Information pursuant to Art. 13 of the General Data Protection Regulation (GDPR) on the processing of your personal data in the context of the publication of photos (or pictures/images) and/or videos and/or podcasts
In the following, we inform you about the processing of your personal data by Helmholtz Zentrum München Deutsches Forschungszentrum für Umwelt und Gesundheit (GmbH) (hereinafter "Helmholtz Munich") in the context of the publication of photos (or pictures) and/or videos and/or podcasts as well as about the claims and rights to which you are entitled under the data protection regulations. We have compiled the different cases in which we work with photos (or pictures/images) in a clear table for you. Where the following explanations refer to photos (or pictures/images), they also apply to videos and podcasts.
| Description of data processing | Purpose ofdata processing | Categories of data processing | Legal basis for data processing | Recipients of the data and third country transfers (Non-EU/EEA- countries)1 | Duration of processing, deletion of data |
|---|---|---|---|---|---|
| Photo for employee ID card | Use only for the ID card | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: security interest of Helmholtz Munich that employees who are on the campus premises can be visually identified) | HR department, service providers (e.g. security personnel) who are involved in the creation of the ID card The data will not be transferred to a third country. | End of employment |
| Portrait photo of employee | Internal use: publication on the Intranet/SharePoint, | Picture of the employee - First name and surname, if applicable Business e-mail address, if applicable | Art. 6(1) point (a) GDPR (consent) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | When leaving the employment relationship or if consent is withdrawn |
| Group picture of employees (team/retreat); internal and external publication | Internal use: publication on the Intranet/SharePoint, | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (a) GDPR (consent)
| Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or if consent is withdrawn |
| Group picture of employees (team/retreat); internal publication only | Internal use: publication on the Intranet/SharePoint, e-mail communication | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees about team events or retreats by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database) | 5 years or in case of objection by one or more employees |
| Public event (freely accessible to everyone) here: speaker pictures for the promotion of the event | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) The use of the image is limited to the promotion of the event. | Picture of the speaker - First name and surname, if applicable | Art. 6(1) point (a) GDPR (consent) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | As soon as the purpose no longer applies, e.g. the event has ended or the website has been removed from the Internet or if consent is withdrawn. |
| Public event (freely accessible to everyone) here: speakers/ participants/group pictures on site | Internal use: publication on the Intranet/SharePoint, The use of the image is limited to reporting on the event. | Picture of the speaker(s) - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees as well as the public about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Internal event (only accessible for employees or invited guests, e.g. Helmholtz Munich Townhall Meeting) here: photos of speakers, external speakers (also group photos of participants on stage) | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) The use of the image is limited to reporting on the event. | Picture of the speaker(s)/participants - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees as well as the public about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Internal event (only accessible for employees or invited guests, e.g. Helmholtz Munich Townhall Meeting) here: photos of participating employees; internal publication only | Internal use: publication on the Intranet/SharePoint, e-mail communication The use of the image is limited to reporting on the event. | Picture of the employee - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database) | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Image or advertising brochure with photos of employees | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) Unlimited use is possible within the scope of the contractually agreed terms, either digitally (e.g. as a pdf file) or as a printed brochure. | Picture of the employee - First and last name, if applicable | Art. 6(1) point (b) GDPR (contract) | Communications and press department, webmaster, processors (service providers, e.g. image database, print shop), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | indefinite |
1 Please note that published media, especially in the online area, may be distributed worldwide and assigned to you as a person, and their complete deletion from the Internet cannot be guaranteed.
For the use, especially on social media platforms, the respective usage and data protection provisions of the operators apply, over which we have no influence. In addition, when publishing media on these platforms, the transfer of the media to a country outside the EU/EEA cannot be ruled out. The social media platforms we use are certified under the EU/US Data Privacy Framework (DPF) and have committed to comply with the provisions of the GDPR (https://www.dataprivacyframework.gov).
Automated decision making/profiling
We do not use automated decision-making or profiling in accordance with Art. 22 GDPR.
Data subject rights according to the GDPR
You have the following rights in connection with the processing of personal data concerning you:
- Pursuant to Art. 7 GDPR, you have the right to withdraw your consent to data processing (if you have given it to us) at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
Pursuant to Art. 15 GDPR, you have the right to request information about the personal data concerning you that is processed by Helmholtz Munich.
