Privacy Policy for the Website of the Francke Foundations

In accordance with Art. 13 and 14 of the GDPR we inform you about the processing of personal data that may have been collected and/or may be collected by us in the provision, procurement, acquisition or conservation of archive resources or library stocks.

1. What categories of personal data do we process?

The following personal data may have been collected and/or may be collected by us in the provision, procurement, acquisition or conservation of archive resources or library stocks:

• First name and surname
• Academic degree/title
• Date of birth
• Nationality
• Name/description of the institution/organisation/community, etc. represented by you
• Occupation/position
• Postal address
• Telephone number
• E-mail address
• Research topic
• Customer/supervisor
• Date of registration/date of use
• Shelf mark of the used sources
• Order date, date of return of the used sources

2. For what purposes and on what legal basis do we process personal data?

We use your data for the following purposes:

• To register the users of the archive resources and of the library stock in the reading room. The registration by stating the main interest and/or research topic is the basis for ensuring that the employees working in the Study Centre can provide professional advice. The legal basis for the owner-user relationship is point (b) of Article 6(1) GDPR (rules governing use); the legal basis for professional advice is point (f) of Article 6(1). The legitimate interest of the Study Centre is the provision of information to the employees about current research topics in order to guarantee its statutory tasks.
• For the daily registration of the users in the user book in the reading room for statistical purposes and for the investigation of any potential loss or damage. The legal basis for this is point (f) of Article 6(1) GDPR. The legitimate interest of the Study Centre is the fulfilment of its statutory accountability and responsibility for the preservation of historical cultural assets.
• So that the employees of the Study Centre are able to provide the archive materials, books and other media ordered by the users by means of library tickets, e-mail or the online ordering system. The relevant legal basis is point (b) of Article 6(1) GDPR (rules governing use) and point (f) of Article 6(1). The legitimate interest of the Study Centre is the obligation to be able to trace any loss of or damage to the sources.
• To handle the photo jobs and invoicing at the photo service point. This is done on the basis of point (c) of Article 6(1) in conjunction with Section 147 AO (Fiscal Code of Germany) and point (f) of Article 6(1) GDPR. The legitimate interest of the Study Centre is the provision of proof of the sources that have been reproduced, and for what purpose of use.
• So that our qualified personnel can answer the enquiries of users submitted by letter, e-mail or phone. The legal basis for this is point (f) of Article 6(1) GDPR. The legitimate interest is the statutory obligation to document the fulfilment of the Study Centre’s tasks.
• To issue a donation receipt and/or to conclude a gift agreement. Where desired by the person making the gift, a provenance entry can be made in the OPAC of the library and/or in the database of the archive consisting of the name and date of the gift. The legal basis is point (a) and (b) of Article 6(1) GDPR.
• To document the restoration of existing archive or library media by stating information on the persons who have supported such restoration by a donation and/or by taking on a sponsorship. The legal basis is point (a), (b) and (f) of Article 6(1) GDPR. The Study Centre’s legitimate interest is the comprehensive documentation in order to pass on the restoration works to the following generations.
• To conclude contracts on the lease of guest apartments of the Francke Foundations. The legal basis is point (b) of Article 6(1) GDPR.

3. What categories of data recipients are there?

The Head of the Study Centre as well as the Study Centre employees who handle the use of our resources and, for technical reasons, our IT administrators have access to the data collected from you. During daytime use in the reading room, your name stated in the user book can be accessed by other reading room users. To support scientific topics, the Director of the Francke Foundations and the Head of the Research Department receive information on your contact details and research priorities. Photo job invoices are handed over to the employees in the Francke Foundations Accounting Department. Agreements on gifts are processed by employees in the Francke Foundations Administrative Department. If you agreed to take on a sponsorship for a restoration, this will be notified to the Director, the President and the Secretary of the Association of Friends as well as the accounting staff members of the Francke Foundations. If a lease contract is concluded on a guest apartment, the head of administration and the accounting staff of the Francke Foundations receive your data.

4. Are the data intended to be transmitted to third countries?

Your data will not be transmitted to any country outside the European Union.

