Skip to main content

Hephaestus — Data-Protection Documentation

This folder is the data-protection package for the TUM-operated Hephaestus deployment at https://hephaestus.aet.cit.tum.de. Files are named after the GDPR articles they answer to, not after the TUM DSMS portal field labels. The portal supplies its own field prompts; submit by pasting from the fenced code blocks in record-of-processing.md into the corresponding form fields.

A different operator forking Hephaestus must amend, before opening their deployment to users: the controller block in record-of-processing.md, the operational-contact email, the Art. 28 row for any processor they engage that is not on the AET pool, the consent / public-task framing in record-of-processing.md "Legal basis", and the live privacy notice and imprint under webapp/public/legal/profiles/.

Files​

FilePurpose
record-of-processing.mdArt. 30 record. TOMs (Art. 32) folded in under Art. 30(1)(g). Fenced blocks paste-ready into the TUM DSMS form.
dpia-prescreen.mdArt. 35 pre-screen. Records the pending controller/DPO determination, safeguards, and change freeze.
processor-checklist.mdArt. 28 checklist. Per-processor AVV status; LRZ-as-separate-controller analysis.
artifact-source-governance.mdApproval, minimization, processor-egress, retention, and erasure gate for every AI-readable source.

The live imprint and privacy pages are at https://hephaestus.aet.cit.tum.de/imprint and https://hephaestus.aet.cit.tum.de/privacy. Markdown source: webapp/public/legal/profiles/tumaet/.

Maintenance​

Re-review annually and on any material change to the processing surface (new processor, source, source combination, purpose, audience, data category, retention window, identity provider, or activation of an integration not covered by the latest review). The DPIA pre-screen requires a recorded controller/DPO determination before material source expansion. The amendment triggers are listed in processor-checklist.md, dpia-prescreen.md §5–§6, and artifact-source-governance.md.

Contacts​