I. Contact details of the person responsible (hereinafter “data controller”)

II. Contact details of the Data Protection Manager

III. General information on data processing

IV. Provision of the website and creation of log files

V. Utilization of Cookies

VI. Rights of data subject

I. Contact details of the data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is the

Helmholtz-Zentrum für Umweltforschung GmbH – UFZ (Helmholtz Centre for Environmental Research – UFZ)

Permoserstraße 15

04318 Leipzig

Deutschland

phone.: 0341/ 235-0

email: info@ufz.de

website: www.ufz.de

II. Contact details of the Data Protection Manager

The Data Protection Manager

Permoserstraße 15

04318 Leipzig

Germanyphone: 0341/ 235-1271

email: datenschutz@ufz.de

website: www.ufz.de

III. General information on data processing

1. Scope of processing of personal data

We process personal data of our users only to the extent necessary to provide a functioning website as well as our contents and services. In the case of processing personal data of our users, we will obtain the prior consent of the user. An exception applies in those cases where prior consent can not be obtained for genuine reasons and the processing of the data is permitted by law.

2. Data deletion and storage period

The affected individual's personal data will be deleted as soon as the purpose of the storage no longer applies. In addition, storage can also occur if provided for by European or national legislators in EU regulations, acts or other legislation to which the data controller is subject. The data shall also be blocked or deleted if a storage period prescribed by one of the aforementioned norms expires, unless it is necessary for further storage of the data for the conclusion or the fulfillment of a contract.

IV. Provision of the website and creation of log files

1. Description and scope of the data processing

Each time our website is accessed, our system automatically records data and information from the computer system of the accessing computer.

The following data are collected:

• websites from which the file was requested,

• name of the file,

• date and time of the query

• amount of the data transferred,

• access status (file transferred, file not found)

• information about the web browser used

• IP address of the requesting computer

The data are likewise stored in our system's log files. These data are not stored together with other personal data of the user.

2. Legal basis for the data processing

The legal basis for the temporary storage of the data and the log files is Article 6 para. 1 lit. f GDPR.

3. Purpose of the data processing

The temporary storage of log files takes place in order to ensure the functionality of the website. We additionally use the data to optimize the website, to eliminate malfunctions and to ensure the security of our information technology systems. Our justified interest in data processing pursuant to Article 6 para. 1 lit. f GDPR also lies in such purposes.

4. Storage period

The data will be deleted as soon as they are no longer necessary for the purpose of their collection. When data is collected in order to enable the functioning of the website, the data will be deleted as soon as the respective session has ended.
Data in log files are stored for security reasons (e.g. to investigate misuse or fraud) for a maximum period of 31 days and then be deleted. Data whose further storage is required for evidentiary purposes are excluded from deletion until the respective incident has been finally clarified.

5. Possibility of objection and removal

The recording of data for the provision of the website and storage of the data in log files is vital to the operation of the website. The user consequently has no possibility to object.

V. Utilization of Cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are saved on the user's computer system in or by the browser software. If a user accesses a website, a cookie can be stored on their operating system. This cookie contains a unique identification code that enables the user's browser to be recognized when the user revisits the website. 

We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identifiable even after the user has gone to a different site. 

The cookies save and transmit the following data:

(1) Shopping cart for image download from the image database

(2) Log-in information for web services

(3) Session information for web services

2. Legal basis for data processing

The legal basis for using cookies to process personal data is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

We use cookies for technical reasons in order to make use of the website easier for users. Without cookies, some of the functions of our website will not work. These functions require that, when you return to our website, your browser is recognized.

We need cookies for the following uses:

(1) Shopping cart for image download from the image database

(2) Log-in information for web services

(3) Session information for web services

The user data we collect for technical purposes via cookies is not used to create user profiles. These purposes also constitute our legitimate interest in the processing of personal data as per art. 6 para. 1 lit. f GDPR.

4. Duration of storage; objection and removal

Cookies are saved on the user's computer and transferred from there to our site. Therefore you as user have full control over the use of cookies. By adjusting your browser settings you can deactivate or restrict the transfer of cookies. Cookies already saved can be deleted at any time and they can also be deleted automatically, but deletion may result in restricted usability of some of the functions of our website.

VI. Rights of data subject

If your personal data is processed, you are a data subject in the sense intended by the GDPR and you have the following rights in your relationship with the data controller:

1. Right to be informed (Art. 15 GDPR)

If your data is being processed, you have the right to the following information from the data controller:

(1) The purposes for which the personal data is being processed;

(2) The categories of personal data being processed;

(3) The recipients or categories of recipients to whom your personal data has been or will be disclosed;

(4) The intended duration of storage of the personal data or, if this information is not available, the criteria for determining the duration;

(5) The existence of your right to the correction or deletion of your personal data, your right to the restriction of its processing by the data controller and your right to object to such processing;

(6) The existence of your right to complain to the supervisory authorities;

(7) All available information on the origin of the data insofar as the data was not collected from the data subject;

You have the right to know if your personal data is transferred to a non-EU country or an international organisation. In this context you have the right to be informed of the relevant guarantees that under art. 46 GDPR are to be provided for the transfer of data. 