5. How long will your data be retained?

Your personal data will be erased as soon as the purpose for which it was saved no longer applies. We erase data collected for the purpose of proving permission 3 years after the end of the processing work for which the permission was granted according to Section 31 of the German Act on Regulatory Offences (OWiG).
Your registration data will be reviewed at the start of every new year. The data of inactive users will be erased 36 months after our resources have last been used. Library tickets will be retained 24 months after lending and then destroyed. Data transmitted for pre-orders by e-mail are erased regularly at the end of each year. Order forms for photo jobs are destroyed 2 years after the order was completed; related invoices are destroyed 10 years after the relevant annual financial statement. Enquiries submitted in writing are stored jointly with their replies for 10 years for the purpose of proof (in the form of a printout if sent by e-mail). Selected enquiries may be permanently archived to document the Study Centre’s work for historical research purposes.
Donation receipts are stored after the statutory period of 10 years in the Accounting Department of the Francke Foundations or in the secretariat of the Association of Friends. Contracts are stored in the Administrative Department and are passed on from there to the archive for permanent storage. A copy of the contracts is situated in the office of the Head of the Study Centre; this copy will be destroyed after archiving. The provenance entries are permanently documented in the archive database and/or in the catalogue of the Common Library Network (Gemeinsamer Bibliotheksverbund, GBV), which is hosted in Göttingen. The related declarations of consent are retained permanently.
As the restoration records need to be permanently retained and archived for reasons of stock protection documentation, the personal data of the donors will also be permanently archived. Bank transfer confirmations are destroyed after 10 years according to the accounting regulations.
Any approvals granted by you as an author for the digital publication of your works will be permanently archived. Requests for approval of publication sent by e-mail are deleted after three years.
Lease contracts for guest apartments are stored for 10 years.

6. Which rights do you have?

In accordance with applicable law, you have various rights concerning your personal data. If you would like to assert your rights, please direct your enquiry by email or by post to the data protection officer named above and clearly identify yourself. Please find an overview of your rights below.

6.1 Right of Access of the Data Subject Pursuant to Art. 15 GDPR and Section 34 FDPA
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store. This includes information about the purposes of processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data has been or will be disclosed, and, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.

6.2 Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3 Right to Erasure acc. to Art. 17 of the GDPR and Section 35 FDPA
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:

• The purpose for which personal data was processed has ceased to apply.
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
• You object to the processing on grounds relating to a particular situation pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.

6.4 Right to Restriction of Processing acc. to Art. 18 of the GDPR
You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.

6.5 Right to Data Portability acc. to Art. 20 of the GDPR
Acc. to Art. 20 of the GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit such data to another controller without hindrance from us where the processing is based on consent pursuant to point (a) of Art. 6(1) of the GDPR or point (a) of Art. 9(2) of the GDPR or on a contract pursuant to point (b) of Art. 6(1) of the GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising your right to data portability according to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

6.6 Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

6.7 Right to Withdraw Consent Given Under Data Protection Law
If you have given us consent, you have the right to withdraw your consent at any time. In this case, any data processing performed by us until such withdrawal will remain lawful. You can send us a message to datenschutz@francke-halle.de in that regard.

6.8 Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0
Fax: +49 (0)391 81803-33
Website: www.datenschutz.sachsen-anhalt.de/datenschutz-sachsen-anhalt

7. Is it Necessary to Provide my Personal Data?

The provision of your personal data is not mandatory. However, we will not be able to accept your registration unless you provide us with the necessary data.

8. Is Automated Decision-Making incl. Profiling applied?

We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).

9. Security Note

We protect your personal data by taking all technical and organisation measures possible to us to meet the protection goals.
We are unable to guarantee data security when communicating by e-mail so we recommend communication of confidential information by mail.

10. Actuality of and Amendments to this Privacy Policy

This privacy policy is currently valid and is dated August 2019.
We reserve the right to update the privacy policy in accordance with current statutory provisions when changes are made to our website.

Halle, 15 August 2019

Download of our Privacy Policy

We are delighted that you are using the databases and catalogues of the August Hermann Francke Study Centre. Careful handling of your personal data is very important to us. This privacy policy informs you of which personal data we collect when you use our databases for your research, and how it is processed.
Some of the Study Centre’s online services are based on static websites. The Privacy Policy of the Website of the Francke Foundations applies to them.

1. Personal Data Processed by Us

The August Hermann Francke Study Centre offers various databases for conducting research in the holdings of the Archive and the Library. Registering for use is generally not necessary.
You may use the following databases:

• Archive database on the basis of the FAUST system of the company Land Software-Entwicklung,
• Database for the Digital Collections on the basis of the software platform Visual Library of the companies semantics GmbH and Walter Nagel GmbH & Co. KG,
• Special databases on the basis of SQL and the software Allegro-C of the TU Braunschweig.

Any time the databases of the Archive and the Library are accessed for research the following data is stored in a log file:

for all databases

• date and time of access,
• volume of data transferred in bytes,
• browser type and version

for the archive program FAUST

• the IP address of the accessing computer (anonymised as of version 9 of the program server),
• address of the website created by the search query (possibly including search query, encrypted with provision of the ID number of the object being looked for),
• if we have given you a user name and a password, the login name,
• User name, e-mail address, password and working topic for online ordering of archive materials,
• information on the data sets downloaded using the download function (encrypted via object numbers)

for the Digital Collections in Visual Library

• anonymised IP address of the accessing computer (anonymisation is carried out by removing the final octet in IPv4 addresses, and by removing the last 80 bits of IPv6 addresses; the complete IP address is therefore never stored),
• name of the file accessed,
• notification of successful access,
• URL of the previously visited page (referrer URL),
• operating system used

for the special databases in Allegro-C and SQL

• anonymised IP address of the accessing computer,
• address of the website created by the search query (possibly including search query)

