Data Pro­tec­tion

 

Saar­land Uni­ver­si­ty regards the pro­tec­tion of per­so­nal data as an essen­ti­al part of its digi­ta­liza­ti­on stra­tegy. Ensu­ring that indi­vi­du­als have the right to deci­de on the dis­clo­sure and pro­ces­sing of their per­so­nal data is of utmost prio­ri­ty to the uni­ver­si­ty. This pri­va­cy noti­ce refers to the web­sites that Saar­land Uni­ver­si­ty is respon­si­ble for. If the scope of data pro­ces­sing on a Saar­land Uni­ver­si­ty web­site goes bey­ond the pro­ce­du­res descri­bed here, this will be sta­ted expli­cit­ly on the rele­vant web­site.

 

Name and address of the data con­trol­ler

 

The data con­trol­ler as defi­ned by the Gene­ral Data Pro­tec­tion Regu­la­ti­on, natio­nal data pro­tec­tion laws of mem­ber sta­tes and other data pro­tec­tion regu­la­ti­ons is:

 

Saar­land Uni­ver­si­ty
repre­sen­ted by the Uni­ver­si­ty Pre­si­dent
Cam­pus
66123 Saar­brü­cken
Tel.: +49 681 302–0
info(at)uni-saarland.de

 

Respon­si­ble orga­niza­tio­nal unit:

Arbeits­grup­pe Quan­ten­op­tik

Prof. Dr. Chris­toph Becher

Cam­pus E2 6, Room 2.02

66123 Saar­brü­cken

Tel.: +49 681 302‑2466

christoph.becher(at)physik.uni-saarland.de

 

Cont­act details for the data pro­tec­tion offi­cer

 

Saar­land Uni­ver­si­ty

Data pro­tec­tion offi­cer

Meer­wie­ser­tal­weg 15
66123 Saar­brü­cken
Tel.: +49 681 302‑2813
datenschutz(at)uni-saarland.de
www.uni-saarland.de/datenschutz

 

Gene­ral infor­ma­ti­on on data pro­ces­sing

 

Pur­po­se and scope of pro­ces­sing per­so­nal data

 

Saar­land Uni­ver­si­ty pro­ces­ses per­so­nal data only to the ext­ent neces­sa­ry to pro­vi­de a func­tio­ning web­site, to deli­ver web­site con­tent and to offer ser­vices. As a rule, per­so­nal data are only pro­ces­sed after the user gives their con­sent. An excep­ti­on appli­es in tho­se cir­cum­s­tances in which it is not pos­si­ble to obtain the user’s pri­or con­sent and the pro­ces­sing of such data is per­mit­ted by law.

 

Legal basis for pro­ces­sing per­so­nal data

 

Art. 6(1)(a) of the EU Gene­ral Data Pro­tec­tion Regu­la­ti­on (GDPR) forms the legal basis for Saar­land Uni­ver­si­ty to obtain the con­sent of a data sub­ject for their per­so­nal data to be pro­ces­sed. 

Art. 6(1)(b) GDPR forms the legal basis for pro­ces­sing per­so­nal data requi­red for the per­for­mance of a con­tract to which the data sub­ject is par­ty. This also appli­es if data have to be pro­ces­sed pri­or to ente­ring into a con­tract. 

Art. 6(1)© GDPR forms the legal basis if per­so­nal data have to be pro­ces­sed in order to ful­fil a legal obli­ga­ti­on on the part of Saar­land Uni­ver­si­ty. 

Art. 6(1)(d) GDPR forms the legal basis when pro­ces­sing of per­so­nal data is neces­sa­ry to pro­tect vital inte­rests of the data sub­ject or ano­ther natu­ral per­son. 

Inso­far as Saar­land Uni­ver­si­ty is acting to ful­fil its legal­ly assi­gned rese­arch and tea­ching duties, the legal basis for pro­ces­sing data is Sec­tion 3(13), Saar­land Hig­her Edu­ca­ti­on Insti­tu­ti­ons Act. 

