Data Protection Policy
We take the protection of your personal data very seriously and treat your personal data with confidentiality and in compliance with the provisions of law governing data protection as well as this data protection declaration. With the following information we give you an overview of our policy for processing your personal data and your rights in connection with data protection.
This data protection policy concerns the protection of data of persons visiting our website including visitors who use our newsletters, other publications, external online-content (social media profiles) with their related contents and functions or order research data sets and/or gain user access to those data, or wish to register for an event or to conclude a contract with us as well as the protection of personal data of persons who apply for employment with us.
To the extent that nothing else is indicated in the following, IWH will process your personal data on visiting our website or in the other cases named above in compliance with the provisions of EU General Data Protection Regulation (DSGVO).
A. General Disclosures
1. Legal Basis for Data Processing
To the extent that we obtain consent of the persons involved for data processing procedures, the legal basis for this is Art. 6 Para. 1 a EU General Data Protection Regulation (DSGVO).
In the case of processing personal data that is necessary for the fulfilment of a contract to which the person involved is a party, Art. 6 Para. 1 b DSGVO is the legal basis. This also applies to data processing that is required in order to execute pre-contractual measures. The data processed in such cases, its kind, scope and the purpose and necessity of their processing will be determined by the contractual relationship on the basis of which it is collected. This includes basic stock data and master data of persons (e.g., name, address), as well as contact data (e.g., e-mail address, telephone number), the contract data (e.g., services demanded, content and information communicated, names of contact persons) and, to the extent that we offer or purchase services or products that must be paid for, any payment data collected (e.g., bank account information, payment history).
If personal data is being processed in fulfilment of a legal obligation, this is done on the basis of Art. 6 Para. 1 c DSGVO.
If data processing is necessary for the protection of a legitimate interest of IWH or a third party and the interests, fundamental rights and fundamental freedoms of the party involved do not outweigh the aforementioned interest, Art. 6 Para. 1 f DSGVO serves as the legal basis for data processing.
2. Security Measures
IWH makes use of technical and organisational security measures following the standard of Art. 32 DSGVO, in order to assure at all times a level of protection commensurate to the particular risk.
Included among these measures in particular are the securing of the confidentiality, integrity and availability of data by controlling the physical access to data, as well as data viewing, input, sharing, securing availability and their separation. Furthermore, we have set up procedures that assure that the rights of the persons involved are protected, that data are deleted and reaction to any threat to the data. We also take protection of personal data into account in the development and/or selection of hardware, software and procedures in accord with the principle of data protection through technical design and pre-settings which are friendly to data protection (Art. 25 DSGVO).
3. Collaboration with Contracted Processors and Third Parties
To the extent that we disclose data to other persons and companies (contracted processors or third parties) in the framework of our data processing, communicate data to them or otherwise grant them access to the data, this is only done on the basis of legal consent (e.g. if communicating data to a third party is necessary as part of contract fulfilment, such as to payment processors, according to Art. 6 Para. 1 b DSGVO), or if you have granted consent, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when assigning agents, web hosts).
To the extent that we commission third parties with processing data based on a so-called “data processing agreement” this is done on the basis of Art. 28 DSGVO.
4. Transfers to Third Countries
To the extent that we process data in a third country (i.e. outside of the European Union (EU) or the European Economic Area (EEA)) or this is done in the framework of making use of the services of third parties or disclosure and/or transmission of data to third parties, this only happens if necessary to the fulfilment of our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests.
Reserving any legal or contractual permissions, we process or allow the processing of data in a third country only if certain preconditions of Art. 44 ff. DSGVO are fulfilled. I.e. processing only proceeds on the foundation specific guarantees wish as the officially recognised identification of a data protection level commensurate to that in the EU (e.g. in the USA through the “Privacy Shield”) or observation of officially recognised special contractual obligations (so-called “Standard Contract Clauses”).
5. Data Deletion
The data we process will be deleted according to the standard of Art. 17 and 18 DSGVO or its processing will be restricted. To the extent that nothing is explicitly specified in the framework of this data protection declaration, the data that we store will be deleted as soon as it is no longer required for its intended purpose and there are no legal obligations to retain standing in the way of deleting it. To the extent that the data is not deleted because it is required for other legally permitted purposes, its processing will be restricted. I.e. the data will be blocked and not used for other purposes. This applies e.g. for data which must be retained for reasons of commercial or tax law.
