Data Protection

I. General Preliminary Remarks

The central web server www.uni-bremen.de, together with the individual sites belonging to the University of Bremen, represents the University of Bremen both internally and externally, disseminates information and supports the University’s activities. The website has an independent, uniform design. However, the university’s institutes and faculties have a certain degree of freedom regarding individual design and also bear their own responsibility in this regard.

II. Responsibility and Accountability

No guarantee is given regarding the operation of the website or the accuracy and timeliness of the information provided. The Centre for Networks at the University of Bremen is responsible for the operation of the server. The respective editors are responsible for organisation within the individual faculties. The Rector’s Office bears overall responsibility for content and, in cases of doubt, decides on the admissibility of the data. The Content Management team (Division 03, Press Office) maintains the homepages of the central website at www.uni-bremen.de. In all other respects, the university’s departments, divisions, faculties and institutions are themselves responsible for the content they present.

I. Name and address of the responsible party:
University of Bremen
Rector Prof. Dr Jutta Günther
Bibliothekstrasse 1–3
28359 Bremen, Germany
Tel.: +49 421 218-1
Email: web@uni-bremen.de
Website: www.uni-bremen.de

II. Name and address of the Data Protection Officer:
Petra Banik
Unit 06
Bibliothekstrasse 1-3
29359 Bremen, Germany
Tel.: +49 421 218-60211
Fax: +49 421 218-60210
Email: pbanik@uni-bremem.de

III. General information on data processing

(1) The University of Bremen takes the protection of personal data very seriously. We process personal data collected when you visit our websites in accordance with the applicable data protection regulations. In particular, the EU General Data Protection Regulation (GDPR), the Bremen Implementation Act for the EU General Data Protection Regulation (BremDSGVOAG), the Bremen Higher Education Act (§ 11 BremHG) and the Telemedia Act (TMG) apply.

(2) As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website and our content and services (see points 6 and 7). The processing of our users’ personal data generally takes place only with their consent. An exception applies in cases where prior consent is not possible for practical reasons and the processing of the data is permitted by law. Any use of your personal data takes place solely for the stated purposes and to the extent necessary to achieve those purposes.

(3) We will neither publish your data nor disclose it to third parties without authorisation. We would, however, point out that, upon instruction from the competent authorities in individual cases, we are entitled to provide information regarding data, insofar as this is necessary for the purposes of criminal prosecution, for the prevention of danger by the police authorities of the federal states, or for the fulfilment of the statutory duties of the federal and state constitutional protection authorities and the Federal Intelligence Service (legal basis: Article 6(1)(c) of the GDPR).

Below, we provide information on the nature, scope and purposes of the collection and use of personal data.

1. Data collection and processing when accessing our website

1) When you visit our website, our web servers automatically record each visit in a log file.

(2) This data is stored separately from any other data you enter whilst using our website. We are unable to link this data to a specific individual. This data is not stored together with any other personal data relating to the user. Data is stored in log files to ensure the website functions properly. The data is also used to optimise the website and to ensure the security of our IT systems. The legal basis for the temporary storage of the data and the log files is Article 6(1)(f) of the GDPR.

The following data is collected:

• The IP address of the requesting computer

• Date and time of access

• The access method/function requested by the requesting computer

• Name and URL of the file accessed

• Amount of data transferred

• Web server access status (file transferred, file not found, command not executed, etc.)

• URL from which the access took place

(3) Logins when accessing restricted areas are sometimes logged in order to detect attempts at misuse and password attacks. No data is stored that could be used to create personalised profiles based on user behaviour.

(4) The collection of data for the provision of the website and the storage of data in log files is absolutely essential for the operation of the website. Consequently, users have no right to object.

2. Cookies

(1) Our website uses cookies in several places. They serve to make our service more user-friendly and effective. Cookies are small text files that are stored on your computer by your browser. Most of the cookies we use are so-called session cookies (legal basis: Article 6(1)(f) of the GDPR), which are deleted when you close your browser session.

The following cookies are set:

• Session cookie (for session recognition; lifetime: one session)

• Matomo cookie for web analytics (see the ‘Analytics Services’ section)

(2) You can specify in your browser settings whether cookies may be set or not.

3. Web analytics via Matomo (formerly PIWIK)

(1) Our website uses Matomo, which is a so-called web analytics service. Matomo uses so-called cookies, which are text files stored on your computer and which enable us to analyse the use of the website.

(2) For this purpose, the usage information generated by the cookie (including your truncated IP address) is transmitted to our server and stored for the purposes of analysing usage. The statistics obtained enable us to improve our website and make it more interesting for you as a user. Your IP address is anonymised immediately during this process, so that you, as a user, remain anonymous to us. The anonymisation of the IP address ensures that users’ interests in the protection of their personal data are adequately safeguarded. The information generated by the cookie regarding your use of this website is not passed on to third parties. You can prevent the use of cookies by adjusting the settings in your browser software accordingly; however, in this case, you may not be able to make full use of all the functions of this website.

(3) The legal basis for the use of Matomo is Article 6(1)(f) of the GDPR.

(4) If you do not consent to the storage and analysis of this data from your visit, you can object to its storage and use at any time with a single click. In this case, a so-called ‘opt-out’ cookie will be stored in your browser, with the result that Matomo will not collect any session data. Please note: If you delete your cookies, this will also delete the opt-out cookie, which you may then need to reactivate. Further information on the privacy settings of the Matomo software can be found at the following link: https://matomo.org/docs/privacy/.

The following currently applies to you:

4. Data security

(1) Our technical and organisational security measures, which we use to protect all data from unauthorised access, are always kept up to date with the latest technical standards. Where your data is collected and recorded by us, it is stored on specially secured servers. These are protected by technical and organisational measures against loss, destruction, unauthorised access, alteration or disclosure by unauthorised persons. Access to your data is restricted to a small number of authorised individuals. All our staff are bound by a duty of confidentiality. Personal information is always transmitted in encrypted form. The data transmitted is stored in a database accessible only to administrators.

(2) Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

5. Links to third-party websites

Our website contains links to external third-party websites. Our website may also contain links to external social media platforms; however, no plug-ins from these platforms are used. These websites are the responsibility of their respective operators. We are therefore unable to accept any liability for this external content. At the time the links were included, the respective websites did not contain any unlawful content. However, we have no influence over the current or future design and content of the linked pages. It is not reasonable to expect us to monitor these third-party pages on an ongoing basis. Should we become aware of any infringement, we will remove the link immediately. When you leave this website, we recommend that you first read the privacy policy of each website carefully.

6. YouTube

Our website uses an iFrame from YouTube, a site operated by Google Inc. The operator of these pages is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our pages featuring a YouTube iFrame, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account (the legal basis is Article 6(1)(f)). Further information on the handling of user data can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?gl=DE&hl=de#infocollect

7. Contact form

(1) If you send us enquiries via the contact form, the details you provide on the form – including the contact details you enter there – will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We do not pass this data on to third parties. In order to answer your questions, we require your name and email address as mandatory fields.

(2) Where consent has been given, the legal basis is Article 6(1)(a) of the GDPR.

(3) You may withdraw your consent to the storage of your data and email address at any time. To do so, please contact us at the addresses given above or by email at the following address: content@uni-bremen.de. In this case, all personal data stored in the course of establishing contact will be deleted.

8. Newsletter data

(1) If you wish to subscribe to the newsletter, where available, on the website, we require your email address and information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No further data is collected. We use this data exclusively for sending the requested information and do not pass it on to third parties.

(2) You may withdraw your consent to the storage of your data and email address, and to their use for sending the newsletter, at any time, for example via the ‘Unsubscribe’ link in the newsletter.

(3) The legal basis for processing the data following registration for the newsletter is Article 6(1)(a) of the GDPR, provided the user has given their consent.

(4) The data will be deleted as soon as it is no longer required to fulfil the purpose. The user’s email address will therefore be stored for as long as the newsletter subscription remains active.

9. SSL encryption

This website uses SSL encryption for security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’ and by the padlock icon in your browser bar. When SSL encryption is enabled, it is virtually impossible for third parties to read the data you transmit to us.

IV. Rights of the data subject

Insofar as the University of Bremen processes your personal data, you, as a data subject within the meaning of the GDPR, are entitled to the following rights:

1. Right of access (Article 15 of the GDPR)

You may request confirmation as to whether we are processing personal data relating to you. If such processing is taking place, you may request the following information:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom personal data relating to you have been or will be disclosed;

(4) the envisaged period for which the personal data relating to you will be stored, or, if it is not possible to provide specific details in this regard, the criteria used to determine the storage period;

(5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restrict processing by the controller or a right to object to such processing;

(6) the existence of a right to lodge a complaint with a supervisory authority;

(7) any available information as to the origin of the data, where the personal data are not collected from the data subject;

(8) the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

You have the right to request information as to whether personal data relating to you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

If your personal data is processed for scientific, historical or statistical research purposes, the right of access may be restricted to the extent that it is likely to render the fulfilment of the research and statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfilment of those research and statistical purposes.

2. Right to rectification (Article 16 of the GDPR)

You have the right to request that the controller rectify and/or complete your personal data if the personal data concerning you that is being processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

3. Right to restriction of processing (Article 18 of the GDPR)

You may request the restriction of the processing of your personal data under the following conditions:

(1) where you contest the accuracy of the personal data relating to you for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;

(3) the controller no longer needs the personal data for the purposes of the processing; however, you require it for the establishment, exercise or defence of legal claims; or

(4) if you have objected to the processing in accordance with Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your own.

Where the processing of your personal data has been restricted, such data – apart from its storage – may only be processed with your consent or for the purposes of asserting, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or of a Member State. If the restriction on processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Where your personal data is processed for scientific, historical or statistical research purposes, the right of access may be restricted to the extent that it is likely to render the fulfilment of the research and statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfilment of the research and statistical purposes.

4. Right to erasure (Article 17 of the GDPR)

a) Obligation to erase

You may request that the controller erases the personal data relating to you without undue delay. The controller is obliged to erase this data without undue delay if one of the following grounds applies:

(1) The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2) You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.

(3) You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Article 21(2) of the GDPR.

(4) The personal data relating to you has been processed unlawfully.

(5) The erasure of your personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.

(6) The personal data relating to you was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.

b) Disclosure to third parties

If the controller has made the personal data relating to you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, it shall take appropriate measures, including technical measures, taking into account the available technology and the cost of implementation, to inform data controllers processing the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replicas of such personal data.

c) Exceptions

The right to erasure does not apply where the processing is necessary

(1) for the exercise of the right to freedom of expression and information;

(2) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or

(5) for the establishment, exercise or defence of legal claims.

5. Right to be informed (Article 19 of the GDPR)

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data have been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed by the controller of the identity of these recipients.

6. Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

(1) the processing is based on consent (Article 6(1)(a) of the GDPR) or Article 9(2)(a) of the GDPR, or on a contract (Article 6(1)(b) of the GDPR), and

(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, in so far as this is technically feasible. The freedoms and rights of other individuals must not be prejudiced thereby.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object (Article 21 of the GDPR)

(1) You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

(2) In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by means of automated procedures using technical specifications.

(3) Where your personal data are processed for scientific, historical or statistical research purposes, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89 of the GDPR. Your right to object may be restricted to the extent that it is likely to render the fulfilment of the research and statistical purposes impossible or seriously impair it, and the restriction is necessary for the fulfilment of those research and statistical purposes.

8. Right to withdraw consent under data protection law (Article 7(3) of the GDPR)

You also have the right to withdraw any declaration of consent given for data protection purposes at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of that consent prior to its withdrawal. For this and any further questions regarding personal data, you may contact us at the addresses given above or by email at the following address: content@uni-bremen.de.

9. Automated individual decision-making, including profiling (Article 22 of the GDPR)

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the controller,

(2) is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests; or

(3) is based on your explicit consent.

However, such decisions must not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests. With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to set out your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint.

V. Processing of personal data on internal, access-restricted websites

(1) On the University of Bremen’s internal, access-restricted websites – which relate solely to information platforms accessible only to members and affiliates of the university – the following personal data is collected from logged-in, registered users (students, staff, university members with a user account) whilst they are on these pages:

a) the user’s name,

(b) the email address associated with the account,

(c) where applicable, the user’s membership of a specific user group.

(2) The legal basis for the processing of personal data is Article 6(1)(a) of the GDPR, provided the user has given their consent. The purpose of collecting this data is to enable access to the restricted-access web pages (establishing a connection), as well as for the purposes of system security, technical administration, network infrastructure and optimising the services offered. The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This occurs upon logging out or closing the web browser.

VI. Validity and currency of the privacy policy (as at May 2018)

By using our website, you consent to the use of data as described above. This privacy policy is effective immediately and supersedes all previous versions. This policy will be updated as necessary to adapt its content to the website and to reflect general legal changes.