Data Protection

Data Protection Information

Data protection is an important concern for us. Not only for this reason, we naturally observe all applicable data protection regulations, in particular those of the European Data Protection Regulation ("DSGVO„) and those of the Federal Data Protection Act ("BDSG„).

This data protection information describes which personal data we process in connection with the website and how this is done. Personal data is any data relating to an identified or identifiable natural person, e.g. name, address as well as e-mail address.

I. Who is responsible for data processing?

The data protection controller for the processing of personal data (within the meaning of Art. 4 No. 7 DSGVO) is the Karl Heinz Böckstiegel Foundation, a legally capable and non-profit foundation under German private law with its registered office in 50997 Cologne, Hahnenstraße 21F, e-mail: info@khboeckstiegel-foundation.org (hereinafter "we“).

II. What data is processed? And for what purposes and on what legal basis is this done?

Personal data is collected when you visit the website. Exactly what data this is and for what purposes and on what legal basis this is done depends on various aspects, in particular on which functions are used.

1.Visit of the website

Logfiles

In principle, it is possible to visit the website without providing personal data. However, even in the case of purely informational use of the website, i.e. even if no data is entered, certain personal data of the visitor is collected, which your browser transmits to our server. These are technically necessary to display the website to you and to ensure stability and security. This is the following data:

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/ HTTP status code
Amount of data transferred in each case
Amount of data transferred in each case
Browser
Operating system and its interface
Language and version of the browser software

The processing is based on Art. 6 para. 1 lit. f) DSGVO to protect our legitimate interest in the trouble-free operation of our website. The data is stored for a period of 7 days and then automatically deleted.

Cookies and similar advertising and tracking technologies

We use cookies and similar tracking technologies (hereinafter "Cookies") on our website to provide the visitor with an optimal experience on our website, for which we process data such as browsing behavior or unique IDs.

Cookies are small text files used by websites to, among other things, make the user experience more efficient. Information about the cookies we use on our website and their purposes can be found in the cookie settings .

The processing of personal data in the context of the use of cookies takes place with regard to the necessary cookies (referred to as "functional" in our cookie settings) on the basis of Art. 6 (1) f) DSGVO to protect our legitimate interest in the trouble-free operation of our website. The Coo-kies of the other categories are only used or personal data is only processed in this context if you have given your corresponding consent to this in the cookie settings. The legal basis for this is then Art. 6 para. 1 lit. a) DSGVO. The consent can be revoked at any time, in particular by the appropriate setting in the cookie settings.

2.Contact us

We offer the possibility on our website to contact us. If you contact us, we process the information you provide, including any personal data, insofar as this is necessary to process your request, on the basis of Art. 6 para. 1 lit. b) DSGVO. If necessary, we also offer you the option of contacting us via a contact form set up for this purpose on the website. If you choose this option, the corresponding marked mandatory fields (*) are required to process your request. The specification of the salutation and the name serves the personal address and the specification of your e-mail address to answer your inquiry. Under certain circumstances, we process further personal data to protect our legitimate interests on the basis of Art. 6 (1) f) DSGVO, see also point 4 below.

3.Data processing for the fulfillment of legal obligations

We may also process the personal data processed for the purposes set out above in order to comply with legal obligations to which we are subject. In this case, the legal basis is Art. 6 para. 1 lit c) DSGVO

4.Data processing for the protection of further legitimate interests

Insofar as necessary, personal data will also be processed by us beyond the purposes outlined above to protect further legitimate interests or the legitimate interests of third parties; this is done on the basis of Art. 6 (1) f) DSGVO. The legitimate interests of us include in particular

The assertion of legal claims and the defense in legal disputes;
ensuring the operation of our website; and
The control and further development of our activities.

III. Are you obliged to provide data?

In principle, you are not obliged to provide data. However, some of the cases mentioned in this data protection information require the described provision of personal data. In particular, this applies in connection with contacting us. As far as applicable, we will point out the data required in each case when collecting the personal data (e.g. by marking it as mandatory data (*)). The provision of this data is necessary for the provision of the respective service. For example, an e-mail inquiry cannot be answered without an e-mail address.

Even if additional personal data is collected, we point out at the time of collection if the provision of this information is required by law or contract or is necessary for the conclusion of a contract. In this context, we regularly mark information whose provision is voluntary and not based on one of the aforementioned obligations or not required for the conclusion of a contract.

IV. Who receives personal data?

Personal data is generally processed within our foundation. In addition, we can also transfer personal data to third parties outside our foundation to the extent permitted by law, in particular to

service providers engaged by us, who provide services for us on a separate contractual basis, which may also include the processing of personal data (e.g. IT service providers), as well as the subcontractors of our service providers engaged with our consent; as well as
non-public and public bodies, insofar as we are obliged to transfer your personal data due to legal obligations.

V.Is data transferred to countries outside the EU or EEA?

In principle, we process personal data exclusively within the EU or the European Economic Area (EEA).

