Privacy Policy

We collect your data, in part, when you provide it to us. This may include, for example, data you enter into a contact form or provide in a chat. Other data is automatically collected by our IT systems when you visit the website. Mittwald, as the provider of our website, automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This includes:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is generally not combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR.

As the website operator, KLU has a legitimate interest in ensuring that its website functions properly and is optimized—to this end, server log files must be collected.

Contacting Us

When you contact us (e.g., by mail, email, contact forms, chat, phone, in person, etc.), we store the personal data you provide. We process this data to handle your inquiry. We do not share this data without your consent. The processing of the aforementioned personal data is based on your consent (Art. 6 (1) a GDPR). You may revoke this consent at any time. To do so, simply send us an informal email. The lawfulness of the data processing operations carried out prior to revocation remains unaffected by the revocation.

The data you provide when contacting us will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Registration on this Website

You can register on our website to access additional features. We use the data you provide solely for the purpose of providing the specific service or offering for which you have registered. The required information requested during registration must be provided in full. 
Otherwise, we will decline your registration. For important changes, such as to the scope of our offerings or for technically necessary changes, we will use the email address provided during registration to inform you.

The processing of the data entered during registration is based on your consent (Art. 6 (1) a GDPR). You may revoke your consent at any time. To do so, simply send us an informal email. The lawfulness of any data processing that has already taken place remains unaffected by the revocation. We will store the data collected during registration for as long as you remain registered on our website, after which it will be deleted. Statutory retention periods remain unaffected.

General Information on Analytics Tools and Third-Party Tools

We use analytics tools and third-party tools on this website. We would therefore like to inform you about the general implications of their use: When you visit our website, your browsing behavior may be statistically analyzed. This is primarily done using cookies and so-called analytics programs. The analysis of your browsing behavior is generally anonymous; your browsing behavior cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. You can find detailed information on this in the following privacy policy. You can object to this analysis.

We will inform you about the options for objecting further down in this privacy policy.

Applications at KLU (Jobs, degree programs, continuing education programs)

When you submit an application to us, we process the associated personal data (e.g., contact and communication details, application documents, notes taken during interviews, etc.) to the extent necessary to make a decision regarding your application. The legal basis for this is Article 6(1)(b) of the GDPR—and, if you have given your consent, Article 6(1)(a) of the GDPR. Consent may be revoked at any time with future effect.
Your personal data will be shared within our company exclusively with individuals involved in processing your application. We process your data in our human resources and student management systems. We have entered into a data processing agreement with the service providers in accordance with Article 28 of the GDPR, but we remain the data controller. Your application is processed exclusively internally and within Germany; it is not disclosed to third parties.

If we are unable to make you an offer or if you withdraw your application, withdraw your consent to data processing, or request that we delete the data, your application documents and data will be retained for a maximum of 6 months after the conclusion of a hiring process. When you apply for a place in a degree program or for a continuing education certificate course, your documents will be retained for a maximum of two years so that we can review the details of the application process in the event of discrepancies or objections (Art. 6(1)(f) GDPR).

Once the retention period has expired, the data will be deleted unless there is a legal obligation to retain it or another legal basis for further storage. If it becomes apparent that the retention of your data will be necessary after the retention period has expired (e.g., due to an impending or pending legal dispute), deletion will not take place until the data is no longer relevant. Other statutory retention obligations remain unaffected.

Full Fabric

We use “Full Fabric” as a Software as a Service (SaaS) solution. The provider is Full Fabric, 1 Primrose Street, London, EC2A 2EX.

The software solution is used to initiate and carry out the study program in accordance with Art. 6 (1) b GDPR. We have entered into a data processing agreement with Full Fabric pursuant to Art. 28 GDPR but remain the controller.

The purpose of data processing is to provide a portal through which prospective students can create and complete their application for admission to a degree program. In addition, certain staff members are to be able to access the documents and review the applications with a view to the final approval of enrollment. We also use Full Fabric to support students during the initial and academic phases of their studies, as well as in special situations, such as study interruptions, pregnancy and maternity leave, severe disabilities, impairments, hardship applications, immigration matters, etc.

Information on data protection at Full Fabric can be found here: https://www.fullfabric.com/privacy-policy.
 

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website visits, and other data generated via a website. The use of the host is intended to ensure the secure, fast, and efficient provision of our online services by a professional provider (Art. 6 (1) f GDPR).

Our hosting provider will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data. To ensure data protection compliance, we have entered into a data processing agreement with our hosting provider.

Our hosting provider collects so-called log file data transmitted by your browser: IP address, the address of the previously visited website (Referer request header), date and time of the request, content of the request, HTTPS status code, amount of data transferred, website from which the request originates, and information about the browser and operating system. This is necessary to display our website and to ensure stability and security in accordance with our legitimate interest pursuant to Art. 6(1)(f) GDPR. No tracking takes place, and we have no direct access to this data. The data is deleted as soon as the purpose of processing no longer applies.
 

For security reasons, and in particular to protect the transmission of confidential information–such as your personal data–this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock icon in your browser bar. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Our website uses cookies. Cookies are pieces of information that the website provider stores on the user’s device and can retrieve when the user visits the site again, in order to facilitate navigation or transactions, or to gather information about user behavior. Cookies do not harm your computer and do not contain viruses. Cookies help make our website more user-friendly, effective, and secure. Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit.

Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to exclude the acceptance of cookies for specific cases or in general, and to enable the automatic deletion of cookies when you close your browser. The legal basis for this is your consent pursuant to Art. 6 (1) a GDPR. Disabling cookies may limit the functionality of this website.

Cookies that are necessary for the execution of the electronic communication process or for the provision of certain functions you have requested (e.g., shopping cart functionality), are stored on the basis of Article 6(1)(f) of the GDPR.

