Privacy Policy according to the requirements of the GDPR
Name and address of the data controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions, is the:
Interdisciplinary Center for HTA and Public Health
Office of the IZPH
Schwabachanlage 6
91054 Erlangen
Tel.: +49 9131 85-35855 (Secretariat)
Fax: +49 9131 85-35854
Email: info@digidem-bayern.de
Website: www.public-health.de
Name and address of the data protection officer
Klaus Hoogestraat
c/o ITM Gesellschaft für IT-Management mbH
Bürgerstraße 81
01127 Dresden
E-Mail: datenschutzbeauftragter@fau.de
General Information on Data Processing
Scope of processing of personal data
We generally only process personal data of our users to the extent necessary for providing a functional website as well as our content and services. The processing of personal data of our users regularly only takes place with the user's consent. An exception applies in cases where it is not possible to obtain prior consent for factual reasons and the processing of data is permitted by legal regulations.
Legal basis for the processing of personal data
To the extent that we obtain the consent of the data subject for processing operations of personal data, Art. 6(1)(a) of the General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
To the extent that the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.
In cases where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.
Processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Data Deletion and Storage Duration
The personal data of the data subject shall be erased or blocked as soon as the purpose of storage ceases to apply. Storage may also occur if this has been provided for by the European or national legislator in Union regulations, laws, or other provisions to which the controller is subject. The blocking or erasure of data also takes place when a storage period prescribed by the aforementioned norms expires, unless there is a necessity for further storage of the data for the conclusion or fulfillment of a contract.
Website provision and log file creation
Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected here:
the address (URL) of the web page from which the file was requested
the name of the accessed file
• the date and time of the request
the transferred data volume
• access status (file transferred, file not found, etc.)
• the description of the web browser type or operating system used
• the anonymized IP address of the requesting computer.
Time zone difference from Greenwich Mean Time (GMT)
• Browser software language and version
The stored data is needed exclusively for technical or statistical purposes; no comparison with other databases or transfer to third parties, even in excerpts, takes place. The data is stored in the log files of our system. The user's IP addresses or other data that allow the data to be assigned to a user are not affected by this: Before storage, each data record is anonymized by changing the IP address. Storage of this data together with other personal data of the user does not take place.
Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6(1)(f) of the GDPR.
Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session.
Log files are stored to ensure the website's functionality and to guarantee a smooth connection to the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. Data is not analyzed for marketing purposes in this context.
In these purposes also lies our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR.
Storage Duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session is ended.
In the case of data storage in log files, this is the case after seven days at the latest. Further storage is possible. In this case, the IP addresses of the users are deleted or anonymized so that attribution to the calling client is no longer possible.
Objection and Rectification Possibility
The collection of data for the provision of the website and the storage of the data in log files are absolutely necessary for the operation of the website. Therefore, there is no possibility for the user to object.
Registration Forms
Description and scope of data processing
On our website, it is possible to register for events or for contact with potential collaboration partners by submitting personal data via a form. When registering, the data from the input mask will be transmitted to us and stored. Your consent will be obtained during the registration process for data processing, and you will be referred to this privacy policy.
The data will not be shared with third parties during data processing. The data will be used exclusively for event administration or for contacting potential cooperation partners.
Legal basis for data processing
The legal basis for processing the data after a user registers for an event, provided the user has given their consent, is Art. 6(1)(a) GDPR.
Purpose of data processing
The processing of personal data from the input form is used solely for processing your application or for contacting potential cooperation partners. In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The other personal data processed during the submission process are used to prevent abuse of the registration form and to ensure the security of our IT systems.
Storage Duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected.
Objection and Rectification Possibility
The user has the right to withdraw consent for the processing of personal data or to have their stored data amended at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
All personal data stored during contact will be deleted in this case.
Digital offers
Description and scope of data processing
On our website, there is an option to receive email reminders about the repetition of digital offerings by providing personal data (email address). The email address provided for the reminder function will be transmitted to us and stored encrypted. For the processing of data, your consent will be obtained during the registration process, and you will be referred to this privacy policy.
Data will not be shared with third parties in connection with data processing. The data will be used exclusively for contact in the form of a reminder email. A link to the self-assessment results or the information provided under „Your opinion is important to us“ is neither planned nor possible. This data is stored separately and without personal reference. The results of the digital offerings will be stored completely anonymously for the purpose of evaluating the digital offering, without any traceability to you. After the evaluation, this data will be deleted. Your email address for the reminder function will also be stored encrypted in the database.