2. Purposes and Legal Basis of Processing

The data collected is solely processed to guarantee the proper operation of the databases and to improve their user friendliness, and to compile annual user statistics in an entirely anonymised form. A respective evaluation of the log files is only possible with evaluation tools, especially developed for the applications. The data is never assigned to specific persons, personal user profiles are not created. The data is not combined with other data sources. The legal basis for the processing of personal data is Art. 6 (1) point (f) GDPR. The legitimate interest of the Study Centre is hereby, to improve, on the basis of the anonymised research behaviour of the users, the databases with regard to their content and functionality, and to thus make the holdings of the Archive and Library of the Francke Foundations accessible to the general public.
The statistical data is part of the annual working report, with which the Study Centre fulfils its accountability to the Administration and the Board of Trustees of the Francke Foundations, in accordance with section 7, clause 7 of the statute of the Francke Foundations, and to third-party donors. The legal basis for the processing of personal data is Art. 6 (1) point (c) GDPR.
By using the order function via the archive database, you declare your consent to the necessary processing of the personal data mentioned under 1. in accordance with Art. 6(1) point (a) GDPR. You can arrange for the deletion of the data at any time and thus revoke your consent.

3. Categories of Recipients

The personal data gathered in the log files is solely processed in the August Hermann Francke Study Centre by the archivist responsible for the databases. The data collected in connection with the ordering of archival records will be processed exclusively by the staff of the Study Centre involved in the ordering process. There is no transfer of personal data to additional places within or outside the Francke Foundations or to a third country.

4. Data Transfer to Third Countries

The data is not transferred to third countries.

5. Retention Period

The data you provide us with is only stored for the duration of the given purpose. The log files are regularly erased after finalisation of the annual report. You can arrange for the deletion of the user data required for the online ordering of archival records at any time. Inactive users of the order function are deleted 36 months after the last booking process. The archival records assigned to a user are only stored in the database until they are returned to the magazine.

6. Cookies

Our website sometimes uses so-called cookies. Cookies do not harm your computer and do not contain any viruses. Cookies serve to make our website more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser.
In the Archive database, cookies are used to provide the service “watch list”. This cookie does not store personal data, it only stores database specific information (name of the FAUST iServer project, name of the database) and the FAUST object number of the remembered data set. Using cookies is necessary for the watch list function. The watch list continues to exist after the session has ended. The first time a data record is transferred to the watch list, a message appears that cookies are being created in the browser. You must confirm this with OK. You can delete the cookies automatically after the search has been completed by making the appropriate browser settings. After deleting the watch list, the message appears again.
In the Digital Collections cookies are used to recognise connected queries during a visit, and to temporarily store settings (so-called session identifier). These session identifiers are automatically deleted by browsers shortly after a visit. There is no other use of cookies.

7. Contacting Us

If you contact us, we save your information in order to process the enquiry, and for the event of additional queries.
The contact function of the databases (special databases) is carried out with the contact form. You can contact us by email via the Archive database and the Digital Collections. Within the framework of your contacting us, your personal data is processed and used for the purpose of answering your query. The legal basis for the processing and storage of data is our legitimate interest in handling your enquiry in accordance with Art. 6 (1) point (f) GDPR. Please note that email communication cannot be entirely protected from access by third parties. Once your query has been answered, your data is erased, insofar as this does not contradict statutory retention periods.

8. Your Rights

You have the right to be provided with information at any time about your personal data processed by us. Please find a summary of your rights below.

Right of Access of the Data Subject Pursuant to Art. 15 GDPR and Section 34 of the DSAnpUG-EU [Act to Adapt Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680]
You have the right to obtain from us confirmation as to whether personal data relating to you is being processed. If this is the case, you have the right to obtain information from us, free of charge, about personal data relating to you which we have saved.

Right to Rectification Pursuant to Art. 16 GDPR
You have the right to request us to immediately rectify inaccurate personal data relating to you. Taking thereby the purposes of processing into consideration, you have the right to request that incomplete personal data is completed, including by means of providing a supplementary statement.

Right to Erasure Pursuant to Art. 17 GDPR and Section 35 DSAnpUG-EU
You have the right to request that personal data relating to you is immediately erased, insofar as the processing is not necessary, and insofar as one of the following grounds applies:

• The purpose for which personal data was processed has lapsed.
• You withdraw the consent on which the processing was based and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21 (1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU Member States to which we are subject.
• The personal data was collected in relation to the offer of information society services as defined in Art. 8 (1) GDPR.

Right to Restriction of Processing Pursuant to Art. 18 GDPR
You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21 (1) GDPR pending a decision on whether our legitimate grounds override yours.