Art. 6(1)(f) GDPR forms the legal basis if data pro­ces­sing is neces­sa­ry in order to pro­tect the legi­ti­ma­te inte­rests of Saar­land Uni­ver­si­ty or of a third par­ty except whe­re such inte­rests are over­ridden by the inte­rests or fun­da­men­tal rights and free­doms of the data sub­ject.

 

Era­su­re of data and sto­rage peri­od

 

The per­so­nal data of the data sub­ject are era­sed or blo­cked as soon as the reason for sto­ring them cea­ses to exist. Sto­rage bey­ond this time peri­od may occur if pro­vi­ded for by Euro­pean or natio­nal legis­la­tors in Uni­on regu­la­ti­ons or natio­nal legis­la­ti­on and rules to which the data con­trol­ler is sub­ject. Such data shall also be blo­cked or era­sed if a sto­rage peri­od pre­scri­bed by one of the afo­re­men­tio­ned legal stan­dards expi­res, unless fur­ther sto­rage of the data is neces­sa­ry for ente­ring into or per­forming a con­tract.

 

Pro­vi­ding con­tent and log files

 

Descrip­ti­on and scope of data pro­ces­sing

 

Each time a Saar­land Uni­ver­si­ty web­site is acces­sed, our sys­tem auto­ma­ti­cal­ly coll­ects data and infor­ma­ti­on from the user’s com­pu­ter sys­tem in order to deli­ver web­site con­tent. The fol­lo­wing data are coll­ec­ted:

• The user’s IP address

• Date and time of access

• Refer­rer web­site

• Data trans­fer size

• HTTP error code (error log)

The data are stored in our system’s log files. We do not store the user’s IP addres­ses or other data that make it pos­si­ble to assign the data to a spe­ci­fic user. The IP addres­ses are trun­ca­ted by the last two octets (e.g: 192.168.xxx.xxx). The­se data are not stored tog­e­ther with the user’s per­so­nal data.

 

Legal basis for data pro­ces­sing

 

The legal basis for the tem­po­ra­ry sto­rage of data and log files is Art. 6(1)(f) GDPR.

 

Pur­po­se of data pro­ces­sing

 

The tem­po­ra­ry sto­rage of the IP address by the sys­tem is neces­sa­ry in order to deli­ver the web­site to the user’s com­pu­ter. The user’s IP address is stored for the dura­ti­on of the ses­si­on. 

Data are stored in log files to ensu­re the website’s func­tion­a­li­ty. The­se data also help us opti­mi­ze the web­site and ensu­re that our IT sys­tems are secu­re. Data eva­lua­ti­on for other pur­po­ses does not take place in this con­text.

The pur­po­ses sta­ted abo­ve con­sti­tu­te our legi­ti­ma­te inte­rests in pro­ces­sing data in accordance with Art. 6(1)(f) GDPR.

 

Sto­rage peri­od

 

Data are era­sed as soon as they are no lon­ger requi­red for the pur­po­se for which they were coll­ec­ted. Data that have been coll­ec­ted for the pur­po­se of pro­vi­ding the web­site are era­sed at the end of the respec­ti­ve ses­si­on.

Data stored in log files are era­sed after no more than seven days. A lon­ger sto­rage peri­od is pos­si­ble. In this case, the users’ IP addres­ses will be era­sed or shor­ten­ed by the last two octets (e.g: 192.168.xxx.xxx), so that they can­not be assi­gned to spe­ci­fic users. 

 

Opti­ons for fil­ing an objec­tion or reques­t­ing rem­oval

 

The coll­ec­tion of data for the pur­po­se of pro­vi­ding the web­site and the sto­rage of such data in log files is essen­ti­al to the website’s ope­ra­ti­on and the user can­not the­r­e­fo­re object to such use.

 

Use of coo­kies

 

Descrip­ti­on and scope of data pro­ces­sing

 

Saar­land Uni­ver­si­ty web­sites may use coo­kies. Coo­kies are text files that are stored by the web brow­ser on the user’s com­pu­ter sys­tem. When a user acces­ses a web­site, a coo­kie may be stored in the user’s ope­ra­ting sys­tem. This coo­kie con­ta­ins a cha­rac­ter string that allows the uni­que iden­ti­fi­ca­ti­on of the brow­ser when the web­site is acces­sed again. 