According to legal requirements in Germany, data is retained specifically for ten years according to §§ 147 Para. 1 AO, 257 Para. 1 No. 1 and 4, Para. 4 HGB (books, recordings, status reports, booking receipts, accounting books, for tax-relevant documents, etc.) and six years according to § 257 Para. 1 No. 2 and 3, Para. 4 HGB (business letters).
6. Contact Data of the Responsible Party
The responsible party in the sense of the DSGVO and other national data protection laws as well as other provisions of law dealing with data protection is the
Leibniz-Institut für Wirtschaftsforschung Halle e.V.
Kleine Märkerstraße 8
D-06108 Halle (Saale)
Telephone: +49 (345) 7753 60
Fax.: +49 (345) 7753 820
7. Contact Data of the Data Protection Officer
The Data Protection Officer of the responsible party is
Dr. Peter Haug
Kleine Märkerstraße 8
D-06108 Halle (Saale)
Telephone: +49 (345) 7753 709
8. Rights of the Affected Persons
As an affected person, whose personal data is processed by or on commission for IWH in the framework of the purposes named in this data protection declaration, you have the following rights, to the extent that the legal preconditions for them are fulfilled:
- Disclosure (Art. 15 DSGVO)
- Correction (Art. 16 DSGVO)
- Deletion (Art. 17 Para. 1 DSGVO)
- Restriction of processing (Art. 18 DSGVO)
- Data transferability (Art. 20 DSGVO)
- Objection to processing (Art. 21 DSGVO)
- Revocation of consent (Art. 7 Para. 3 DSGVO)
- Right to bring a complaint to the supervisory authority (Art. 77 DSGVO).
Responsible supervisory authority:
Dr. Harald von Bose
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Telephone: +49 (391) 81803 0
B. Information for Users of Our Website
1. Providing the Website and Generating Logfiles
Every time our website is called up our servers and applications or those of our hosting provider automatically record data and information from the computer system of the contacting computer.
The following data are temporarily stored:
- Your IP-address
- Date and clock time when you accessed the site
- Address of the webpage accessed
- Address of the previously-visited webpage (referrer)
- Name and version of your browser and operating system (to the extent transmitted)
- Host name of the accessing computer
The data is stored in the logfiles of our systems. This data is not stored together with the user’s other personal data.
The legal basis for temporarily storing the data and for the logfiles is Art. 6 Para. 1 f DSGVO. Logfiles are stored in order to assure the functionality of the website. Additionally, the data help us to optimise the websites, to clear faults and assure the security of our information technology systems (e.g. to investigate incidents of abuse and fraud). Our legitimate interest in data processing as defined in Art. 6 Para. 1 f DSGVO also lies in these purposes.
The data will be deleted as soon as they are no longer needed for the purpose for which they were collected.
In the event that data is recorded in order to provide the website itself, this is the case when the current session expires. In the case of storing data in logfiles, this is the case after at most seven days. Storage going beyond this is possible. In this case, the IP-addresses of the users will be deleted or removed so that assigning them to the accessing client is no longer possible.
Recording data for providing the website and storing the data in logfiles is absolutely necessary for the operation of the website. Consequently, the user may not refuse.
2. Web Analysis (Matomo)
- IP-address, abbreviated to render anonymous
- Two cookies for differentiating between different visitors (pk_id and pk_sess)
- Previously visited URL (referrer), to the extent that the browser communicates it
- Name and version of operating system
- Name, version and language setting of the browser
- URLs visited on this website
- Times when the pages were accessed
- Type of HTML queries
- Screen resolution and colour depth
- Technologies and formats supported by the browser (e.g. cookies, Java, Flash, PDF, WindowsMedia, QuickTime, Realplayer, Director, SilverLight, Google Gears)
Storage and evaluation of data proceeds solely on a central server which is operated by IWH or its hosting provider. Along with the central website www.iwh-halle.de/ it is also used on the website www.comp-net.org/ and possibly the project websites assigned to IWH.
