Privacy

The Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU) is responsible for its websites within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection regulations. It is legally represented by its President. For contact details, please consult the legal notice on FAU’s central website.

The respective FAU institutions are responsible for any content they make available on the websites of Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU). For questions related to specific content, please contact the person responsible as named in the legal notice of this web page.

Name and address of the Data Protection Officer

Norbert Gärtner, RD
Schloßplatz 4
91054 Erlangen

Phone: +49 9131 85-25860
Fax: +49 9131 85-70239
Email: ✉ datenschutzbeauftragter@fau.de

General Information on Data Processing

Scope of processing of personal data

We only process our users' personal data to the extent necessary to provide services, content and a functional website. As a rule, personal data are only processed after the user gives their consent. An exception applies in those cases where it is impractical to obtain the user's prior consent and the processing of such data is permitted by law.

Legal basis for the processing of personal data

Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) forms the legal basis for us to obtain the consent of a data subject for their personal data to be processed.

When processing personal data required for the performance of a contract in which the contractual party is the data subject, Art. 6 (1) (b) GDPR forms the legal basis. This also applies if data has to be processed in order to carry out pre-contractual activities.

Art. 6 (1) (c) GDPR forms the legal basis if personal data has to be processed in order to fulfil a legal obligation on the part of our organisation.

Art. 6 (1) (d) GDPR forms the legal basis in the case that vital interests of the data subject or another natural person make the processing of personal data necessary.

If data processing is necessary in order to protect the legitimate interests of our organisation or of a third party and if the interests, basic rights and fundamental freedoms of the data subject do not outweigh the interests mentioned above, Art. 6 (1) (f) GDPR forms the legal basis for such data processing.

Deletion of data and storage period

The personal data of the data subject are deleted or blocked as soon as the reason for storing them ceases to exist. Storage beyond this time period may occur if provided for by European or national legislators in directives under Union legislation, laws or other regulations to which the data controller is subject. Such data are also blocked or deleted if a storage period prescribed by one of the above-named rules expires, unless further storage of the data is necessary for entering into or performing a contract.

Provision of the Website and Generation of Log Files

Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the user's computer system.
In this context, the following data are collected:

• Address (URL) of the website from which the file was requested
• Name of the retrieved file
• Date and time of the request
• Data volume transmitted
• Access status (file transferred, file not found, etc.)
• Description of the type of web browser and/or operating system used
• Anonymised IP address of the requesting computer

The data stored are required exclusively for technical or statistical purposes; no comparison with other data or disclosure to third parties occurs, not even in part. The data are stored in our system's log files. This is not the case for the user's IP addresses or other data that make it possible to assign the data to a specific user: before data are stored, each dataset is anonymised by changing the IP address. These data are not stored together with other personal data.

Legal basis for data processing

The legal basis for the temporary storage of data and logfiles is §§ 14, 15 TMG, § 100 Abs. 1 TKG and Art. 4 BayDSG following the tasks of Art. 11 BayEGovG and Art. 7 and 34 BayHO.

Purpose of data processing

The temporary storage of the IP address by the system is necessary in order to deliver the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

The storage of such data in log files takes place in order to ensure the website's functionality. These data also serve to help us optimise the website and ensure that our IT systems are secure. They are not evaluated for marketing purposes in this respect.

Storage period

Data are deleted as soon as they are no longer necessary for fulfilling the purpose for which they were collected. If data have been collected for the purpose of providing the website, they are deleted at the end of the respective session.

If data are stored in log files, they are deleted at the latest after seven days. A longer storage period is possible. In this case, the users' IP addresses are deleted or masked so that they can no longer be assigned to the client accessing the website.

Options for filing an objection or requesting removal

The collection of data for the purpose of providing the website and the storage of such data in log files is essential to the website's operation. As a consequence, the user has no possibility to object.

