDPR serves as the legal basis. The processing of personal data in this project is based on the informed consent of the parents or legal guardians of the participating students. The data include students’ verbal, behavioral, and performance interactions with the educational robot. Participants may withdraw their consent at any time without any negative consequences for their participation. b) Fulfilment of a legal obligation Where processing of personal data is necessary for compliance with a legal obligation to which the controller is subject, Art. 6 para. 1 sentence 1 lit. c) or Art. 9 para. 2 lit. b) GDPR (labor law, social security law, social protection) serves as the legal basis. Personal data may be stored, for example, if this has been provided for by the European or national legislator in Union regulations, laws, or other provisions to which the controller is subject. c) Vital interests In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d) or Art. 9 para. 2 lit. c) GDPR serves as the legal basis. d) Public interest including scientific or historical research purposes If the processing of personal data is necessary for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes in accordance with Art. 89(1) GDPR, Art. 6(1)(e) GDPR or Art. 9(2)(j) GDPR in conjunction with Section 12 of the Saxon Data Protection Implementation Act (SächsDSDG) as the legal basis. The processing of personal data, including data pursuant to Art. 9(1) GDPR is therefore permissible for scientific or historical research purposes, insofar as this is necessary for the performance of scientific or historical research, in particular if the purpose of the research cannot be achieved by other means or only with disproportionate effort, and if the public interest, in particular the scientific or historical interest in the performance of the research project, outweighs the interest of the data subject in the processing not taking place. We have carefully examined and confirmed in advance that these conditions are met – insofar as the grounds for permission are relevant – within the framework of a data protection impact assessment within the meaning of Art. 35 GDPR (including a proportionality test). 3. Storage period (Data deletion – storage limitation) The personal data we process will only be stored in a form that allows the identification of the data subjects for as long as is necessary for the purposes for which it is processed. If, for example, data processing is carried out exclusively on the basis of project-related consent within the meaning of Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, this point in time is regularly the complete termination of the research project. If, on the other hand, data processing is based on a legal obligation within the meaning of Art. 6 (1) (c) or Art. 9 (2) (b) GDPR, the personal data will be deleted, blocked, or anonymized when a storage period prescribed by the aforementioned standards expires, unless there is another legal basis for data processing (e.g., Art. 6 (1) sentence 1 lit. d) or Art. 9 (2) lit. c) GDPR). However, personal data will be stored beyond this and thus for longer if the personal data is processed exclusively for archiving purposes in the public interest or for scientific and historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, subject to the implementation of appropriate technical and organizational measures required to protect the rights and freedoms of the data subject. 4. Recipients of personal data Personal data is only processed by the following natural/legal persons: Technische Universität Chemnitz, Department or Laboratory Operating the Robot, Robotics Lab, Chemnitz University of Technology (This group may handle robot data logs, interaction recordings, or performance analytics.) Speech Recognition Tools, Google Cloud Speech-to-Text for the transcription of the audio interviews. The robot programming specialist will have access solely to the technical data required for developing and implementing the robot’s teaching functions. This person will not have access to any personal data from the participating children or their guardians. The human–robot interaction analyst may access video recordings of the experimental sessions for the purpose of behavioral analysis and evaluation of the child–robot interaction. All recordings provided for analysis will be anonymized or pseudonymized by assigning random participant codes, and any identifiable visual or audio elements (e.g., faces, names, or voices) will be blurred, masked, or altered where possible. All individuals involved in the processing of research data are bound by strict confidentiality agreements, and any access to the data will occur exclusively under the supervision of the responsible researcher. No personal data will be disclosed to third parties outside the research team, nor will it be transferred to other organizations, countries, or international entities. Personal data collected in this research will be processed only by the responsible researcher, Mina Raeisi, and members of the internal research team who are directly involved in the study (e.g., the robot programming specialist and the human–robot interaction analyst). These team members are bound by strict confidentiality obligations, and any access to personal data will occur only under the supervision of the responsible researcher. No personal data will be transferred to external third parties, funding institutions, or cloud services. No data will be transferred to another EU country, a third country, or any international organization. In this study, no contract data processing within the meaning of Article 28 GDPR takes place. In the event of processing in accordance with Art. 6 (1) sentence 1 lit. e) GDPR or Art. 9 (2) lit. j) GDPR in conjunction with § 12 SächsDSDG, the personal data may only be published in accordance with Art. 6(1)(1)(a) GDPR (consent) or Art. 9(2)(a) GDPR (express consent), only if this is essential for the presentation of research results on events of contemporary history and does not conflict with the overriding interests of the data subject worthy of protection. 