Source: https://www.cmmc-uni-koeln.de/contact-services/privacy-policy/
Timestamp: 2019-04-26 08:36:43+00:00

Document:
referred to hereinafter as “controller” or “we”.
No data protection officer has been appointed by the CMMC.
Please be aware that you may be redirected to other Internet pages via links on our website which other pages are not operated by use but by third parties. We either clearly mark such links or you can recognise them by the change of URL in your browser. We are not responsible for compliance with the applicable data protection regulations and secure handling of your personal data by third parties operating such other webpages.
Cookies are text files which a website places on your terminal or which are read there. They contain letter- and number combinations to facilitate, for instance when a connection is again established with the website that places the cookies, the recognition of the user and his settings, to enable you to stay logged in to a customer account or to conduct statistical analyses of a certain user behaviour.
We only process personal data to the extent this is permitted by law. Disclosure or transfer to third parties takes place only in the cases described below (see sec. 4 below).
The personal data is deleted or protected by technical and organisational measures (e.g. pseudonymisation, encryption) as soon as the data processing purpose ceases to exist. This is also the case as soon as a prescribed storage period expires unless continued storage of the personal data is necessary for the purpose of conclusion or performance of a contract.
Unless we are obliged by law to ensure extended storage or disclose or transfer personal data to third parties (including but not limited to criminal prosecution authorities), the decision which personal data is collected by us, how long it is stored and to which extent you may be required to disclose your data depends on which functions and features of the website you in particular cases.
Using the website and its functions and features, as a rule, requires the processing of certain personal data.
The personal data is stored for a period of 2-4 weeks. We do not combine the personal data with other data sources. We do not disclose or transfer the personal data to third parties. The data is only disclosed or transferred to third parties if and to the extent this is necessary for operating our website. For such purpose, the personal data is transferred to the Federmann und Kampczyk design gmbh | www.federmann-kampczyk.de and Host. It is not intended to transfer personal data to a third country or an international organisation.
When you access our website, so-called Web Fonts are downloaded to ensure uniform display of various fonts. This content is provided by fonts.com, a service of Monotype, Horexstraße 30, 61325 Bad Homburg, Germany. When you access our website, your browser loads the required web fonts to your browser cache to correctly display texts and fonts. For such purpose, the browser you use establishes a connection to the Monotype servers. Monotype thereby becomes aware that our website was accessed from your IP address.
Web fonts are used for the purpose of uniform and appealing presentation of our website. This constitutes a legitimate interest within the meaning of Art. 6 subs. 1 f) GDPR.
Your IP address is collected by us to enable the transmission to Monotype. If your browser does not support web fonts or you deactivate this function, no data transfer takes place.
We use Google Maps to ensure an appealing and comfortable design of our website; Google Maps helps to find the locations which we refer to in our website. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).
We collect your IP address to enable data transfer to Google. You are not obliged to provide this personal data; however, if you do not provide this data, you will not be able to use certain parts of our website (pages: “How to get there”, Ernst Klenk Sympoisum 2018 – “Venue”).
We use the YouTube plug-in to ensure an appealing design of our website and enable the display of video contents. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).
We collect your IP address to enable data transfer to YouTube. You are not obliged to provide this personal data; however, if you do not provide this data, you will not be able to use certain parts of our website (pages: The Summer Song „Clever in Sonne und Schatten“)).
We use Google Analytics for the purposes of economic optimisation and to tailor our website to suit the customers’ demands. This is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR. In addition, we have concluded a contract with Google for data processing on behalf and we fully implement and comply with the strict requirements of the German data protection authorities when we use Google Analytics. Data transfer to the USA is made in accordance with the EU Commission Implementing Decision (EU) 2016/1250 (EU-U.S. Privacy Shield).
When you write us an email, we will process the personal data you have provided thereby. This information is transmitted by your email client and stored in our information technology systems. The processing of this personal data is necessary to answer your request. In addition, your IP address as well as the data and time of your request will be stored if you write us an email.
Data processing serves to answer your request and prevent misuse of the contact form and ensure the security of our information technology systems. These processing activities are lawful because answering your request and the protection of our information technology systems are legitimate interests/is a legitimate interest in terms of Art. 6 subs. 1 f) GDPR.
