Privacy policy

The controller within the meaning of the data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

humedica e.V.
Goldstraße 8
87600 Kaufbeuren
Germany

Tel.: +49 (0) 8341 966148-0
Fax: +49 (0) 8341 966148-290
Email: info@humedica.org 

Data protection officer (DPO)

We have appointed the following as our data protection officer:

activeMind AG Management- und Technologieberatung
Potsdamer Straße 3
80802 München
Germany

Telefon: +49 (0)89 / 91 92 94 - 900
E-Mail: datenschutzbeauftragter@humedica.org

You can exercise the following rights at any time using the contact details provided:

• Information about your data stored by us and its processing (Art. 15 GDPR),
• Correction of incorrect personal data (Art. 16 GDPR),
• deletion of your data stored by us (Art. 17 GDPR),
• restriction of data processing if we are not yet permitted to delete your data due to legal obligations (Art. 18 GDPR),
• objection to the processing of your data by us (Art. 21 GDPR) and
• data portability, provided you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).

If you have given us your consent, you can revoke it at any time with effect for the future. You can contact a supervisory authority at any time with a complaint, e.g. the competent supervisory authority in the federal state of your place of residence or the authority responsible for us as the controller.

A list of supervisory authorities (for the non-public sector) with addresses can be found at www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

Individual right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Recipient of an objection
The objection can be made informally with the subject "Objection", stating your name, address or other identifying features to:

activeMind AG Management- und Technologieberatung
Potsdamer Straße 3
80802 München
Germany

Telefon: +49 (0)89 / 91 92 94 - 900
E-Mail: datenschutzbeauftragter@humedica.org

Type and purpose of processing: When you access our website, i.e. if you do not register or otherwise transmit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar.

They are processed in particular for the following purposes:

• Ensuring a smooth connection setup of the website
• Ensuring a smooth use of our website
• Ensuring and evaluating system security and stability, in particular for misuse detection
• Ensuring an error-free presentation and optimization of our website

We do not use your data to draw conclusions about your person. However, we reserve the right to subsequently check the server log files if there are concrete indications of illegal use.

Legal basis: The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website as well as ensuring system security and detecting misuse.

Recipients: Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

Third country transfer: There is no third country transfer. The data is processed exclusively in the EU/EEA.

Storage period: Data is stored in server log files in a form that enables the identification of the data subjects for a maximum period of 7 days, unless a security-relevant event occurs (e.g. a DDoS attack).

In the event of such an incident, server log files are stored until the security-relevant incident has been resolved and fully clarified.

Provision required or necessary: The provision of the aforementioned personal data is neither required by law nor by contract. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may be restricted.

Right to object: Please read the information about your right to object in accordance with Art. 21 GDPR above.

Type and purpose of processing: There is a contact form on our website that can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask is transmitted to us and stored.

The following data is also stored at the time the message is sent:

• Date and time of the request
• URL from which the request was made

Contact can also be made via the email addresses provided. In this case, the user's personal data transmitted with the email will be stored. This includes the date and time the email was sent, email address, IP addresses and information about the servers involved in the email communication.

You can also contact us using the telephone number provided. In this case, we collect log data that includes your telephone number and the duration of the call.

Depending on the type of communication selected, we collect the content of your request. Your data is stored for the purpose of individual communication with you.

Legal basis: The data entered in the contact form is processed on the basis of a legitimate interest (Art. 6 para. 1 lit. f GDPR). Our legitimate interest in processing your data is to enable you to contact us easily.

If you contact us to request a quote, the data entered in the contact form will be processed to carry out pre-contractual measures (Art. 6 para. 1 lit. b GDPR).

Recipients: Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

Third country transfer: There is no third country transfer. The data is processed exclusively in the EU/EEA.

Storage period: Data will be deleted no later than 6 months after the request has been processed. If there is a contractual relationship, we are subject to the statutory retention periods. These are generally 6 or 10 years for reasons of proper accounting and tax law requirements.