If you provide your postal code, it will be used for an anonymous evaluation of the regional use of the service and demand.
If you provide your email address for re-contact, it will only be used for the purpose of re-contact.
Legal basis for data processing
The legal basis for processing the data for the reminder function is the user's consent pursuant to Art. 6(1)(a) GDPR, Art. 7 GDPR, and Art. 9(2)(a) GDPR.
Purpose of data processing
The processing of personal data (email address) from the input form of the reminder function is used solely to send you a reminder email after 6 months or for re-contact.
Storage Duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In this case, after sending the reminder email, after 6 months. If you have agreed to be recontacted, this data will be stored by digiDEM Bayern until you withdraw your consent or the project ends.
Cookie Usage
Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that allows for the unique identification of the browser when the website is visited again. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.
The following data are stored and transmitted in the cookies:
Login Information
The user data collected in this way is pseudonymized through technical measures. Therefore, it is no longer possible to attribute the data to the user accessing the site. The data is not stored together with any other personal data of the users.
When visiting our website, users are informed about the use of cookies via an info banner and are directed to this privacy policy.
Legal basis for data processing
The legal basis for processing personal data using cookies is Art. 6 para. 1 lit. f GDPR.
Purpose of data processing
The cookies are used for the purpose of improving the quality of our website and its content. Our legitimate interest in processing personal data under Article 6(1)(f) of the GDPR also lies in these purposes.
Duration of storage, right of objection and erasure
Cookies are stored on the user's computer and transmitted by the user to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all functions of the website to their full extent.
User behavior analysis
etracker
The provider of this website uses services from etracker GmbH from Hamburg, Germany (https://www.etracker.com) for the analysis of usage data. By default, we do not use cookies for web analysis. If we use analysis and optimization cookies, we will obtain your explicit consent separately in advance. If this is the case and you agree, cookies will be used that enable statistical reach analysis of this website, measurement of the success of our online marketing measures, and testing procedures to, for example, test and optimize different versions of our online offering or its components. Cookies are small text files that are stored by the internet browser on the user's end device. etracker cookies do not contain any information that allows for the identification of a user.
The data generated by etracker is processed and stored exclusively in Germany on behalf of the provider of this website by etracker, and is therefore subject to the strict German and European data protection laws and standards. etracker has been independently audited, certified, and awarded the ePrivacyseal data protection seal of approval for this.
Data processing is carried out on the basis of the legal provisions of Art. 6 (1) lit. f (legitimate interest) of the General Data Protection Regulation (GDPR). Our interest within the meaning of the GDPR (legitimate interest) is the optimization of our online offering and our web presence. As the privacy of our visitors is important to us, data that could potentially identify an individual, such as the IP address, login or device identifiers, are anonymized or pseudonymized as early as possible. No other use, merging with other data, or disclosure to third parties will occur.
You can object to the aforementioned data processing at any time. The objection will have no adverse consequences.
You can find more information about data protection at etracker here: https://www.etracker.com/datenschutz/.
The data processing is carried out on the legal basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the optimization of our online offering and our website.
Email contact
Description and scope of data processing
You can contact us using the provided email address. In this case, the personal data of the user transmitted with the email will be stored. The data will not be passed on to third parties in this context. The data will be used exclusively for processing the conversation.
Legal basis for data processing
The legal basis for processing the data transmitted during an email correspondence is Article 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.
Purpose of data processing
In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.
Storage Duration
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the matter in question has been definitively clarified.
Objection and Rectification Possibility
The user has the right to revoke their consent to the processing of personal data at any time. If the user contacts us via email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.
All personal data stored during contact will be deleted in this case.
SSL encryption
For security reasons and to protect the transmission of confidential content (e.g., for event registrations), this page uses SSL encryption. Users can recognize an encrypted connection by the fact that the browser's address bar changes from „http://“ to „https://“ and by the padlock icon in the browser bar. When SSL encryption is activated, data transmitted by the user cannot be read by third parties.
Newsletter
With your consent, you can subscribe to our email newsletter, which will keep you informed about current topics.
We use the so-called double opt-in procedure to register for our newsletter. This means that after you register, we will send you an email to the specified email address asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. We also store your IP addresses used and the times of registration and confirmation. The purpose of this procedure is to be able to prove the newsletter registration by you and, if necessary, to clarify any possible misuse of your personal data.