We use coo­kies to make the brow­sing expe­ri­ence more user-fri­end­ly. Some ele­ments of our web­sites requi­re that the reques­t­ing brow­ser can also be iden­ti­fied after chan­ging pages or when using spe­ci­fic ser­vices. In such cases, the user is infor­med about the use of coo­kies for ana­ly­sis pur­po­ses, and their con­sent to the pro­ces­sing of the per­so­nal data used in this con­text is obtai­ned. The user will also be infor­med about this pri­va­cy noti­ce.

 

Legal basis for data pro­ces­sing

 

The legal basis for the pro­ces­sing of per­so­nal data with the use of coo­kies is Art. 6(1)(f) GDPR. 

Once the user has gran­ted con­sent, the legal basis for data pro­ces­sing with the use of coo­kies for ana­ly­sis pur­po­ses is Art. 6(1)(a) GDPR.

 

Pur­po­se of data pro­ces­sing

 

Coo­kies that are requi­red for tech­ni­cal reasons are used to enhan­ce the user expe­ri­ence. Some func­tions on Saar­land Uni­ver­si­ty web­sites can­not be offe­red wit­hout the use of coo­kies. In order for the­se func­tions to work cor­rect­ly, it is neces­sa­ry that the brow­ser is reco­gni­zed when the user acces­ses ano­ther page. 

The user data coll­ec­ted by coo­kies that are requi­red for tech­ni­cal reasons are not used to crea­te user pro­files. 

 

Sto­rage peri­od, opti­ons for fil­ing an objec­tion or reques­t­ing rem­oval

 

As coo­kies are stored on the user’s com­pu­ter and are trans­mit­ted from it to our web­site, users have full con­trol over the use of coo­kies. Users can deac­ti­va­te or rest­rict the trans­mis­si­on of coo­kies by chan­ging the set­tings in their web brow­ser. Coo­kies that are alre­a­dy stored can be era­sed at any time. This may also be done auto­ma­ti­cal­ly. If you deac­ti­va­te coo­kies on a Saar­land Uni­ver­si­ty web­site, you may not be able to use some of the website’s func­tions in full.

 

News­let­ters

 

Descrip­ti­on and scope of data pro­ces­sing

 

Some Saar­land Uni­ver­si­ty web­sites offer sub­scrip­ti­on to a free news­let­ter. If you regis­ter for a news­let­ter, the data from the input form will be trans­mit­ted to us.

• E‑mail address

• Area of inte­rest

• News­let­ter fre­quen­cy

• Regio­nal or natio­nal edi­ti­on

In addi­ti­on, the fol­lo­wing data are coll­ec­ted during regis­tra­ti­on:

• User’s IP address

• Date and time of regis­tra­ti­on

In the cour­se of the regis­tra­ti­on pro­cess, we request the user’s con­sent for pro­ces­sing per­so­nal data and draw their atten­ti­on to this pri­va­cy noti­ce. 

No data are dis­c­lo­sed to third par­ties in con­nec­tion with data pro­ces­sing for the dis­patch of news­let­ters. Such data are used exclu­si­ve­ly for the pur­po­se of sen­ding the news­let­ter.

 

Legal basis for data pro­ces­sing

 

Once the user has gran­ted con­sent, the legal basis for data pro­ces­sing fol­lo­wing the user’s regis­tra­ti­on for a news­let­ter is Art. 6(1)(a) GDPR.

 

Pur­po­se of data pro­ces­sing

 

The user’s email address is nee­ded to deli­ver the news­let­ter.

 

Sto­rage peri­od

 

Data are era­sed as soon as they are no lon­ger requi­red for the pur­po­se for which they were coll­ec­ted. Users’ email addres­ses are the­r­e­fo­re stored for as long as they sub­scri­be to the news­let­ter.

 

Opti­ons for fil­ing an objec­tion or reques­t­ing rem­oval

 

Users may unsub­scri­be from a news­let­ter at any time. Each news­let­ter con­ta­ins a link for this pur­po­se. This also allows sub­scri­bers to revo­ke their con­sent to the sto­rage of per­so­nal data coll­ec­ted during the regis­tra­ti­on pro­cess.

