Data Protection Information

The Max-Planck-Gesellschaft zur Förderung der Wissenschaften e.V. (MPG) takes the protection of your personal data very seriously. We process personal data collected during visits to our website, observing the currently valid provisions under data protection law as amended. Your data is neither published by us, nor disclosed to third parties on an unauthorised basis. In the following, we will explain which data we record during your visit to our webpages and exactly how we use it.

A. General details

1. Scope of data processing

We only ever collect and use personal data to the extent required in order to provide a functional website which presents our content and services. The collection and utilization of our users' personal data is carried out regularly based on the users' consent. An exception applies in instances where processing of the data is permitted by statutory provisions.

2. Legal basis for data processing

If we obtain the consent of the data subject to carry out personal data processing operations, the legal basis is Article 6, para. 1, lit. a EU General Data Protection Regulation (GDPR).

When it is necessary to process personal data in order to fulfil a contract whose contractual party is the data subject, the legal basis is Article 6, para. 1, lit. b GDPR. This also applies to processing operations required in order to implement pre-contractual measures.

If processing is required in order to safeguard a legitimate interest of the MPG or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject override the first-mentioned interest, the legal basis for processing is Article 6, para. 1, lit. f GDPR.

3. Data erasure and duration of storage

The personal data of the data subject is erased or blocked as soon as the purpose of storage no longer applies. Data can also be stored if this is required under European or national legislation in EU directives, laws or other provisions to which the MPG is subject. Data is also blocked or erased if the retention period prescribed by the above-mentioned legislation expires, unless the data is required to be stored for longer for the purpose of concluding or performing a contract.

4. Contact details of the controller

The controller as defined by the EU General Data Protection Regulation (GDPR) as well as other data protection laws and provisions under data protection legislation is:

Max-Planck-Gesellschaft zur Förderung der Wissenschaften e.V. (MPG)
Hofgartenstraße 8
D-80539 Munich
Telephone: +49 (89) 2108-0
Contact form: https://www.mpg.de/contact/requests
Internet: https://www.mpg.de

5. Contact details of the Data Protection Officer

The controller's Data Protection Officer is

Heidi Schuster
Hofgartenstraße 8
D-80539 Munich
Telephone: +49 (89) 2108-1554
E-mail: datenschutz@mpg.de

B. Provision of the website and creation of log files

Every time our website is accessed, our servers and applications automatically log data and information from the accessing computer system.

The following data is collected:

Your IP address
Date and time the page is accessed
Address of the page accessed
Address of the website visited previously (referrer)
Name and version of your browser/operating system (if transmitted)

The data is saved in our systems' logfiles. This data is not saved together with other personal data relating to the user.

The legal basis for the temporary saving of data and logfiles is Article 6, para. 1, lit. f GDPR. Data is saved in logfiles in order to ensure the functional capability of the website. In addition, the data serves to optimize the web pages, eliminate faults and ensure the security of our IT systems. These purposes also constitute our legitimate interest in data processing according to Article 6, para. 1, lit. f GDPR.

The data is deleted as soon as it is no longer required in order to fulfil the purpose of its collection. In the case of the collection of the data for the purpose of providing the website, this applies when the session in question is finished. In the case of saving data in logfiles, this applies after a maximum of seven days. Saving of data beyond this period is possible. In this case, users' IP addresses are deleted or altered so that they can no longer be attributed to the accessing client.

Data collection for the purpose of providing the website and the saving of data in logfiles are absolutely necessary in order to operate the website. It is therefore not possible for the user to object.

C. Web analysis

We use the web analytics programme Matomo (formerly Piwik) for statistical data collection in relation to utilization behaviour; this programme uses cookies and JavaScript to collect various information on your computer and transmit this automatically to us. Every time our website is accessed, our system logs the following data and information from the accessing computer system:

IP address, anonymized by means of abbreviation
Two cookies to distinguish between different visitors (pk_id and pk_sess)
Previously visited URLs (referrers) if transmitted by the browser
Name and version of the operating system
Name, version and language setting of the browser

The following data is also collected if JavaScript is activated:

URLs visited on this website
Times of page visits
Type of HTML requests
Screen resolution and colour depth
Technologies and formats supported by the browser (e.g. cookies, Java, Flash, PDF, WindowsMedia, QuickTime, Realplayer, Director, SilverLight, Google Gears)

The saving and analysis of data is carried out solely on a central server operated by the MPG. In addition to the central website www.mpg.de, it is also used by most Max Planck Institutes and many MPG project websites.