Your email address is the only mandatory information for sending the newsletter. Providing additional, separately marked data is voluntary and will be used to address you personally. After your confirmation, we will store your email address for the purpose of sending the newsletter.
You can revoke your consent to receive the newsletter at any time and thus unsubscribe. You can revoke your consent by clicking on the link provided in every newsletter email or by sending an email to info@digidem-bayern.de.
We use MailPoet for sending newsletters.
Downloadable Products and Registration of Restricted Content
If you take advantage of offers for downloads or unlock content that requires registration, we will store your email address and personal master data for the duration of the contract for the purpose of identification, contact, and verification of eligibility. The legal basis for this is Article 6(1) sentence 1(b) of the GDPR.
Info on social media fan pages
The „digiDEM Bayern“ project maintains social media profiles on the social networks Facebook and Twitter (so-called „fan pages“):
https://www.facebook.com/digiDEMBayern (Facebook-Seite)
https://twitter.com/de/privacy (Twitter-Seite)
Description and purpose of data processing
On our fan pages, we present our institution, provide information about our services, and communicate with prospective clients.
When you visit our fan pages, digiDEM Bayern fundamentally records all communications, content, and other information that you directly share with us there, for example, when you post something on a fan page, like a post, leave a comment, or send us a private message. If you have an account with the respective social network, we in turn can also see your public information, such as your username, information in your public profile, and content that you share with a public audience.
The legal basis for such data processing is, depending on the nature of your activity, Art. 6(1)(b) GDPR (e.g., if you send us a contract-relevant inquiry) or your consent according to Art. 6(1)(a) GDPR (e.g., if you „like“ or comment on a post from us or upload content to our Facebook page). Otherwise, the legal basis is Article 6(1)(f) GDPR, where our legitimate interests lie in the aforementioned purposes.
Data processed by Facebook
With every interaction on our fan pages or other Facebook websites, the operators of the social networks collect your usage behavior using cookies and similar technologies. On this basis, the fan page operators receive so-called „Page Insights.“ Page Insights contain only statistical, anonymized information about visitors to the fan page, which therefore cannot be assigned to any specific person. We cannot access the personal data that Facebook uses to create Page Insights. The selection and processing of personal data are carried out exclusively by Facebook.
With the help of Page Insights, we gain an understanding of how users interact with our Facebook page. The legal basis for data processing is Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in marketing our institution via social media and analyzing and evaluating the use of our social media pages to improve our offerings and services.
The social network Facebook is offered by the US-based company Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025 (hereinafter referred to as „Facebook“).
digiDEM Bayern is responsible for processing your data only to the extent that you communicate with us directly via our fan pages or share personal content with us. An exception applies to the data processing described in the usage analysis (Page Insights). In this case, there is an agreement with Facebook on joint responsibility according to Art. 26 GDPR (Page Controller Addendum, https://www.facebook.com/legal/terms/page_controller_addendum).
In addition to the processing described above, Facebook also processes your data for analysis and advertising purposes, respectively, personalized advertising. To our knowledge, Facebook also uses cookies for this, which store your usage behavior (including across different devices). This allows Facebook to display targeted advertising within its own platform as well as on third-party sites.
To find out about Facebook's data processing operations, please refer to the privacy policy of the respective social networks:
https://www.facebook.com/about/privacy/
According to Facebook's privacy policy, user data is also processed in the USA or other third countries. Facebook only transfers user data to countries for which there is an adequacy decision by the European Commission pursuant to Art. 45 GDPR or on the basis of appropriate safeguards pursuant to Art. 46 GDPR. Facebook Inc. is certified under the EU-US Privacy Shield, thereby offering an adequate level of data protection pursuant to Art. 45 GDPR (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
You can revoke a granted consent at any time with effect for the future by deleting the comment or the relevant content. A revocation does not affect the lawfulness of the processing carried out up to the point of revocation based on the consent.
You can find more information about your data protection rights regarding Page Insights and how to exercise them directly with Facebook here: https://www.facebook.com/legal/terms/information_about_page_insights_data
Facebook offers the possibility to object to certain data processing; related information and opt-out options can be found at https://www.facebook.com/policies/cookies/ and for logged-in users at https://www.facebook.com/settings?tab=ads.
Furthermore, data processing via cookies used by Facebook can be prevented by disallowing third-party cookies or Facebook cookies in your own browser settings.
Data Subject Rights
If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights with regard to the controller:
Right to information
You can request confirmation from the person responsible as to whether personal data concerning you is being processed by us.