The legal basis of processing the user’s personal data is Art. 6 Para. 1 f DSGVO. Processing user’s personal data makes it possible for us to analyse the user behaviour of our users. We are able, through the evaluation of the data we obtain, to gather information about the use of the individual components of our websites. This helps us to constantly improve our websites and increase their user-friendliness. Our legitimate interests in processing this data as defined in Art. 6 Para. 1 f DSGVO also lie in these purposes. The users’ interest in the protection of their personal data is given adequate consideration by rendering the IP address anonymous.
This data is never stored together with other personal data from the user.
Of course, you have the option of objecting to data collection. You have the following independent options for refusing the collection of data by the central server:
- In your browser, activate the setting "Do not track". As long as this setting is activated, our central server will not store any of your data. Important: The Do-not-track instruction applies as a rule only for the one device and the one browser in which you activate the setting. Should you use multiple devices or browsers, you will need to activate the "Do not track" separately in each one.
- Use our opt-out function. Click on the checkbox in the following selection box, in order to stop data collection or re-activate it. As long as the selector box is de-activated, our server or that of our hosting provider will not store any data from you. Important: For the opt-out we have to store a special recognition-cookie in your browser. If you delete it or use a different PC or browser, you have to refuse data collection again on this webpage.
- Language settings of the browser in order to provide the user with the proper language version (English or German) of our website
- Data that make it possible for us to analyse the user behaviour of our users (see B.2 "Web Analysis")
Both cookies will be deleted after the session closes.
The user data collected by technically necessary cookies will not be used to generate user profiles. Our legitimate interests in processing this data as defined in Art. 6 Para. 1 f DSGVO also lie in these purposes.
4. E-Mail Contact
It is possible to contact IWH using the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be saved. In this context the data will not be shared with third parties. The data will be used exclusively for processing the conversation.
The legal basis for processing the data, once the user’s consent is given, is Art. 6 Para. 1 a DSGVO. The legal basis for processing the data that is transmitted in the course of sending an e-mail, is Art. 6 Para. 1 f DSGVO. If the objective of the e-mail contact is the conclusion of a contract, the additional legal basis for processing the data is Art. 6 Para. 1 b DSGVO.
Processing of personal data from e-mail contact only allows us to process the request for contact. In the event of e-mail contact, there is also a legitimate interest in processing data.
The other personal data processed during the sending process serve to prevent abuse of the e-mail connection and assure the safety of our information technology systems.
The data will be deleted as soon as they are no longer needed for achieving the purpose for which they were collected. This is the case for personal data which was sent via e-mail when the conversation with the user is finished. The conversation is finished if the circumstances permit the inference that the relevant state of facts has been finally clarified.
The personal data collected during the act of sending will be deleted at the latest within a period of seven days.
The user always has the option of revoking his/her consent to processing of personal data. If the user contacts us by e-mail, he/she can refuse processing of his/her personal data at any time. In such a case the conversation cannot be continued.
All personal data that were stored in the course of establishing contact will be deleted in this case.
C. Information for Subscribers to Our Newsletters, Publications and for Subscribers to Mailing Lists
If you want to get one of the publications offered on the website or subscribe to the free newsletter, we need an e-mail address from you to send it to as well as information that allows us to check and make sure that you are the owner of that e-mail address and you agree to receive the publication/the newsletter. We use this data exclusively to send the requested products and do not share it with third parties.
Processing of the data entered in the particular order or subscription form is based on your consent (according to Art. 6 Para. 1 a DSGVO). The data is collected to send the newsletter/the publication. The data will be deleted as soon as it is no longer needed to achieve the purpose for which it was collected. The user’s e-mail address will be stored afterward for as long as the subscription to the newsletter remains active. The subscription to the newsletters can be terminated by the user in question at any time. You can at any time revoke your consent, e.g. by using the “unsubscribe” link at the bottom of each e-mail you receive in the course of the running subscription. The legality of data collection already completed remains unchanged by this. In the event of revocation, we delete your data unless it is also permissibly in our system for other purposes (e.g. your e-mail addresses for the member area). In such a case we only delete your data, to the extent that we no longer need it for the other purpose. In other respects, we de-activate it for the purpose for which you have revoked your consent.
Our newsletter subscribers also have the data protection rights named under A.8.