Pursuant to Art. 16 GDPR, you have the right to request the immediate correction or completion of incorrect or incomplete data stored by us.
Pursuant to Art. 17 GDPR, you have the right to request the erasure of personal data concerning you that is stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation to which Helmholtz Munich is subject, for the performance of a task carried out in the public interest, or for the establishment, exercise or defense of legal claims.
Pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data if you contest the accuracy of such data or if the processing of such data is unlawful.
Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format, and to transmit this data to another controller without hindrance or to have it transmitted by us;
Pursuant to Art. 21 GDPR, you have the right to object to the processing of your personal data, insofar as there are grounds for doing so that arise from your particular situation. Your data will then no longer be processed, unless Helmholtz Munich can demonstrate compelling grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to assert or defend legal claims.
Pursuant to Art. 77 GDPR in conjunction with Section 17 BDSG, you have the right to lodge a complaint against Helmholtz Zentrum München Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH) with the competent supervisory authority.
This is:
The Federal Commissioner for Data Protection and Freedom of Information (BfDI) Husarenstr. 30 D-53117 Bonn Phone: +49 (0)228-997799-0 e-mail: poststelle@bfdi.bund.de
Controller's contact details
The controller in relation to the processing of the personal data described above, and to any requests or queries associated with it, is:
Helmholtz Zentrum München
Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH)
Ingolstädter Landstraße 1 D-85764 Neuherberg
e-mail: info@helmholtz-munich.de
If you have any questions regarding data protection, please contact our Data Protection Officer:
Data Protection Officer
Helmholtz Zentrum München
Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH)
Ingolstädter Landstraße 1 D-85764 Neuherberg
e-mail: datenschutz@helmholtz-munich.de
In the following, we inform you about the processing of your personal data by Helmholtz Zentrum München Deutsches Forschungszentrum für Umwelt und Gesundheit (GmbH) (hereinafter "Helmholtz Munich") in the context of the publication of photos (or pictures) and/or videos and/or podcasts as well as about the claims and rights to which you are entitled under the data protection regulations. We have compiled the different cases in which we work with photos (or pictures/images) in a clear table for you. Where the following explanations refer to photos (or pictures/images), they also apply to videos and podcasts.
| Description of data processing | Purpose ofdata processing | Categories of data processing | Legal basis for data processing | Recipients of the data and third country transfers (Non-EU/EEA- countries)1 | Duration of processing, deletion of data |
|---|---|---|---|---|---|
| Photo for employee ID card | Use only for the ID card | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: security interest of Helmholtz Munich that employees who are on the campus premises can be visually identified) | HR department, service providers (e.g. security personnel) who are involved in the creation of the ID card The data will not be transferred to a third country. | End of employment |
| Portrait photo of employee | Internal use: publication on the Intranet/SharePoint, | Picture of the employee - First name and surname, if applicable Business e-mail address, if applicable | Art. 6(1) point (a) GDPR (consent) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | When leaving the employment relationship or if consent is withdrawn |
| Group picture of employees (team/retreat); internal and external publication | Internal use: publication on the Intranet/SharePoint, | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (a) GDPR (consent)
| Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or if consent is withdrawn |
| Group picture of employees (team/retreat); internal publication only | Internal use: publication on the Intranet/SharePoint, e-mail communication | Picture of the employee - First name and surname, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees about team events or retreats by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database) | 5 years or in case of objection by one or more employees |
| Public event (freely accessible to everyone) here: speaker pictures for the promotion of the event | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) The use of the image is limited to the promotion of the event. | Picture of the speaker - First name and surname, if applicable | Art. 6(1) point (a) GDPR (consent) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | As soon as the purpose no longer applies, e.g. the event has ended or the website has been removed from the Internet or if consent is withdrawn. |