Right to Data Portability Pursuant to Art. 20 GDPR
In accordance with Art. 20 GDPR you have the right to receive the personal data relating to you, which you have provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit this data to another controller without hindrance from us, insofar as the processing is based on consent pursuant to Art. 6 (1) point (a) GDPR or Art. 9 (2) point (a) GDPR or based on a contract pursuant to Art. 6 (1) point (b) GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

Right to Object Pursuant to Art. 21 GDPR and Section 36 DSAnpUG-EU
You have the right, on grounds relating to a particular situation, to object at any time to the processing of personal data relating to you which is necessary due to a legitimate interest on our part or to perform a task carried out in the public interest or in the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Right to Withdraw Consent
If you have given us consent, you have the right to withdraw your consent at any time. In this event, any data processing performed by us until such withdrawal shall remain lawful. With regard to this please notify us at datenschutz(at)francke-halle.de.

Right to Lodge a Complaint with a Supervisory Authority Pursuant to Art. 77 GDPR
You have the right to lodge a complaint with a supervisory authority at any time, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you violates applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.

The supervisory authority responsible for us is:
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: 0391 81803-0
Fax: 0391 81803-33

9. Automated Decision-Making Incl. Profiling

We do not use automated decision-making incl. profiling (Art. 22 GDPR).

10. Information

You are not obliged to communicate data to us at any time.
We protect your personal data by taking all technical and organisational measures possible to meet the protection goals.
We are unable to guarantee data security when communicating by email, we therefore recommend communicating confidential information by post.
Insofar as you wish to object to the processing or use of your data by us as set out in this privacy policy, either in general or in regard to individual measures, please direct your objection to the data controller named above. You can save and print this privacy policy at any time.

11. Actuality of and Amendments to this Privacy Policy

We reserve the right to update the privacy policy in accordance with current statutory provisions when changes are made to our website.

Halle, 17 September 2020

In accordance with Art. 13 and 14 of the GDPR we inform you about the processing of personal data which we have collected or will be collected from you within the framework of the application procedure and the organisational procedure of the Dr. Liselotte Kirchner Scholarship of the Francke Foundations.

1. What categories of personal data do we process?

The following personal data may be collected and processed by us in preparation for and during your scholarship stay:

• First name and surname
• Academic degree/title
• Date of birth
• Citizenship
• Name and location of the institution/organization etc. you represent
• Activity/Position
• Postal address
• Telephone number
• Email address
• Research topic
• Advisor/assessor/exhibitor of references
• Bank details

2. For what purposes and on what legal basis do we process personal data?

We use your data for the following purposes:

• To select suitable applicants for the Dr. Liselotte Kirchner Scholarship, to conclude contracts within the framework of the scholarship and to document the selection procedure. The legal basis for this is Art. 6(1) points b and f GDPR. The legitimate interest of the Francke Foundations is the statutory implementation of the scholarship, in particular the further development of research on the history of the Francke Foundations on the basis of their source collections.
• For the use of the source holdings in the archive and the library in the August Hermann Francke Study Centre. Further information can be found in the Privacy Policy of the Study Centre at www.francke-halle.de/datenschutz.
• For the announcement of the lectures of the scholarship holders in the scientific colloquium on the website, in social media and press releases of the Francke Foundations as well as on a poster and a flyer. The legal basis for this is Art. 6 (1) points a and f GDPR. The legitimate interest of the Francke Foundations consists in the statutory public relations work for information about the scientific work of the Francke Foundations.
• To document the research work carried out during the fellowship period in a research report, including a short presentation of the research project on the website of the Francke Foundations. The legal basis for this is Art. 6 (1) points a and f GDPR. The legitimate interest of the Francke Foundations lies in their statutory public relations work to provide information on the scientific work of the Francke Foundations and their documentation in order to fulfil their accountability and other duties of proof.
• To conclude a contract for the rental of guest apartments of the Francke Foundations. The legal basis is Art. 6 (1) point b DSGVO.

3. What categories of data recipients are there?

The members of the selection committee have access to the data collected in the course of the application procedure and, if your application is accepted, the employees of the Accounting Department. For the internal documentation of the research reports, your data will be processed by the head and the staff of the Research Department responsible for this. The data collected on the use of the source holdings in the archive and library are transmitted to the head of the department and the staff of the Study Centre who are responsible for the organisation of the use of the holdings. The data processed within the framework of public relations work are made available to the staff of the Communications/Events Department and, through press releases, to the editorial offices of the print and social media of the City of Halle. The information provided via public notices and the website of the Francke Foundations is addressed to the interested scientific and non-scientific public. When concluding a rental agreement for a guest apartment, your data will be passed on to the administrative management and the accounting staff of the Francke Foundations.

4. Are the data intended to be transmitted to third countries?

Your data will not be transmitted to any country outside the European Union.

