Information on data protection

We take data protection and privacy seriously. We process your personal data in accordance with current legal requirements and wish to do so in a transparent manner. For this reason, we would like to briefly explain to you which data we process in relation to the use of our website, for what purposes, and on what lawful basis this is done. You will also find information about contact persons and your rights in connection with data processing.

Name and contact details of the responsible person

Leuphana University Lüneburg
represented by the President
Universitätsallee 1
21335 Lüneburg, Germany

Contact details of the data protection officer

Leuphana University Lüneburg
Data Protection Officer
Universitätsallee 1
21335 Lüneburg, Germany
email: datenschutz@leuphana.de

Purposes and lawful basis of data processing

Log-Files

As soon as you visit our website, we store so-called log files. Your IP address, date and time of the page access, the URL accessed, the URL you last visited (referrer URL), the browser you are using and its version, as well as the version of the operating system you are using are recorded in these files. In addition, the URL accessed, the browser used and its version, the version of the operating system you are using and the screen size used are sent to our server together with JavaScript error messages in order to be able to analyse and eliminate error messages from the JavaScripts used on our site. A link with your IP address will not be made. We use this data to prevent misuse of our website and to enable you to visit our website trouble-free and with optimum results. The lawful basis for this processing is Art. 3 p.1 no. 1 NDSG (Lower Saxony Data Protection Act) in conjunction with Art. 6 para. 1 p. 1 NDSG. Art. 6 para. 1 p. 1 letter e) GDPR in conjunction with Art. 3 para. 1 p.1 No. 10 NHG (Lower Saxony Higher Education Act).

Cookies

Our website uses cookies. With the aid of cookies, the users of this website can be provided with more user-friendly services than would be possible without setting cookies. In addition, cookies can be used to optimise information and offers on our website for the benefit of our users. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the person concerned from other internet browsers that contain other cookies. A specific internet browser can be recognised and identified via the unique cookie ID. The purpose of this recognition is to make it easier for users to browse our website. Insofar as consent allows the use of cookies, the following cookies could be used on our websites:

First-Party-Cookies

1. Contact form

Leuphana.de – PHPSESSID (Session-ID)

We set a session cookie with a session ID on the website, provided you use our contact form. The information entered in the fields of the contact form is temporarily stored in this cookie. Temporary cookies are deleted at the latest after you have left our online offer and closed your browser. Provided you contact us via the contact form or e-mail, the data you provide (name, surname, e-mail address, subject and message) will be used to process your enquiry. Your enquiry, together with the data provided, will be forwarded by e-mail to the contact person indicated on the relevant page. The provision of the data is necessary for the processing and answering of your enquiry - without their provision we cannot answer your enquiry or at best only to a limited extent.

Your data will be deleted once your enquiry has been conclusively answered and as long as there is no legal obligation to retain the data, e.g. in the case of subsequent contract processing. The lawful basis for the technically necessary processing of this data for the presentation and provision of our website on the internet as well as the possibility of contacting us is Art. 3 S.1 No. 1 NDSG (Lower Saxony Data Protection Act) in conjunction with Art. 6 Para. 1 Sentence 1 NDSG. Art. 6 para. 1 sentence 1 letter e) GDPR in conjunction with Art. 3 para. 1 p. 1 no. 10 NHG (Lower Saxony Higher Education Act).

2. Cookie-Banner

We offer you the opportunity to select your preferences regarding cookies as part of your initial visit to our website and at any time thereafter by means of a cookie banner. In order to ensure that the setting you have chosen can be adhered to on our sub-pages and that no data is processed against your will, it is necessary for your decision to be recorded in a machine-readable form. This is in turn done by a cookie that is set by our cookie banner. The lawful basis for this data processing is Art. 6 para. 1 sentence 1 letter c) GDPR in conjunction with. Art. 5 para. 2 and Art. 7 para. 1 GDPR. You can delete cookies that have already been set at any time via an internet browser or other software programmes or adjust your cookie settings at the bottom of the website.

Cookies and plug-ins from third parties

1. Google Analytics

_ga (Google Analytics)  
_gat (Google)  
_gid (Google) 

We use Google Analytics on our website. It is a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as „Google“.

The service uses cookies to store information about the use of the website on your computer. The information generated by the cookies about the use of our website is usually transmitted to a Google server and stored there. The Google Analytics service is used to analyse user behaviour and improve our website.

In individual cases, usage and user-related information, such as IP address, location, time, or frequency of visits to our website, may also be transmitted to a Google server in the USA and stored there. Further information on the transfer of data to non-EU countries can be found below in the section „Transfer to third countries“.     

We use Google Analytics with the so-called anonymisation function. This function enables Google to truncate the IP address within the EU or EEA before it is transmitted to a server in the USA.

The data collected in this way is in turn used by Google to provide us with an evaluation of visits to our website and of usage activities.  

In addition, it is possible that this data will be used by Google to provide further services related to the use of our website and the use of the internet. Google states that it will not associate your IP address with any other data. Further data protection information on the use of Google is available at

https://www.google.com/intl/de/policies/privacy/partners 

including, for example, the options for preventing the use of data by Google. In addition, at

https://tools.google.com/dlpage/gaoptout?hl=de 

Google offers a so-called deactivation add-on. This add-on can be installed with the usual internet browsers and offers you further control over the data that Google collects when you call up our website. The add-on informs the JavaScript (ga.js) of Google Analytics that information about your visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analytics services.

There is joint responsibility with Google with regard to processing.  
Data will only be transferred to Google after your consent has been obtained. Your consent or refusal will be stored in a cookie set by us. You can revoke your selection at any time via "cookie settings" at the bottom of our website. The lawful basis for data processing in connection with Google Analytics is Art. 6 para. 1 sentence 1 letter a) GDPR, and with regard to the exceptional transfer to a non-European third country Art. 49 para. 1 sentence 1 letter a) GDPR.

The storage period of the user and event data collected within the scope of Google Analytics is 14 months. 

2. YouTube

ytimg.com (YouTube)  
googlevideo.com (YouTube) 
www.google-analytics.com (Google Analytics)
www.youtube.com (YouTube)
yt3.ggpht.com (YouTube)
doubleclick.net (Google Ads)

We use YouTube on our website. It is a video portal of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as „Google“ or „YouTube“.

We use YouTube in „privacy-enhanced mode“ in order to be able to show you videos.  

The „privacy-enhanced mode“ function means that the data described in more detail below is only transmitted to the YouTube server if you actually start a video by clicking on it a second time. Without this "enhanced privacy" function, a connection to the YouTube server in the USA is established as soon as you call up one of our internet pages on which a YouTube video is embedded.

We would like to point out that user data might be processed on Google servers outside the European Union. Further information on the transfer of data to non-EU countries can be found below in the section „Transfer to third countries“.   

However, this connection is necessary in order to be able to display the respective video on our website via your internet browser. In the course of this, YouTube will at least record and process your IP address, the date and time, as well as the website you visited. In addition, a connection to Google's „DoubleClick“ advertising network will be established.

If you are logged in to YouTube or Google at the same time, YouTube will assign the connection information to your Google account. If you wish to prevent this, you must either log out of YouTube/Google before visiting our website or make the appropriate settings in your YouTube/Google user account.

For the purpose of functionality and to analyse user behaviour, YouTube permanently stores cookies on your end device via your internet browser. If you do not agree to this processing, you have the option of preventing the storage of cookies by means of choosing a setting in your internet browser.

As part of the display of YouTube videos on our website, external fonts from the Google Fonts service are used. Google Fonts is also a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. The integration of these web fonts is carried out by a server call, usually a Google server in the USA. This transmits to the server, which of our internet pages you have visited (referrer). The IP address of the browser of the visitor’s end device to these internet pages is also transmitted to Google's servers.

Google provides further information on the collection and use of data, as well as on your rights and protection options in this regard, in the privacy policy published at

https://policies.google.com/privacy

Data will only be transferred to Google after your consent has been obtained via the cookie banner displayed at the beginning of the page or by two-click confirmation on the video displayed. Your consent or refusal is stored in a cookie set by us. You can revoke your selection at any time via „cookie settings“ at the bottom of our website. The lawful basis is Art. 6 para. 1 letter a) GDPR, and with regard to the exceptional transfer to a non-European third country, Art. 49 para. 1 sentence 1 letter a) GDPR.

Cookie banner - delete or change your permission settings

You can use the above link to cancel or change any permission you have given via the cookie banner or in a video player.

Social media presence

We maintain profiles in social networks that serve the communication and external presentation of Leuphana University Lüneburg. Generally, social networks such as Facebook, Instagram, YouTube, and Twitter can comprehensively analyse the user behaviour of visitors when they access their websites or a website with integrated social media content (e.g. Like buttons or advertising banners). Through your visit to our social media presence or interaction with it, processing relevant to data protection is usually carried out.