Provision mandatory or required: The provision of your personal data is voluntary. However, we can only process your request if you provide us with the required data and the reason for the request.

Right to object: Please read the information on your right to object in accordance with Art. 21 GDPR above.

Type and purpose of processing: For the purpose of carrying out and processing donations, the data entered in the corresponding fields on our website is collected by the Fundraisingbox software of the third-party provider Wikando GmbH (Schießgrabenstr. 32, 86150 Augsburg, Germany). If a user uses this option, the data entered in the form will be transmitted to us and stored.

The data entered is forwarded directly to Wikando GmbH and to the technical service providers commissioned by Wikando GmbH to provide the form via an encrypted SSL connection. The data will not be passed on to other third parties.

If a donation receipt is requested, we will also process the data to issue and deliver the receipt.

Legal basis: The data collected is required to carry out and process the donation order. The user's email address is required to confirm receipt of the donation order. The data will not be used for any other purpose. The legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

The user's IP address is also stored at the time the form is sent. This serves to prevent misuse and fraud and to protect against unauthorized transactions to the detriment of third parties. The legal basis for processing the IP address is Article 6(1)(f) GDPR.

Recipients: Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website and the provision of the donation form.

In addition, you can choose between different payment methods and may have to register with a payment service provider to process the payment. The respective payment service provider is responsible for processing the payment.

Here are our payment service providers:

• PayPal: https://www.paypal.com/de/legalhub/paypal/privacy-full
• Google Pay: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice&ldl=en / https://policies.google.com/privacy
• Apple Pay: https://www.apple.com/en/legal/privacy/data/en/apple-pay/ / https://www.apple.com/de/privacy/
• Stripe: see notes on Stripe below.
  

Third country transfer: A transfer to a third country takes place within the framework of the sub-processor MaxMind - USA. https://www.maxmind.com/en/privacy-policy

Storage period: We store this data in our systems until the statutory retention periods have expired. These are generally 6 or 10 years for reasons of proper accounting and tax law requirements.

The additional IP address collected during the sending process will be deleted after a period of seven days at the latest.

Provision mandatory or required: The provision of your personal data is voluntary. However, we can only process your donation if you provide us with the required data and necessary information.

Right to object: Please read the information on your right to object in accordance with Art. 21 GDPR above.

Type and purpose of processing: We collect personal data that is transmitted to us via an input mask for the delivery of our newsletter or comparable information. We require a valid e-mail address for effective registration. We use the "double opt-in" procedure to check that a registration is actually made by the owner of an e-mail address. For this purpose, we log the registration for the newsletter, the sending of a confirmation email and the receipt of the requested reply. No further data is collected.

The following data is also stored at the time of DOI confirmation:

• Date and time
• Country and language
  

Legal basis: On the basis of your express consent (Art. 6 para. 1 lit. a GDPR), we will regularly send you our newsletter or comparable information by email to the email address you have provided.

Recipient: We use a service provider who acts as our processor to send the newsletter.

Third country transfer: There is no third country transfer. The data is processed exclusively in the EU/EEA.

Storage period: The data is only processed in this context for as long as the corresponding consent is available.

Provision mandatory or required: The provision of your personal data is voluntary, solely on the basis of your consent. We cannot send you our newsletter without your consent.

Revocation of consent: You can revoke your consent to the storage of your personal data and its use for sending the newsletter at any time with effect for the future. You can unsubscribe using the link provided in every email or the contact information provided in this privacy policy.

Type and purpose of processing: You can send us your application documents by email and via job portals. We will only process the data you provide to assess your professional suitability and to contact you.

Legal basis: The processing is carried out to establish an employment relationship as part of the implementation of pre-contractual measures that are carried out on request, Art. 6 para. 1 lit. b GDPR.