The website operator has a legitimate interest in storing cookies to ensure the technically flawless and optimized provision of its services. To the extent that other cookies (e.g., cookies used to analyze your browsing behavior) are stored, these are addressed separately in this privacy policy.

General Information on Withdrawal of Consent and Objection (Opt-Out)

Depending on whether the processing is based on consent or legal authorization, you have the option at any time to withdraw your consent or to object to the processing of your data through cookie technologies (collectively referred to as “opt-out”). You can initially express your objection through your browser settings, e.g., by disabling the use of cookies (although this may also limit the functionality of our online offering). Objection to the use of cookies for online marketing purposes can also be expressed through a variety of services, particularly in the case of tracking, via the websites https://youradchoices.com/
and https://www.youronlinechoices.com.

In addition, you can find further information on how to opt out in the sections regarding the service providers we use and cookies. You can also prevent the collection and processing of your data by disabling script execution in your browser or by installing a script blocker (you can find one, for example, at www.noscript.net or www.ghostery.com).

Klaro! Cookie Consent Tool

We use Klaro! on our website, a cookie consent manager tool provided by the German company KIProtect GmbH, Bismarckstr. 10-12, 10625 Berlin, Germany, to obtain consent for the storage of certain cookies on end devices or for the use of certain technologies, and to document this in compliance with data protection regulations.

When you use our website, the following personal data is processed via Klaro!: your consent(s) or the revocation of your consent(s), your IP address, information about your browser, information about your device, the time of your visit to the website, and geolocation. Furthermore, Klaro! stores a cookie in your browser to be able to associate the consents you have given or their revocation with you. The data collected in this manner is stored until you request its deletion, delete the Klaro! cookie yourself, or the purpose for data storage no longer applies. Mandatory legal retention obligations remain unaffected.
Klaro! is used to obtain the legally required consents for the use of certain technologies. The legal basis for this is Art. 6 (1) c GDPR. Information on data protection can be found here: https://klaro.org/resources/privacy.

We maintain an online presence on social media platforms to inform users active on those platforms about our services and to communicate with them via those platforms if they are interested. Our social media channels can only be accessed via an external link. You can recognize the links by the typical buttons. These buttons do not have a “Share” or “Like” function; they are simply graphics that link to our corresponding social media channel. When you click on one of these buttons, the respective social media site is opened. The respective social network is informed that you have visited our website using your IP address. As soon as you access our social media profile on the respective network, the terms of service and data processing policies of the respective operators apply there. 

We have no control over the collection of data or its subsequent use by social networks. We have no information regarding the extent to which, the location where, or the duration for which the data is stored; the extent to which the networks comply with existing data deletion obligations; the analyses and linkages performed on the data; or to whom the data is disclosed. We therefore expressly draw your attention to the fact that your data (e.g., personal information, IP address) is stored by the operators of these networks in accordance with their data usage policies and used for business purposes. For details, please refer to the terms of use and privacy policies of the respective social media platforms.

Legal Basis

Our social media presence is intended to ensure the broadest possible online reach. This constitutes a legitimate interest within the meaning 
of Article 6(1)(f) of the GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g., consent within the meaning of Article 6(1)(a) of the GDPR).

Data Controller and Exercising Rights

When you visit one of our social media pages, we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may generally exercise your rights (right of access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint) against both us and the operator of the respective social media portal.

Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing activities of the social media platforms. Our options depend largely on the corporate policies of the respective provider.

Retention Period

Data collected directly by us through our social media presence is deleted from our systems as soon as the purpose for its storage no longer applies, you request its deletion, you revoke your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions — in particular retention periods — remain unaffected.

We have no influence over the retention period of your data that is stored by the operators of social networks for their own purposes. For details on this, please contact the operators of the social networks directly.

Links to LinkedIn 

Our website includes links to the social network LinkedIn. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. 
You can recognize the link by the LinkedIn logo.

Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by LinkedIn. If you do not want LinkedIn to associate this data with your account, you must log out of your LinkedIn account. 
For more information, please refer to LinkedIn’s privacy policy at: www.linkedin.com/legal/privacy-policy.

Links to Facebook

Our website includes links to the social network Facebook. The provider is Meta Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognize these links by the Facebook logo on our site. An overview of Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/.

Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Facebook. For more information, please refer to Facebook’s privacy policy at https://de-de.facebook.com/privacy/policy/.

If you do not want Facebook to associate your visit to our pages with your Facebook user account, please log out of your Facebook account.

Links to Instagram 

Our website contains links to the social network Instagram. The provider is Meta Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognize the link by the Instagram logo on our site.

Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Instagram. If you do not want Instagram to associate this data with your account, you must log out of your Instagram account. For more information, please refer to 
Instagram’s Privacy Policy: https://instagram.com/about/legal/privacy/.

Links to YouTube

Our website includes links to the social media platform YouTube. The provider is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. You can recognize these links by the YouTube logo on our site.
Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how YouTube uses it. If you do not want YouTube to associate this data, you must log out of your YouTube account.

For more information on the handling of user data, please refer to YouTube’s privacy policy at: policies.google.com/privacy and here https://support.google.com/youtube/answer/2801895?hl=de.

Links to Reddit

Our website contains links to the social network Reddit, operated by Reddit Inc., 520 Third Street, Suite 305, San Francisco, CA 94107, USA.

Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Reddit. If you do not want Reddit to associate this data with you, you must log out of your Reddit account.

For more information, please refer to Reddit’s Privacy Policy: https://www.reddit.com/policies/privacy-policy

Links to TikTok

Our website includes links to the social network TikTok: According to TikTok’s privacy policy, TikTok Technology Limited (“TikTok Ireland”) and TikTok Information Technologies UK Limited (“TikTok UK”) are responsible for the processing of personal data.