The legal basis for the processing of personal user data is Article 6, para. 1, lit. f GDPR. By processing personal user data we are able to analyze our users' utilization behaviour. Analysis of the data collected enables us to compile information on the use of the individual components of our web pages. This helps us improve our websites and their user-friendliness on an ongoing basis. These purposes also constitute our legitimate interest in data processing according to Article 6, para. 1, lit. f GDPR. Anonymization of the IP address sufficiently meets the users' interest in the protection of their personal data.

The data is deleted after the final annual totals have been arrived at for access statistics.

Of course, you have the opportunity to object to your data being collected. The following independent methods are available to you if you wish to object to data collection by the central server:

1. In your browser, activate the Do-Not-Track setting. If this setting is active, our central server does not save any of your data. Important: Do-Not-Track generally only applies to the one device and browser on which the setting is activated. If you use several devices/browsers, you must activate Do-Not-Track separately on each one.

2. Use our opt-out function. Click on the check mark in the following selection box under https://www.mpg.de/datenschutzhinweis/datenerhebung-deaktivieren, in order to stop or re-activate data collection. If the selection box is deactivated, our central server does not save any of your data. Important: We have to save a special recognition cookie in your browser for the opt-out function. If you delete this or use a different PC/browser, you have to object to data collection once again on this page.

This data is not saved together with other personal data relating to the user.

D. Use of cookies

Our website uses cookies. Cookies are text files which are saved in or by the internet browser in the user's computer system. If a user accesses a website, a cookie can be saved on the user's operating system. This cookie contains a characteristic string of characters which enables definitive identification of the browser the next time the website is accessed.

We use cookies in order to make our website more user-friendly. It is a technical requirement of certain elements of our website that the accessing browser can also be identified after a page change. The following data is saved and transmitted in cookies:

Language settings (localization) of the browser: Sessioncookie i18next
Session data (click series, pages accessed, current language and any error messages on forms: Sessioncookie mpg_session_r

Both cookies are deleted when the session is closed.

The legal basis for the processing of personal data by means of cookies is Article 6, para. 1, lit. f GDPR. The purpose of cookies that are technically necessary is to simplify use of the websites for users. Some of the functions of our website cannot be offered without the use of cookies. For these to work, the browser has to be recognized after a page change. We require cookies for the following applications:

Adoption of the browser language setting: automatic selection of the start page and spell check
Remembering of form details entered: words used in searches within the website, details entered in the contact form (Section F)

The user data collected by technically required cookies is not used to create user profiles. These purposes also constitute our legitimate interest in the process of personal data according to Article 6, para. 1, lit. f GDPR.

Cookies are saved on the user's computer and transmitted by the latter to our website. For this reason, you as the user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or limit the transmission of cookies. Cookies which have already been saved can be deleted at any time. This can also happen on an automated basis. If cookies our deactivated for our website, the full range of functions of the website may not be entirely available for use.

On our website we also use cookies that enable analysis of utilization behaviour. For details, please read the information under C.

E. Newsletter

Our website offers users the opportunity to sign up for a free newsletter. When users sign up for the newsletter, the data from the input screen is transmitted to us. This generally consists of your email address, last name and first name. We inform you about the concrete processing of your data in the course of the sign-up process and obtain your consent accordingly. There is also a reference to this Data Protection Information. The data is used solely for sending out the newsletter.

The legal basis for processing the data after a user signs up for the newsletter is the user's consent according to Article 6, para. 1, lit. a GDPR. The purpose of data collection is to be able to send out the newsletter. The data is deleted as soon as it is no longer required in order to fulfil the purpose of its collection. The user's email address is therefore only saved for as long as the newsletter subscription is active. The newsletter subscription can be cancelled by the user concerned at any time.

