Document Actions

Privacy Policy Part II

VIII. Rights of the data subject

If your personal data is processed, you are a data subject in accordance with the GDPR and you have the following rights in relation to the data controller:

1. Right to information

You may request confirmation from the controller as to whether we are processing your personal data.

If such processing takes place, you may request the following information from the controller:

  1. The purposes for which the personal data is processed
  2. The categories of personal data that are processed
  3. The recipients or categories of recipients to whom your personal data has been or will be disclosed
  4. How long the controller plans to store your personal data or, if specific information on this is not possible, criteria for determining the storage period
  5. The existence of any right to correct or delete your personal data, any right to restrict the controller's processing of this data, or any right to object to this processing
  6. The existence of any right to lodge a complaint with a supervisory authority
  7. Any available information on the origin of the data if the personal data is not collected from the data subject
  8. The existence of any automated decision making, including profiling, pursuant to Article 22(1) and (4) GDPR and—in these cases at minimum—meaningful information about the logic involved, as well as the significance and the anticipated effects of such processing for the data subject.

You have the right to request information about whether personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request that you be informed about the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.

This right to information may be restricted insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

2. Right to correction

You have the right to request that the controller correct and/or complete your personal data if it is inaccurate or incomplete. The controller must make the correction immediately.

Your right to correction may be restricted insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

3. Right to restrict processing

You may request that processing of your personal data be restricted under any of the following conditions:

  1. If you contest the accuracy of the your personal data for a time period that enables the controller to verify its accuracy.
  2. The processing is unlawful, and you oppose erasure of the personal data and request instead that its use be restricted.
  3. The controller no longer needs the personal data for processing purposes, but you need it to assert, exercise, or defend legal claims.
  4. You have objected to processing pursuant to Article 21(1) GDPR, and it has not yet been determined whether the legitimate interests of the controller override your interests.

If processing your personal data has been restricted, it can only be used—apart from its storage—with your permission to assert, exercise, or defend legal claims, to protect the rights of another natural or legal person, or for important public interest reasons of the EU or a member state.

If processing has been restricted in accordance with the aforementioned conditions, the controller will inform you prior to lifting the restriction.

Your right to restrict processing may be limited insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

4. Right to deletion

a) Obligation to delete

You may request that the controller delete your personal data without delay, and the controller is obligated to delete this data without delay, provided that one of the following reasons applies:

  1. Your personal data is no longer needed for the purposes for which it was collected or otherwise processed.
  2. You withdraw your consent on which the processing was based in accordance with Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for such processing.
  3. You object to processing pursuant to Article 21(1) GDPR and there are no overruling legitimate interests for such processing, or you object to processing pursuant to Article 21(2) GDPR.
  4. Your personal data has been processed unlawfully.
  5. Deleting your personal data is necessary to comply with a legal obligation under EU law or the law of the member states to which the controller is subject.
  6. Your personal data has been collected with regard to services the information society offers in accordance with Article 8(1) GDPR.

b) Information to third parties

If the controller has made your personal data public and is required to delete it pursuant to Article 17(1) GDPR, he or she shall take reasonable steps, taking into account available technology and implementation costs, including technical measures, to inform any controllers who process the personal data that you, as the data subject, have requested that they delete all links to this personal data or copies or replications thereof.

c) Exceptions

The right to deletion does not apply if processing is necessary for any of these reasons:

  1. Exercising the right of freedom of expression and information.
  2. Compliance with a legal obligation that requires processing under EU or member state law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.
  3. Public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR.
  4. Archiving for public interest, scientific or historical research, or for statistics pursuant to Article 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the objectives of that processing.
  5. To establish, exercise, or defend legal claims.

5. Right to notification

If you have asserted your rights to correction, deletion, or processing restriction with the controller, he or she is required to notify all recipients of your personal data of this correction, deletion, or processing restriction unless it proves impossible or involves disproportionate effort.

You have the right to receive information from the controller about these recipients.

6. Right to data transferability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller who has received the personal data, provided that both of the following apply:

  1. Processing is based on consent pursuant to Articles 6(1)(a) or 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR.
  2. Processing is automated.

In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the freedoms and rights of other persons.

The right to data transferability does not apply to any processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object at any time, in the interest of your particular situation, to us processing your personal data on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller will no longer process your personal data unless they can demonstrate compelling legitimate interest for processing that outweighs your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

You have the option, in connection with the use of information society services, to exercise your right to object by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

You also have the right to object, in cases arising from your particular situation, to any processing of your personal data that is carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) GDPR.

Your right to object may be limited insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

8. Right to revoke the declaration of consent under data protection laws

You have the right to revoke your declaration of consent under data protection laws at any time. Revoking your consent does not affect the legality of any processing carried out on the basis of your consent prior to revocation.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that any processing of your personal data violates the GDPR.

Supervisory authority:

Hessian Commissioner for Data Protection and Freedom of Information
Prof. Dr. Alexander Rossnagel
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Tel.: +49 (0) 611 1408-0, Fax: +49 (0) 611 1408-611
Internet: https://datenschutz.hessen.de
Email:

* Evaluations of page visits (website analysis)
We use Matomo software to optimize our website. Matomo tracks repeat visits to our website for 24 hours; this is done anonymously based on the system configuration, without any personal identification. Furthermore, Matomo collects information about the browser used, operating system settings (screen resolution), entry and exit pages, and the duration of the visit.

Matomo tracks repeat visits to our website for 24 hours. After that, it is no longer possible to link them to an anonymized visitor profile.
Anonymized access data for the JLU websites is automatically deleted from the Matomo database—which is hosted exclusively on the servers of Justus Liebig University—after 365 days.  

Right to object: To prevent Matomo from tracking your visits to our website, you can opt out with a cookie. To do so, please uncheck the following box: