Data privacy

Data privacy

Note on data privacy

English working translation. Only the German version is binding.

 

With this note, the Research Data Centres of the Statistical Offices of the Federation and the Federal States inform you about the processing of your person-related data:
 

A.    Acts of processing by the Research Data Centres

Here, you find information concerning the person-related data which is processed by the Research Data Centres within their frame of action. These are outlined based on the different acts of processing:


I.    Processing of the request for access

1.    For which purpose is the data processed?
To enable the Research Data Centres to organizationally handle the data use and to check if the legal conditions for a use of microdata are fulfilled, the necessary information is collected in the request for access and then stored and utilized.

2.    Which data is processed?
The following information is collected, stored and utilized in the request for access:

  • Name and address of the applying institution
  • Name of cooperating institutions, if a cooperation is wished
  • Name and contact data of all data users
  • Description of the project and the statistical methods that are to be applied
  • Description of the procedure if the requested data is to be merged
  • Requested statistic(s) and survey year(s)
  • Requested way(s) of access

3.    On which legal basis is the data processed?
The processing of this data is necessary for the Statistical Offices of the Federation and the Federal States to attend to their task according to section 16 (6) BStatG to provide the institutions stated there with microdata (section 6 (1) item 1b) GDPR).

4.    How long is the data stored?
The person-related data is stored for the duration of the processing.


II.    Distribution of the newsletter

1.    For which purpose is the data processed?
Your e-mail address is processed to send you the newsletter of the Research Data Centres. The other data is collected so that we can, if necessary, prove that a valid declaration of consent was given for the delivery of the newsletter.

2.    Which data is collected?

On our website, you can order our newsletter under the offer “Service”. To register for the newsletter, it is sufficient to click on the button “Subscribe” and send the opening e-mail. After receiving your e-mail, we accept you as a subscriber of our newsletter. We offer a further option for subscribing within the registration process for Campus Files (see below). During the registration process, you can use the selectable option to register for the newsletter.   

After your acceptance as a subscriber of our newsletter, the following data is stored:

  • E-mail address
  • Information that subscribers might make additionally
  • Information from the header of e-mails. As compulsory information, this only contains information about the sender and the date the e-mail was generated. In addition, the header can contain optional information. Usually, there is information about the path the e-mail has taken, about the content of the mail and its format as well as information on the recipients.
  • Time the e-mail was sent and received

3.    On which legal basis is the data processed?
The legal basis for the storage and utilization of your e-mail address for the delivery of the newsletter is your consent (section 6 (1) item 1a) GDPR).

4.    How long is the data stored?
Your data is deleted as soon as it is no longer necessary for the purpose of its collection. Consequently, your data is stored as long as your subscription to the newsletter is active.

5.    Right on the withdrawal of the declaration of consent as required by the data protection law and option for objection and elimination
You have the right to withdraw your declaration of consent as required by the data protection law at any time. Withdrawing from the consent does not touch the lawfulness of the processing that has been done before the withdrawal. For withdrawing your consent, please go to the page newsletter and unsubscribe there.


III.    Registration for Campus Files

1.    For which purpose is the data processed?
To use the Campus Files provided by the Research Data Centres, it is necessary to log in via the registration tool. The registration procedure is structured in two stages. To handle this process, we need the information that has to be stated in the registration form. After your registration, a confirmation e-mail will be sent to the e-mail address you indicated. After that, you will be asked to verify your registration by clicking on a link. This verification is necessary so that no one can register using an unfamiliar e-mail address. A short time later you will receive the confirmation of access from the RDC. You can then use your user name and password to log in and download Campus Files.

Subsequent to your registration the RDC record your downloads with the aim to improve data supply. Personal data which has been stored as part of your registration are used to ensure the terms of use of public use files.

a) Legal bond of addressees: users are prohibited to pass on absolutely anonymous data.
b) Obligation to cite correctly: users are required to cite the RDC as source:

  • „Source: RDC of the Federal Statistical Office and Statistical Offices of the Federal States of Germany, [name of statistic used], [survey year(s) YYYY-YYYY], own calculations.“

      or

  • „Quelle: FDZ der Statistischen Ämter des Bundes und der Länder, [Name der Statistik], [JJJJ-JJJJ], eigene Berechnungen.“

c) No warranty/liability for accuracy, completeness, potential damage or consequences, technical availability. 

2.    Which data is processed?
The following information is asked for in the registration form. The information marked with * has to be filled out when first registering; the other boxes can be filled out optionally:

  • Address (Mrs./Mr.)*
  • Title
  • Status*
  • First name*
  • Last name*
  • Area of studies*
  • Faculty*
  • Street name and house number / post office box of the institution
  • Postal code
  • City
  • E-mail address (=user name for log in)*
  • Password*
  • Confirmation*
  • Intended use*
  • E-mail address, if the newsletter is subscribed to

In addition to the data stated above, the following data is recorded for every download with the objective to improve the data supply:

  • Purpose of use for the specific download
  • Time and date of the download
  • Name of the download

3.    On which legal basis is the data processed?
The processing is based on your consent (section 6 (1) item 1 a) GDPR).

4.    How long is the data stored?
The data is stored for the period of the registration. If users cancel their registration, their data from the recording of the uses and all data about the user is deleted from the database.

5.  Right on the withdrawal of the declaration of consent as required by the data protection law
You have the right to withdraw your declaration of consent for the use of your personal data as required by the data protection law at any time. Withdrawing from the consent does not touch the lawfulness of the processing that has been done before the withdrawal. If you want to withdraw from your consent for the use of your personal data, just write an e-mail to .