Information on data processing for contact tracing purposes in view of the pandemic when attending face-to-face sessions or using facilities at Bavarian universities

General information

Pursuant to Art. 15 GDPR, you, the data subject, are entitled to the following rights concerning the processing of your data:

• You can ask for information about whether data concerning you are being processed. If this is the case, you are entitled to information about which data are processed and other information relating to the processing (Art. 15 GDPR). Please note that this right to information can be restricted or excluded in certain cases (see in particular Section 10 BayDSG).
• If the personal data concerning you are/have become inaccurate or are incomplete, you can request that these data are rectified and/or completed (Art. 16 GDPR).
• If the legal requirements are met, you can request that your personal data are deleted (Art. 17 GDPR) or processing of these data is restricted (Art. 18 GDPR). The right to deletion pursuant to Art. 17 (1) and (2) GDPR does not apply, however, if the processing of personal data is vital for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 17 (3)(b) GDPR).
• You are entitled to file a complaint concerning the processing of your personal data with a supervisory authority as defined in Art. 51 GDPR. The pertinent supervisory authority for the Bavarian public service is the Bavarian Data Protection Officer, Wagmüllerstraße 18, 80538 München.

Obligation to provide data

If you would like to attend any face-to-face session or enter our institution, we are obliged by the statutory accident insurance provider and current legal requirements to process your personal data in an effort to contain the coronavirus pandemic.

If you do not provide the required data, we must unfortunately prevent you from attending the session or entering our institution.

Purpose of processing

Infection prevention and contact tracing at face-to-face sessions or visits to the institution in order to comply with official requirements for ensuring the safety of the event.

Legal basis of processing

The legal basis for the temporary saving of the data is meeting official requirements for ensuring the safety of the event pursuant to Section 6 (1) (c) and (d) GDPR and Section 9 (2) (i) GDPR in conjunction with Section 4 (1), Section 5 (1) (1)(1) BayDSG on the basis of BayIfSMV, IfSG, Section 21 SGB VII.

Categories of personal data

Number	Name of data
1	Contact information
2	Time and duration of stay
3	Information from health authority

Categories of recipients

No. for categories	Recipients	Reason for disclosure	Storage location
1, 2	Pertinent health authorities / local authorities	Sections 16 (2) and 25 (2) IfSG	Germany

Planned deadlines for deleting the various data categories

No. of categories	Deadline for deletion
1, 2	Four weeks after attending the session or visiting the institution, unless disclosure is required.
3	Information from the health authorities is not stored permanently.

External Services

YouTube

Dieses Webangebot bindet Videos des Videoportals YouTube ein. Betreiber von YouTube ist die Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Irland.

Beschreibung und Umfang der Datenverarbeitung

Wenn Sie eine unserer Seiten besuchen, auf denen YouTube eingebunden ist, wird eine Verbindung zu den Servern von YouTube hergestellt. Dabei wird dem YouTube-Server mitgeteilt, welche unserer Seiten Sie besucht haben.

Die Einbindung von YouTube Videos erfolgt entweder

• über ein Plugin des RRZE, welches dafür sorgt, dass Daten erst dann zu YouTube gehen, wenn Sie das Video abspielen,
• über eine direktes Embedding, in dem das Video über den Proxydienst Youtube-Nocookie.com gesendet wird. Dies verhindert zwar die Übertragung vom Daten bereits beim Abruf der Seite, verhindert diese jedoch nicht, nachdem Sie das Video gestartet haben
• oder über ein Einbinden des Videos mit Hilfe der originalen YouTube-Embeddings-Codes.

Beim Abruf des Videos kann YouTube verschiedene Cookies auf Ihrem Endgerät speichern. Mit Hilfe dieser Cookies kann YouTube Informationen über Besucher dieser Website erhalten. Diese Informationen werden u. a. verwendet, um Videostatistiken zu erfassen, die Anwenderfreundlichkeit zu verbessern und Betrugsversuchen vorzubeugen. Die Cookies verbleiben auf Ihrem Endgerät, bis Sie sie löschen.

Wenn Sie in Ihrem YouTube-Account eingeloggt sind, ermöglichen Sie YouTube, Ihr Surfverhalten direkt Ihrem persönlichen Profil zuzuordnen. Dies können Sie verhindern, indem Sie sich aus Ihrem YouTube-Account ausloggen.