Recipients: Within the company, access to your data is granted to those departments that require it to fulfill contractual, legal and supervisory obligations and to safeguard legitimate interests. In addition, we use service providers who act as processors to manage the application process.

Third country transfer: There is no third country transfer. The data will only be processed in the EU/EEA.

Storage period: If your application is rejected, it will be deleted six months after notification of the decision.

If an employment relationship is established, the application documents will be stored by us for at least the period of employment.

Provision required or necessary: The provision of personal data is neither required by law nor by contract. However, it is not possible to process the application without this information.

You can find more information on the processing of your data as part of the whistleblower system here: Data protection declaration for the whistleblower system.

Type and purpose of processing: The personal data provided during registration will be processed exclusively for the purpose of organizing the event.

Legal basis: The legal basis for this is Art. 6 para. 1 sentence 1 lit. f) GDPR, the practicable and participant-friendly execution of the event, including a good user experience for the purpose of external presentation of the company.

Recipients: Recipients are technical service providers for the execution of the registration within the framework of order processing.

With regard to the transfer of data to recipients outside our company, it should first be noted that we only transfer necessary personal data in compliance with the applicable data protection regulations. Under these conditions, recipients of personal data may be, for example:

• public bodies and institutions (e.g. tax authorities, law enforcement authorities) in the event of a legal or official obligation,
• credit and financial services institutions (processing of payment transactions)
• tax consultants, auditors and payroll tax auditors (statutory audit mandate)
• furthermore, technical service providers for registration management as part of order processing.
• All service providers are contractually obliged to treat your data confidentially.

Third country transfer: There is no third country transfer. The data is processed exclusively in the EU/EEA.

Storage period: Registration data is deleted once the purpose no longer applies. Deletion generally takes place after a maximum storage period of six months in our system.

Provision mandatory or required: The provision of your personal data is voluntary. We can only offer the event if we can carry out the associated processing.

Right to object: Read the information about your right to object in accordance with Art. 21 GDPR above.

Like many other websites, we also use so-called "cookies". Cookies are small text files that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website.

You can delete individual cookies or the entire cookie inventory. You will also receive information and instructions on how to delete these cookies or block their storage in advance. Depending on your browser provider, you will find the necessary information under the following links:

• Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-loeschen-daten-von-websites-entfernen
• Internet Explorer: https://support.microsoft.com/en-en/help/17442/windows-internet-explorer-delete-manage-cookies
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=de
• Opera: http://www.opera.com/en/help
• Safari: https://support.apple.com/kb/PH17191?locale=de_DE&viewlocale=de_DE

Type and purpose of processing: We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We require cookies for the following applications:

• Consent management

Legal basis: The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in a user-friendly design of our website.

Recipients: Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

Third country transfer: There is no third country transfer. The data is processed exclusively in the EU/EEA.

Storage period: For more information, please refer to the notes on the individual tools below.

Provision required or necessary: The provision of the aforementioned personal data is neither required by law nor by contract. However, without this data, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be restricted.

Right to object: Please read the information on your right to object in accordance with Art. 21 GDPR above.

Type and purpose of processing: Furthermore, we use cookies to better tailor the offer on our website to the interests of our visitors or to generally improve it on the basis of statistical evaluations.

Please refer to the information below on the display, tracking, remarketing and web analysis technologies used to find out which providers use cookies.

Legal basis: The legal basis for this processing is your consent, Art. 6 para. 1 lit. a GDPR.

Recipients: Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

For further recipients, please refer to the information below on the display, tracking, remarketing and web analysis technologies used.

Third country transfer: For information on this, please refer to the lists of the individual tools below.

Storage period: For more information, please refer to the information on the individual tools in Section 10 of this privacy policy.

Provision mandatory or required: Of course, you can also view our website without cookies. Web browsers are regularly set to accept cookies. In general, you can deactivate the use of cookies at any time via the settings of your browser (see Revocation of consent).

Please note that individual functions of our website may not work if you have deactivated the use of cookies.