5. Data protection impact assessment If a form of data processing carried out by us is likely to result in a high risk to the rights and freedoms of natural persons, we have carried out a preliminary assessment of the consequences of the intended processing operations for the protection of personal data. This data protection impact assessment contains at least the following: 1. a systematic description of the planned processing operations and the purposes of the processing; 2. an assessment of the necessity and proportionality of the processing operations in relation to the purpose; 3. an assessment of the risks to the rights and freedoms of data subjects; and 4. the measures envisaged to address the risks, including safeguards, security measures, and procedures to ensure the protection of personal data and demonstrate compliance with data protection provisions, taking into account the rights and legitimate interests of the data subjects and other persons concerned. A preliminary Data Protection Impact Assessment (DPIA) is currently being conducted for this study due to the involvement of children and the recording of videos during child–robot interaction. All planned processing activities are documented in the record of processing activities (Art. 30 GDPR). Measures to minimize risks to participants’ rights and privacy, including data anonymization, restricted access, and secure storage, will be implemented and documented. Once the DPIA is completed, the findings and additional risk mitigation measures will be fully integrated. 6. Data security The security of your personal data in our hands is also very important to us. Therefore, taking into account the state of the art, the implementation costs, the nature, scope, circumstances, and purposes of processing, as well as the likelihood and severity of the risks associated with processing for the legal interests of the persons concerned, we have taken the necessary technical and organizational measures to ensure a level of protection appropriate to the risk when processing personal data, in particular with regard to the processing of special categories of personal data. Relevant technical guidelines and recommendations of the Federal Office for Information Security (BSI) have been taken into account in this respect. This applies in particular to the IT baseline protection provided by the BSI. In particular, when processing personal data within the meaning of Art. 9 (1) GDPR, we have provided for appropriate and specific measures to safeguard the interests of the data subject. Taking into account the state of the art, the implementation costs and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons associated with the processing, the following measures in particular may be taken, without prejudice to the measures referred to in Articles 25 (data protection by design and by default), 32 (security of processing), and 36 (prior consultation) of the GDPR, these measures may include, in particular: 1. ensuring that it can be subsequently verified and established whether and by whom personal data have been entered, modified, or deleted, 2. raising awareness and training those involved in processing operations. In addition, insofar as the research purpose allows, the characteristics that can be used to establish a personal reference are stored separately (pseudonymization); the characteristics are deleted as soon as the research purpose allows (anonymization). All personal data collected in this study are securely encrypted during storage and transfer. Access to personal data is restricted to authorized researchers only. All staff involved in data processing have received training on data protection and confidentiality. Personal identifiers are pseudonymized during the study and anonymized as soon as the research purpose allows, ensuring that participants cannot be identified once the analysis is complete. These measures ensure that the handling of data complies with current data protection standards and safeguards participants’ privacy. 7. Legal/contractual requirements for the provision of personal data and consequences of non-provision We hereby also inform you that the provision of personal data is not regularly required by law or contract or necessary for the conclusion of a contract, and you are not regularly obliged to provide personal data. Failure to provide your personal data therefore does not regularly have any consequences/implications for you. However, you are welcome to contact us before providing personal data in the above sense. We will then clarify in each specific case whether the provision of personal data is required by law/contract or necessary for the conclusion of a contract. We will also clarify whether there is an obligation to provide personal data and what the consequences of not providing personal data would be in this case. IV. Project-related data processing 1. Description and scope of data processing To carry out the project “Using a Teaching-Assistant Humanoid Robot for Young Students Learning English,” the following categories of personal data are collected and processed: Identification and demographic data: age, gender, mother tongue, grade or school level, English proficiency level, and information about stays in English-speaking countries. Educational and experience data: information about learning deficits (if applicable) and prior experience with robots or educational technology. Feedback and opinion data: students’ responses to online pre- and post-surveys (30 questions, e.g., multiple choice), students’ interview responses regarding their learning experience with the humanoid robot, and parents’ opinions about their child’s reactions and attitudes toward the robot-assisted learning approach. Multimedia data: audio recordings of interviews and video recordings of classroom interactions between students and the humanoid robot, used exclusively by the researcher for detailed Where applicable, a distinction should be made between data subjects (e.g., parents and children). This personal data is also stored in our system. This data is not stored together with other personal data of the data subjects. In addition, we process the aforementioned personal data within the scope of our project for scientific or historical research purposes Study objectives: The main objective is to evaluate the effectiveness of robot-assisted teaching in improving motivation, language performance, and students’ perceptions of technology in education. Methods used: The study follows a pre–post intervention design. The educational intervention consists of classroom sessions using the humanoid robot as a teaching assistant. Data collection instruments include online pre- and post-surveys (30 questions), semi-structured interviews with students and parents, and classroom observations. Data will be analyzed using mixed methods: quantitative