D. Registration for the Purpose of Accessing Research Data and Library Media
IWH provides the option to register, disclosing personal data, in order to get access to research data and library media. As a rule, we collect your e-mail-address, last name and first name. We will inform you about the concrete data processing in the context of of the registration process and get your consent. Additionally we refer to this data protection declaration.
The legal basis for data processing on obtaining the consent of the user Art. 6 Para. 1 a DSGVO. If the registration serves to fulfil a contract to which the user is a contracting party or the execution of pre-contractual measures, the additional legal basis for data processing is Art. 6 Para. 1 b DSGVO. The user must register in order to gain access to certain content and services on our website and/or to fulfil a contract with the user or execute pre-contractual measures. The data will be deleted as soon as they are no longer needed to fulfil the purpose for which they were collected. This is the case for the data collected during the registration process when the registration is rescinded or changed on our websites. In the case of a registration process for the fulfilment of a contract or execution of pre-contractual measures, this is the case when the data are no longer needed for the execution of the contract. Even after a contract is concluded, the necessity of storing personal data of the contracting partner can persist for the purpose of fulfilling contractual or legal obligations.
- User ID number
- Name, date of birth and sex
- Private address/business address, telephone number
- Users type
- Mail address
- Password (encrypted)
Your personal data will be deleted on de-registration or at the latest one year after the expiration of your user authorisation. To the extent that media are still on loan or any open claims (e.g. late fees) exist, the data will not be deleted.
Additionally, in corresponding procedures, lending and fee data will be saved and processed. The lending data will be deleted when the books are returned. The last person to borrow a volume will be deleted either through a new loan or at the latest after three months. The fees will be deleted when they are paid.
As a user you may at any time rescind your registration. You can have the data stored about you changed at any time. The procedure is described in detail in the course of the actual registration procedure. If the data is needed to fulfil a contract or execute pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or legal obligations prohibit deletion.
E. Alumni Network
As a former employee of IWH, you can register for the alumni network. To establish contact and specify your preferred term of address, we need you to enter your first and last name and your e-mail address in the required fields. The title of your previous position at IWH must also be entered in the required field to allow the alumni network to sub-divide its work by department. The legal basis for this data processing is Art. 6 Para. 1 a DSGVO.
You can also send us your address and telephone number. We will use your address to send you invitations through regular mail on your request. We will only use your telephone number for events or to ask if you would be available for an interview/short statement. You can also tell us about your current position and provide links to your homepage. With the consent you grant by sending the aforementioned personal data, we will use this data to present you on the alumni homepage. Please note that information published in the internet can be accessed world-wide. Consent can be revoked at any time with future effect. In other respects, the data protection rights enumerated under A.8 apply.
F. Information for Parties Registering for Events
If you register for one of our events, we save the data that you provided on registration exclusively for the purposes of event management. If we are hosting the event jointly with another institution or for another institution, we will forward your data to this cooperating partner as well so that it can plan and organise the event.
The legal bases for the aforementioned data processing are Article 6 Para. 1 b DSGVO. Additionally, Article 6 Para. 1 f DSGVO, because we have a legitimate interest in storing your data for the organisation of the event possible in sharing it with other institutions (jointly) hosting the event with us. The data will be deleted after the end of the event for which you registered.
We expressly note for your attention that in the framework of our events, video and audio recordings in the form of photos, audio and video recordings can be made by IWH and/or the joint organiser or contracted service providers. The recordings are meant to document both the event itself and the participation of specific persons.
In the case of recordings in which the focus is on individual persons, the participants have at any time both the right and the option to inform the photographer or videographer that they do not want to be recorded. Should this be impossible or be ignored, we will prohibit publication later if we are so notified.
We assume that the persons who participate in or who are otherwise involved in the event grant consent to the creation and publication of the recordings for communication purposes, including in social media, through their act of participating or being involved in the event. Such consent also includes consent to download the recordings from our website. This consent applies especially if the persons involved make themselves voluntarily available, e.g. by “posing” or “looking into the camera”.
With registration or participation based on a free invitation the participant in the event gives consent to video and audio recordings as well as to the use and publication of such recordings for t it purposes of public reporting about the event and in various media, including our website and in social media.
Persons who register for our events also have the data protection rights enumerated under A.8.