Revocation of consent: You can revoke your consent at any time via our cookie consent tool.

Profiling: To what extent we analyze the behavior of website visitors with pseudonymized user profiles, please refer to the information on the technologies used below, if applicable.

An overview of cookies and tools can be found in the content banner.

In the following section you will find information on the tools of external providers integrated on our website.

Type and purpose of processing: If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that enable us to analyze your use of our website and to draw conclusions about user behavior on our website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google uses this information on behalf of humedica to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage.

For more information on data processing by Google, please see the following link: https://policies.google.com/privacy.

You can also prevent Google from collecting and processing the data generated by the cookie and relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available at the following link: Browser add-on to deactivate Google Analytics.

Legal basis: The data is processed on the basis of the user's consent (Art. 6 para. 1 lit. a GDPR).

Recipients: Our website is maintained by service providers who act as our processors. Google is also a recipient of the data. All service providers are contractually obliged to treat your data confidentially.

Third country transfer: Since Google is headquartered in the USA, it cannot be ruled out that the data will be processed on Google servers in the USA. An adequacy decision by the European Commission exists for the USA, under which all companies certified under the Privacy Shield Framework do not have to provide any additional guarantees. Google LLC is a certified service provider.

Storage period: The data will be deleted as soon as you withdraw your consent or it is no longer required to achieve the purpose for which it was collected. Deletion generally takes place 14 months after the data has been provided.

Provision mandatory or required: Your personal data is provided voluntarily, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.

Withdrawal of consentYou can prevent tracking by Google Analytics on our website by clicking this link. This will install an opt-out cookie on your device. This will prevent data collection by Google Analytics for this website and for this browser in the future as long as the cookie remains stored in your browser.

You can also prevent Google from collecting and processing the data generated by the cookie and relating to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link: Browser Add On to deactivate Google Analytics.

Type and purpose of processing: For payment processing we use Stripe, a service of Stripe Payments Europe Ltd (Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland). When you make a payment, information such as your name, address, bank account number, sort code, credit card number (if applicable), invoice amount, currency and transaction number will be transmitted to Stripe.

Legal basis: This data transfer is used exclusively for payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

Recipients: Our website is maintained by service providers who act as our processors. Google is also a recipient of the data. All service providers are contractually obliged to treat your data confidentially.

Third country transfer: This processing may involve the transfer of your personal data to the USA. For the USA, there is an adequacy decision by the European Commission for companies that are certified under the Data Privacy Framework, as is Stripe.

For more information on data protection at Stripe, please refer to Stripe's privacy policy: https://stripe.com/de/privacy

Storage period: Stripe stores biometric data used as part of identity verification for up to one year. Non-biometric data, such as information from ID documents, is stored for up to three years. Users have the option of objecting to the storage and requesting the deletion of their data.

Provision required or necessary: The provision of the aforementioned personal data is neither legally nor contractually required. However, without the processing of your data to Stripe, payment processing is not possible.

Type and purpose of processing: This website uses Google Tag Manager from Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland).

The function is used to collect data from website visitors and forward it to Google analysis tools. These tools evaluate the data in order to display personalized advertising, among other things. You can find more information about data processing by Google in the Google privacy policy

(policies.google.com/privacy). You can also change your personal data protection settings there in the data protection center.

Legal basis: The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

Recipients: We use technical service providers who act as our processors for the operation and maintenance of our website and for the analysis of cookies.

Another recipient of the data is Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Google Ireland Limited uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a service provider.

Third country transfer: Since Google is headquartered in the USA, it cannot be ruled out that the data will be processed on Google servers in the USA. An adequacy decision by the European Commission exists for the USA, under which all companies certified under the Privacy Shield Framework do not have to provide any additional guarantees. Google LLC is a certified service provider.

Storage period: Data is deleted as soon as it is no longer required for the processing purposes.

Provision mandatory or required: The provision of your personal data is voluntary, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.

