Source: https://www.hiig.de/en/data-protection-policy/
Timestamp: 2019-04-26 15:45:09+00:00

Document:
We only process personal data of users of our website if this is necessary to provide a functional website as well as our contents and offers. The processing of personal data of users of our website only takes place if the processing of the data is permitted by legal regulations. The processing of personal data is geared to the objective of protecting fundamental rights and freedoms (Article 1(2) GDPR).
If processing is necessary to safeguard a legitimate interest of HIIG or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Article 6(1)(f) GDPR serves as the legal basis for processing.
Every time you visit our website, our system automatically collects data and information from the computer system of the client computer.
The data is also stored in the log files of our system and will be deleted after 60 days. This data is kept separated from other personal data of the user.
All websites except for www.hiig.de are hosted at Mittwald. IP addresses are anonymized there by removing the last three digits. For further information see also Mittwald's data protection declaration.
The temporary storage of the IP address by our system is necessary to enable the website to be delivered to the user's computer. For this the IP address of the user must be kept for the duration of the session.
The data is stored in log files to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our IT systems. An evaluation of the data for marketing purposes does not take place in this context.
If the data is stored in log files, this is the case after 60 days at the latest.
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. According to Art. 21 para. 1 sentence 2 1st alternative GDPR there is therefore no possibility to object on the part of the user.
We use procedures to make our website more user-friendly and to increase the security of the website. Some elements of our website require that the calling browser can be identified even after a page change.
We also incorporate external fonts from Google Fonts and media, including sound recordings and videos, such as YouTube and Twitter’s Periscope and maps from Google Maps.
We use Google ReCaptcha to protect against comment spam and attacks on our login page.
The data will not be stored together with other personal data of the user.
The legal basis for processing personal data to improve the user experience is Art. 6 para. 1 lit. f GDPR.
When integrated content is called up, personal data is transmitted to the provider of this content, among other things. The access to these contents is subject to the full control of the users. By changing the settings in your browser, you can deactivate or restrict the access to external content, either directly in the browser or with the help of uBlock Origin or NoScript.
The integration of Google ReCaptcha is mandatory for the security of the website if you want to comment on articles on the website or log in. According to Art. 21 para. 1 sentence 2 1st alternative GDPR there is therefore no possibility of objection on your part.
We use the web analytics tool Matomo to improve the quality of our website and its content.
If you have activated 'Do Not Track' in your browser or set the following opt-out cookie, no personal data will be collected, stored or used for usage analysis.
The IP address is shortened to 2 bytes directly during the collection and thus anonymized.
The analytical tool is used to improve the quality of our website and its content. This tells us how the website is used and enables us to continually optimise our offering.
The web analytics cookie with unique ID is valid until the end of the browser session. The IP address is shortened to 2 bytes directly during the survey and thus made anonymous. This means that at the latest after the end of your browser session the data is no longer personal.
You can activate 'Do Not Track' in your browser or set the following opt-out cookie to prevent the collection, storage and use of personal data for usage analysis. The opt-out cookie is valid for two years.
For the processing of the data, reference is made to this data protection declaration as part of the registration process.
In connection with data processing for the dispatch of newsletters and event announcements, the data is passed on to MailPoet and SendGrid. The data will only be used for sending newsletter and event announcements, see also MailPoet's and SendGrid’s privacy notice.
For www.elephantinthelab.org Mailchimp is used instead.
The legal basis for the processing of the data after registration for the newsletter and entry on the list of events by the user is Art. 6 para. 1 lit. f GDPR.
The collection of the user's email address serves to deliver the newsletter or the event announcements. The collection of first and last names serves to personalize these messages. The collection of the desired language serves to ensure that only messages in this language are delivered.
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. E-mail address, first name, surname and language of the user will be stored as long as the subscription to the newsletter or the list of events is active.
The subscription to the newsletter and the list of events can be cancelled by the user concerned at any time. For this purpose, there is a corresponding link in every newsletter and in every event announcement.
If you register for an event on our website and enter your e-mail address, we may subsequently use this to send you information about the event, e.g. changes in time or location or cancellation.
If you register on our website for an event in a event series and enter your e-mail address, this can subsequently be used by us to send information on this event, e.g. time or place changes or cancellations, as well as on other events in this series.
In some cases, it may be possible to register on third party websites (e.g. Meetup or Facebook) for events held at or co-organized by HIIG. The data protection regulations of the respective provider apply to these external websites.
The purpose of data processing is to organise and carry out events, to inform participants about changes or the cancellation of the event, as well as other events in the same series.
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. This is regularly the case after the end of the event or series of events, for individual data at the latest, however, after expiry of the billing and documentation obligations.
If you do not wish to receive further information about other events of the respective event series, simply unsubscribe from the list. For this purpose, each event announcement contains a corresponding link to the relevant series.
The legal basis for the processing of data in the context of job applications is Art. 6 para. 1 lit. b GDPR.
The legal basis for the processing of data in the context of fellowship applications is Art. 6 para. 1 lit. f GDPR.
The purpose of data processing is the electronic submission and examination of applications and application documents for advertised positions and fellowships.
If the application is for employment within the scope of a project, the data will be deleted three months after the end of the project if the application is rejected, and six months after the end of the application procedure if the application is not project-related.
Upon request, we will delete the stored data before the end of the storage period, provided there is no longer storage due to commercial, tax or social security law storage obligations.
In the event of employment, the application documents will be deleted three years after termination of employment, provided that there is no longer retention due to commercial, tax or social security retention obligations.
You have the right to request information from us as to whether we process the personal data relating to you. In a positive case, this also includes information about the data relating to you, as well as the information specified in Art. 15 para. 1 lit. a to h GDPR.
You have the right to request us to correct any data relating to you if it is inaccurate.
You have the right to request us to restrict the processing of data relating to you if this request is covered by one of the reasons in Art. 18 para. 1 lit. a to d GDPR.
You have the right to request us to delete the data relating to you, provided that this request is covered by one of the reasons in Art. 17 para. 1 lit. a to f GDPR and none of the exceptions in Art. 17 para. 3 lit. a to e GDPR applies.
You have the right to ask us to inform you of the parties to whom we have transmitted data relating to you, unless this involves disproportionate effort on our part.
They have the right to data transferability if data processing is carried out using automated procedures and the legal basis is Article 6(1)(b) GDPR.
You have the right to object to the processing insofar as the legal basis of the processing is Art. 6 para. 1 lit. e or f GDPR.
You have the right to lodge a complaint with any supervisory authority if you believe that the processing of data relating to you is illegal.

References: Art. 21
 Art. 6
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 18
 Art. 17
 Art. 17
 Art. 6