When you are logged into your social media account of the respective provider and visit our social media presence, the operator of the social media platform can assign this visit to your user account. Your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection is carried out, for example, via cookies that are stored on your end device or by recording your IP address.

With the data collected in this way, the operators of the social media portals can create user profiles. This allows the operator to show you interest-based advertising inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are or were logged in.

We have no influence on the data collected by the operator and data processing procedures, nor are we aware of the full extent of the data collection and the purposes of the processing. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

We would like to point out that your data collected on the social media presence could be processed outside the area of the European Union. We inform you about the cooperation with the respective social media platform providers in the following sections. Further information on the transfer of data to non-EU countries can be found below in the section „Transfer to third countries“.

In the following sections, we also inform you about the extent to which a corresponding contract on joint responsibility has been concluded with the respective providers, insofar as corresponding analysis data (so-called page insights) are made available to us by the provider.

Our social media presence is intended to ensure a performance on the internet that is as comprehensive and up-to-date as possible, with corresponding opportunities for interaction, in order to inform the public about the performance of our tasks. The lawful basis for our processing by means of presence on social media platforms is therefore Art. 6 para. 1 sentence 1 letter e) GDPR, in conjunction with Art. 3 para. 1 No. 10 NHG (Lower Saxony Higher Education Act). The analysis processes initiated by the social networks may be based on different lawful bases, which are to be indicated by the operators of the social networks (e.g. in consent within the meaning of Art. 6 para. 1 letter a) GDPR).

Responsible party and assertion of rights

When you visit one of our social media sites (e.g. Facebook), the providers supply us with statistics and analyses in anonymised form about the use of our social media sites. This gives us insight into the use of our presence (so-called page insights). The statistics provided to us do not allow any conclusions to be drawn about individual profiles. In these cases, we are jointly responsible with the respective social media provider for the processing of the personal data (Art. 26 GDPR) used to create the aforementioned statistics and analyses. Insofar as there is joint responsibility with the respective platform provider in this regard, we will inform you about the details of the cooperation available to us in the following sections. 

We use the statistics and analyses provided to improve our social media presence and to gain knowledge about the distribution. Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider. If you visit our respective presence in the social networks, the networks process personal data.

We therefore generally ask you to first address requests to assert your rights to the respective platform provider. However, you can generally assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook). 

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing no longer applies, you request us to delete it, or revoke your consent to store it. Mandatory legal provisions - in particular retention periods - remain unaffected. In all other respects, the provisions in the general information apply.

We have no influence on the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Social media sites in detail

1. Facebook and Instagram

We operate a profile on Facebook under the URL www.facebook.com/Leuphana/ and on Instagram under the URL www.instagram.com/leuphana/. The provider of the two social networks is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Facebook Inc, 1601 Willow Rd, Menlo Park CA 94025, USA, hereinafter referred to as „Facebook“.

There is an agreement with Facebook on joint responsibility for the processing of data (controller addendum). This specifies the data processing operations, which we or Facebook are responsible for when you visit our Facebook profile. The controller addendum can be viewed at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

For details, please refer to the privacy policy of Facebook or Instagram:

https://www.facebook.com/about/privacy/
https://help.instagram.com/519522125107875

2. YouTube

We have a channel or profile on the video platform YouTube, available at www.youtube.com/channel/UC9RGFj6J1yCTLrz7EAdClcA, through which we provide video content. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as „Google“ or „YouTube“.

For details, please refer to YouTube's privacy policy:

https://www.youtube.com/t/terms 

3. Twitter

We have a profile on the short message service Twitter, available at twitter.com/Leuphana. Twitter is a service of Twitter International Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 IRELAND, a subsidiary of Twitter Inc, 1355 Market Street #900, San Francisco, California 94103, USA, hereinafter referred to as „Twitter“. 

There is an agreement with Twitter on joint responsibility for the processing of data (controller to controller data protection addendum). This defines the data processing operations, which we or Twitter are responsible for when you visit our Twitter page. The controller-to-controller data protection addendum can be viewed at the following link:

https://gdpr.twitter.com/en/controller-to-controller-transfers.html

Details can be found in Twitter's privacy policy:

https://twitter.com/de/privacy 

4. XING

We have a group on the social network XING, available at https://www.xing.com/communities/groups/offizielle-gruppe-der-leuphana-universitaet-lueneburg-c974-1071385 . XING is a service of New Work SE, Dammtorstraße 30, 20354 Hamburg.  