Revocation of consent: You can revoke your consent for the future at any time in the cookie settings.

Type and purpose of processing: Our website uses the services of the Google Marketing Platform (formerly "DoubleClick"), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This tool uses cookies to display ads that are relevant to users, to improve marketing campaigns and to prevent a user from seeing the same ad more than once. For this purpose, Google uses a cookie ID to record which ads have been displayed in which browser. In addition, Google can use the cookie ID to record so-called conversions, i.e. the fact that a website visitor visited our website after seeing a relevant ad. If you are logged into your Google account, Google can assign your visit to the relevant website to your user account. If you do not want this, please log out of your Google account beforehand.

Legal basis: The data is processed on the basis of the user's consent (Art. 6 para. 1 lit. a GDPR).

Recipients: We use technical service providers who act as our processors for the operation and maintenance of our website and for the evaluation of cookies.

Another recipient of the data is Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Google Ireland Limited uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a service provider.

Third country transfer: Since Google is headquartered in the USA, it cannot be ruled out that the data will be processed on Google servers in the USA. An adequacy decision by the European Commission exists for the USA, under which all companies certified under the Privacy Shield Framework do not have to provide any additional guarantees. Google LLC is a certified service provider.

Storage period: Your data will be deleted as soon as you withdraw your consent or the data is no longer required to achieve the purpose for which it was collected.

Provision required or necessary: Your personal data is provided voluntarily, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.

Revocation of consent: To prevent the use of the Google Marketing Platform, you can prevent the setting of the corresponding cookies, for example in your browser settings or by adjusting your settings accordingly under the following link: https://adssettings.google.com.

Type and purpose of processing: We use Google Maps on this website. Google Maps is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter "Google"). This allows us to show you interactive maps directly on the website and enables you to conveniently use the map function.
For more information about data processing by Google, please refer to the Google privacy policy: https://policies.google.com/privacy. You can also change your personal data protection settings there in the data protection center.

You can find detailed instructions on managing your own data in connection with Google products here: https://www.dataliberation.org

By visiting the website, Google receives information that you have accessed the corresponding subpage of our website. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account.

If you do not want your data to be assigned to your Google profile, you must log out of Google before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its websites. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

Legal basis: The data is processed on the basis of the user's consent (Art. 6 para. 1 lit. a GDPR).

Recipients: We use technical service providers who act as our processors for the operation and maintenance of our website and for the evaluation of cookies.

Another recipient of the data is Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Google Ireland Limited uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a service provider.

Third country transfer: Since Google is headquartered in the USA, it cannot be ruled out that the data will be processed on Google servers in the USA. An adequacy decision by the European Commission exists for the USA, under which all companies certified under the Privacy Shield Framework do not have to provide any additional guarantees. Google LLC is a certified service provider.

Storage period: Your data will be deleted as soon as you withdraw your consent or the data is no longer required to achieve the purpose for which it was collected.

Provision is mandatory or required: Your personal data is provided voluntarily, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.

Withdrawal of consent: The provider does not currently offer the option of simply opting out or blocking data transmission. If you wish to prevent your activities on our website from being tracked, please revoke your consent for the corresponding cookie category or all technically unnecessary cookies and data transmissions in the cookie consent tool. In this case, however, you may not be able to use our website or only to a limited extent.

Type and purpose of processing: We embed YouTube videos on our website. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA (hereinafter "YouTube"). YouTube, LLC is a subsidiary of Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (hereinafter "Google"). When you visit a page on our website that has a YouTube video embedded, a connection to the YouTube or Google servers is automatically established. Depending on the settings, various data is transmitted (e.g. your IP address). If a YouTube video is started, the provider sets cookies that store your IP address and URL, for example.

If you are logged into your Google or YouTube account, YouTube can assign your surfing behavior to you personally. If you are not logged into a Google or YouTube account, less data will be stored. Nevertheless, Google stores data with a unique identifier that is linked to your device, browser or app.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy https://policies.google.com/privacy.