G. Information for Applicants for Jobs at IWH
IWH processes personal data from applicants for the purposes of carrying out the job application and candidate selection process (also in the framework of joint appointments with partner universities of the IWH) in order to establish an employment relationship. The legal basis is § 26 BDSG. Your application materials will only be received by the employees at IWH who are involved in the application process for the purpose of selecting candidates.
If the IWH does not conclude an employment contract with you, we will delete the application materials reserving a legitimate revocation by the applicants five months after we have notified you that we have not selected you. We do not delete the documents immediately after we make our decision known, because we have a legitimate interest in the continued storage of the documents due to the course of legally mandated retention periods, e.g. in order to meet our documentation obligations under the AGG. The legal basis for this is Article 6 Para. 1 f DSGVO.
We only retain the documents beyond the aforementioned five months if we expressly arrange this with the applicant.
In the event of a successful application, IWH can continue processing the personal data of the applicant for the purposes of the employment relationship.
To the extent that in the framework of the application process certain categories of personal data in the sense of Art. 9 Para. 1 DSGVO are voluntarily communicated, they will be processed as well according to Art. 9 Para. 2 b DSGVO (e.g. health data, such as status as severely handicapped person, or ethnic identity). To the extent that in the framework of the application process certain categories of personal data in the sense of Art. 9 Para. 1 DSGVO is asked of applicants, they will be processed as well according to Art. 9 Para. 2 a DSGVO (e.g. health data if it is necessary for performing the work).
When the application is sent to us, the applicant gives consent to the processing of his/her data for the purposes of the application process corresponding to the type and scope set down in this data protection declaration.
H. Information for Users of Our Online Presences in Social Media
We maintain online presences in social networks and platforms (currently especially on Facebook, Twitter, LinkedIn and Xing), in order to communicate the IWH’s content in the fields of economic sciences, economic policy and science policy to active interested parties there and inform them of our academic achievements there. When any of these networks or platforms is accessed, the terms and conditions and the data processing guidelines of their respective operators apply.
To the extent that nothing to the contrary is stated in the framework of our data protection declaration, we process the users‘ data to the extent they share it with us within these social networks and platforms e.g. to compose entries in our online presences or send us messages.
I. Data Transfer/Integration of Third-Party Services and Content
1. Data Transfer
The hosting services of the service provider Connecta AG, Wiesbaden, that we make use of in the framework of contract data processing, are intended to provide the following services: infrastructure and platform services, computing capacity, storage capacity and database services, e-mail-sending, security services as well as technical maintenance services which we use for the purposes of operating this website.
In the course of these activities we or the hosting provider process personal data from customers, interested parties and visitors to the website(s) of IWH on the basis of our legitimate interests in an efficient and secure providing of this website according to Art. 6 Para. 1 f DSGVO in connection with Art. 28 DSGVO (Conclusion of a Contracted Processing Agreement).
The administration and storage of your personal information occurs when the following services are used
- Use of the websites www.iwh-halle.de and www.comp-net.org
- Online-subscription to the IWH-Newsletter and IWH-journals
- Online-applications to use data sets from the IWH-Research Data Centre including the data from the CompNet Network
Your personal data will only be forwarded to state institutions and authorities in the legally required cases and/or cases of criminal prosecution of attacks on our network infrastructure. It will not be shared with third parties for other purposes.
2. Integration of Services and Contents of Third Parties
Within our online presence and on the basis of our legitimate interests in the sense of Art. 6 Para. 1 f DSGVO (i.e. interest in the analysis, optimisation and economical operation of our online presence), we make use of the content and service offerings of third providers in order to integrate their contents and services e.g. videos or typefaces (referred to in the following uniformly as “contents”).
This always assumes that the third-party providers of these contents detect the IP-addresses of the users, since they cannot send the content to their browsers without the IP-address. The IP-address is therefore required for the display of these contents. We take pains to use only to use the contents, whose respective providers only use the IP-address to deliver the content. Third party providers can furthermore use so-called pixel tags (invisible graphics that are also referred to as "Web Beacons") for statistical or marketing purposes. Information such as visitor traffic on the pages of this website can be evaluated using "pixel-tags". The pseudonymous information can also be stored in cookies on the user’s device and contain among other things technical information about the browser and operating system, referring websites, time of visits as well as other information about using our website as well as combining such information with data from other sources.