For details, please refer to XING's privacy policy:

https://privacy.xing.com/de/datenschutzerklaerung 

5. LinkedIn

We have a profile on the social network LinkedIn, available at https://www.linkedin.com/school/universitat-luneburg?pathWildcard=600057 . LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 98585, USA. Maude Avenue, Sunnyvale, CA 94085, USA.

There is an agreement with LinkedIn on joint responsibility for the processing of data (page insights joint controller addendum). This defines the data processing operations, which we or LinkedIn are responsible for when you visit our LinkedIn page. The agreement can be viewed at the following link:

https://legal.linkedin.com/pages-joint-controller-addendum 

For details, please refer to LinkedIn's privacy policy:

https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy 

General Information

Even if you do not make use of your rights below, your data will only be stored by us for as long as is necessary for the purposes stated above. The log files are generally stored for a maximum of 7 days. The specified storage periods do not apply if, notwithstanding this, a longer storage or retention period is required by law or is necessary for legal enforcement within the statutory limitation periods. If data is only retained for the aforementioned purposes, data access is limited to the extent necessary for this purpose.

If we have not provided any information to the contrary in this regard, we will generally keep your data to ourselves, and only make it available to those employees who need it for their work within the scope of fulfilling their tasks. This does not apply if we are legally obliged to disclose it. In order to be able to guarantee a secure transmission of your data, all data is encrypted with a TLS certificate.

We would like to inform you that the provision of your data is neither legally nor contractually required. If you do not provide your data, this may mean that the website cannot be displayed to you or only to a limited extent. Automated decision-making including profiling as defined in Art. 22 (1) and (4) GDPR is not carried out.

Transmission to third countries

We would like to point out that when using optional services on our site or when using our social media sites, user data could be processed outside the area of the European Union. In particular, there is the possibility that data is stored on servers in the USA or that security authorities access the data at subsidiaries of US parent companies. There is then the possibility in exceptional cases that US authorities might process your data.

This can result in risks for you because, for example, the enforcement of your rights could be made more difficult as there are no sufficient official or judicial legal protection options against this processing. Furthermore, there are no specific guarantees pursuant to Art. 46 f. GDPR to compensate for any shortcomings. For these reasons, the European Court of Justice has assessed the level of data protection in the USA, measured against EU standards of the GDPR, as insufficient.

Therefore, with regard to the exceptional transfer to a non-European third country, a use of the services thus affected will only be carried out after you have given your consent in accordance with Art. 49 (1) (a) GDPR. Your consent or refusal is stored in a cookie set by us. You can revoke your selection at any time with effect for the future via "cookie settings" at the bottom of our website.  

Your right to objection according to Art. 21 GDPR

If we process your data on the basis of tasks in the public interest on the lawful basis of Art. 6 (1) sentence 1 letter e), you have the right to object to the processing of personal data relating to you at any time for reasons arising from your particular situation; this also applies to profiling based on Art. 6 (1) sentence 1 letter e) GDPR within the meaning of Art. 4 No. 4 GDPR.

In this case, we will no longer process this data unless we can demonstrate compelling legitimate reasons for the processing that override your interests, rights, and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

Your right of revocation pursuant to Art. 7 (1) sentence 1 GDPR

If we process your data on the basis of your consent, you have the right to revoke your consent at any time with effect for the future. This means that the lawfulness of the processing that took place on the basis of the consent until the revocation is not affected. The declaration of revocation can be made informally and does not require any justification. You can revoke your selection at any time via "cookie settings" at the bottom of the page on our website. If you revoke your consent, you will not suffer any disadvantages as a result.

Your other rights

You have the right to request information from us about the processing of data relating to you. In addition to a copy of the data, this right to information also includes the purposes of the data processing, the data recipients and the storage period.

If incorrect data is being processed, you can demand that we correct this data without delay. If the lawful requirements according to Art. 17 or 18 GDPR are met, you also have the right to immediate deletion or restriction of the processing of the data. Please note that restricted processing of the data may not be possible.

Furthermore, you can make use of your right to data portability under the conditions of Art. 20 GDPR.
You can also assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) in the case of joint responsibility, e.g. related to our social media presence, against the operator of the respective service, with whom we are jointly responsible (e.g. against Facebook). We therefore generally ask you to direct enquiries regarding the assertion of your rights to the respective platform provider first.  

Otherwise, to assert your rights, please contact:

Leuphana University Lüneburg
Thomas Puls
Universitätsallee 1
21335 Lüneburg
E-Mail: thomas.puls@leuphana.de

If you have any further questions, our data protection officer. will be happy to advise you.
You can also contact a competent data protection authority with data protection-related complaints.