DUBLIN CITY UNIVERSITY TENJIN
PERSONAL DATA PRIVACY POLICY
1. Introduction to Tenjin Technology
Tenjin Technology ('Tenjin') develops web applications for the purpose of
supporting accounting and finance education. Tenjin has been engaged by
Dublin City University ('DCU') in order to make the Tenjin application (the
'Application') available to DCU's registered students ('individuals') for
the purpose of formative self-assessment, revision of relevant subject
matter content and, for some modules, summative assessments.
Contact details
for each of DCU and for Tenjin are listed at the bottom of this page.
2. Personal Data and Privacy
Personal data comprise information relating to an identifiable living
individual. Both DCU and Tenjin are committed to maintaining the
appropriate confidentiality, integrity and security of personal data that
are processed by complying with both legal and ethical obligations in
respect of data protection and privacy. This policy sets out the
principles that each of DCU and Tenjin adhere to when processing personal
data and sets out the operational aspects of the data processing
activities.
3. What personal data points are collected and processed?
(a) In order for Tenjin to be able to fulfil its role as instructed by DCU,
personal data is processed by each of DCU and Tenjin.
Tenjin automatically receives the following personal data from DCU when a
DCU-registered individual accesses Tenjin through a Moodle course page.
• Individual's Moodle username (for example 'sam.jones5');
• Individual's display name (for example 'Sam Jones').
(b) Tenjin processes this personal data on the first occasion to create an
account for the individual and to keep a record of the subsequent assessment
and revision activities undertaken by that individual. The specific
assessment and revision activities of the individual that are recorded by
Tenjin on behalf of DCU are as follows:
• Date and time of on-screen quiz generation or PDF file download;
• Subjects for which on-screen quizzes are generated or PDF files
downloaded;
• Question reference numbers included in each generated on-screen quiz
or PDF file download;
• Types of questions included in each generated on-screen quiz or PDF
download (for example, multiple-choice or short computational or long
computational);
• Whether an on-screen quiz is generated in 'learning' mode or 'exam'
mode;
• Actions taken by the individual in an on-screen quiz as follows:
o Whether a question is viewed (Yes or no);
o Whether a question is attempted (Yes or no);
o Whether an attempt is correct or incorrect (Yes or no);
o Whether the hint is viewed (in 'learning' mode) (Yes or no);
o Whether a 'similar question' is selected (in 'learning' mode) (Yes or no);
o Whether the solution is selected (in 'learning' mode) (Yes or no);
o Option selected for multiple-choice type questions ((a), (b) or (c));
o Values input for short computational questions;
• Whether actions taken by the individual in an on-screen quiz result
in the awarding of points for summative assessment purposes:
(c) Individuals have the possibility to contact Tenjin directly through the
'contact us' tab. In this circumstance, the individual's email address and
potentially other personal data are communicated by the individual directly
to Tenjin.
(d) Cookies
A cookie is a small amount of information that may be stored on an
individual's device. Cookies are used to make it easier for an individual to
stay logged in to the Application. Further information about cookies is
included on
the Cookies page.
4. What are the purposes of the collection and processing of personal
data?
(a) DCU communicates personal data to Tenjin in order to facilitate access
to the Application and for Tenjin to present relevant subject matter to each
individual. An individual is authorised to use the Application solely by
reference to the information that is communicated by DCU.
(b) With regard to personal data points that are generated by individuals
through use of the Application, DCU applies a range of data and learning
analytics techniques for up to one year after the end of an academic year in
order (i) to assist with review and assessment of the quality of all
teaching and learning resources and (ii) to investigate relationships
between educational outcomes and use of the Application by individuals and
groups.
(c) Tenjin processes personal data in order to implement a fair usage policy
in respect of PDF file downloads. Each individual is limited in terms of the
number of revision questions that may be downloaded during any continuous
24-hour, 7-day or 30-day period. For this purpose, Tenjin processes personal
data in order to maintain a historical record of PDF downloads by each
registered individual.
(d) Tenjin processes personal data when an individual communicates
directly with Tenjin through the 'contact us' tab.
5. What is the legal basis of the processing of personal data?
By law, each of DCU and Tenjin may only process personal data where there is
a legal justification to do so. In accordance with that law, each of DCU and
Tenjin process personal data in relation to the Application because it is
necessary for the purposes of the legitimate interests of DCU and Tenjin.
(a) DCU processes personal data in order to facilitate authorised access to
the Application for each registered individual. The Application is a
significant component of DCU's overall educational infrastructure.
(b) Tenjin, in its capacity as a data processor on behalf of DCU, processes
personal data in order to facilitate data and learning analytics that are
undertaken by DCU. The sole purpose of the analytics is to facilitate
assessments by DCU of the quality of all educational resources and content
and, where evidence indicates, to improve those resources and content.
(c) Tenjin processes personal data in order to implement its fair usage
policy in relation to PDF file downloads. It is necessary to process
personal data in order to enforce this policy.
(d) Tenjin processes personal data when an individual communicates by means
of the 'contact us' tab. This processing is necessary in order to be able to
respond to the individual.
Each of DCU and Tenjin have taken care to be able to conclude that:
(a) the interests pursued by each in the context of the Application
are legitimate interests that are solely related to the provision of a
high-quality educational experience to registered individuals;
(b) the processing of personal data is necessary (in that it is
targeted to apply only to the stated legitimate interests and is a
proportionate way of achieving the stated legitimate interests);
(c) the fundamental rights and freedoms of an individual are not
compromised by the legitimate interests of either DCU or Tenjin. In this
regard, DCU and Tenjin have given due consideration to the nature of the
data processed, the expectations of an individual in an educational
environment and the likely impact of the processing of personal data on an
individual.