Please note that you use our TikTok page and its features at your own risk. This applies in particular to the use of interactive features (e.g., following, commenting, sharing, liking). When you visit our TikTok page and its content, TikTok collects, among other things, your IP address and other information stored on your computer in the form of cookies.

TikTok also stores information about its users’ devices. If you are currently logged into TikTok, a cookie containing your TikTok ID is stored on your device. This allows TikTok to track that you have visited this page and how you used it. The data collected about you in this context is processed by TikTok Technology Limited and transferred to countries outside the European Union. TikTok relies on the EU Standard Contractual Clauses for this purpose.

TikTok collects the following data about its users, among other things: profile data, user content and usage data, location data, and information about contacts/friends.

Some of this collected information is also used to provide us, as the operators of our TikTok page, with statistical data on how our content is being used. This includes, for example:

• Number of profile views
• Information about our followers (number of followers, demographic data)
• Information about our videos (number of views, number of likes, comments, and shares)

TikTok describes what information it receives and how it is used in its Privacy Policy (https://www.tiktok.com/legal/privacy-policy-eea?lang=de). You can find information and details about TikTok and how it works in TikTok’s Help Center (https://support.tiktok.com/de).

Privacy Notice for Our Facebook Page

We maintain a Facebook page: https://www.facebook.com/kuehnelogisticsuniversity/

The provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. We have entered into a joint processing agreement (Controller Addendum) with Facebook. This agreement specifies which data processing operations we and Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads. For details, please refer to Facebook’s Privacy Policy: https://www.facebook.com/about/privacy/.
Facebook Ireland Ltd (“Facebook”) provides us, as the operator of a Facebook fan page, with so-called “Facebook Insights” (“Insights”). Insights consist of various statistics that provide us with information about the use of our Facebook fan page.

Detailed information on this and the data processing involved can be found at https://www.facebook.com/business/a/page/page-insights and https://www.facebook.com/legal/terms/information_about_page_insights_data

We process Facebook Fanpage Insights data based on our legitimate interest in analyzing activity on our Fanpage and our marketing activities (ads, campaigns, posts); Article 6(1)(f) of the GDPR.
The legal basis and purposes of processing by Facebook Ireland can be found here:

Facebook Fan Pages and Insights (in German only)
https://www.facebook.com/about/privacy/legal_bases and
https://www.facebook.com/privacy/policy/

Facebook Fan Page Insights may be based on personal data collected in connection with a visit to or interaction with our Facebook Fan Page and its content, which means that personal data may also be processed by Facebook. You are not legally required to provide your personal data. However, providing such data may be necessary for the conclusion of a contract or for certain functions of the Facebook fan page. If you do not provide this data, a contract or a function on the Facebook fan page may not be available.

The key information regarding the agreement concluded between us and Facebook within the meaning of Article 26 of the General Data Protection Regulation can be found here: www.facebook.com/legal/terms/page_controller_addendum

The following parties are jointly responsible for processing Facebook Page Insights:

Facebook Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2, Ireland
https://www.facebook.com/help/contact/2061665240770586
https://www.facebook.com/help/contact/540977946302970

and Kühne Logistics University (KLU)

With regard to your personal data, you have the right to

• Access, Article 15 of the GDPR
• Rectification, Article 16 of the GDPR
• Erasure, Article 17 of the GDPR
• Restriction of processing, Article 18 of the GDPR, and
• Data portability, Article 20 of the GDPR.
• You also have the right to object to the processing of personal data, Article 21 GDPR. The objection may be made in any form. See information below.
• If you have given consent to the processing of personal data, you have the right to withdraw that consent with effect for the future, Article 7 GDPR.

In this context, Facebook Ireland primarily fulfills the information obligations under Articles 12 and 13 of the GDPR, as well as the obligations under Articles 15 through 21 of the GDPR and the obligations under Articles 33 and 34 of the GDPR. Data subjects may therefore exercise their rights with Facebook Ireland. Of course, you may also exercise your rights with us.

If you believe that the processing of your personal data violates data protection law, you always have the right to lodge a complaint with the competent supervisory authority. 
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the General Data Protection Regulation. The supervisory authority responsible for Facebook Ireland is the https://www.dataprotection.ie/.

Facebook Connect

Instead of registering directly on our website, you can register using Facebook Connect. This service is provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The use of Facebook Connect is subject to Facebook’s privacy policy and terms of service.

When using Facebook Connect, Facebook profile data and data published on Facebook from your Facebook profile are transferred to us. Conversely, data may be transferred from us to your Facebook profile. We store and process the data you transfer for the purpose of registration on our site. Through this link, we gain access to the data you have stored on Facebook. These include, in particular:

• Facebook name
• Facebook profile and profile picture
• Facebook profile picture
• Email address stored on Facebook
• Facebook ID
• Facebook friend lists
• Facebook Likes
• Birthday
• Gender
• Country
• Language

This data is used to set up, provide, and personalize your account. Registration via Facebook Connect and the associated data processing operations are based on your consent (Art. 6(1)(a) GDPR). You may revoke this consent at any time with future effect.

For more information, please refer to Facebook’s Terms of Service and Privacy Policy. These can be found at: www.facebook.com/privacy/center/ and https://de-de.facebook.com/legal/terms/.

Use of YouTube with Enhanced Privacy Settings

Our website uses plugins from YouTube. The operator of the site is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch the video. However, the enhanced privacy mode does not necessarily prevent the sharing of data with YouTube partners. Thus, YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video.

As soon as you start a YouTube video on our website, a connection is established with YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.