 

Cont­act form and cont­act by email

 

Descrip­ti­on and scope of data pro­ces­sing

 

Cont­act forms are available on some Saar­land Uni­ver­si­ty web­sites and may be used to cont­act us elec­tro­ni­cal­ly. If a user cont­acts us in this way, the data they enter in the input form are trans­mit­ted to us and stored. As the data coll­ec­ted are spe­ci­fic to each cont­act form, plea­se refer to the rele­vant cont­act form. 

The fol­lo­wing data are also stored when the mes­sa­ge is trans­mit­ted:

• The user’s IP address

• Date and time of regis­tra­ti­on

Befo­re the mes­sa­ge is sent, we request the user’s con­sent for pro­ces­sing their per­so­nal data and draw their atten­ti­on to this pri­va­cy noti­ce. 

Alter­na­tively, they cont­act us using the email address pro­vi­ded. In this case, the per­so­nal data of the user trans­mit­ted with the email will be stored. 

No data are dis­c­lo­sed to third par­ties in con­nec­tion with the data pro­ces­sing requi­red for this pur­po­se. The data are used exclu­si­ve­ly for pro­ces­sing the con­ver­sa­ti­on (i.e. email com­mu­ni­ca­ti­on) with the user.

 

Legal basis for data pro­ces­sing

 

Once the user has gran­ted con­sent, the legal basis for data pro­ces­sing is Art. 6(1)(a) GDPR. 

The legal basis for the pro­ces­sing of data trans­mit­ted by email is Art. 6(1)(f) GDPR. If the pur­po­se of the email cont­act is to enter into a con­tract, the addi­tio­nal legal basis for data pro­ces­sing is Art. 6(1)(b) GDPR.

 

Pur­po­se of data pro­ces­sing

 

The per­so­nal data from the input form are pro­ces­sed sole­ly for the pur­po­se of cont­ac­ting the user. If the user cont­acts us by email, this also con­sti­tu­tes our legi­ti­ma­te inte­rest in pro­ces­sing the data. 

All other per­so­nal data pro­ces­sed during the trans­mis­si­on of an email pre­vent misu­se of the cont­act form and to ensu­re that our IT sys­tems are secu­re.

 

Sto­rage peri­od

 

Data are era­sed as soon as they are no lon­ger requi­red for the pur­po­se for which they were coll­ec­ted. This is the case for the per­so­nal data from the cont­act form and tho­se data sent by email when the respec­ti­ve con­ver­sa­ti­on with the user has ended. The con­ver­sa­ti­on will be dee­med to have ended when it can be infer­red from the cir­cum­s­tances that the sub­ject mat­ter in ques­ti­on has been con­clu­si­ve­ly sett­led. 

Any addi­tio­nal per­so­nal data coll­ec­ted during the trans­mis­si­on pro­cess will be era­sed after a peri­od of no more than seven days.

 

Opti­ons for fil­ing an objec­tion or reques­t­ing rem­oval

 

Users can with­draw their con­sent for the pro­ces­sing of their per­so­nal data at any time. If the user cont­acts us by email, they may with­draw their con­sent for the sto­rage of their per­so­nal data at any time. 

In such cases, the con­ver­sa­ti­on can­not be con­tin­ued and all per­so­nal data stored when cont­act was made will be era­sed. 

 

Web ana­ly­sis using Mato­mo (form­er­ly PIWIK)

 

Scope of pro­ces­sing of per­so­nal data

 

Saar­land Uni­ver­si­ty web­sites may use the Mata­mo open-source soft­ware tool (form­er­ly PIWIK) to ana­ly­se our users’ brow­sing beha­viour. The soft­ware places a coo­kie on the user’s com­pu­ter (plea­se see abo­ve for more infor­ma­ti­on about coo­kies). If the user acces­ses indi­vi­du­al pages on a Saar­land Uni­ver­si­ty web­site, the fol­lo­wing data are stored:

• Two bytes of the user’s IP address

• The acces­sed web­site

• The refer­rer web­site

• Other pages retrie­ved via the acces­sed web­site

• Time on site

• Access fre­quen­cy

• Num­ber of actions on the web­site (page views, down­loads, use of exter­nal links, inter­nal search queries)

The soft­ware used for such ana­ly­ses runs exclu­si­ve­ly on our ser­vers. Users’ per­so­nal data are stored on the­se ser­vers only. Data are not dis­c­lo­sed to third par­ties. 

The soft­ware is con­fi­gu­red so that it does not store IP addres­ses in full, but ins­tead marks two bytes of the IP address (e.g. 192.168.xxx.xxx). In this way, the trun­ca­ted IP address can no lon­ger be tra­ced to the acces­sing com­pu­ter.

 

Legal basis for pro­ces­sing per­so­nal data

 

The legal basis for the pro­ces­sing of users’ per­so­nal data is Art. 6(1)(f) GDPR.

 

Pur­po­se of data pro­ces­sing

 

Pro­ces­sing our users’ per­so­nal data allows us to ana­ly­se their brow­sing beha­viour. By eva­lua­ting the coll­ec­ted data we are able to col­la­te infor­ma­ti­on about the use of Saar­land Uni­ver­si­ty web­sites. This helps us to con­ti­nuous­ly impro­ve our con­tent and user-expe­ri­ence. The reasons sta­ted abo­ve con­sti­tu­te our legi­ti­ma­te inte­rests in pro­ces­sing data in accordance with Art. 6(1)(f) GDPR. Anony­mi­zing the IP address takes appro­pria­te account of users’ inte­rests in the pro­tec­tion of their per­so­nal data.

 

Sto­rage peri­od

 

Data are era­sed as soon as we no lon­ger need them for track­ing pur­po­ses, which in our case means after six months.

 

Opti­ons for fil­ing an objec­tion or reques­t­ing rem­oval

 

As coo­kies are stored on the user’s com­pu­ter and are trans­mit­ted from it by a Saar­land Uni­ver­si­ty web­site, users have full con­trol over the use of coo­kies. Users can deac­ti­va­te or rest­rict the trans­mis­si­on of coo­kies by chan­ging the set­tings in their web brow­ser. Coo­kies that are alre­a­dy stored can be era­sed at any time. This may also be done auto­ma­ti­cal­ly. If you deac­ti­va­te coo­kies for a Saar­land Uni­ver­si­ty web­site, you may not be able to use some of the website’s func­tions in full. 

Our users can opt out of the ana­ly­sis pro­cess. To do this, you must uncheck the cor­re­spon­ding check box. This places an addi­tio­nal coo­kie on the user’s sys­tem that signals to our sys­tem not to store the user’s data. If the user sub­se­quent­ly dele­tes this coo­kie from their own sys­tem, they must set the opt-out coo­kie again. 

You can find fur­ther infor­ma­ti­on about Mato­mo soft­ware and its pri­va­cy set­tings under the fol­lo­wing link: https://matomo.org/docs/privacy/

 

Rights of the data sub­ject

 

If any of your per­so­nal data are pro­ces­sed, you are con­side­red a data sub­ject within the mea­ning of the GDPR and have the fol­lo­wing rights in rela­ti­on to Saar­land Uni­ver­si­ty:

 

Right of access

 

You have the right to obtain con­fir­ma­ti­on from the data con­trol­ler as to whe­ther or not we are pro­ces­sing your per­so­nal data. 

If your data are being pro­ces­sed, you have the right to request the fol­lo­wing from the data con­trol­ler:

• The pur­po­ses for which your per­so­nal data are pro­ces­sed

• The cate­go­ries of per­so­nal data pro­ces­sed

• The reci­pi­ents or cate­go­ries of reci­pi­ents to whom your per­so­nal data have been or will be dis­c­lo­sed

• The plan­ned sto­rage peri­od for your per­so­nal data or, if details can­not be pro­vi­ded, the cri­te­ria used to deter­mi­ne the sto­rage peri­od

• The exis­tence of the right to rec­ti­fi­ca­ti­on or era­su­re of your per­so­nal data, a right to limi­ta­ti­on of pro­ces­sing by the data con­trol­ler or a right to object to such pro­ces­sing

• The right to lodge a com­plaint with a super­vi­so­ry aut­ho­ri­ty

• All available infor­ma­ti­on on the source of the data if the per­so­nal data are not coll­ec­ted from the data sub­ject

• Infor­ma­ti­on on the exis­tence of auto­ma­ted decis­i­on-making, inclu­ding pro­fil­ing, refer­red to in Artic­le 22(1) and (4) GDPR and, at least in tho­se cases, meaningful infor­ma­ti­on about the logic invol­ved, as well as the signi­fi­can­ce and the envi­sa­ged con­se­quen­ces of such pro­ces­sing for the data sub­ject. 

