Consent Management
==================

Review of the legal basis for data processing
---------------------------------------------

There are three options that justify **Legal basis for data processing**:

-   **Recruitment consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR)
-   **Study consent** (Art. 6 (1) lit. a, Art. 9 (2) lit. a GDPR and Art. 27 BDSG)
-   **Guardianship** (Art. 6 (1) lit. a, Art. 9 (2) lit. a DSGVO and Art.
    1626, 1902 BGB)

Castellum is mainly used for the management of **Recruitment consent**. **Study
consents** must be obtained separately from the database by the respective
**Study conductor** at the execution level

1.  Click on **Admin** on the front page

2.  Go to **Consent documents** in the **Subjects**-field

    -   There you will see a list of all consent documents that have already been
        created
    -   As additional information, the date of creation and the validity of the
        consent document are displayed

Updating consent forms
----------------------

Consent documents are marked as invalid if a change in the law occurs,
significant changes are made to the old document, or other reasons require the
subjects's signature on a new document

1.  There are two options that can be implemented when a consent document becomes
    invalid.

    -   For both options, first go to **Admin** at the front page > **Consent
        documents** > click on the creation date of the consent document to be
        modified

    1. The consent document can be marked as **Is valid** AND **Is deprecated**

        -   **Is deprecated** can be seen as a intermediate step in the process of
            declaring a valid consent document to be invalid
        -   If both checkboxes are marked, the subjects remain in the database
            and may be recruited. However, a new declaration of consent should be
            obtained as soon as possible

    2.  If only the box **Is deprecated** is ticked, the consent document is
        presumed to be invalid in general

        -   If the invalidity of the document is saved, there is no longer any
            recruitment consent of subjects in the database

    This does not apply if the **Legal basis for data processing** refers to a
    **Study consent** or a **Guardianship**.
    The **Legal basis for data processing** can be viewed for each individual
    subject by following the instructions below:

    -   Go to **Subjects** on the front page
    -   Enter the first and last name of the subject and click on **Submit**
    -   Go to **Details** next to the subject
    -   You can see three different **Legal basis for data processing** in
        **Overview** and which of those apply to the respective subject

2.  If you wish to upload a valid and current consent document, proceed as follows:

    -   Click on **Admin** on the front page
    -   Go to **Consent documents**
    -   Click on **Add Consent Document** (oval with grey background)
    -   Choose the file you want to upload
    -   Click on one of the saving options

Deletion of a consent document
------------------------------

1.  Click on **Admin** on the front page
2.  Go to **Consent documents**
3.  Choose the consent document to be deleted
4.  Click on **Delete**
5.  Confirm the query about whether the version should be deleted by clicking on
    **Yes, I am sure**

Maintenance of Recruitment consent
-----------------------------------

To get an overview of all subjects for whom a new **Recruitment consent** is
required, proceed as follows:

1.  Click on **Subjects** on the front page

2.  Go to **Maintenance** (blue button)

3.  Choose the fourth tab **Consent**

    -   You will see a list of all subjects with recruitment consents that are not
        current

4.  Click on **Details** next to the indication **Last updated on: XY**

    -   A new window will open for each subject with invalid recruitment consent

5.  Go to the fourth tab **Data protection** individually

    -   You will see an orange field that indicates the following text: **The
        subject has recently come of age. Please ask them to renew or withdraw
        their consent. This message will disappear once you change the value of the
        checkbox.**

6.  Obtain a valid recruitment consent either by E-Mail, telephone or post

    -   As an intermediate step, click once on the checkbox **Recruitment
        consent**. This is how you note that you are waiting for confirmation from
        the subject

7.  If the subject agrees or withdraws his/her consent in the current consent
    document, this must be indicated

    -   If the subject agrees, click on **Confirm** below **Recruitment consent**
        and **Save**
    -   If the subject requests a deletion according to GDPR, click on **To be
        deleted** and save your submission