5. How long will your data be retained?

Your personal data will be erased as soon as the purpose for which it was saved no longer applies. We erase data collected for the purpose of proving permission 3 years after the end of the processing work for which the permission was granted according to Section 31 of the German Act on Regulatory Offences (OWiG).
If your application for a research grant is accepted, your data will be stored until the end of your fellowship. In the event of rejection, your data will be deleted immediately. If you have given your consent, your data may also be stored for a longer period of time.
The data provided for the announcements of your scholarship presentation on flyers and posters will be permanently archived by one media copy each. All other posters and flyers will be destroyed after the presentation of the presentation or at the end of the calendar year. The announcement on the website and in the social media of the Francke Foundations will be placed offline or deleted after the event. If information was forwarded to print and social media of the city of Halle in press releases, the data protection declarations of these media apply to the periods of erasure.
Your data processed for the documentation of your scholarship stay will be permanently stored on the basis of your declaration of consent.
Rental contracts for guest apartments will be kept for 10 years.

6. Which rights do you have?

In accordance with applicable law, you have various rights concerning your personal data. If you would like to assert your rights, please direct your enquiry by email or by post to the data protection officer named above and clearly identify yourself. Please find an overview of your rights below.

6.1 Right of Access of the Data Subject Pursuant to Art. 15 GDPR and Section 34 FDPA
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store. This includes information about the purposes of processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data has been or will be disclosed, and, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.

6.2 Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3 Right to Erasure acc. to Art. 17 of the GDPR and Section 35 FDPA
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:

• The purpose for which personal data was processed has ceased to apply.
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
• You object to the processing on grounds relating to a particular situation pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.

6.4 Right to Restriction of Processing acc. to Art. 18 of the GDPR
You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.

6.5 Right to Data Portability acc. to Art. 20 of the GDPR
Acc. to Art. 20 of the GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit such data to another controller without hindrance from us where the processing is based on consent pursuant to point (a) of Art. 6(1) of the GDPR or point (a) of Art. 9(2) of the GDPR or on a contract pursuant to point (b) of Art. 6(1) of the GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising your right to data portability according to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

6.6 Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

6.7 Right to Withdraw Consent Given Under Data Protection Law
If you have given us consent, you have the right to withdraw your consent at any time. In this case, any data processing performed by us until such withdrawal will remain lawful. You can send us a message to datenschutz@francke-halle.de in that regard.

6.8 Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0
Fax: +49 (0)391 81803-33
Website: www.datenschutz.sachsen-anhalt.de/datenschutz-sachsen-anhalt

7. Is it Necessary to Provide my Personal Data?

The provision of your personal data is not mandatory. However, an application cannot be accepted without providing the above-mentioned data necessary for the implementation of the scholarship.

8. Is Automated Decision-Making incl. Profiling applied?

We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).

9. Actuality of and Amendments to this Privacy Policy

This privacy policy is currently valid and is dated September 2019.
We reserve the right to update the privacy policy in accordance with current statutory provisions when changes are made to our website.

Halle, 03. September 2019

Download our Privacy statement

The Francke Foundations process personal data in connection with the conduct of video and telephone conferences, online meetings and/or webinars (hereinafter: webmeetings) using Cisco Webex. With this privacy statement, we would like to inform you about the processing of your personal data in the context of such web meetings in accordance with Art. 13 GDPR.

Please note: When you access the Cisco Webex website, the provider is responsible for data processing. However, accessing the website is only necessary to use Cisco Webex in order to download the software for using the service. You can also use Cisco Webex via the Cisco Webex app.

1. What categories of personal data do we process?

When using Cisco Webex, different types of personal data are processed. The scope of data processing here also depends on the information you provide before or when participating in a web meeting and the settings you make.
The following personal data are subject to processing:

• User details: last name, first name, email address
• Meeting metadata: Topic, description (optional), attendee IP addresses, device/hardware information.
• For recordings: MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of online meeting chat.
• For dial-in with the telephone: information on the incoming and outgoing call number, country name, start and end time. If necessary, further connection data such as the IP address of the device can be stored.
• Text, audio and video data: You may have the opportunity to use the chat, question or survey functions in a web meeting. To this extent, the text entries you make are processed in order to display and, if necessary, record them in the web meeting. In order to enable the display of video and the playback of audio, the data from the microphone of your terminal device and from any video camera of the terminal device are processed during the meeting. You can turn off or mute the camera or microphone yourself at any time through the Cisco Webex application.
  The default settings are made by the Francke Foundations in such a way that no text, audio, or video data from you is processed without you initiating this processing yourself.