You have the right to request infor­ma­ti­on as to whe­ther your per­so­nal data are trans­mit­ted to a third coun­try or to an inter­na­tio­nal orga­niza­ti­on. Whe­re per­so­nal data are trans­fer­red to a third coun­try or to an inter­na­tio­nal orga­niza­ti­on, you may request that you are infor­med of the appro­pria­te safe­guards in accordance with Art. 46 GDPR. 

This right of access may be rest­ric­ted if it is likely to ren­der impos­si­ble or serious­ly impair the rese­arch or sta­tis­ti­cal pur­po­ses for which the data are requi­red and rest­ric­ting the right of access is neces­sa­ry to achie­ve the requi­red rese­arch or sta­tis­ti­cal pur­po­ses.

 

Right to rec­ti­fi­ca­ti­on

 

You have the right to obtain from the data con­trol­ler the rec­ti­fi­ca­ti­on and/or com­ple­ti­on of your per­so­nal data if the data pro­ces­sed are inac­cu­ra­te or incom­ple­te. The data con­trol­ler must rec­ti­fy such data wit­hout delay. 

Your right to rec­ti­fi­ca­ti­on may be rest­ric­ted inso­far as it is likely to ren­der impos­si­ble or serious­ly impair the rese­arch or sta­tis­ti­cal pur­po­ses for which the data are requi­red and rest­ric­ting the right to rec­ti­fi­ca­ti­on is neces­sa­ry for achie­ving the requi­red rese­arch or sta­tis­ti­cal pur­po­ses.

 

Right to rest­ric­tion of pro­ces­sing

 

You may request that the pro­ces­sing of your per­so­nal data is rest­ric­ted in the event that one of the fol­lo­wing appli­es:

• You con­test the accu­ra­cy of the per­so­nal data for a peri­od that enables the data con­trol­ler to veri­fy their accu­ra­cy.

• The pro­ces­sing is unlawful and you oppo­se the era­su­re of the per­so­nal data and ins­tead request the rest­ric­tion of their use.

• The data con­trol­ler no lon­ger requi­res the per­so­nal data for the pur­po­ses of pro­ces­sing, but you need them in order to assert, exer­cise or defend legal claims.

• You have objec­ted to pro­ces­sing in accordance with Art. 21(1) GDPR pen­ding veri­fi­ca­ti­on whe­ther the legi­ti­ma­te grounds of the con­trol­ler over­ri­de your reasons.

If the pro­ces­sing of your per­so­nal data has been rest­ric­ted, the data may, with the excep­ti­on of sto­rage, only be pro­ces­sed with your con­sent or for the pur­po­se of asser­ting, exer­cis­ing or defen­ding legal claims or for pro­tec­ting the rights of ano­ther natu­ral or legal per­son or for reasons of important public inte­rest of the Uni­on or a Mem­ber Sta­te. 

If pro­ces­sing has been rest­ric­ted in accordance with the abo­ve con­di­ti­ons, the data con­trol­ler shall inform you befo­re the rest­ric­tion is lifted. 

Your right to rest­ric­tion of pro­ces­sing may be rest­ric­ted inso­far as it is likely to ren­der impos­si­ble or serious­ly impair the rese­arch or sta­tis­ti­cal pur­po­ses for which the data are requi­red and this rest­ric­tion is neces­sa­ry for achie­ving the requi­red rese­arch or sta­tis­ti­cal pur­po­ses.

 

Right to era­su­re

 

Duty to era­se 

You may request that the data con­trol­ler era­se your per­so­nal data wit­hout delay. The data con­trol­ler is obli­ged to era­se the­se data wit­hout delay in the event that one of the fol­lo­wing appli­es:

• Your per­so­nal data are no lon­ger requi­red for the pur­po­ses for which they were coll­ec­ted or other­wi­se pro­ces­sed.