In addition, YouTube may store various cookies on your device after a video is started. YouTube uses these cookies to collect information about visitors to our website. This information is used, among other things, to track video statistics, improve user experience, and prevent fraud. The cookies remain on your device until you delete them. In some cases, additional data processing operations may be triggered after a YouTube video is started, over which we have no control.

The use of YouTube is in the interest of presenting our online offerings in an appealing manner. This constitutes a legitimate interest within the meaning of Art. 6 (1) f GDPR.
For more information about data protection on YouTube, please refer to their privacy policy at https://policies.google.com/privacy?hl=de&gl=de.

Vimeo

Our website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our pages that includes a Vimeo plugin, a connection is established with Vimeo’s servers. In doing so, the Vimeo server is informed which of our pages you have visited. In addition, Vimeo obtains your IP address. This applies even if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the United States.

If you are logged into your Vimeo account, you allow Vimeo to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your Vimeo account. For more information on how user data is handled, please refer to Vimeo’s privacy policy at: https://vimeo.com/privacy.

Users can subscribe to a newsletter on our website. The personal data provided to us when subscribing to the newsletter is determined by the form used; required fields are marked.

If you sign up for the newsletter offered on the website, we require your email address as well as information that allows us to verify that you are the owner of the provided email address and that you consent to receiving the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The processing of the data entered in the newsletter registration form is based solely on your consent (Art. 6 (1) a GDPR). You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time, for example via an unsubscribe link in the newsletter. 
The lawfulness of data processing operations that have already taken place remains unaffected by the revocation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted after you unsubscribe. Data stored by us for other purposes (e.g., email addresses for customer communication) remains unaffected by this.

Consent to receive the newsletter may be revoked at any time. A link to revoke consent is included in every newsletter. You may also unsubscribe from the newsletter directly on the website at any time or notify us of your decision in another manner.

Inxmail

This website uses Inxmail to send newsletters. The provider is Inxmail GmbH, Wetzinger Straße 17, 79106 Freiburg (hereinafter “Inxmail”). Inxmail is a service that can be used, among other things, to organize and analyze the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter is processed on Inxmail’s servers. Data processing is based on your consent (Art. 6 (1) a GDPR). You may revoke this consent at any time with future effect. We have entered into a Data Processing Agreement (DPA) for the use of the service.

With the help of Inxmail, we are able to analyze our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked. This allows us to determine, among other things, which links were clicked particularly often. We can also determine whether certain predefined actions were performed after opening or clicking (conversion rate). Inxmail also allows us to segment newsletter recipients into different categories (“clustering”). For example, newsletter recipients can be segmented by age, gender, or location. This enables us to better tailor the newsletters to the respective target groups.

If you do not wish to have your data analyzed by Inxmail, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter. After you unsubscribe from the newsletter distribution list, your email address may be stored in a blacklist by us or the newsletter service provider, if necessary, to prevent future mailings.

The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 (1) f GDPR). Storage in the blacklist is not time-limited. You may object to the storage provided that your interests outweigh our legitimate interest.

You can find Inxmail's privacy policy at:
https://www.inxmail.de/en/data-conditions/

Plugins are small add-on programs that extend the functionality of web applications. When you install a plugin, the website or software in question typically gains a new feature it didn’t have before. One advantage of plugins is that they allow you to easily add new features to programs and applications without significantly increasing the size of the main application or modifying its source code. The program code containing the new features is moved to the plugin—uninstalling the extension automatically restores the original state.

Google Web Fonts (locally hosted)

This site uses so-called web fonts provided by Google to ensure consistent font display. When you visit a page, your browser loads the necessary web fonts into its cache to display text and fonts correctly. The Google Fonts are installed locally on the provider’s servers. No connection to Google’s servers is established during this process.
The use of locally stored Google Web Fonts is based on the legitimate interest (Art. 6 (1) f GDPR) of ensuring a consistent and appealing presentation of our online offerings.

If your browser does not support web fonts, a standard font from your device will be used. For more information about Google Web Fonts, visit developers.google.com/fonts/faq and see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

MyFonts Counter 

On this website, we use MyFonts Counter, a web analytics service provided by MyFonts Inc., 500 Unicorn Park Drive, Woburn, MA 01801, USA.

In accordance with the license terms, page view tracking is performed by counting the number of visits to the website for statistical purposes and transmitting this data to MyFonts. MyFonts collects only anonymized data. The data may be transmitted by activating JavaScript code in your browser. For more information about MyFonts Counter, please see MyFonts’ privacy policy at http://www.myfonts.com/info/terms-and-conditions/#Privacy

Option to Block

To prevent all JavaScript code from MyFonts from running, you can install a JavaScript blocker (e.g., www.noscript.net).

Font Awesome

We use Font Awesome from the American company Fonticons (307 S. Main St., Suite 202, Bentonville, AR 72712, USA) to ensure consistent font display on our website. When you visit one of our webpages, the fonts are loaded via the Font Awesome Content Delivery Network (CDN). This ensures that text, fonts, and icons are displayed correctly on every device.

In doing so, your IP address is processed. Font Awesome also collects data on which icon files are downloaded. Additionally, technical data (browser version, screen resolution, time the page was accessed, etc.) is processed.

CDNs are networks of servers distributed worldwide that make it possible to quickly load files from a nearby location. Thus, as soon as you visit one of our pages, the corresponding icons from Font Awesome are provided. Font Awesome stores data regarding the use of the Content Delivery Network on servers located in the U.S. and elsewhere. We would like to point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the U.S.

The use of Font Awesome is based on your consent pursuant to Art. 6 (1) a GDPR, in the interest of a uniform and appealing presentation of our online offerings.

If you do not consent or if your browser does not support web fonts, a standard font will be used by your device. For more information about Font Awesome, visit https://fontawesome.com/support and review the privacy policy of Fonticons, Inc.: https://fontawesome.com/privacy.