F. Contact form

On our website there is a contact form which can be used to make contact electronically. If a user makes use of this option, the details entered in the input screen are transmitted to us and saved. This generally consists of your e-mail address, last name and first name. We inform you about the concrete processing of your data in the course of the operation and obtain your consent accordingly. There is also a reference to this Data Protection Information. The data is used solely for processing the dialogue.

The function Google reCaptcha is used in order to avoid misuse of the form. reCaptcha serves to prevent any automatic mass use of the contact form in that visual questions appear which can only be answered by a human being. reCaptcha is an embedded JavaScript which establishes a connection with the provider's servers when the contact form is accessed. This at least supplies the provider with the information that you have visited the contact form, potentially also additional information revealing your web browser and the device you are using. You can find out details from a reference to data processing by the provider that is included in the contact form.

The legal basis for processing data in connection with use of the contact form is the existence of the user's consent according to Article 6, para. 1, lit. a GDPR. Processing of personal data from the input screen serves the sole purpose of processing the contact request. The data is deleted as soon as it is no longer required in order to fulfil the purpose of its collection. This is the case when the relevant dialogue with the user is finished or the user's request has been dealt with. The dialogue is finished when circumstances indicate that the matter in question has been conclusively clarified. The user can withdraw their consent to the processing of personal data vis-à-vis the contact partners listed at any time.

The legal basis for the processing of data by reCaptcha is Article 6, para. 1, lit. f GDPR. reCaptcha is used to ensure the functional capability of the contact form and prevent its misuse. These purposes also constitute our legitimate interest in data processing according to Article 6, para. 1, lit. f GDPR. The use of reCaptcha is absolutely necessary in order to operate the contact form. It is therefore not possible for the user to object.

G. Registration

On our web pages we offer users the opportunity to register by entering personal data via an input screen. Generally speaking we ask for your e-mail address, last name and first name. We inform you about the concrete processing of your data in the course of the registration operation and obtain your consent accordingly. There is also a reference to this Data Protection Information.

The legal basis for processing data is the existence of the user's consent according to Article 6, para. 1, lit. a GDPR. If registration serves to fulfil a contract of which the user is a contractual party or to implement pre-contractual measures, the additional legal basis for data processing is Article 6, para. 1, lit. b GDPR. It is necessary to register the user in order to be able to provide certain content and services on our website, fulfil a contract with the user or implement pre-contractual measures. The data is deleted as soon as it is no longer required in order to fulfil the purpose of its collection. This applies to the data collected during the registration operation if registration on our websites is withdrawn or altered. It applies to the registration operation to fulfil a contract or to implement pre-contractual measures if the data is no longer required in order to implement the contract. It may also be necessary to save the contractual partner's personal data after conclusion of the contract in order to meet contractual or statutory requirements.

As a user, you can withdraw registration at any time. You can have the data relating to you altered at any time; the procedure is described in detail during the actual registration operation. If the data is required to fulfil a contract or implement pre-contractual measures, premature deletion of the data is only possible if this is not prevented by contractual or statutory obligations.

H. Data transmission

The management and storage of your personal details is carried out by selected services

Newsletter (section E)
Contact form (section F)
Registration for subscriber management "abo.mpg.de" (Section G)

In connection with contract processing on the systems of Infopark AG, Berlin.

Your personal data is only transmitted to public institutions and authorities if legally required or for the purpose of criminal prosecution due to attacks on our network infrastructure. The data is not shared with third parties for any other purposes.

I. Rights of data subjects

As a data subject whose personal data is collected in connection with the above-mentioned services, you have the following fundamental rights unless legal exceptions apply in individual cases:

Access (Article 15 GDPR)
Rectification (Article 16 GDPR)
Erasure (Article 17, para. 1 GDPR)
Restriction of processing (Article 18 GDPR)
Data portability (Article 20 GDPR)
Objection to processing (Article 21 GDPR)
Withdrawal of consent (Article 7, para. 3 GDPR)
Right to lodge a complaint with a supervisory authority (Article 77 GDPR). For the MPG, this is BayLDA (Bavarian Data Protection Authority), Postfach 1349, 91504 Ansbach.