| Public event (freely accessible to everyone) here: speakers/ participants/group pictures on site | Internal use: publication on the Intranet/SharePoint, The use of the image is limited to reporting on the event. | Picture of the speaker(s) - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees as well as the public about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Internal event (only accessible for employees or invited guests, e.g. Helmholtz Munich Townhall Meeting) here: photos of speakers, external speakers (also group photos of participants on stage) | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) The use of the image is limited to reporting on the event. | Picture of the speaker(s)/participants - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees as well as the public about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Internal event (only accessible for employees or invited guests, e.g. Helmholtz Munich Townhall Meeting) here: photos of participating employees; internal publication only | Internal use: publication on the Intranet/SharePoint, e-mail communication The use of the image is limited to reporting on the event. | Picture of the employee - First and last name, if applicable | Art. 6(1) point (f) GDPR (legitimate interest, here: Helmholtz Munich's interest in informing all employees about events by means of images) | Communications and press department, webmaster, processors (service providers, e.g. image database) | 5 years or longer if Helmholtz Munich has a historical interest in the image(s) (e.g. for archiving purposes) or in the event of an objection by one or more person(s) depicted |
| Image or advertising brochure with photos of employees | Internal use: publication on the Intranet/SharePoint, e-mail communication External use: publication on corporate website, press and public relations work, social media (e.g. Instagram, LinkedIn, Vimeo, X, YouTube) Unlimited use is possible within the scope of the contractually agreed terms, either digitally (e.g. as a pdf file) or as a printed brochure. | Picture of the employee - First and last name, if applicable | Art. 6(1) point (b) GDPR (contract) | Communications and press department, webmaster, processors (service providers, e.g. image database, print shop), social media platforms If the data is published on social media platforms, a transfer to third countries cannot be ruled out. | indefinite |
1 Please note that published media, especially in the online area, may be distributed worldwide and assigned to you as a person, and their complete deletion from the Internet cannot be guaranteed.
For the use, especially on social media platforms, the respective usage and data protection provisions of the operators apply, over which we have no influence. In addition, when publishing media on these platforms, the transfer of the media to a country outside the EU/EEA cannot be ruled out. The social media platforms we use are certified under the EU/US Data Privacy Framework (DPF) and have committed to comply with the provisions of the GDPR (https://www.dataprivacyframework.gov).
Automated decision making/profiling
We do not use automated decision-making or profiling in accordance with Art. 22 GDPR.
Data subject rights according to the GDPR
You have the following rights in connection with the processing of personal data concerning you:
- Pursuant to Art. 7 GDPR, you have the right to withdraw your consent to data processing (if you have given it to us) at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.
Pursuant to Art. 15 GDPR, you have the right to request information about the personal data concerning you that is processed by Helmholtz Munich.
Pursuant to Art. 16 GDPR, you have the right to request the immediate correction or completion of incorrect or incomplete data stored by us.
Pursuant to Art. 17 GDPR, you have the right to request the erasure of personal data concerning you that is stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation to which Helmholtz Munich is subject, for the performance of a task carried out in the public interest, or for the establishment, exercise or defense of legal claims.
Pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data if you contest the accuracy of such data or if the processing of such data is unlawful.
Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format, and to transmit this data to another controller without hindrance or to have it transmitted by us;
Pursuant to Art. 21 GDPR, you have the right to object to the processing of your personal data, insofar as there are grounds for doing so that arise from your particular situation. Your data will then no longer be processed, unless Helmholtz Munich can demonstrate compelling grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to assert or defend legal claims.
Pursuant to Art. 77 GDPR in conjunction with Section 17 BDSG, you have the right to lodge a complaint against Helmholtz Zentrum München Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH) with the competent supervisory authority.
This is:
The Federal Commissioner for Data Protection and Freedom of Information (BfDI) Husarenstr. 30 D-53117 Bonn Phone: +49 (0)228-997799-0 e-mail: poststelle@bfdi.bund.de
Controller's contact details
The controller in relation to the processing of the personal data described above, and to any requests or queries associated with it, is:
Helmholtz Zentrum München
Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH)
Ingolstädter Landstraße 1 D-85764 Neuherberg
e-mail: info@helmholtz-munich.de
If you have any questions regarding data protection, please contact our Data Protection Officer:
Data Protection Officer
Helmholtz Zentrum München
Deutsches Forschungszentrum für Gesundheit und Umwelt (GmbH)
Ingolstädter Landstraße 1 D-85764 Neuherberg
e-mail: datenschutz@helmholtz-munich.de