Typekit

Our website uses Adobe web fonts to ensure consistent display of certain fonts. The provider is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).

When you visit our pages, your browser loads the required fonts directly from Adobe so that they can be displayed correctly on your device. In doing so, your browser establishes a connection to Adobe’s servers in the United States. As a result, Adobe becomes aware that our website has been accessed via your IP address. According to Adobe, no cookies are stored when the fonts are provided.

Adobe is certified under the EU-US Data Privacy Framework. The Data Privacy Framework is an agreement between the United States of America and the European Union designed to ensure compliance with European data protection standards. For more information, visit https://www.adobe.com/de/privacy/eudatatransfers.html.

The use of Adobe Fonts is necessary to ensure a consistent typeface on our website. This constitutes a legitimate interest within the meaning of Art. 6 (1) f GDPR. For more information about Adobe Fonts, please visit https://www.adobe.com/de/privacy/policies/adobe-fonts.html.
Adobe’s privacy policy can be found at https://www.adobe.com/de/privacy/policy.html

Google Maps

This site uses the Google Maps mapping service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the features of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the United States and stored there. The provider of this site has no influence over this data transmission.

The use of Google Maps is in the interest of presenting our online offerings in an appealing manner and making it easy to find the locations listed on our website. This constitutes a legitimate interest within the meaning of Art. 6 (1) f GDPR. For more information on the handling of user data, please refer to Google’s Privacy Policy: https://www.google.de/intl/de/policies/privacy/.

OpenStreetMap

We use the open-source mapping service “OpenStreetMap” (OSM) on our website to display geographic data. The service is provided by the OpenStreetMap Foundation, 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.

OSM is used to provide an interactive map on our website that shows you where to find us and helps you plan your route. To use OSM, the IP address of your device must be stored, and the map data is loaded from an external server.

The map is integrated into our website via an iframe or by retrieving map images from the provider’s server. The use of OSM serves the interest of presenting our online offerings in an appealing manner and ensuring that the locations listed on our website are easy to find; this constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR (Legitimate Interest in Data Processing).

You can view how OpenStreetMap stores your data on the OpenStreetMap privacy page here https://osmfoundation.org/wiki/Privacy_Policy and here https://wiki.openstreetmap.org/wiki/DE:Legal_FAQ.

Pure by Elsevier

The research information system Pure is a modular system developed by the Danish company Atira. Since 2012, it has been part of the product portfolio of the Elsevier Group in the Research Intelligence Solutions division, Elsevier GmbH, Bernhard-Wicki-Straße 5, 80636 Munich.

Pure is suitable, for example, for recording publications, grant applications, grants awarded, and projects, as well as research data, press and media reports, awards, and activities (such as committee work, conference participation, etc.).

The use of Pure on our website is based on our legitimate interest pursuant to Art. 6 (1) f GDPR. With the help of the reporting module, various queries can be created and saved without requiring any programming knowledge. Content is always recorded in relation to a person — a scientist  as an author, project leader, etc. The various entries can be linked to one another. This allows for the maintenance of profiles that illustrate various connections and relationships. Entries can be created manually, through synchronization with other systems, or via imports. Further privacy notices can be found on the Elsevier website: https://www.elsevier.com/de-de/legal/privacy-policy.

Handshake

Handshake is a platform that connects students, employers, and universities. The platform helps students in their search for internships, part-time jobs, and their first full-time job, often in collaboration with university career centers. Companies use Handshake specifically to recruit “early talent.”

The headquarters of the Handshake career platform (Handshake Europe GmbH) is located in Berlin at Zimmerstraße 78, 10117 Berlin. The global headquarters of the parent company is Handshake (USA/Global): 225 Bush St, San Francisco, CA 94104, USA. According to its own statements, Handshake is fully GDPR-compliant and stores data from European users in Europe.

The use of Handshake on our website is based on our legitimate interest pursuant to Art. 6 (1) f GDPR. We want to provide our students and potential employers with an efficient and simple way to get in touch.
A detailed description of how Handshake works and what data is processed can be found here: https://joinhandshake.de/info/privacy-policy.

Calendly

On our website, you have the option to schedule appointments with us. We use the “Calendly” tool for appointment scheduling. The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter “Calendly”).

To book an appointment, you enter the requested data and your preferred date into the form provided. The data you enter is used for planning, conducting, and, if necessary, following up on the appointment. The appointment data is stored for us on Calendly’s servers; you can view their privacy policy here: https://calendly.com/de/pages/privacy.

The data you enter will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies. Mandatory legal provisions—in particular retention periods—remain unaffected. The legal basis for data processing is Article 6(1)(f) of the GDPR.

The website operator has a legitimate interest in making it as easy as possible for prospective customers and clients to schedule appointments. Provided that the relevant consent has been obtained, processing is carried out exclusively on the basis of Article 6 (1) a of the GDPR and the Telecommunications and Digital Services Data Protection Act (TDDDG), insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Data transfers to the United States are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://calendly.com/pages/dpa.

Content Delivery Networks (CDNs), also known as Content Distribution Networks, are a network of regionally distributed servers connected via the Internet that are used to deliver content — particularly large media files. CDNs work together to fulfill end-users’ requests for content as efficiently as possible. Behind the scenes, data is cached across the network in such a way that delivery is either as fast as possible (performance optimization) or uses as little bandwidth as possible (cost optimization), or both at the same time.

Gstatic CDN

We use the Gstatic service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, on our website.

Gstatic is a Content Delivery Network (CDN) from Google that is used to deliver static content such as images, JavaScript files, and stylesheets. In particular, the service loads background data for Google Fonts, Google Maps, Google Analytics, YouTube, and various Google APIs.

