Privacy Policy

I. Name and address of the responsible party

The data controller in accordance with the General Data Protection Regulation and other such national laws of the member states, as well as other data protection regulations, is as follows:

Justus Liebig University Giessen
Legally represented by its president, Prof. Dr. Katharina Lorenz
Ludwigstrasse 23
35390 Giessen
Germany
Telephone: +49 (0) 641 99-0
Telefax: +49 (0) 641 99-12259
Email: praesidentin
Website: http://www.uni-giessen.de

II. Contact details of the official data protection officer 

Justus Liebig University Giessen
Official data protection officer
Ludwigstrasse 23
35390 Giessen
Germany
Telephone: +49 (0) 641 99-12230 or +49 (0) 641 99-12270
Telefax: +49 (0) 641 99-12229
Email: datenschutz
Website: https://www.uni-giessen.de/de/org/beauftragte/datenschutz (German only)

III. General information on data processing

1. Scope of personal data processing

We only process our users' personal data to the extent necessary to provide a functional website and our content and services. The processing of our users' personal data is carried out regularly only with the user's consent. An exception applies in cases where prior consent cannot be obtained for practical reasons and where such processing of data is permitted by law.

2. Legal basis for processing personal data

Insofar as we obtain the consent of the persons concerned for processing their personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary to fulfill a contract to which the person concerned is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out measures prior to entering into a contract.

Insofar as personal data processing is necessary to fulfill a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

In the event that the vital interests of the person concerned or another natural person require personal data processing, Article 6(1)(d) GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights, and freedoms of the person concerned do not override the former interest, Article 6(1)(f) GDPR serves as the legal basis for processing.

3. Data deletion and duration of storage

The personal data of persons concerned will be deleted or locked as soon as the purpose for which it was stored no longer applies. Storage may also happen if European or national legislators have provided for this in EU regulations, laws, or other provisions to which the controller is subject. The data will also be locked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data in order to conclude or fulfill a contract.

IV. Website hosting and log file creation

1. Description and scope of data processing

Every time someone visits our website, our system automatically collects data and information from the visiting computer's system.

The following data is hereby collected:

• IP address of the requesting computer
• Date and time of the request
• Access method/function sought by the requesting computer
• Data the requesting computer has transmitted
• Access status of the web server (file transferred, file not found, command not executed, etc.)
• Name of the file requested

The data is also stored in our system's log files. This data is not stored together with any other personal data of the user.

2. Legal basis for data processing

The legal basis for temporarily storing data and log files is Article 6(1)(f) GDPR.

3. Purpose of data processing

The system must temporarily store the recipient's IP address in order to deliver the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. We also use the data to optimize the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of collecting data to provide the website, deletion occurs when the respective session has ended.

When data is stored in log files, deletion occurs after two months at the latest.

5. Opt-out and deletion options

Collecting data to provide the website and storing it in log files is essential for the website to work. This means users cannot opt out.

V. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

We use cookies to process user logins for protected areas of the website, to facilitate support in the event of errors, and to make our website more user friendly. Some elements of our website require the calling browser to remain identifiable even after a page change.

The following data is stored and transmitted in the cookies:

1. Language settings
2. Identification of the requesting server
3. Log-in information (persistent user authentication for logging into protected areas)

We also use cookies on our website that enable us to analyze users' surfing behavior. The following data can be transmitted in this way: frequency of page views. This collected user data is gathered without cookies and anonymized through technical default settings. This means that it is no longer possible to assign the data to the user who accessed the site. The data is not stored together with the users' other personal data.

2. Legal basis for data processing

The legal basis for using essential cookies to process personal data is Article 6(1)(f) GDPR.

The legal basis for using cookies to process personal data for analysis purposes is Article 6(1)(a) GDPR, provided that the users have given their consent. 

3. Purpose of data processing

The purpose of using essential cookies is to simplify the use of websites for users. Some features of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognized even after a page change.

We require cookies for the following uses:

1. Accepting the selected language setting
2. Identifying the server that handled the request in order to analyze errors
3. Persistent user authentication for access to protected areas

The user data that essential cookies collect is not used to create user profiles.

Analytical cookies are used to improve the quality of our website and its content. These cookies tell us how the website is used, enabling us to continuously optimize our offering.