2. For what purposes and on what legal basis do we process personal data?

Your personal data is processed by the Francke Foundations to fulfill its statutory cultural, scientific, social and educational mission. The Cisco Webex application is used to be able to fulfill this task digitally. The legal basis for this is Art. 6 (1) f) GDPR. Insofar as personal data of employees of the Francke Foundations are processed, Section 26 FDPA is the legal basis for data processing.
Personal text, audio and video data of you as a participant will be collected and, if applicable, stored if you yourself contribute to the web meeting by triggering the corresponding functions via chat or video. In this case, the legal basis is your consent pursuant to Art. 6 (1) a) DSGVO, which you implicitly declare by activating the corresponding functions in Cisco Webex.
If a web meeting is to be recorded, you will be asked for your consent separately.

3. What categories of recipients of the data are there?

Personal data processed in connection with participation in webmeetings are generally not disclosed to third parties unless they are specifically intended for disclosure. The Cisco Webex provider necessarily obtains knowledge of the above-mentioned data insofar as this is provided for under the data processing agreement with Cisco Webex.

4. Is the transfer to a third country outside the European Union intended?

Cisco Webex is a service of Cisco Systems, Inc. which is based in the USA. Nevertheless, processing of personal data takes place in a third country only with regard to the contractual data. The other personal data, in particular that of the meeting participants, is processed exclusively on servers in the EU.
The Francke Foundations have concluded a data processing agreement with the Cisco Webex provider that complies with the requirements of Art. 28 GDPR. So-called EU standard contractual clauses have been concluded in connection with this agreement.

5. How long will your data be retained?

The personal data concerning you will be stored until the purpose of the data processing no longer applies or after the expiry of legal retention obligations.

6. Which rights do you have?

According to the GDPR, you are entitled to the following rights under the conditions specified in the law: right of access of the data subject (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to object (Art. 21 GDPR).
Moreover, you have the right to lodge a complaint with a Supervisory Authority acc. to Art. 77 of the GDPR. The supervisory authority in charge for us is:
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0; fax: +49 (0)391 81803-33
Website: www.datenschutz.sachsen-anhalt.de/datenschutz-sachsen-anhalt

7. Does profiling take place?

Your data will not be used by us for automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Updates to this Privacy Policy

This Privacy Policy is currently valid and has the state of February 2021.
We reserve the right to make changes to this Privacy Policy if there are changes in the data processing and according to the latest statutory provisions.

Download our Privacy statement

Careful handling of your personal data is very important to us. This Privacy Policy is intended to inform you about the processing of your data collected in course of your work as author or publisher of the publication department of the Francke Foundations.

1. Personal Data Processed by Us

Where a business and/or contractual relationship between you and us has been established, should be substantively arranged or altered, we process personal data about you, to the extent necessary for such purposes. Where you have concluded a publishing contract (also by oral arrangement) on the publication of your work with us, we collect the following data:

• name; with academic titles, if appropriate
• postal (business) address
• postal (private) address
• addresses deviating from the invoice address
• delivery addresses
• telephone number
• fax
• e-mail address
• bank details, if appropriate
• tax number, if appropriate
• information as to VAT liability
• printing cost contributions
  
  Furthermore, we process the following personal data:
   
• accounting information
• dunning levels
• delivery blocks
• debt collection

2. Purposes and Legal Basis of Processing

We process and use your data to implement the contract. Point (a) of Art. 6(1) of the GDPR serves us as a legal basis for processing operations for which we obtain consent for a specific processing purpose. Where processing of personal data is necessary to perform a contract, processing is based on point (b) of Art. 6(1) of the GDPR. The same applies to processing operations necessary for the implementation of measures prior to entering into a contract, for ex. in cases of requests regarding services. Where we are subject to a legal obligation due to which processing of personal data becomes necessary, for example to meet tax obligations, processing is based on point (c) of Art. 6(1) of the GDPR i.c.w. Section 147 of the AO [German Fiscal Code].
Finally, processing operations can be based on point (f) of Art. 6(1) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, where processing is necessary to safeguard our legitimate interests or the ones of a third party, unless this the interests, fundamental rights and freedoms of the data subject override such interests. We are allowed to carry out such processing operations, in particular, because they have been specifically mentioned by the European legislator. Usually, a legitimate interest is to be assumed where the data subject is a customer of the controller.
We use the data provided by you for general author and publisher administration to publish books or articles. In concrete terms, this comprises contract preparation, disbursement and the general fulfilment of the publishing contract.

3. Categories of Recipients

The relevant data provided to us can be processed as part of the author and publisher administration within Franckesche Stiftungen:

• Publications Department
• Accounting Department
• Communications and Events Department
• HR Department
• Study Centre - Archive and Library - Department

Franckesche Stiftungen does not disclose your personal data to third parties, except if it is necessary to execute business transactions. Data transfer is limited to the required minimum.

3.1 Processors

Different service providers perform data processing on our behalf. The security of your data is ensured by corresponding contracts acc. to Art. 28 of the GDPR. Such processors include:

• printing houses and typesetting service providers
• graphic artists
• delivery service providers
• Commission partner: Harrassowitz Verlag, Wiesbaden
• IT service provider: mps public solutions GmbH, Koblenz

4. Data Transfer to Third Countries

No such data transfer takes place.