The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6 (1) f GDPR. The use of Gstatic helps us improve loading speeds and optimize the overall performance of websites that integrate these services.

This also involves the transfer of personal data to the United States. With regard to the transfer of personal data to the United States, there is an adequacy decision regarding the EU-US Data Privacy Framework within the meaning of Article 45 of the GDPR. You can view the provider’s certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list.

We have entered into a data processing agreement with Google. As part of this data processing, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States.

You may withdraw your consent at any time. For more information on how to withdraw your consent, please refer either to the consent form itself or to the end of this Privacy Policy.
For further information on how the transferred data is handled, please refer to the provider’s privacy policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. 

We use marketing and tracking mechanisms for analytical purposes. The use of marketing cookies and tracking mechanisms enables us and our partners to display personalized offers to you based on an analysis of your interests and usage behavior. Below, we explain which mechanisms and tools we use on this website:

• Statistics:
  We use statistics tools to measure, for example, the number of page views.
• Conversion Tracking:
  Our conversion tracking partners place a cookie on your computer (“conversion cookie”) if you arrived at our website via an ad from the respective partner. These cookies typically expire after 30 days. If you visit certain pages on our site and the cookie has not yet expired, we and the respective conversion tracking partner can recognize that a specific user clicked on the ad and was thus redirected to our site. This can also occur across devices. The information collected using the conversion cookie is used to generate conversion statistics and to track the total number of users who clicked on the relevant ad and were redirected to a page tagged with a conversion tracking tag.
• Retargeting:
  These tools use advertising cookies or third-party advertising cookies, so-called web beacons (invisible graphics also known as pixels or tracking pixels), or similar technologies to create usage profiles. These are used for interest-based advertising and to control the frequency with which the user sees certain ads. The providers of these tools may also share information with third parties for the purposes mentioned above. Please refer to the privacy policy of the respective provider in this regard.

Please note that when using these tools, your data may be transferred to recipients outside the European Economic Area (e.g., the U.S.). Details can be found in the following description of the individual marketing tools:

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It serves solely to manage and deploy the tools integrated through it.

However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.

The use of Google Tag Manager is based on Art. 6 (1) f GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. If consent has been requested, processing is based on Article 6(1)(a) of the GDPR and the Telecommunications and Digital Services Data Protection Act (TDDDG), insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

For more information, please refer to Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

Google Ads Remarketing Tag

This website uses the “Google Ads” service. Google processes your personal data based on your consent via the “Google Ads Remarketing Tag” pixel to create campaign reports, track conversions and click events, and deliver targeted advertising outside of our websites (retargeting) based on, for example, URL, referrer URL, and membership in remarketing lists defined by us. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the legal basis is your consent pursuant to Art. 6 (1) a GDPR.

Using the information mentioned above, you may also be associated with your Google account and added to remarketing lists. We do not receive any personal data about you from Google, but only anonymized campaign reports regarding the target audience and ad performance. You can opt out of receiving interest-based ads from Google by either changing your advertising preferences on Google’s website at https://www.google.com/settings/ads/onweb#display_optout.

Alternatively, you can disable the use of third-party cookies by visiting the Network Advertising Initiative’s opt-out page at

https://www.networkadvertising.org/managing/opt_out.asp or manage the use of device identifiers via your device settings.

You can find instructions at https://support.google.com/ads/answer/1660762#mob. For more information, visit: https://policies.google.com/privacy.

LinkedIn Insight Tags

We use Insight Tags from the social network LinkedIn on our website. This service is provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter “LinkedIn”).

LinkedIn processes your personal data based on your consent in accordance with Art. 6 (1) a of the GDPR via the “LinkedIn Insight Tag” pixel to generate campaign reports, track conversions and click events, and deliver targeted advertising outside our websites (retargeting) based on URL, referrer URL, IP address (truncated or hashed for cross-device retargeting), device and browser characteristics (user agent), and timestamps. We do not receive any personal data about you from LinkedIn, but only anonymized campaign reports regarding the website audience and ad performance.

The so-called Insight Tags enable us to analyze user activity on our website. The data collected is anonymized. We use LinkedIn Insight Tags to tailor our website to your needs and to promote it (legitimate interest pursuant to Art. 6 (1) f GDPR).

You can prevent the execution of the JavaScript code required for LinkedIn Insight Tags by adjusting your browser settings accordingly. To prevent JavaScript code from running altogether, you can also install a JavaScript blocker, such as the browser plugin NoScript (www.noscript.net) or Ghostery (www.ghostery.com). For more information on how user data is handled, please refer to LinkedIn’s Privacy Policy at https://www.linkedin.com/legal/privacy-policy.

Trade Desk Pixel

The Trade Desk is an advertising technology platform for managing digital advertising campaigns and processes your personal data based on your consent in accordance with Article 6(1)(a) of the GDPR. The provider is The Trade Desk Inc., 42 N Chestnut St, Ventura, California, CA 9300, USA.

The Trade Desk Inc. is certified under the Data Privacy Framework. To this end, the browsing behavior of visitors to our website is analyzed using cookies. The Trade Desk collects and processes personal data about users, devices, and ads, as well as where these ads are displayed. This includes, for example, unique cookie identifiers, advertising identifiers for mobile devices, IP addresses, and other information about browsers and devices, such as type, version, and settings. You can object or withdraw your consent at any time in the cookie settings of the consent management tool used. For more information, visit: https://www.thetradedesk.com/de/privacy.

Meta Pixel, Custom Audiences, and Meta Conversion

Our website uses a “pixel” provided by Meta Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are located in the EU, Meta Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”).