IV. Registration for Safe Centre Online Booking  

1. Purpose of data processing
Specification of mail addresses is needed for general login and consequently for usage of the Safe Centre Online Booking. Every account is linked to an individual mail address and enables users to book and manage their appointments. Through specification of your name, RDCs are enabled to successfully link the reservation to a certain data use. It is only possible to make appointments for current projects.

2. Which data is processed?
Name and mail address are collected as part of every registration. Additionally, it is possible to specify first name and phone number. Appointments will be stored for a period of six month during the usage of the Safe Centre Online Booking. As part of that storage information about data, time and location as well as the project number linked to a certain reservation will be saved. Only employees of the RDC have access to this data.

3. .;Which legal base, data is processed on?
Legal base for processing of data is your declaration of consent as part of section 6 (1) sentence 1a) General Data Protection Regulation.

4. Duration of data storage
Data (name and mail address) of an account are stored for the period of registration. Data will be deleted as part of an account deletion (respectively at the end of the project). Data related to an appointment will be deleted automatically after six months.

5. Right to withdraw the declaration of consent regarding data privacy protection
You can withdraw your declaration regarding data privacy protection, anytime, by deleting your account (Click on User -> Click on your own name -> Click on “Delete my account”). Alternatively, you may ask at for deletion of your account. Please be aware that in case of deletion of your account it is not possible to book appointments through the Safe Centre Online Booking any longer.

 

V.    Provision of the website and creation of record and log files

 

The internet offer of the Research Data Centres is hosted at the Landesbetrieb Information und Technik Nordrhein-Westfalen (IT.NRW).

          Landesbetrieb Information und Technik Nordrhein-Westfalen
          Mauerstraße 51
          40476 Düsseldorf
          Germany
          Phone: +49 211 9449-01
          Fax: +49 211 9449-8000

IT.NRW receives the data stated below for this purpose.

1.    For which purpose is the data processed?
The data from the record resp. log files serves the assurance of the functionality of the website. In addition, it serves the defense against and analysis of attacks.
 
2.    Which data is processed?
With every access to the content of the internet offer, data is stored temporarily via so called record or log files. Those might allow for identification. The following data is hereby collected:

  • Date and time of the access
  • Name of the accessed internet service, the activated resource and the applied action
  • Request that was placed by the client
  • Transmitted data volume
  • Notification weather the access was successful
  • IP address of the accessing data processor
  • Client information (among others browser, operating system)

3.    On which legal basis is the data processed?
The legal basis for the temporary storage of the data is section 6 (1) letter e GDPR in conjunction with section 3 (1) Data Protection Law NRW.

4.    How long is the data stored?
The data is stored for up to 48 hours directly and only accessible for the administration. After that, they are available only indirectly via the reconstruction of backup tapes. They are terminally deleted after six weeks.

   
B.    Recipients of the person-related data

As far as the passing on of your personal data is necessary for the fulfillment of the purposes stated above, your data is only passed on within

  • the Statistical network,
  • the Research Data Centres,
  • and, if necessary, their subcontractors.


Data that was collected within the frame of the access to our services is only transmitted to third parties outside of these institutions

  • as far as we are obliged to do so by legal or judicial resp. public prosecutor's order or
  • if the transfer is necessary for legal or persecutive purposes in the case of attacks on the web infrastructure of the state government.
     

C.    Your rights as a person concerned

If the legal preconditions are met, you have the following rights:

  • Right of information about individual data related to you (section 15 General Data Protection Regulation)
  • Right of correction of incorrect individual data related to you (section 16 General Data Protection Regulation)
  • Right of the deletion of individual data (section 17 General Data Protection Regulation)
  • Right of limitation of the processing of individual data (section 18 General Data Protection Regulation)
  • Right of objection against the processing of individual data (section 21 General Data Protection Regulation)

According to section 77 of the General Data Protection Regulation you have the additional right to file a complaint at the supervisory authority if you think that the processing of the individual data related to you is not handled legitimately.


D.    Contact data of the authority responsible for the processing and of the data protection officer

I. Responsible for the data processing in the Research Data Centre of the Statistical Offices of the Federal States is:

          Research Data Centre of the Statistical Offices of the Federal States
          – Administrative office –
          c/o Information und Technik Nordrhein-Westfalen
          Postal address: 40002 Düsseldorf, Postfach 10 11 05
          Phone: +49 211 9449-01
         

          Data protection officer of the Landesbetrieb
          Information und Technik Nordrhein-Westfalen (IT.NRW)
          Mauerstraße 51
          40476 Düsseldorf
          Germany
          Phone: +49 211 9449-01
         


II. Responsible for the data processing in the Research Data Centre of the Federal Statistical Offices is:

          Research Data Centre of the Federal Statistical Office
          65189 Wiesbaden, Gustav-Stresemann-Ring 11
         

          Data protection officer of the Federal Statistical Office
          Gustav-Stresemann-Ring 11
          65180 Wiesbaden
          Germany
          Phone: +49 61175 3929
         


E.    Contact data of the supervisory authority

I. The responsible supervisory authority for the data processing in the Research Data Centre of the Statistical Offices of the Federal States is:

          Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
          Postfach 20 04 44
          40102 Düsseldorf
          www.ldi.nrw.de
          Phone: +49 211/38424-0
          Fax: +49 211/38424-10
         


II. The responsible supervisory authority for the data processing in the Research Data Centre of the Federal Statistical Office is:

          Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
          Husarenstraße 30
          053117 Bonn