statistical analysis for survey and test data, and qualitative content analysis for interviews and observations. Sources of funding: The project is funded by the Sächsische Landesstipendium. No external or commercial funding sources are involved (until now, 3 Nov, 2025). Possible conflict of interests: There are no financial, institutional, or personal conflicts of interest associated with this research. Institutional affiliation: All researchers are affiliated with Technische Universität Chemnitz (TU Chemnitz). Expected benefits: The project is expected to improve students’ English learning outcomes, increase their motivation to learn, and enhance retention of learned material. It will also generate practical insights and recommendations for teachers and designers of robot-assisted educational tools. Potential risks: No significant mental or psychological risks are expected for students. However, there is a minor potential risk that some children might develop an emotional attachment or dependency on the robot. This risk is considered low and manageable. Possible inconveniences: Some participants may find it slightly inconvenient to allocate time for surveys and interviews or may feel shy in front of the camera. Measures to be taken after completion of the project: After completion, all personal data will be pseudonymized or anonymized. Video and audio files will be securely stored and deleted 5 years after the data collection. Only anonymized data will be used for publication or academic presentation. The robot programming specialist will have access solely to the technical data required for developing and implementing the robot’s teaching functions. This person will not have access to any personal data from the participating children or their guardians. The human–robot interaction analyst may access video recordings of the experimental sessions for the purpose of behavioral analysis and evaluation of the child–robot interaction. All recordings provided for analysis will be anonymized or pseudonymized by assigning random participant codes, and any identifiable visual or audio elements (e.g., faces, names, or voices) will be blurred, masked, or altered where possible. All individuals involved in the processing of research data are bound by strict confidentiality agreements, and any access to the data will occur exclusively under the supervision of the responsible researcher. No personal data will be disclosed to third parties outside the research team, nor will it be transferred to other organizations, countries, or international entities. Five years after the data collection, all identifiable data will be deleted, and only anonymized data necessary for scientific documentation and transparency will be retained. 2. Legal basis for data processing The legal basis for the above-mentioned data processing is generally Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, i.e. the express consent of the data subject. In the absence of consent, the processing of personal data, including data pursuant to Art. 9(1) GDPR for scientific or historical research purposes, insofar as this is necessary for the performance of scientific or historical research, in particular if the purpose of the research cannot be achieved by other means or only with disproportionate effort, and if the public interest, in particular the scientific or historical interest in the performance of the research project, outweighs the interest of the data subject in the processing not taking place. In these cases, the legal basis for data processing is derived from Art. 89 (1) GDPR, Art. 6 (1) sentence 1 lit. e) GDPR or Art. 9 (2) lit. j) GDPR in conjunction with § 12 Saxon Data Protection Implementation Act (SächsDSDG). Any special features, restrictions, and specific requirements in this regard have already been pointed out above. No personal data will be processed without consent. 3. Purpose of data processing Project-related data processing is carried out for scientific or historical research purposes, in particular for the purpose of conducting the scientific research. The processing is necessary to evaluate the effectiveness of robot-assisted English instruction, to assess students’ engagement, motivation, and learning outcomes, and to analyze their behavioral interactions with the humanoid robot during classroom activities. Students’ data (survey responses, interviews, and recorded interactions with the humanoid robot) are processed to measure learning progress, motivation, and reactions to the robot-assisted teaching method. Parents’ data (interview responses) are processed to capture their perceptions of their child’s learning experience and observed behavioral or attitudinal changes. All data are used exclusively for research analysis, preparation of the doctoral dissertation, and scientific publications. Data will not be processed for any commercial purpose and will be stored, analyzed, and published only in anonymized or pseudonymized form. V. Rights of the data subjects If your personal data is processed, you are a data subject within the meaning of the GDPR, which means that you are entitled to the following rights vis-à-vis Chemnitz University of Technology (the controller) if the relevant conditions are met. You can contact us at any time to assert your rights vis-à-vis Chemnitz University of Technology or if you have any further questions about data protection. All communications and measures pursuant to Articles 15 to 22 (including the right to information, rectification, erasure, restriction of processing, notification, data portability, and objection) and Article 34 GDPR (right to notification in the event of data breaches) are provided free of charge. However, in the event of manifestly unfounded or excessive requests from a data subject, particularly in the case of frequent repetition, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request. In such cases, however, Chemnitz University of Technology must provide evidence of the manifestly unfounded or excessive nature of the request. In addition, it should be noted that restrictions on the rights of the data subject exist in accordance with Sections 7–10 SächsDSDG. These include, among other things, the right to erasure and access, as well as the obligations to provide information to the data subjects. 