Data protection information for recipients of advertising information

We, the Foundation for the Promotion of the HRK, take the protection of personal data and the confidential treatment of such very seriously. We would like to inform you about the processing of your personal data in the context of advertising and organising events and other activities of our organisation via e-mail and your rights. Your personal data is exclusively processed in accordance with the applicable statutory provisions of data protection legislation, specifically the General Data Protection Regulation (hereinafter “GDPR”) and the German Federal Data Protection Act (“BDSG”).

I. Who is the controller responsible for data processing and who is the Data Protection Officer?

1.    The controller responsible for the processing of your personal data is:
Stiftung zur Förderung der Hochschulrektorenkonferenz
Ahrstraße 39
53175 Bonn
Germany
Tel.: +49 228 887-153
Fax: +49 228 887-280
E-mail: post[at]hrk.de
www.hrk.de

2.    You can contact our Data Protection Officer as follows:
Mr Florian Reichert
Scheja & Partners GmbH & Co. KG
Adenauerallee 136
53113 Bonn
Germany
Tel.: (+49) 0228-227 226 0
www.scheja-partner.de/en/contact/contact.html
www.scheja-partner.de/en/index.html

II. What is the subject of data protection?

Personal data is the subject of data protection. This contains all information pertaining to an identified or identifiable natural person (known as the data subject). It includes data such as name, postal address, e-mail address and telephone number.

III. What personal data pertaining to me is processed?

We process your name and e-mail address in the context of sending event information and further information regarding our organisation’s activities via e-mail. Your e-mail address may reveal information about your employer.

IV. For what purposes is my personal data processed and what is the legal basis for this?

In the following, we outline the purposes and legal base of the aforementioned contact and the associated processing of your personal data:

1.    Consent
By signing the declaration of consent you agree that we process your personal data and receive information from us by email. This will occur if you have registered for our press lists or granted us your consent in another way in order to receive information from us or subscribed to our newsletter.
Data is processed on the basis of Article 6 Paragraph 1 Sentence a) GDPR.
You can revoke consent at any time. However, please note that this revocation only has future effect; i.e. all the data that is processed on the basis of your consent prior to the time of revocation shall be unaffected by the revocation.

2.    Processing for the purpose of protecting legitimate interests
If you have not granted your consent, we will also process your personal data for the purpose of protecting our legitimate interests in case we believe that our interests prevail and balanced our interests in processing with your potential conflicting interests, basic rights and freedoms. This is the case where we send you advertising information and you do not object to this form of direct contact.
Our legitimate interests are promoting and organising events and providing the relevant information.
We delete data where it is no longer required for the purposes pursued by us and there is no other legal basis, particularly if you have objected to being contacted by us.

V. Will my personal data also be collected by third parties?

We predominantly process personal data that we receive directly from you. In some cases, we also acquire your personal information from third parties, specifically co-organisers of the event. Where necessary, we will provide you with detailed information about this separately.

VI. Am I required to provide my personal data?

You are not required to provide your data.

VII. Who has access to my personal data and who receives it?

Within our organisation, only the departments and the employees working there who absolutely require such access in order to fulfil their roles or tasks will have access to your personal data.

We will forward your personal data to external recipients where there is a legal justification for this. External recipients may include:
•    Processors in the form of service providers who we appoint to render e-mail dispatch/e-mail marketing services or who are tasked with the maintenance of our IT systems. We carefully select and regularly review these processors in order to ensure that your personal data is in good hands. The service providers may only process your personal data for the purposes stipulated by us.
•    Public authorities: authorities and government institutions, such as public prosecutors, courts or fiscal authorities, to whom we may be required to send personal data in particular cases.

VIII. Is there any intention to transmit my personal data to third countries?

Your personal data will not be transmitted to third countries.

IX. How long will my personal data be stored?

To find out how long your personal data will be stored, please refer to the relevant chapter on data processing under Clause IV.

X. What are my rights as the data subject?

You have the following rights with regard to the processing of your personal data:

1.    Right of access
You have the right to receive confirmation from us as to whether we process your personal data or not. If this is the case, you will have the right of access to your personal data and to further information about processing.

2.    Right of rectification
You have the right to request the rectification of your incorrect personal data and to have your incomplete personal data completed.

3.    Right of erasure (“right to be forgotten”)
In certain circumstances, you have the right to request that we erase your personal data. For example, this right exists where the personal data is no longer required for the purposes for which it was collected or otherwise processed, is no longer required or where the personal data has been unlawfully processed.

4.    Restriction of processing
In certain circumstances, you have the right to request that we restrict the processing of your personal data. In this case, we will only store the personal data for which you have granted consent or for which the GDPR permits processing. For example, you may have the right to restrict processing where you have disputed the accuracy of your personal data.

5.    Data portability
If you have provided us with personal data on the basis of a contract or your consent, you can request to be sent the personal data which you have provided in a structured, up-to-date and machine-readable format or that we transfer this to another controller for processing, provided that the legal prerequisites have been met.

6.    Revocation of consent
If you have granted us your consent for the processing of your personal data, you are entitled to revoke it
at any time with future effect. The lawfulness of the processing of your personal data prior to the revocation shall remain hereby unaffected.

7.    Right to object
Right to object in individual cases
For reasons related to your specific situation, you have the right to raise an objection to the processing of your personal data which takes place under Article 6 Paragraph 1 Sentence f) GDPR (data processing based on a balancing of interests) at any time. Should you raise an objection, we will no longer process this personal data, unless we can prove compelling legitimate grounds for processing which outweigh your interests, rights and freedoms or processing is necessary in order to assert, exercise or defend legal claims.

Right to object to the processing of data for the purposes of direct advertisingYou have the right to object to the processing of your personal data for the purposes of direct advertising at any time. Should you object to processing, your personal data will no longer be processed for these purposes.

8.    Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with the responsible supervisory authority if you believe that the processing of your personal data infringes existing legislation. You can contact the data protection authorities who are responsible for your place of residence, place of employment or the location of an alleged infringement or the data protection authorities responsible for us. The responsible authority is the supervisory authority of the federal state in which you live, work or where an alleged infringement has occurred that is the subject of the complaint.

XI. Who can I contact to ask questions or to assert my rights as the data subject?

If you have any questions regarding the processing of your personal data or the assertion of your rights as the data subject specified in Clause X. No. 1 to 7, you can contact us free of charge. Please use our contact details specified in Clause I. No. 1.

Dated: [25. 02.2020]