2. Right to correction, Art. 16 GDPR

You have the right to have your personal data corrected or completed by the data controller, in case your personal data are wrong or incomplete. Correction must be carried out by the data controller immediately.

3. Right to restriction of processing, Art. 18 GDPR

You have the right to the restriction of the processing of your personal data subject to the following criteria:

(1) You dispute the accuracy of your personal data for a period of time that allows the data controller to check the accuracy of the data concerned;

(2) The processing is unlawful and you decline to have the personal data deleted and instead request that the use of the data be restricted;

(3) The data controller no longer requires the personal data for the purposes originally intended but nonetheless needs it for the assertion of rights or the bringing of or defense against claims; or

(4) You have objected to processing as per Art. 21 para. 1 GDPR and it has not yet been established whether the legitimate interests of the data controller outweigh your interests.

Where the processing of your personal data is restricted, this data may (apart from being stored) be processed only with your consent or for the assertion of rights or the bringing of or defense against claims or for the upholding of the rights of another natural or juristic person or on the grounds of significant public interest within the European Union or a member state.

Where processing is restricted in accordance with the aforementioned criteria, the data controller will inform you prior to the removal of such restriction. 

4. Right to deletion, Art. 17 GDPR

a) Obligation to delete

You have the right to the immediate deletion of your personal data by the data controller, provided that:

(1) The data concerned is no longer required for the purposes for which it was originally collected or has otherwise been processed;

(2) You revoke the consent on which under Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR processing was based and there is no other legal basis for the processing.

(3) You object to processing under Art. 21 para. 1 GDPR and there are no legitimate grounds for processing that take priority, or your objection to processing is based on Art. 21 para. 2 GDPR;

(4) Your personal data has been processed unlawfully;

(5) The deletion of your personal data is necessary for compliance with a legal obligation under European Union law of the law of a member state to which the data controller is subject;

(6) Your personal data has been collected in relation to services offered as part of the information society as per Art. 8 para. 1 GDPR.

b) Sharing of information with third parties

Where the data controller has published your personal data and is required under Art. 17 para. 1 GDPR to delete it, it must, with due regard to the technology available and the costs of implementation, put in place appropriate measures (including technical ones) to inform those responsible for processing your personal data that you, the data subject, have exercised your right to have all links to or copies of your personal data deleted.

c) Exceptions

You have no right to the deletion of your personal data where its processing is required:

(1) For the exercise of the right to freedom of expression or information;

(2) For compliance with a legal obligation that makes processing necessary under the law of the European Union or the law of a member state to which the data controller is subject or for compliance with an order in the public interest or with an official requirement to which the data controller is subject;

(3) For reasons of public interest as it relates to public health as per Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;

(4) For archiving purposes or scientific or historical research purposes that are within the public interest or for statistical purposes as per Art. 89 para. 1 GDPR, insofar as the rights specified under a) are likely to make the realisation of the aims of this processing impossible or jeopardize it; or

(5) For the assertion of or defense against claims or the exercise of rights.

5. Right to be informed

If you exercise your rights to have the data controller correct or delete your personal data or to restrict its processing, the data controller must inform all recipients to whom your personal data has been disclosed that you have exercised the aforementioned rights, unless to do so is impossible or would involve disproportionate cost or effort.

You have the right to be informed by the data controller who these recipients are.

6. Right to data portability, Art. 20 GDPR

You have the right to receive in a current, structured and machine-readable form the personal data that you have provided to the data controller. You also have the right to transfer this data to another data controller without hindrance by the data controller to whom you provided the data, provided:

(1) The processing is based on consent under Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract as per Art. 6 para. 1 lit. b GDPR; 

(2) The data processing is automated.

In exercising this right you further have the right, insofar as is technically feasible and insofar as the rights and freedoms of third parties are not infringed, to have your personal data transferred directly from one data controller to another.

The right to data portability does not apply where personal data needs to be processed in order to comply with an order in the public interest or that is required on official orders to which the data controller is subject. 

7. Right to object, Art. 21 GDPR

You have the right at any time and on grounds unique to you to object to the processing of your personal data as based on Art. 6 para. 1 lit. e or lit. f GDPR.

The data controller will then cease to process your personal data unless it can prove compelling grounds for processing that outweigh your interests, rights and freedoms or unless the processing serves the assertion of or defense against claims or the exercise of rights.

In connection with the use of information society services, and regardless of Directive 2002/58/EC, you can exercise your right to object by using automated processes for which technical specifications are used. 

8. Right to revoke your declaration of consent as given under data protection law, Art. 7 para. 3 GDPR

You have the right to revoke at any time your declaration of consent as given under data protection law. Such revocation will not affect the lawfulness of any data processing carried out prior to the revocation on the basis of your consent. 

9. Right to complain to a supervisory authority, Art. 77 GDPR

Without prejudice to any other legal or judicial remedy, you have the right to complain to a supervisory authority, especially one in the EU member state where you live or work or where the alleged infringement has taken place, if you believe that the processing of your personal data is in breach of the GDPR. 

The supervisory authority to which the complaint is submitted will keep you informed as to the status and outcome of your complaint, including your options for judicial remedy as per Art. 78 GDPR.