These purposes also constitute our legitimate interest in processing personal data in accordance with Article 6(1)(f) GDPR.

4. Duration of storage, opt-out and deletion options

Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all of the website's functions to their full extent.

VI. Newsletter

1. Description and scope of data processing

On our website, you have the option of subscribing to a free newsletter in various areas. When you register for a newsletter, data from the input form is transmitted to us.

This usually includes the following:

• Salutation
• Name
• Email address for the newsletter subscription  

Furthermore, the following data is collected during registration:

1. Date and time of registration
2. IP address of the accessing computer
3. URL of the registration form
4. Data transmitted by the requesting computer (HTTP_USER_AGENT)

To process the data, we will obtain your consent during the registration process and will reference this privacy policy.

When processing data to distribute newsletters, no data is passed on to third parties. It is used exclusively to deliver the newsletter.

2. Legal basis for data processing

The legal basis for processing data after users have subscribed to a newsletter is Article 6(1)(a) GDPR, provided that the users have given their consent.

3. Purpose of data processing

The user's email address is collected for the purpose of delivering the newsletter.

Collecting other personal info during the sign-up process helps us prevent misuse of our services or the email address used.

4. Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user's email address will therefore be stored for as long as the newsletter subscription is active.

Other personal data collected during the registration process will generally be deleted after a period of seven days.

5. Opt-out and deletion options

The affected user may cancel their subscription to a newsletter at any time. To do so, please send us an informal email.

VII. Contact form, email contact, and other forms

1. Description and scope of data processing

Our website features contact forms in various areas, which can be used for electronic contact, conference registrations, reporting malfunctions, and other purposes. If a user takes advantage of these options, the data entered in the input fields will be transmitted to us and stored. This data includes the following:

• First and last name
• Email address
• Subject
• Message
• Other contextual data

At the time the message is sent, the following data is also stored:

1. Date and time the message was sent
2. IP address of the requesting computer
3. URL of the registration form
4. Data transmitted from the requesting computer (HTTP_USER_AGENT)

Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email will be stored.

In this context, the data will not be passed on to third parties but will be used exclusively to process the conversation.

2. Legal basis for data processing

The legal basis for data processing is Article 6(1)(a) GDPR if the users have given their consent.

The legal basis for processing data transmitted in the course of sending an email is Article 6(1)(f) GDPR. If the email contact seeks to conclude a contract, an additional legal basis for processing is Article 6(1)(b) GDPR.

3. Purpose of data processing

We use the personal data entered into the input fields solely to process your contact request or for the purpose stated in the form. In the case of email contact, this also constitutes the necessary legitimate interest to process the data.

Any other personal data processed while sending the form is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the input fields of the contact form, other forms, and those sent via email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

5. Opt-out and deletion options

The user may revoke their consent to process their personal data at any time. If the user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

In this case, all personal data stored in the course of establishing contact will be deleted.

VIII. Rights of the data subject

If your personal data is processed, you are a data subject in accordance with the GDPR and you have the following rights in relation to the data controller:

1. Right to information

You may request confirmation from the controller as to whether we are processing your personal data.

If such processing takes place, you may request the following information from the controller:

1. The purposes for which the personal data is processed
2. The categories of personal data that are processed
3. The recipients or categories of recipients to whom your personal data has been or will be disclosed
4. How long the controller plans to store your personal data or, if specific information on this is not possible, criteria for determining the storage period
5. The existence of any right to correct or delete your personal data, any right to restrict the controller's processing of this data, or any right to object to this processing
6. The existence of any right to lodge a complaint with a supervisory authority
7. Any available information on the origin of the data if the personal data is not collected from the data subject
8. The existence of any automated decision making, including profiling, pursuant to Article 22(1) and (4) GDPR and—in these cases at minimum—meaningful information about the logic involved, as well as the significance and the anticipated effects of such processing for the data subject.

You have the right to request information about whether personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request that you be informed about the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.

This right to information may be restricted insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

2. Right to correction

You have the right to request that the controller correct and/or complete your personal data if it is inaccurate or incomplete. The controller must make the correction immediately.

Your right to correction may be restricted insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

3. Right to restrict processing

You may request that processing of your personal data be restricted under any of the following conditions:

1. If you contest the accuracy of the your personal data for a time period that enables the controller to verify its accuracy.
2. The processing is unlawful, and you oppose erasure of the personal data and request instead that its use be restricted.
3. The controller no longer needs the personal data for processing purposes, but you need it to assert, exercise, or defend legal claims.
4. You have objected to processing pursuant to Article 21(1) GDPR, and it has not yet been determined whether the legitimate interests of the controller override your interests.

If processing your personal data has been restricted, it can only be used—apart from its storage—with your permission to assert, exercise, or defend legal claims, to protect the rights of another natural or legal person, or for important public interest reasons of the EU or a member state.

If processing has been restricted in accordance with the aforementioned conditions, the controller will inform you prior to lifting the restriction.

Your right to restrict processing may be limited insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

4. Right to deletion

a) Obligation to delete

You may request that the controller delete your personal data without delay, and the controller is obligated to delete this data without delay, provided that one of the following reasons applies:

1. Your personal data is no longer needed for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing was based in accordance with Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for such processing.
3. You object to processing pursuant to Article 21(1) GDPR and there are no overruling legitimate interests for such processing, or you object to processing pursuant to Article 21(2) GDPR.
4. Your personal data has been processed unlawfully.
5. Deleting your personal data is necessary to comply with a legal obligation under EU law or the law of the member states to which the controller is subject.
6. Your personal data has been collected with regard to services the information society offers in accordance with Article 8(1) GDPR.

b) Information to third parties

If the controller has made your personal data public and is required to delete it pursuant to Article 17(1) GDPR, he or she shall take reasonable steps, taking into account available technology and implementation costs, including technical measures, to inform any controllers who process the personal data that you, as the data subject, have requested that they delete all links to this personal data or copies or replications thereof.

c) Exceptions

The right to deletion does not apply if processing is necessary for any of these reasons:

1. Exercising the right of freedom of expression and information.
2. Compliance with a legal obligation that requires processing under EU or member state law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.
3. Public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR.
4. Archiving for public interest, scientific or historical research, or for statistics pursuant to Article 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the objectives of that processing.
5. To establish, exercise, or defend legal claims.

5. Right to notification

If you have asserted your rights to correction, deletion, or processing restriction with the controller, he or she is required to notify all recipients of your personal data of this correction, deletion, or processing restriction unless it proves impossible or involves disproportionate effort.

You have the right to receive information from the controller about these recipients.

6. Right to data transferability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller who has received the personal data, provided that both of the following apply:

1. Processing is based on consent pursuant to Articles 6(1)(a) or 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR.
2. Processing is automated.

In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the freedoms and rights of other persons.

The right to data transferability does not apply to any processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object at any time, in the interest of your particular situation, to us processing your personal data on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller will no longer process your personal data unless they can demonstrate compelling legitimate interest for processing that outweighs your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

You have the option, in connection with the use of information society services, to exercise your right to object by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

You also have the right to object, in cases arising from your particular situation, to any processing of your personal data that is carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) GDPR.

Your right to object may be limited insofar as it is likely to render impossible or seriously impair research or statistical objectives and whenever the restriction is necessary to fulfill said objectives.

8. Right to revoke the declaration of consent under data protection laws

You have the right to revoke your declaration of consent under data protection laws at any time. Revoking your consent does not affect the legality of any processing carried out on the basis of your consent prior to revocation.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that any processing of your personal data violates the GDPR.

Supervisory authority:

Hessian Commissioner for Data Protection and Freedom of Information
Prof. Dr. Alexander Rossnagel
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Tel.: +49 (0) 611 1408-0, Fax: +49 (0) 611 1408-611
Internet: https://datenschutz.hessen.de
Email: poststelle

* Evaluations of page visits (website analysis)
We use Matomo software to optimize our website. Matomo tracks repeat visits to our website for 24 hours; this is done anonymously based on the system configuration, without any personal identification. Furthermore, Matomo collects information about the browser used, operating system settings (screen resolution), entry and exit pages, and the duration of the visit.

Matomo tracks repeat visits to our website for 24 hours. After that, it is no longer possible to link them to an anonymized visitor profile.
Anonymized access data for the JLU websites is automatically deleted from the Matomo database—which is hosted exclusively on the servers of Justus Liebig University—after 365 days.  

Right to object: To prevent Matomo from tracking your visits to our website, you can opt out with a cookie. To do so, please uncheck the following box: