Source: https://www.wiwi.uni-due.de/en/datenschutz/
Timestamp: 2019-04-25 09:48:43+00:00

Document:
We generally process personal data of our users only to the extent that this is necessary to ensure the functioning of our websites and to provide our contents and services. As a rule, the processing of personal data of our users will always be subject to their prior consent. An exemption applies where it is not possible to obtain prior consent for factual reasons and the data processing is permitted by law.
Where we obtain the data subject’s consent to the processing of personal data, the legal basis is provided by Art. 6 (1) (a) General Data Protection Regulation (GDPR).
Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, the legal basis is provided by Art. 6 (1) (b) GDPR. This also applies to any processing required in order to take steps prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is provided by Art. 6 (1) (c) GDPR.
Where the vital interest of the data subject or another person requires the processing of personal data, the legal basis is provided by Art. 6 (1) (d) GDPR.
Where the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party and where such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, the legal basis for the processing is provided by Art. 6 (1) (f) GDPR.
We will erase or block the personal data of a data subject as soon as the specific purpose of retention ceases to exist. A further retention may happen where this is required by European or national lawmakers in EU regulations, national laws or other provisions applying to the data controller. We will also block or erase the data upon expiry of a legal retention period stipulated in any of the rules referred to above, unless it is still necessary to retain the data for concluding or performing a contract.
Each time you visit our websites our system will automatically collect data and information from the computer system you use.
However, when storing these data they will not be linked with any other personal data of the user. Accordingly no personal Information is saved.
Our websites use so-called session cookies. Session cookies are small text files that are stored in a user’s computer memory. Each session cookie contains a random unique identification number, called session ID. Moreover, cookies hold information about their origin and the retention period. These cookies can not save other data.
The legal basis for data processing by using cookies is provided by Art. 6 (1) (f) GDPR.
The purpose of using technically necessary cookies is to make it easier for users to navigate the websites. Some functions of our websites cannot be offered without these cookies. They require that the browser is recognised after a page change.
User data collected by technically necessary cookies will not be used for the creation of user profiles.
The session cookies we use are essential for the functioning of our websites and are deleted as soon as you end your session.
Not applicable for the websites we maintain. You can find Information about the data protection regrading the newsletter of the university in the central data protection information of the UDE.
Date and time of the message.
We do not disclose any data to third parties in this context.
The legal basis for processing data is provided by Art. 6 (1) (a) GDPR where the user has given consent.
The legal basis for processing data submitted by sending an email is provided by Art. 6 (1) (f) GDPR.
Where the email communication is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR.
Personal data from the input mask are only processed for the purpose of processing the intention specified in the form.
All other personal data processed during the submission process serve the purpose of avoiding misuse of our contact form and ensuring the safety of our IT systems.
We will delete the data as soon as they are no longer necessary in relation to the purposes for which they were collected. This is the case for general contact forms, if the respective user conversation has ended. The data of login forms will be deleted, if the registration period is over and the applicants are assigned. In case of an application to university, the data is saved for up to twelve month past the date of confirmation or rejection.
Users have the right to withdraw consent to the processing of their personal data at any time. Where users contact us per email, they may object to the storage of their personal data at any time. The conversation cannot be continued under these circumstances.
In such a case all personal data stored in the course of the communication will be deleted.
For accessing these channels it is necessary that the user’s IP address becomes visible to the providers, because without the IP address no content can be delivered to the browser of the specific user. This means that the IP address is necessary for displaying these contents. We cannot influence whether and how third-party providers save and use IP addresses.
Our websites use social plugins (“plugins”) of the social online network Google, operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.
Where you access a page of our websites containing such a plugin, your browser will establish a direct connection with Google’s servers. The content of the plugin is submitted directly to your browser by Google and thus integrated into the website services.
You may find YouTube videos integrated into the websites of University of Duisburg-Essen. As a rule, this requires that the user’s IP address becomes visible to the provider, because without the IP address no content can be delivered to the browser of the specific user. This means that the IP address is necessary for displaying these contents. We cannot influence whether and how third-party providers save and process IP addresses.
You may obtain from the controller confirmation as to whether or not we process any personal data concerning you.
(6) The right to lodge a complaint with a supervisory authority.
(8) The existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to obtain information whether the personal data concerning you are disclosed to third countries or international organisations. In this context you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR with regard to the transfer.
This right to access may be limited in so far as it is likely to render impossible or seriously impair the achievement of specific research or statistical purposes, and where such a limitation is necessary for the fulfilment of those purposes.
You have a right to obtain from the controller the rectification and/or completion, where the processed personal data concerning you are inaccurate or incomplete. The controller must undertake the rectification without delay.
Your right to rectification may be limited in so far as it is likely to render impossible or seriously impair the achievement of specific research or statistical purposes, and where such a limitation is necessary for the fulfilment of those purposes.
(4) You have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your interest.
Where restriction of processing has been obtained under the conditions above, you will be informed by the controller before the restriction of processing is lifted.
Your right to restriction of processing may be limited in so far as it is likely to render impossible or seriously impair the achievement of specific research or statistical purposes, and where such a limitation is necessary for the fulfilment of those purposes.
(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8 (1) GDPR.
Where the controller has made public the personal data concerning you and is obliged pursuant to Art. 17 (1) GDPR to erase them, the controller, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform data controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Where you have exercised your right to rectification, erasure or restriction of processing, the controller is obliged to communicate any rectification or erasure of personal data concerning you or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
You also have the right to be informed about these recipients by the controllers.
In exercising this right you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The rights and freedoms of others may not be affected adversely hereby.
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6 (1) (e) or (f) GDPR, including profiling based on those provisions.
The controller will no longer process the personal data concerning you, unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purposes of establishing, exercising or defending legal claims.
Where you object to processing for direct marketing purposes, the personal data concerning you are no longer processed for such purposes.
You also have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you, where these are processed for scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR.
Your right to object may be limited in so far as it is likely to render impossible or seriously impair the achievement of specific research or statistical purposes, and where such a limitation is necessary for the fulfilment of those purposes.
You have the right to withdraw consent given under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
However these decisions must not be based on special categories of personal data referred to in Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in points (1) and (3) above, the data controller implements suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 17
 Art. 89
 Art. 9
 Art. 9