The legal basis is our legitimate interest pursuant to Art. 6 (1) f GDPR in the analysis, optimization, and economic operation of our online offering.
With the help of the pixel, Meta is able, on the one hand, to identify visitors to our online offering as a target group for the display of advertisements (so-called “ads”). Accordingly, we use the Meta pixel to display the ads we place only to those users of Meta services who have also shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites visited) that we transmit to Meta (so-called “Custom Audiences”). We also use the Meta Pixel to ensure that our Meta ads align with users’ potential interests and do not appear intrusive.

With the help of the Meta pixel, we can also track the effectiveness of Meta ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta ad (so-called “conversion”).

The data is stored and processed by Facebook, allowing it to be linked to the respective user profile and enabling Meta to use the data for its own advertising purposes in accordance with Meta’s Data Use Policy. This allows Meta to display ads on Meta sites as well as outside of Meta. As the site operator, we have no control over this use of data.

You can object to the collection of data via the Meta Pixel and the use of your data for the display of Meta ads. To control which types of ads are shown to you within Meta, you can visit the page set up by Meta and follow the instructions there regarding usage-based advertising settings:
https://www.facebook.com/settings?tab=ads.

The settings are platform-independent, meaning they apply to all devices, such as desktop computers or mobile devices.

Meta processes the data in accordance with Meta’s Data Use Policy. You can find further information on the protection of your privacy in Meta’s Privacy Policy: https://www.facebook.com/privacy/policy/. Information and details about the Meta Pixel and how it works are available in Meta’s Help Center: https://www.facebook.com/business/help/651294705016616.

Matomo

This website uses the open-source web analytics service Matomo provided by InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand.

The use of Matomo is based on Article 6(1)(a) of the GDPR. Matomo is open-source software that we have installed on our server. This website uses Matomo in the “no cookies” version as self-hosted software to collect anonymous usage data for this website. The service provider is the New Zealand company InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand.

When using Matomo “without cookies,” no cookies are stored on your device. Your IP address is also processed anonymously by removing the last 2 bytes. The pseudo-anonymized location (based on the anonymized IP address) is recorded. No data is shared with third parties — in particular with InnoCraft Ltd. Your IP address is recorded exclusively in truncated form, so that it cannot be traced back to you (so-called IP masking). Matomo cookies remain on your device until you delete them.

The statistics generated by Matomo track, in particular, how many users visit our website, from which country or location the access originates, which subpages are visited, and through which links or search terms visitors arrive at our website. The collected information is transmitted to our server and stored there. You can revoke the consent you have given regarding Matomo at any time in the consent tool settings, effective for the future.

You can also prevent the storage of cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent. You can learn more about Matomo’s data processing at https://matomo.org/privacy-policy/.

Completely Disable Matomo

Your visits to this website will not be tracked by the web analytics tool. Please note: If you clear your cookies, delete the opt-out cookie, or switch computers or web browsers, you will need to repeat the opt-out process.

Reddit Conversion Tracking

Our website also uses the “Reddit Conversion Pixel,” an analytics service provided by Reddit Inc., 520 Third Street, Suite 305, San Francisco, CA 94107, USA (“Reddit”).

This tool uses tracking pixels integrated into our pages. When you visit our pages, this tracking pixel establishes a direct connection between your browser and Reddit’s server. As a result, Reddit receives information from your browser, including the fact that our site was accessed from your device.

Please note that we have no influence over the scope of the data transmitted or its further use by Reddit, and we therefore inform you based on our current knowledge:

By embedding Reddit conversion pixels, Reddit receives the information that you have accessed the corresponding webpage on our website or clicked on one of our ads. If you are registered with a Reddit service, Reddit can associate the visit with your account. Even if you are not registered with Reddit or have not logged in, there is a possibility that the provider may obtain and store your IP address and other identifying characteristics.

For more information on data protection and your related settings options, please visit https://www.redditinc.com/policies/privacy-policy

TikTok Pixel

We use the TikTok Pixel on our website. The TikTok Pixel is a tool provided by the following two companies:

• TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and
• TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom (both hereinafter collectively referred to as “TikTok”).

The TikTok Pixel is a JavaScript code that enables us to understand and track visitor activity on our website. To this end, the TikTok Pixel collects and processes information about visitors to our website or the devices they use (so-called event data).

The data collected via the TikTok Pixel is used for targeting our advertisements, improving ad delivery, and for personalized advertising. To this end, the data collected on our website via the TikTok Pixel is transmitted to TikTok.

Some of this data consists of information stored on the device you are using. In addition, the TikTok Pixel sets cookies that store information on the device you are using. The TikTok Pixel will only store information or access information already stored on your device with your consent in accordance with Article 6(1)(a) of the GDPR. You can revoke your consent at any time via our Consent Management Tool.

For the processing of data where TikTok acts as a data processor, we have entered into a data processing agreement with TikTok, in which we require TikTok to protect our customers’ data and not to disclose it to third parties.

You can view the agreement concluded between us and TikTok at
https://ads.tiktok.com/i18n/official/article?aid=300871706948451871

TikTok processes the data in accordance with TikTok’s Privacy Policy
(https://www.tiktok.com/legal/privacy-policy-eea?lang=de).

Specific information and details about the TikTok Pixel and how it works can be found in TikTok’s Help Center (https://support.tiktok.com/de).

Hotjar

We use the web analytics service Hotjar, provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (“Hotjar”), to better understand your usage behavior and needs and to optimize our services accordingly.
In particular, Hotjar uses cookies (see Section V of this Privacy Policy) to collect information about user behavior and user devices (specifically, a device’s IP address, screen size, device type, browser information, geographic information, and the preferred language for displaying our website).

Hotjar stores this data in a pseudonymized user profile. Neither Hotjar nor we will use this information to identify you. Nor will Hotjar or we combine the data with other data about individual users. You can object to the creation of user profiles, the storage of data regarding your use of our website by Hotjar, and the use of tracking cookies by Hotjar on other sites at any time via the following link:
https://www.hotjar.com/opt-out.