In individual cases, such as the execution of contracts, it may be necessary that information is (must be) transferred by us to recipients in so-called "third countries". "Third countries" are countries outside the European Union or the Agreement on the European Economic Area, in which it cannot be assumed without further ado that the level of data protection is comparable to that in the European Union. If personal data are also included in the transfer, it shall be ensured prior to such transfer that the required adequate level of data protection is guaranteed in the respective third country or at the recipient in the third country. This may result in particular from the determination of an adequate level of data protection in a third country as a whole within the framework of a so-called "adequacy decision" of the European Commission. Alternatively, the data transfer can also be based on the so-called "EU standard contractual clauses" agreed with a recipient. We will be happy to provide further information on the suitable and appropriate guarantees for compliance with an adequate level of data protection upon request; you will find the corresponding contact details at the beginning of this data protection information. Information on the so-called EU standard contractual clauses is available athttps://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en and information on adequacy decisions (in English) athttps://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

VI.Is automated decision making used?

Automated decision-making (including profiling) within the meaning of Art. 22 DSGVO does not take place in connection with the processing of your personal data presented in this data protection information.

VII. How long is personal data stored?

Processing of personal data, in particular storage, will only take place for as long as the purpose of the processing or our legitimate processing interests require and your interests in not continuing the processing do not outweigh this. Your data will therefore only be stored for as long as is necessary to provide our website and any associated services or for as long as we are legally obliged to store your data, and will otherwise be deleted. Personal data will also be deleted without any action on the part of the data subject as soon as it is no longer required for the processing purpose or storage would otherwise be legally inadmissible.

As a rule

the data will be deleted or anonymized after the period of time specified above for the respective data processing or website function described in more detail; and
the data processed in connection with a business relationship will be deleted at the latest after expiry of the statutory retention periods.

If personal data must be stored to fulfill retention obligations, it will be stored until the end of the respective retention obligation. Insofar as personal data is stored exclusively for the fulfillment of retention obligations, the processing in this regard is generally restricted so that it can only be accessed if this is necessary with regard to the purpose of the retention obligation.

VIII. What rights do you have as a data subject?

As a person affected by data processing (Art. 4 No. 1 DSGVO), you have special data protection rights vis-à-vis us as the controller, which we would like to inform you about below. To exercise these rights, you can simply contact us using the contact options provided above and in the imprint.

1.Information right, Art. 15 DSGVO

You have the right to receive information from us about whether and what data about you is being processed. Among other things, this also includes information on how long and for what purpose we process the data, where it comes from and to which recipients or categories of recipients it is passed on. In addition, you can receive a copy of this data from us.

2.Right to rectification, Art. 16 DSGVO

As a data subject, you have the right to request that we correct information about you that is not or no longer accurate without delay. In addition, you can request that we complete your incomplete personal data. If required by law, we will also inform third parties about this correction if we have passed on your data to them.

3.Right to erasure ("right to be forgotten"), Art. 17 DSGVO

As a data subject, you have the right to request that we delete your personal data without delay if one of the following reasons applies:

Your data is no longer necessary for the purposes for which it was collected or otherwise processed, or the purpose has been achieved;
You revoke consent and there is no other legal basis for the processing;
You object to the processing and there are no overriding legitimate grounds for the processing; in the case of use of personal data for direct marketing, a sole objection by you to the processing is sufficient;
your personal data have been processed unlawfully;
the erasure of your personal data is necessary for compliance with a legal obligation under Union or Member State law to which we are subject.

Please note that your right to deletion may be restricted by legal provisions. These include in particular the restrictions listed in Art.17 DSGVO and § 35 BDSG.

4.Right to restriction of processing, Art. 18 DSGVO

As a data subject, you have the right to request that we restrict the processing of your personal data if one of the following conditions is met:

You dispute the accuracy of your personal data for a period of time sufficient to enable us to verify the accuracy of the personal data;
the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of your personal data;
we no longer need your personal data for the purposes of processing, but you need it for the assertion, exercise or defense of legal claims; or
You have objected to the processing as long as it has not yet been determined whether our legitimate grounds outweigh yours.

If you have obtained a restriction on processing in accordance with the above list, we will inform you before the restriction is lifted.

5.Right of revocation for consents, Art. 7 Abs. 3 DSGVO

You may revoke any consent given to us at any time with effect for the future. This revocation can be made in the form of an informal message to the contact options mentioned above or in the imprint. If you revoke your consent, the legality of the data processing carried out up to that point will not be affected.

6.Data portability right, Art. 20 DSGVO

As a data subject, you have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to others. Details and restrictions can be found in Art. 20 DSGVO. The exercise of this right does not affect your right to erasure.

7.Right to complain to the supervisory authority, Art. 77 DSGVO

If you believe that the processing of your data by us violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, i.e., in particular with the State Commissioner for Data Protection and Freedom of Information of the State of North Rhine-Westphalia, or with the respective supervisory authority in the member state of your residence, domicile or workplace or the place of the alleged data protection violation.

8.Right of objection, Art. 21 DSGVO

As the data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (e) or (f) DSGVO; this also applies to profiling based on these provisions. In the event of such an objection, we will no longer process the personal data concerning you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms as a data subject, or for the establishment, exercise or defense of legal claims.

If we process personal data for the purpose of direct marketing, you as the data subject have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you, as the data subject, object to processing for direct marketing purposes, we will no longer process the personal data concerned for these purposes.