5. Retention Period

We retain data obtained from you only for the duration of its purpose. Termination of the contract cannot be equated with the erasure of your data in all cases, since we must adhere to legal retention periods (e.g. by the Fiscal Code of Germany (AO)). The following data is retained for the term of the underlying author or publisher contract for ten years:

• name; with academic titles, if appropriate
• postal (business) address
• postal (private) address
• addresses deviating from the invoice address
• delivery addresses
• telephone number
• fax
• e-mail address
• bank details, if appropriate
• tax number, if appropriate
• information as to VAT liability
• accounting information
• printing cost contributions
• dunning levels

The following data is retained for the term of the underlying author or publisher contract for four years:

• delivery blocks
• customer block

6. Your Rights

You have the right to access at any time your personal data processed by us.

Right of Access of the Data Subject acc. to Art. 15 of the GDPR and Section 34 of the DSAnpUG-EU
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store.

Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure acc. to Art. 17 of the GDPR
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:

• The purpose for which personal data was processed has ceased to apply.
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing according to Art. 21(2) of the GDPR.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.
• The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

Right to Restriction of Processing acc. to Art. 18 of the GDPR
You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.

Right to Data Portability acc. to Art. 20 of the GDPR
Acc. to Art. 20 of the GDPR, you have the right to receive the personal data concerning you, which you have s provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit such data to another controller without hindrance from us where the processing is based on consent pursuant to point (a) of Art. 6(1) of the GDPR or point (a) of Art. 9(2) of the GDPR or on a contract pursuant to point (b) of Art. 6(1) of the GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising your right to data portability according to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to Withdraw Consent Given Under Data Protection Law
If you have given us consent, you have the right to withdraw your consent at any time. In this case, any data processing performed by us until such withdrawal will remain lawful. You can send us a message to datenschutz@francke-halle.de in that regard.

Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0
Fax: +49 (0)391 81803-33

7. Automated Decision-Making Incl. Profiling

We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).

8. Security Note

We protect your personal data by taking all technical and organisation measures possible to us to meet the protection goals.
We are unable to guarantee data security when communicating by e-mail so we recommend communication of confidential information by mail.

9. Legal and Contractual Obligation to Provide Data

You are not obliged to communicate data to us at any time. If you do not provide us with your data specified above for the respective processing, however, we might not be able to conclude a contract with you or, where already concluded, to perform such contract in some circumstances.

10. Actuality of and Amendments to this Privacy Policy

This privacy policy is currently valid and is dated July 2018.
We reserve the right to update the privacy policy in accordance with current statutory provisions when changes are made to our website.

Halle, 19 February 2019

Download of our Privacy Policy

Careful handling of your personal data is very important to us. This Privacy Policy is intended to inform you about the processing of your data collected by us . , die wir von Ihnen erheben, if you as a customer contact our publishing house

1. Personal Data Processed by Us

Where a business and/or contractual relationship between you and us has been established, should be substantively arranged or altered, we process personal data about you, to the extent necessary for such purposes.
In principle, we only collect data of you that you actively provided to us. This may include, in particular:

• title
• name; with academic titles, if appropriate
• invoice address
• delivery address
• telephone number
• fax
• e-mail address
• bank details
• language

Furthermore, we process the following personal data:

• accounting information
• dunning levels
• delivery blocks
• customer blocks
• debt collection

2. Purposes and Legal Basis of Processing

We process and use your data to implement the contract. Point (a) of Art. 6(1) of the GDPR serves us as a legal basis for processing operations for which we obtain consent for a specific processing purpose. Where processing of personal data is necessary to perform a contract, processing is based on point (b) of Art. 6(1) of the GDPR. The same applies to processing operations necessary for the implementation of measures prior to entering into a contract, for ex. in cases of requests regarding services. Where we are subject to a legal obligation due to which processing of personal data becomes necessary, for example to meet tax obligations, processing is based on point (c) of Art. 6(1) of the GDPR i.c.w. Section 147 AO [German Fiscal Code].
Finally, processing operations can be based on point (f) of Art. 6(1) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, where processing is necessary to safeguard our legitimate interests or the ones of a third party, unless this the interests, fundamental rights and freedoms of the data subject override such interests. We are allowed to carry out such processing operations, in particular, because they have been specifically mentioned by the European legislator. Usually, a legitimate interest is to be assumed where the data subject is a customer of the controller. Our interest in this case is our ability to offer you services even after the end of our contractual relationship. Dispatching publishing brochures is based on point (f) of Art. 6(1) of the GDPR, where we send you advertising material as part of your order. Another interest on our part is to inform you of publications.

3. Categories of Recipients

The relevant data provided to us is processed to implement the contract within Franckesche Stiftungen:

• Publications Department (Sales)
• Accounting Department

Franckesche Stiftungen does not disclose your personal data to third parties, except if it is necessary to execute business transactions. Data transfer is limited to the required minimum.