6. For how long is personal data held?
Personal data points that are processed in connection with the Application
are held for up to one year after the end of the academic year in which the
personal data points are first processed. An academic year commences at the
beginning of September and ends at the end of the following August.
For example, 'Sam Jones' uses the Application on one or more occasions
during the 2022/2023 academic year - personal data points relating to 'Sam
Jones' are therefore processed during the 2022/2023 academic year. These
personal data points are retained up to the end of the 2023/2024 academic
year, at which point the personal data points are anonymised. Once
anonymised, the Application activity data points can no longer be associated
with an identifiable individual. Therefore, after an anonymisation process,
Application activity that was previously associated with 'Sam Jones' can no
longer be associated with 'Sam Jones'.
Anonymised Application activity data points are retained either by DCU or by
Tenjin on behalf of DCU for archive, research and statistical analysis
purposes.
Personal data points sent to Tenjin as a result of communication
through the 'contact us' tab are retained by Tenjin only for as long as is
required to address the subject matter of the communication. Once the
matter is resolved or forwarded to DCU, the personal data points are
permanently deleted.
7. What are an individual's rights in relation to personal data?
Individuals who wish to exercise any of the rights listed below should
contact
Dublin City
University in the first instance.
(a) Right to information and access
An individual has the right to request access to the information about him
or her that is held by DCU or by Tenjin on behalf of DCU. On request, DCU
will provide the individual with a copy of the personal data points that
have been generated in connection with the Application. This information
will be provided in a convenient electronic format.
(b) Right to rectification
DCU will rectify any noted inaccuracies in relation to an individual's
personal data following a request by the individual concerned.
(c) Right to object to processing
An individual has the right to object to processing of personal data in
connection with the Application on grounds relating to his or her particular
situation.
(d) Right to restrict processing
An individual has the right to request the restriction of personal data. In
this case, personal data points would be stored by DCU or by Tenjin on
behalf of DCU but would not be processed in connection with any aspect of
the Application.
(e) Right to erasure
An individual has the right to request erasure of personal data points
that arise in connection with his or her use of the Application.
(f) Right to make a complaint to the Data Protection Commission
An individual has the right to make a complaint to the
Data Protection
Commission in order to ensure that his or her rights are fully
upheld.
8. Is personal data shared with third parties?
The Application is hosted on a Microsoft cloud platform. Personal data that
are processed as a result of accessing or using the Application are stored
on the Microsoft cloud platform and in accordance with the terms and
conditions of Tenjin's subscription to
Microsoft Online Services.
Other than in connection with Tenjin's subscription to Microsoft
Online Services, only DCU or Tenjin on behalf of DCU handle personal data
that is processed in connection with the Application.
9. What data security measures are in place to protect personal
data?
Each of DCU and Tenjin take appropriate technical and organisational
measures to protect personal data points that are transmitted, stored or
otherwise processed in connection with the Application against accidental or
unlawful destruction, loss, alteration, or unauthorised disclosure or
access.
In general, personal data points are encrypted in storage and during
transmission to and from DCU and Tenjin servers. Authorised access to the
Application requires an individual to be logged in to Moodle by means of a
username/password combination.
Any data files transferred between DCU and Tenjin that contain personal data
are password protected as a matter of standard policy. Any data files
containing personal data that may be temporarily stored on a Tenjin portable
device are password protected and encrypted.
Prior to introducing any technologies that are relevant to the processing of
personal data in connection with the Application, both DCU and Tenjin on
behalf of DCU undertake all necessary impact assessments.
Whereas DCU and Tenjin strive to protect each individual's personal
data, including through use of encryption and other measures, it is not
possible to guarantee the security of any internet communication or
transmission. If any individual has reason to believe that interactions
with the Application are not secure, please notify DCU or Tenjin by using
the
contact details
at the bottom of this page.
Where an individual has been provided with, or has chosen, a password that
enables access to certain parts of the application, the individual is solely
responsible for keeping that password confidential.
In the event of any breach of DCU's or Tenjin's systems impacting on
the security of an individual’s Application-related personal data, DCU
will inform the affected individuals at the earliest opportunity
describing the nature of the breach, the possible consequences and the
measures being taken to remedy the situation in accordance with DCU
procedures and applicable law.
10. What about site links to third party sites?
The Application site may contain links to third-party resources.
Individuals should note that these third-party sites may have their own
personal data and privacy policies. Neither DCU nor Tenjin accept any
responsibility or liability in connection with those third party personal
data and privacy policies.
11. Contact details
Comments and enquiries relating to this personal data and privacy policy
should be directed to:
Dublin City University
For attention of Office of Vice President Academic Affairs
Glasnevin
Dublin 9
Ireland
Bazwaldo Limited T/A Tenjin Technology
For attention of Barry Smith
c/o Leahy O'Riordan Chartered Accountants
1-2 Marino Mart
Fairview
Dublin 3
Tenjin email: Use the form on the 'contact us' tab or email directly to '
dataprotection@tenjin.ie'.
The website for the Data Protection Commission is
https://www.dataprotection.ie.
12. Updates to Personal Data and Privacy Policy
In the event that there are any changes to this personal data and privacy
policy for the Application, an updated version will be posted on this page
and all individuals will be notified of the updated version by means of the
home page.
This version is dated September 2022.