1. Right of access You may request confirmation from the controller as to whether personal data concerning you is being processed by them. If such processing is taking place, you may request the following information from the controller: • the purposes of the processing; • the categories of personal data being processed; • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; • where possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration; • the existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing; • the existence of a right to lodge a complaint with a supervisory authority; • where the personal data are not collected from you, the data subject, all available information on the source of the data; • the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. However, Chemnitz University of Technology, as the controller, naturally processes a large amount of information about data subjects, so you, as the data subject, are required to specify, when exercising your right of access, to which information or processing operations your request for access relates before you are provided with access, cf. p. 7 of Recital 63 of the GDPR. If personal data is transferred to a third country or to an international organization, you as the data subject also have the right to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer. 2. Right to Rectification You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you as the data subject also have the right to obtain the completion of incomplete personal data, including by means of a supplementary statement. 3. Recht to erasure a) Obligation to erase, Art. 17 GDPR („Right to be forgotten“) You may request that the controller erase your personal data without undue delay. The controller is also obliged to erase this data without undue delay if one of the following reasons applies: The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed. You withdraw your consent on which the processing is based in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR, and there is no other legal basis for the processing. You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR. The personal data concerning you has been processed unlawfully. The erasure of personal data concerning you is necessary for compliance with a legal obligation to which the controller is subject under Union law or the law of the Member States. The personal data concerning you was collected in relation to the provision of information society services in accordance with Art. 8 (1) GDPR. Please note that if your data is anonymized, it will no longer be possible to establish a link to you, which means that you will no longer be able to request the deletion of the anonymized data. b) Information to third parties If the controller has made the personal data concerning you public and is obliged to delete it pursuant to Art. 17 (1) GDPR, it shall take reasonable steps, including technical measures, to inform the data controllers who process the personal data of the fact that you, as the data subject, have requested the deletion of all links to this personal data or of copies or replications of this personal data. c) Exceptions to the right of erasure The right to erasure does not apply if the processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing in accordance with Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health pursuant to Art. 9 (2) lit. h) and lit. i) as well as Art. 9 (3) GDPR; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the above-mentioned “right to be forgotten” is likely to render impossible or seriously impair the achievement of the objectives of this processing, or for the establishment, exercise or defense of legal claims. 4. Right to restriction of processing You may request the restriction of the processing of personal data concerning you under the following conditions: if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defense of legal claims; or if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons. If the processing of personal data concerning you has been restricted in the sense described above, such data may – apart from its storage – only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted. 5. Right to notification The controller is obliged to inform you of any rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17(1) and 18 of the GDPR to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject of these recipients if the data subject so requests. 6. Right to data portability You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format (including PDF, CSV). You also have the right to transmit these data to another controller without hindrance from the controller to which the personal data have been provided, provided that the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out using automated procedures. In exercising this right, you have the right, in particular, to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this. The right to data portability is unaffected by Art. 17 GDPR (“Right to be forgotten”). Furthermore, it does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 7. Right to object You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e) (public interest or in the exercise of official authority) or lit. f) GDPR (legitimate interests); this also applies to profiling based on these provisions. The controller shall no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defense of legal claims. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes. In connection with the use of information society services, you have the option of exercising your right to object by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC. 8. Right to revoke your consent to data protection You have the right to withdraw your data protection consent at any time without giving reasons. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent is as simple as giving consent. 9. Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This refers to a decision – which may include a measure – to evaluate personal aspects that is based solely on automated processing and has legal effects on the data subject or significantly affects them in a similar manner, such as the automatic rejection of an online credit application or online recruitment procedures without any human intervention. Profiling is understood to mean any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. The above regarding automated decision-making in individual cases does not apply if the decision is necessary for the conclusion or performance of a contract between you and the controller, is authorized by Union or Member State law to which the controller is subject and that law provides for appropriate measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent. However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) lit. a) or lit. g) GDPR applies and appropriate measures to protect your rights and freedoms and legitimate interests have been taken. With regard to the cases referred to in No. 1 and No. 3 above, the controller shall take appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision. We do not carry out automated decision-making. 10. Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes applicable data protection provisions. The competent supervisory authority in the Free State of Saxony is, in accordance with Art. 51 GDPR in conjunction with §§ 14 ff. SächsDSDG: Sächsische Datenschutz- und Transparenzbeauftragte Dr. Juliane Hundert Devrientstraße 5 01067 Dresden Internet: www.saechsdsb.de E-Mail: saechsdsb@slt.sachsen.de Telefon: 0351/85471-101 Telefax: 0351/85471-109 The supervisory authority to which the complaint was lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. 11. Restriction of data subject rights Article 89(2) GDPR allows, where personal data are processed for scientific or historical research purposes or statistical purposes, that, subject to the conditions and safeguards laid down in Article 89(1) GDPR, exceptions to the rights provided for in Articles 15, 16, 18, and 21 GDPR, provided that these rights are not likely to render impossible or seriously impair the achievement of the specific purposes and such exceptions are necessary for the fulfillment of these purposes. Section 12(5) of the Saxon Data Protection Act (SächsDSDG) takes this up and stipulates that the rights to information under Art. 15 GDPR, to rectification under Art. 16 GDPR, to restriction of processing pursuant to Art. 18 GDPR, and to objection pursuant to Art. 21 GDPR do not exist to the extent that the exercise of these rights would render the specific research purposes impossible or seriously impair them and the restriction is necessary for the fulfillment of the research purposes. Notwithstanding this, pursuant to Art. 21(6) GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you for scientific or historical research purposes or for statistical purposes in accordance with Art. 89(1) GDPR, unless the processing is necessary for the performance of a task carried out in the public interest. The right to erasure (“right to be forgotten”) under Art. 17 (1), (2) GDPR also does not apply if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) GDPR, insofar as the right to erasure within the meaning of Art. 17 (1) GDPR is likely to render impossible or seriously impair the achievement of the objectives of such processing, Art. 17 (3) lit. d) GDPR. VI. Validity of this privacy policy This privacy policy is currently valid and was last updated on Nov 24, 2025. VII. Declaration of consent (template) Data subject Last name, first name: Home address, postal code, city: Date of birth (DD/MM/YYYY) Child (minor) Last name, first name: Home address, postal code, city: Date of birth (DD/MM/YYYY) Privacy policy I have read the above privacy policy and any questions I had regarding the protection of personal data were answered satisfactorily by employees of XXX, Chemnitz University of Technology. Consent regarding my personal data I hereby expressly and voluntarily, i.e. free of coercion and pressure, agree that my personal data may be processed to the extent and for the purposes described in the privacy policy. Consent may be revoked at any time, in whole or in part, without giving reasons and without unreasonable disadvantages, with effect for the future. Withdrawing consent is as easy as giving it. The consent covers the following areas of research: The research project “Using a Teaching-Assistant Humanoid Robot for Young Students Learning English,” including data collection through online surveys, interviews, and classroom video recordings; Secure storage of data on password-protected university servers for the duration of the PhD project; Publication of aggregated and anonymized research results (Open Access) in scientific papers and the doctoral dissertation; No open access to raw data or personal information (no Open Data). Consent is given only for this specific research project and does not extend to other or future studie The above consent regarding the processing of my personal data expressly includes, but is not limited to, the following special categories of personal data: See in particular Art. 9 Abs. 1 GDPR, The above consent also includes the processing of video and audio recordings that may reveal biometric data (e.g., students’ faces and voices). No other special categories of personal data according to Art. 9(1) GDPR (e.g., health, religious, political, or genetic information) are collected or processed within this study. Consent regarding personal data of my above-named child I expressly and voluntarily, i.e. free of coercion and pressure, agree that the personal data of my above-named child may be processed to the extent and for the purposes described in the privacy policy. Consent may be revoked at any time, in whole or in part, without giving reasons and without unreasonable disadvantages, with effect for the future. Withdrawing consent is as easy as giving it. The consent covers the following areas of research: The research project “Using a Teaching-Assistant Humanoid Robot for Young Students Learning English,” including data collection through online surveys, interviews, and classroom video recordings; Secure storage of data on password-protected university servers for the duration of the PhD project; Publication of aggregated and anonymized research results (Open Access) in scientific papers and the doctoral dissertation; No open access to raw data or personal information (no Open Data). Consent is given only for this specific research project and does not extend to other or future studie The above consent regarding the processing of the personal data of my above-mentioned child expressly includes, but is not limited to, the following special categories of personal data: See in particular Art. 9 Abs. 1 GDPR, The above consent also includes the processing of video and audio recordings that may reveal biometric data (e.g., students’ faces and voices). No other special categories of personal data according to Art. 9(1) GDPR (e.g., health, religious, political, or genetic information) are collected or processed within this study. Place, date Signature (mother) Place, date Signature (father)