Legal basis: The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 sentence 1 GDPR. Art. 6 para. 1 sentence 1 lit. a GDPR.

Recipients: We use technical service providers for the operation and maintenance of our website and for the evaluation of cookies, who act as our processors.

Other recipients of the data are YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a service provider.

Third country transfer: Since Google is headquartered in the USA, it cannot be ruled out that the data will be processed on Google servers in the USA. In order to protect your data even after transmission, we have concluded standard contractual clauses with the service provider.

Storage period: YouTube stores data for different lengths of time, depending on the type and purpose of the information. https://policies.google.com/technologies/retention?hl=de

Provision mandatory or required: The provision of your personal data is voluntary. However, we can only display the embedded videos if you give your consent.

Revocation of consent: You can revoke your consent for the future at any time in the cookie settings.

Type and purpose of processing: We have integrated the anti-bot service hCaptcha (hereinafter referred to as "hCaptcha") on our websites. The service provider is Intuition Machines Inc ("IMI"), 350 Alabama St, San Francisco, CA 94110, USA. hCaptcha enables us to distinguish whether a contact request comes from a natural person or is automated by means of a program. Captchas are displayed by the tool. These are small tasks that are easy for humans to solve but difficult for machines to master. The captchas help us to identify spam. As soon as the website visitor visits a part of the website with hCaptcha activated, hCaptcha analyzes the behavior of the website visitor. For the analysis, hCaptcha evaluates various information (e.g. IP address, time spent by the visitor on the website/app or the user's mouse movements). The data collected during the analysis is forwarded to IMI.

The following data is processed when hCaptcha is used:

• Analysis information: IP addresses, browser type, internet service provider, platform type, device type, operating system, date and time and other similar information. This analytics information is collected through contracted service providers and tracking technologies, including cookies.
• Identified data: Information as a result of answering the task to be solved: image caption data, text converted from audio files, answers to questions and other prompts generated by the service. These responses are not tied to an identified individual.
• Other information collected from website visitors as part of the service, such as mouse movements, scroll position, keystroke events, touch events and similar information, as applicable. This is necessary to determine whether the user is human.

Legal basis: The data processing is based on our legitimate interest (Art. 6 para. 1 lit. f) GDPR) to protect our website from abusive, automated colleagues.

Recipient: IMI processes the data on our behalf. We have concluded a data processing agreement (Data Protection Agreement) with IMI for this purpose. You can find out more about the data that is processed through the use of hCaptach in the privacy policy at https://www.hcaptcha.com/privacy?tid=331691580230.

Third country transfer: Processing also takes place outside the EU, namely in the USA. There is no adequacy decision by the European Union for this country. There are guarantees in the form of standard contractual clauses. The best possible guarantee of an approximately equal level of data protection as within the EU is achieved by technically restricting the transfer of data. The necessary documents are provided at https://newassets.hcaptcha.com/dpa/IMI.DPA.9.23.21.New.SCCs.pdf.

Storage period: Data is usually only stored for as long as is necessary for the security check and processing.

Provision required or necessary: The provision of the aforementioned personal data is neither required by law nor by contract. However, without the data, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be restricted.

Right to object: Read the information about your right to object in accordance with Art. 21 GDPR above.

Our website uses CCM19 (Papoo Software & Media GmbH, Auguststr. 4, 83229 Bonn, Germany) for consent management. This tool sets a technically necessary cookie to store your cookie consent.

The cookie stores the consent you gave when you entered the website. If you wish to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked for your cookie consent again. Further information on the processing of data by CCM19 can be found here: https://www.ccm19.de/datenschutzerklaerung.html.

Data security (TLS): In order to protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. TLS) via HTTPS.

Changes to our privacy policy: We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

Questions about data protection: If you have any questions about data protection, please send us an email to: datenschutzbeauftragter@humedica.org.