If such processing takes place, you can request information from the controller regarding the following:
- the purposes for which the personal data are processed;
- the categories of personal data being processed;
- the recipients or categories of recipients to whom your personal data have been or will be disclosed;
- the planned duration for which the personal data concerning you will be stored, or, if that is not possible, the criteria used to determine that storage period;
- the right to rectification or erasure of your personal data, the right to restrict processing by the controller, or the right to object to such processing;
- The existence of a right of complaint to a supervisory authority.;
- all available information as to the origin of the personal data, where the personal data have not been obtained from the data subject;
- the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the scope and the intended impact of such processing on the data subject.
You have the right to request information as to whether personal data concerning you are transmitted to a third country or an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
This right of access may be restricted to the extent that it is likely to make the achievement of research or statistical purposes impossible or seriously impair them, and the restriction is necessary for the fulfillment of the research or statistical purposes.
Right to rectification
You have the right to request that the controller correct and/or complete your personal data if the personal data being processed is inaccurate or incomplete. The controller must make the correction without delay.
Your right to rectification may be restricted to the extent that it is likely to make the achievement of research or statistical purposes impossible or to seriously impair them, and the restriction is necessary for the fulfillment of the research or statistical purposes.
Right to restrict processing
You can request the restriction of processing of your personal data under the following conditions:
- if you contest the accuracy of your personal data for a period that allows the controller to verify the accuracy of the personal data;
- the processing is unlawful, and you refuse the erasure of your personal data and instead request the restriction of the use of your personal data;
- the controller no longer needs your personal data for the purposes of processing, but you need it to establish, exercise, or defend legal claims; or
- if you have objected to the processing pursuant to Art. 21 (1) GDPR, and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
If the processing of your personal data has been restricted, those data may be processed – apart from storage – only with your consent, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.
If the restriction of processing is lifted under the above-mentioned conditions, you will be informed by the controller before the restriction is lifted.
Your right to restrict processing may be restricted to the extent that it is likely to make the achievement of research or statistical purposes impossible or seriously impair them, and the restriction is necessary for the achievement of the research or statistical purposes.
Right to erasure
Duty to delete
You may request that the data controller immediately erase the personal data concerning you, and the data controller shall immediately erase the personal data, provided that one of the following applies:The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.You object to the processing pursuant to Art. 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.The personal data concerning you have been unlawfully processed.The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.The personal data concerning you have been collected in relation to services of the information society offered pursuant to Art. 8(1) GDPR.
Information to third parties
If the controller has made personal data relating to you public and is obliged to erase that personal data pursuant to Article 17(1) of the GDPR, the controller shall take reasonable steps, including technical measures, to inform other data controllers who are processing the personal data that you, as the data subject, have requested the erasure by them of any links to, or copy or replication of, that personal data.
Exceptions
The right to erasure does not apply to the extent that processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; by reason of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in the section „Obligation to erase“ is likely to render impossible or seriously impair the achievement of the objectives of that processing, or for the establishment, exercise or defence of legal claims.
Right to information
If you have asserted your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to inform all recipients to whom personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed about these recipients by the controller.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, common, and machine-readable format. Furthermore, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data have been provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out using automated procedures.
In exercising this right, you also have the right to obtain the transfer of your personal data from one controller to another, insofar as this is technically feasible. The freedoms and rights of others must not be affected by this.
The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right of objection
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The controller shall cease processing the personal data concerning you unless they can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling where it is related to such direct marketing.
If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object using automated procedures that employ technical specifications.
You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR.
Your right to object may be restricted to the extent that it is likely to make the achievement of research or statistical purposes impossible or seriously impair them, and the restriction is necessary for the fulfillment of the research or statistical purposes.
Right of withdrawal of the data protection consent declaration
You have the right to revoke your data protection consent declaration at any time. Revoking your consent does not affect the lawfulness of processing carried out based on the consent prior to revocation.
Automated individual decision-making, including profiling
You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for the conclusion or performance of a contract between you and the controller, is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or is based on your explicit consent.
However, these decisions may not be based on special categories of personal data within the meaning of Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
In the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to human intervention on the part of the controller, to express your point of view, and to contest the decision.
Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority with which the complaint was lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
Responsible data protection supervisory authority:
Bavarian State Commissioner for Data Protection
Wagmüllerstraße 18
80538 Munich
Phone: +49 89 212672-0
Fax: +49 89 212672-50
E-Mail: poststelle@datenschutz-bayern.de
