For the purposes of the General Data Protection Regulation (GDPR) and other national data protection laws in the member states as well as other data protection regulations, the controller is

Helmholtz Zentrum München

Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH)

Ingolstädter Landstr. 1

D-85764 Neuherberg

Neuherberg, Germany

Phone: + 49 89 3187-0

e-mail: info@helmholtz-munich.de

website: http://www.helmholtz-munich.de

You can contact the data protection officer of the controller as follows:

Data Protection Officer of Helmholtz Zentrum München

Björn Kronfeld

Ingolstädter Landstr. 1

D-85764 Neuherberg

Germany

e-mail: datenschutz@helmholtz-munich.de

1. Scope of the processing of personal data

We only process personal data of our users to the extent necessary to provide a functional website and our content and services.

2. The legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6(1) point (a) EU General Data Protection Regulation (GDPR) serves as the legal basis.

Art. 6(1) point (b) GDPR serves as the legal basis for the processing of personal data required for the fulfilment of a contract to which the data subject is a party. This also applies to processing that is necessary in order to take steps prior to entering into a contract.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6(1) point (c) GDPR serves as the legal basis.

If the processing is necessary to safeguard the legitimate interests of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6(1) point (f) GDPR serves as the legal basis for the processing.

3. Data erasure and retention period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in regulations, laws or other provisions to which the controller is subject and is foreseeable. The data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or fulfilment of a contract.

Our MediaHub uses the digital asset management system AdmiralCloud from AdmiralCloud AG, Gustav-Meyer-Allee 25, 13355 Berlin. AdmiralCloud is a software-as-a-service platform that is used to provide media content (videos, images, audio and documents) on this website.

When accessing content delivered via AdmiralCloud, the following data may be processed:

· IP address (in abbreviated or anonymised form)

· Date and time of access

· Information on the browser and operating system used

· For media playback: usage statistics such as playback time

This data is used for the following purposes:

· Technical provision of content

· Statistical analysis of media usage (in anonymised form)

· Ensuring system security

AdmiralCloud respects "Do Not Track" (DNT) settings for its own statistics as far as technically possible. If you have activated the DNT option in your browser, no statistical usage data will be stored for AdmiralCloud statistics when you use the player.

Use of cookies

AdmiralCloud only uses technically necessary session cookies for the login process and OAuth2 authentication. These are valid for a maximum of 24 hours. No marketing or tracking cookies are used.

Further information on data protection at AdmiralCloud can be found at: https://trustcenter.admiralcloud.com

As our MediaHub (as described in Section IV) is hosted by the service provider AdmiralCloud AG, personal data is also transmitted to this company. We have concluded a data processing agreement with Admiral Cloud AG in accordance with Art. 28(3) GDPR.

We will only pass on your personal data to third parties if you have given your express consent in accordance with Art. 6(1) point (a) GDPR, if this is necessary for the fulfilment of a contract with you in accordance with Art. 6(1) point (b) GDPR or if there is a legal obligation to do so in accordance with Art. 6(1) point (c) GDPR.

If your personal data is processed, you are the data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

· In accordance with Art. 7(3) GDPR, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

· In accordance with Art. 15 GDPR, you have the right to request information about the personal data concerning you that is processed by Helmholtz Munich.

· In accordance with Art. 16 GDPR, you have the right to demand the immediate correction or completion of incorrect or incomplete data stored by us.

· In accordance with Art. 17 GDPR, you have the right to request the erasure of personal data concerning you that is stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation to which Helmholtz Munich is subject, for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims.

· In accordance with Art. 18 GDPR, you can request the restriction of the processing of your personal data if you dispute the accuracy of this data or if the processing of this data is unlawful.

· In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us;

· According to Art. 77 GDPR in connection with § Section 17 BDSG, you have the right to lodge a complaint against Helmholtz Zentrum München Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH) with the competent supervisory authority. This is:

The Federal Commissioner for Data Protection and Freedom of Information (BfDI)

Husarenstr. 30, 53117 Bonn

Phone: +49 (0)228-997799-0

E-mail: poststelle@bfdi.bund.de