During the games study app will store behavioral data (e.g., reactions and reaction times). With your permission, this data will then be stored in a pseudonymized way. This means that it will be stored and analyzed separate from any of your identifiable data.
During the study, the data described in the section "What data is collected?" will be collected from you and stored electronically. Your data is subject to medical confidentiality and the applicable data protection regulations.
For scientific evaluation, only pseudonymized data are analyzed. This means that identifying features, such as your name and email address, are separated from the remaining research data. Instead of your name, an ID number (your prolific.co ID) is used in the research data. The identifying features, the corresponding ID number, study code, and examination date are stored separately by prolific.co, and we do not have access to these data. The pseudonymized research data, which are used for evaluation, cannot be assigned to a specific person without consulting the ID list or additional information. The pseudonymization of the data is intended to ensure that your rights and freedoms in accordance with Art. 89 (1) GDPR are preserved. At the same time, an assignment of examination results to your name and contact details remains theoretically possible (e.g., in the case of a data leak).
The important, pseudonymized research data for the study will be stored on the servers of movisens GmbH while you participate in the study. These servers use encrypted data transfer and only the study staff can access your data stored there. Once you have finished the study, the data from this server will be deleted and transferred to servers of ZIH (Zellescher Weg 12, 01069 Dresden).
The data will be used exclusively for the purposes mentioned in this information document. The data will be anonymized after the study is completed (at the latest in August 2024) for later scientific reuse. Thus, they can no longer be associated with your person. They can then also be used by other scientists at other institutions at home and abroad.
Regardless, we would like to point out that in principle, there is a data protection risk for your personal data with every collection, storage, and transmission of data via online portals, apps, and/or during mobile data collection, e.g., through the unintended intermediation of third parties via malware or unsecured internet access. In such a case, a guarantee for the protection of your personal data under the European General Data Protection Regulation (GDPR) is not possible despite our described security precautions and the encryption of your data.
The study app was reviewed by the Information Security Service of TU Dresden and found to be acceptable in terms of data protection.
The entity responsible for data processing is the Technical University of Dresden. Contacts can be found further below. The legal basis for data processing for the above-mentioned research purposes is Art. 6 (1) sentence 1 lit. a and possibly Art. 9 (2) lit. a GDPR (consent). The reuse of the data for other research purposes is based on § 12 (1) SächsDSDG.
You have the right to request information about the personal data stored about you by the responsible person (see below) (Art. 15 GDPR). You can also request the correction of incorrect personal data (Art. 16 GDPR) as well as the deletion of your data (Art. 17 GDPR) or the restriction of their processing (Art. 18 GDPR). Furthermore, you have the right to receive the personal data concerning you, which you have provided to the responsible person. You can request that these data be transferred either to you or, if technically feasible, to another location designated by you (Art. 20 GDPR). Insofar as data processing is permitted even without your consent, you may object to the processing of your personal data (Art. 21 GDPR). Moreover, you have the right to withdraw your consent at any time without incurring any disadvantages (Art. 7 (3) GDPR). The legality of the data processing carried out until the revocation is not affected by this. In the event of revocation, your research data will be anonymized so that they can no longer be assigned to your person.
Your above rights are restricted by Art. 17 (3) lit. d GDPR and the state data protection laws concerning research (§ 12 (5) SächsDSDG) in cases where the exercise of your above rights is likely to make the realization of the research goals associated with the data processing impossible or seriously impair them. Under certain research-specific conditions, the aforementioned state data protection laws also allow the processing of personal data without the consent of the data subjects. Therefore, deletion or restriction of data processing of data already collected may be refused by the responsible research institutions.