The personal data is stored as long as this is required for answering your request. If your request should bring about subsequent contract conclusion, the data is stored as long as this is required for taking steps prior to entering into a contract or for the performance of the contract. We do not combine this personal data with other data sources. The data is not disclosed or transferred to third parties. It is not intended to transfer the data to a third country or an international organisation. You are not obliged to provide this personal data; however, if you do not provide this data, you cannot send an email.
You can log into your personal account on our website. If you do so, your browser will transfer the personal data which you enter there to us and we store it in our information technology systems. If you do this, your IP address and the time of login will be saved. When you log in to your personal account, our website places cookies on your terminal to enable you to stay logged in even if you have to load the website anew in the meantime.
The processing of the personal data you have entered serves to allocate future usage activities. This processing is legal because it is necessary for the performance of the respective contract in accordance with Art. 6 subs. 1 b) GDPR. It is necessary to store your IP address and the time of registration to ensure the security of our information technology systems. This is at the same time our legitimate interest which renders the processing permissible according to Art. 6 subs. 1 f) GDPR.
We will store the personal data you have entered until your personal account kept with us is cancelled. The cookies expire when you log out. We do not combine this personal data with other data sources. We do not disclose or transfer the data to third parties. It is not intended to transfer the data to a third country or an international organisation. You are not obliged to provide this personal data; however, if you do not provide this data, you cannot use a personal account.
You can register on our website for online portals (e.g. "My IPMM Curriculum Online Portal"), events, seminars or workshops, book seminar rooms, register for the use of our microscopy facility or reserve them online. If you do this, the personal data you provide during registration/booking will be transmitted to us by your browser and stored in our information technology systems. If you are already registered with us, it is sometimes sufficient to enter your e-mail address and password, otherwise we will use the personal data from your registration.
The processing of the personal data entered by you serves the purpose of preparing and conducting the seminars/events/workshops in which you would like to participate or to enable the use of our microscopy equipment as well as the execution of the reservation for seminar rooms. These processing operations are legal because they are necessary for the performance of the respective contract in accordance with Art. 6 subs. 1 b) GDPR. The storage of IP address and time of registration serves the purpose of ensuring the security of our information technology systems. This is also in our legitimate interest, which is why processing is permissible under Art. 6 subs. 1 f) GDPR.
The personal data provided by you will be stored until after the implementation of the Se Minimal. We do not combine this personal data with other data sources. Data is only passed on if this is necessary for the execution of the seminar/workshop/event or the provision of seminar rooms (e.g. to cooperation partners providing the rooms). A transfer to a third country or to an international organisation is not intended. You are not obliged to provide this personal data, but registration for seminars/workshops/events, booking of seminar rooms, use of the microscopy facility and reservation for these is not possible without such provision.
You as the person concerned (hereinafter “data subject”) are entitled to a right to information according to Art. 15 GDPR, a right to rectification according to Art. 16 GDPR, a right to erasure according to Art. 17 GDPR, a right to restriction of processing according to Art. 18 GDPR as well as a right to data portability according to Art. 20 GDPR. The right to information as well as the right to erasure are subject to the restrictions under §§ 34, 35 BDGS (German Federal Data Protection Act). In addition, you are entitled to lodge a complaint with a supervisory authority (Art. 77 GDPR in combination with § 19 BDSG).
No automated case-by-case decisions are taken, including profiling.
We will inform all recipients to whom your personal data was disclosed of any rectification or erasure of your personal data or any restriction of processing according to Art. 16, Art. 17 subs. 1 and Art. 18 GDPR unless it is impossible or requires unreasonable effort to inform them.
We will also inform you about the identity of the recipients at your request.
You are entitled under Art. 7 subs. 3 sentence 4 GDPR to at any time withdraw your consent. However, the withdrawal will leave the lawfulness of the processing that has taken place with your consent before the withdrawal unimpaired. Thus, the withdrawal only takes effect for the processing intended for the time after the withdrawal. The withdrawal can be made informally, by posted letter or email. If you oppose the processing, we will no longer process your personal data unless this is permitted by another (legal) basis. If you oppose the processing and there is no other legal basis which permits continued processing, we are obliged under Art. 17 subs. 2 b) GDPR to erase your personal data without undue delay (“unverzüglich”) upon your request.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 § 19
 Art. 16
 Art. 17
 Art. 18
 Art. 7
 Art. 17