• You with­draw your con­sent on which the pro­ces­sing was based in accordance with Art. 6(1)(a) or Art. 9(2)(a) GDPR and the­re is no other legal basis for the pro­ces­sing.

• You object to the pro­ces­sing in accordance with Art. 21(1) GDPR and the­re are no over­ri­ding legi­ti­ma­te reasons for the pro­ces­sing, or you object to the pro­ces­sing in accordance with Art. 21(2) GDPR. 

• Your per­so­nal data have been pro­ces­sed unlawful­ly. 

• The era­su­re of your per­so­nal data is neces­sa­ry to ful­fil a legal obli­ga­ti­on under Uni­on or Mem­ber Sta­te law to which the data con­trol­ler is sub­ject.

• Your per­so­nal data have been coll­ec­ted in rela­ti­on to infor­ma­ti­on socie­ty ser­vices in accordance with Art. 8(1) GDPR.

Obli­ga­ti­on to inform third par­ties 

If the data con­trol­ler has made your per­so­nal data public and is obli­ged to era­se them in accordance with Art. 17(1) GDPR, the con­trol­ler shall, taking account of available tech­no­lo­gy and the cost of imple­men­ta­ti­on, take reasonable steps to inform data con­trol­lers respon­si­ble for pro­ces­sing such per­so­nal data that you as the data sub­ject have reques­ted the era­su­re by such con­trol­lers of any links to, or copy or repli­ca­ti­on of, the­se per­so­nal data. 

Excep­ti­ons 

The right to era­su­re does not app­ly inso­far as the pro­ces­sing is neces­sa­ry:

• To exer­cise the right to free­dom of expres­si­on and infor­ma­ti­on

• To ful­fil a legal obli­ga­ti­on that requi­res pro­ces­sing in accordance with Uni­on or Mem­ber Sta­te law to which the data con­trol­ler is sub­ject or to per­form a task in the public inte­rest or in the exer­cise of offi­ci­al aut­ho­ri­ty ves­ted in the data con­trol­ler

• For reasons of public inte­rest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR

• For archi­ving pur­po­ses in the public inte­rest, for sci­en­ti­fic or his­to­ri­cal rese­arch pur­po­ses or for sta­tis­ti­cal pur­po­ses in accordance with Artic­le 89(1) GDPR inso­far as the right refer­red to in Art. 89(1)(a) is likely to ren­der impos­si­ble or serious­ly impair the achie­ve­ment of the objec­ti­ves of such pro­ces­sing.
To assert, exer­cise or defend legal claims. 

 

Right to noti­fi­ca­ti­on

 

If you have exer­cis­ed your right to have the data con­trol­ler rec­ti­fy, era­se or rest­rict the pro­ces­sing of your per­so­nal data, he or she is obli­ged to inform all reci­pi­ents to whom such data have been dis­c­lo­sed of their rec­ti­fi­ca­ti­on or era­su­re or of the rest­ric­tion of pro­ces­sing, unless this pro­ves impos­si­ble or invol­ves dis­pro­por­tio­na­te effort. 

You have the right to be infor­med of the­se reci­pi­ents by the con­trol­ler.

 

Right to data por­ta­bi­li­ty

 

You have the right to recei­ve the per­so­nal data you made available to the data con­trol­ler in a struc­tu­red, com­mon and machi­ne-rea­da­ble for­mat. You also have the right to trans­mit the­se data to ano­ther data con­trol­ler wit­hout hin­drance from the data con­trol­ler to whom they were made available, pro­vi­ded that:

• The pro­ces­sing is based on con­sent in accordance with Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a con­tract in accordance with Art. 6(1)(b) GDPR.

• The pro­ces­sing is car­ri­ed out by auto­ma­ted means. 

In exer­cis­ing this right, you also have the right to have your per­so­nal data trans­mit­ted direct­ly from one data con­trol­ler to ano­ther inso­far as this is tech­ni­cal­ly fea­si­ble. This must not com­pro­mi­se the free­doms and rights of other per­sons. 