3.1 Processors

Different service providers perform data processing on our behalf. The security of your data is ensured by corresponding contracts acc. to Art. 28 of the GDPR. Such processors include:

• Commission partner: Harrassowitz Verlag, Wiesbaden
• IT service provider: mps public solutions GmbH, Koblenz

4. Data Transfer to Third Countries

No such data transfer takes place.

5. Retention Period

We retain data obtained from you only for the duration of its purpose.
Termination of the contract cannot be equated with the erasure of your data in all cases, since we must adhere to legal retention periods (e.g. by the Fiscal Code of Germany (AO)). The following data is retained for ten years:

• title
• name; with academic titles, if appropriate
• postal address
• addresses deviating from the invoice address
• delivery address
• telephone number
• fax
• e-mail address
• bank details
• language
• accounting information
• dunning levels
• delivery blocks
• customer blocks
• debt collection

6. Your Rights

You have the right to access at any time your personal data processed by us.

Right of Access of the Data Subject acc. to Art. 15 of the GDPR and Section 34 of the DSAnpUG-EU
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store.

Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure acc. to Art. 17 of the GDPR
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:

• The purpose for which personal data was processed has ceased to apply.
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing according to Art. 21(2) of the GDPR.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.
• The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

Right to Restriction of Processing acc. to Art. 18 of the GDPR

You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.

Right to Data Portability acc. to Art. 20 of the GDPR
Acc. to Art. 20 of the GDPR, you have the right to receive the personal data concerning you, which you have s provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit such data to another controller without hindrance from us where the processing is based on consent pursuant to point (a) of Art. 6(1) of the GDPR or point (a) of Art. 9(2) of the GDPR or on a contract pursuant to point (b) of Art. 6(1) of the GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising your right to data portability according to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to Withdraw Consent Given Under Data Protection Law
If you have given us consent, you have the right to withdraw your consent at any time. In this case, any data processing performed by us until such withdrawal will remain lawful. You can send us a message to datenschutz@francke-halle.de in that regard.

Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0
Fax: +49 (0)391 81803-33

7. Automated Decision-Making Incl. Profiling

We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).

8. Security Note

We protect your personal data by taking all technical and organisation measures possible to us to meet the protection goals.

We are unable to guarantee data security when communicating by e-mail so we recommend communication of confidential information by mail.

9. Legal and Contractual Obligation to Provide Data

You are not obliged to communicate data to us at any time. If you do not provide us with your data specified above for the respective processing, however, we might not be able to conclude a contract with you or, where already concluded, to perform such contract in some circumstances.

10. Actuality of and Amendments to this Privacy Policy

This privacy policy is currently valid and is dated July 2018.
We reserve the right to update the privacy policy in accordance with current statutory provisions when changes are made to our website.

Halle, 19 February 2019

Download of our Privacy Policy

1. Personal Data Processed by Us

• Entry at Schwarzes Tor: Licence plate of the vehicle,
• Ground of the Franckesche Stiftungen, Information Center (House 28) und Historical Library (House 22): image data, date and time,
• Reading and catalogue room of the August Hermann Francke Study Center: image data, date and time.

2. Purposes and Legal Basis of Processing

The video surveillance in the Franckesche Stiftungen is based on Art. 6(1) point (f) of the GDPR. The legitimate interest of the Franckeschen Stiftungen is the protection of its material and cultural heritage against vandalism, damage, destruction, and theft.
The video surveillance in the Historical Library and the Information Center is also intended to protect the employed staff in these public institutions.

3. Categories of Recipients

In case of an offence the data will be conveyed to prosecuting authorities and lawyers.

4. Retention Period

• Entry to and ground of the Franckesche Stiftungen, catalogue room of the Study Center: Data are not retained.
• Historical Library, reading room and Information Center: Data are retained for a period of 8 days. In case of an offence data will be retained until the conclusion for the criminal or civil procedure.

5. Your Rights

You have the right to access at any time your personal data processed by us.

Right of Access of the Data Subject acc. to Art. 15 of the GDPR and Section 34 of the DSAnpUG-EU
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store.

Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure acc. to Art. 17 of the GDPR
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:

• The purpose for which personal data was processed has ceased to apply.
• You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing according to Art. 21(2) of the GDPR.
• The personal data has been unlawfully processed.
• The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.
• The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

Right to Restriction of Processing acc. to Art. 18 of the GDPR
You have the right to obtain from us restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
• You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.

Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Telephone: +49 (0)391 81803-0; fax: +49 (0)391 81803-33

6. Automated Decision-Making Incl. Profiling

We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).

7. Updates to this Privacy Policy

This Privacy Policy is currently valid and has the state of September 2018.
We reserve the right to make changes to this Privacy Policy according to the latest statutory provisions.