For more information on Hotjar’s privacy policy, please visit https://www.hotjar.com/privacy.
 

Our online store is powered by the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. 

In connection with the operation of the shop and order processing, Shopify processes the following personal data on our behalf (Art. 28 GDPR): contact and address data, order data, payment information, and technical connection data (e.g., IP address, browser type). 

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the shop). 

Transfer to third countries: Data may be transferred to the United States or Canada. The necessary safeguards are ensured by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). 

Retention period: Data is deleted as soon as the purpose of processing no longer applies, provided that no statutory retention obligations (§§ 147 AO, 257 HGB) preclude this. 

Further information: https://www.shopify.com/legal/privacy 

You have the right to receive specific information regarding the processing of your data (Art. 15–21 GDPR). Please direct any inquiries to our contact address listed above. To the extent that your personal data is processed, you, as the “data subject,” have the following rights:

Right of Access

You may request information from us regarding whether we are processing your personal data. The right to access is excluded if the data is stored solely because it may not be deleted due to statutory or statutory retention periods, or if it serves exclusively for data backup or data protection control purposes, provided that providing the information would require a disproportionately high effort and processing for other purposes is prevented by appropriate technical and organizational measures.

Provided that the right to information is not excluded in your case and we are processing your personal data, you may request the following information from us:

• the purposes of the processing,
• the categories of personal data concerning you that are processed,
• the recipients or categories of recipients to whom your personal data is disclosed, in particular recipients in third countries,
• where possible, the planned period for which your personal data will be stored or, if this is not possible, the criteria used to determine the storage period,
• the existence of a right to rectification or erasure or restriction of processing of the personal data concerning you, or a right to object to such processing,
• the existence of a right to lodge a complaint with a data protection supervisory authority,
  if the personal data were not collected from you as the data subject, the available information regarding the origin of the data,
• where applicable, the existence of automated decision-making, including profiling, and meaningful information regarding the logic involved, as well as the significance and intended consequences of automated decision-making,
• where applicable, in the case of transfers to recipients in third countries, unless there is a decision by the European Commission on the adequacy of the level of protection pursuant to Article 45(3) of the GDPR, information regarding the appropriate safeguards provided pursuant to Article 46(2) of the GDPR to protect the personal data.

Correction and Completion 

If you discover that we hold inaccurate personal data about you, you may request that we correct such inaccurate data without delay. If the personal data we hold about you is incomplete, you may request that we complete it.

Erasure 

You have the right to erasure (“right to be forgotten”), provided that the processing is not necessary for the exercise of the right to freedom of expression, the right to information, or to comply with a legal obligation or to perform a task carried out in the public interest, and one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was processed.
• The legal basis for the processing was solely your consent, which you have withdrawn.
• You have objected to the processing of your personal data that we have made public.
• You have objected to the processing of personal data that we have not made public, and there are no overriding legitimate grounds for the processing.
• Your personal data has been processed unlawfully.
• The erasure of the personal data is necessary to comply with a legal obligation to which we are subject.

There is no right to erasure if, in the case of lawful non-automated data processing, erasure is not possible or would require disproportionate effort due to the specific nature of the storage, and your interest in erasure is minimal. In this case, restriction of processing shall replace erasure.

Restriction of Processing 

You may request that we restrict processing if any of the following grounds apply:

• You contest the accuracy of the personal data. In this case, the restriction may be requested for the period necessary to allow us to verify the accuracy of the data.
• The processing is unlawful, and you request the restriction of the use of your personal data instead of erasure.
• We no longer need your personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims.
• You have objected pursuant to Art. 21(1) GDPR. Restriction of processing may be requested until it is determined whether our legitimate grounds override your grounds.

Restriction of processing means that the personal data will only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest. Before we lift the restriction, we are required to inform you of this.

Data Portability 

You have the right to data portability provided that the processing is based on your consent (Art. 6(1)(a) or Art. 9(2)(a) of the GDPR) or on a contract to which you are a party, and the processing is carried out by automated means.

In this case, the right to data portability includes the following rights, provided that this does not infringe upon the rights and freedoms of others: You may request that we provide you with the personal data you have provided to us in a structured, commonly used, and machine-readable format.

You have the right to transmit this data to another controller without hindrance from us. To the extent technically feasible, you may request that we transmit your personal data directly to another controller.

Withdrawal of Consent 

You have the right to withdraw your consent at any time with future effect. You may withdraw your consent informally by email or by sending a letter to our mailing address. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of your consent prior to the receipt of the withdrawal. Upon receipt of the withdrawal, data processing that was based exclusively on your consent will be discontinued.

Objection

If the processing is based on Article 6(1)(e) of the GDPR (performance of a task carried out in the public interest or in the exercise of official authority) or on Article 6 (1)(f) GDPR (legitimate interests of the controller or a third party), you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.

This also applies to profiling based on Article 6(1)(e) or (f) GDPR. Once you have exercised your right to object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

You may object at any time to the processing of your personal data for direct marketing purposes. This also applies to profiling related to such direct marketing. Once you have exercised this right to object, we will no longer use the relevant personal data for direct marketing purposes.

You may inform us of your objection informally by phone, email, or by sending a letter to our postal address listed above.

Use of Automated Decision-Making

As a responsible company, we do not use automated decision-making or profiling as defined by the GDPR.

Right of appeal 

If you are of the opinion that we are violating German or European data protection law with regard to the processing of your data, please contact us so that we can address any questions you have.

Please contact us either by mail (address above) or by email: privacy@klu.org.

If any doubts arise, we may request additional information to confirm your identity. In addition, the supervisory authority of the Federal State of Hamburg is available to you as a contact.