The right to data por­ta­bi­li­ty does not app­ly to the pro­ces­sing of per­so­nal data neces­sa­ry for the per­for­mance of a task in the public inte­rest or in the exer­cise of offi­ci­al aut­ho­ri­ty ves­ted in the data con­trol­ler.

 

Right to object

 

You have the right, on grounds rela­ting to your par­ti­cu­lar situa­ti­on, to object at any time to the pro­ces­sing of your per­so­nal data that occurs on the basis of Art. 6(1)(e) or (f) GDPR; this also appli­es to pro­fil­ing acti­vi­ties under­ta­ken on the basis of the­se pro­vi­si­ons. 

Saar­land Uni­ver­si­ty shall no lon­ger pro­cess your per­so­nal data, unless it pro­du­ces com­pel­ling legi­ti­ma­te reasons for such pro­ces­sing that out­weigh your inte­rests, rights and free­doms or such pro­ces­sing is neces­sa­ry for asser­ting, exer­cis­ing or defen­ding legal claims. 

In con­nec­tion with the use of infor­ma­ti­on socie­ty ser­vices, and not­wi­th­stan­ding Direc­ti­ve 2002/58/EG, you may exer­cise your right to object by auto­ma­ted means using tech­ni­cal spe­ci­fi­ca­ti­ons. 

You also have the right, on grounds rela­ting to your par­ti­cu­lar situa­ti­on, to object to the pro­ces­sing of your per­so­nal data that occurs for sci­en­ti­fic or his­to­ri­cal rese­arch pur­po­ses or for sta­tis­ti­cal pur­po­ses in accordance with Art. 89(1) GDPR. 

Your right to object may be rest­ric­ted inso­far as it is likely to ren­der impos­si­ble or serious­ly impair the achie­ve­ment of rese­arch or sta­tis­ti­cal pur­po­ses, and this rest­ric­tion is neces­sa­ry for achie­ving such rese­arch or sta­tis­ti­cal pur­po­ses.

 

Right to with­draw a decla­ra­ti­on of con­sent con­cer­ning data pro­tec­tion

 

You have the right to with­draw your decla­ra­ti­on of con­sent con­cer­ning data pro­tec­tion at any time. With­dra­wing your con­sent does not affect the lawful­ness of data pro­ces­sing based on your con­sent befo­re its with­dra­wal. 

 

Right to lodge a com­plaint with a super­vi­so­ry aut­ho­ri­ty

 

Wit­hout pre­ju­di­ce to any other admi­nis­tra­ti­ve or judi­cial reme­dy, you have the right to lodge a com­plaint with a super­vi­so­ry aut­ho­ri­ty, in par­ti­cu­lar in the Mem­ber Sta­te of your habi­tu­al resi­dence, your place of work or the place of the alle­ged inf­rin­ge­ment if you con­sider that the pro­ces­sing of your per­so­nal data inf­rin­ges the GDPR. 

The super­vi­so­ry aut­ho­ri­ty with which the com­plaint has been lodged shall inform the com­plainant of the pro­gress and the out­co­me of the com­plaint, inclu­ding the pos­si­bi­li­ty of a judi­cial reme­dy in accordance with Art. 78 GDPR. 

The regu­la­to­ry aut­ho­ri­ty respon­si­ble for Saar­land Uni­ver­si­ty is: 

Unab­hän­gi­ges Daten­schutz­zen­trum Saar­land
Die Lan­des­be­auf­trag­te für Daten­schutz und Infor­ma­ti­ons­frei­heit
Fritz-Dobisch-Stra­ße 12
66111 Saar­brü­cken
Tel.: +49 681 94781–0
poststelle(at)datenschutz.saarland.de

 

Updates to this pri­va­cy noti­ce

 

Plea­se note that Saar­land University’s online ser­vices are sub­ject to con­stant chan­ge and deve­lo­p­ment and this pri­va­cy noti­ce will be updated accor­din­gly. You should the­r­e­fo­re read this pri­va­cy noti­ce regu­lar­ly to keep infor­med about chan­ges with regard to the pro­ces­sing of your per­so­nal data. We will noti­fy you if the­se chan­ges requi­re your con­sent.