Rechtsgrundlage für die Datenverarbeitung

Die Nutzung von YouTube erfolgt im Interesse einer ansprechenden Darstellung unserer Online-Angebote. Dies stellt ein berechtigtes Interesse im Sinne von Art. 6 Abs. 1 lit. f DSGVO dar. Sofern eine entsprechende Einwilligung abgefragt wurde (z. B. eine Einwilligung zur Speicherung von Cookies), erfolgt die Verarbeitung ausschließlich auf Grundlage von Art. 6 Abs. 1 lit. a DSGVO; die Einwilligung ist jederzeit widerrufbar.

Weitere Informationen zum Umgang mit Nutzerdaten finden Sie in der Datenschutzerklärung von YouTube unter: https://policies.google.com/privacy?hl=de.

Vimeo

Dieses Webangebot bindet Videos des Videoportals Vimeo ein. Anbieter ist die Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

Wenn Sie eine unserer mit einem Vimeo-Plugin ausgestatteten Seiten besuchen, wird eine Verbindung zu den Servern von Vimeo hergestellt. Dabei wird dem Vimeo-Server mitgeteilt, welche unserer Seiten Sie besucht haben. Zudem erlangt Vimeo Ihre IP-Adresse. Dies gilt auch dann, wenn Sie nicht bei Vimeo eingeloggt sind oder keinen Account bei Vimeo besitzen. Die von Vimeo erfassten Informationen werden an den Vimeo-Server in den USA übermittelt.

Wenn Sie in Ihrem Vimeo-Account eingeloggt sind, ermöglichen Sie Vimeo, Ihr Surfverhalten direkt Ihrem persönlichen Profil zuzuordnen. Dies können Sie verhindern, indem Sie sich aus Ihrem Vimeo-Account ausloggen.

Die Nutzung von Vimeo erfolgt im Interesse einer ansprechenden Darstellung unserer Online-Angebote. Dies stellt ein berechtigtes Interesse im Sinne des Art. 6 Abs. 1 lit. f DSGVO dar. Sofern eine entsprechende Einwilligung abgefragt wurde (z. B. eine Einwilligung zur Speicherung von Cookies), erfolgt die Verarbeitung ausschließlich auf Grundlage von Art. 6 Abs. 1 lit. a DSGVO; die Einwilligung ist jederzeit widerrufbar.

Weitere Informationen zum Umgang mit Nutzerdaten finden Sie in der Datenschutzerklärung von Vimeo unter: https://vimeo.com/privacy.

SSL Encryption

Our website uses SSL encryption for security reasons and to protect the transmission of confidential information, for example enquiries you send to us as operators of the website. You can recognise an encrypted connection when the browser's address line changes from http:// to https:// and a padlock appears in your web browser.

If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

Rights of the Data Subject

With regard to the processing of your personal data, you as a data subject are entitled to the following rights pursuant to Art. 15 et seq. GDPR:

• You can request information as to whether we process your personal data. If this is the case, you have the right to information about this personal data as well as further information in connection with the processing (Art. 15 GDPR). Please note that this right of access may be restricted or excluded in certain cases (cf. in particular Art. 10 BayDSG).
• In the event that personal data about you is (no longer) accurate or incomplete, you may request that this data be corrected and, if necessary, completed (Art. 16 GDPR).
• If the legal requirements are met, you can demand that your personal data be erased (Art. 17 GDPR) or that the processing of this data be restricted (Art. 18 DSGVO). However, the right to erasure pursuant to Art. 17 (1) and (2) GDPR does not apply, inter alia, if the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority or in the exercise of official authority vested (Art. 17 para. 3 letter b GDPR).
• If you have given your consent to the processing, you have the right to withdrawal it at any time. The withdrawal will only take effect in the future; this means that the withdrawal does not affect the lawfulness of the processing operations carried out on the basis of the consent up to the withdrawal.
• For reasons arising from your particular situation, you may also object to the processing of your personal data by us at any time (Art. 21 GDPR). If the legal requirements are met, we will subsequently no longer process your personal data.
• Insofar as you have consented to the processing of your personal data or have agreed to the performance of the contract and the data processing is carried out automated , you may be entitled to data portability (Art. 20 GDPR).
• You have the right to lodge a complaint to a supervisory authority within the meaning of Art. 51 GDPR about the processing of your personal data. The responsible supervisory authority for Bavarian public authorities is the Bavarian Data Protection Commissioner, Wagmüllerstraße 18, 80538 Munich.