Startseite Data protection policy

Data protection policy

Please note: This English translation is intended as a convenience to non-German-reading visitors and has no legal effect for compliance or enforcement purposes. Only the German version shall be legally binding.

I. Controller – name and address

As defined by the General Data Protection Regulation, other national data protection acts and legal data protection regulations, the following public authority is responsible for the content of these websites:

Bundesanstalt für Gewässerkunde (BfG)
Am Mainzer Tor 1
D – 56068 Koblenz
Tel.: +49 (0)261 1306 0
Fax : +49 (0)261 1306 5302
E-mail: posteingang@bafg.de
URL: http://www.bafg.de

Contact – data protection officer:

Michael Hils
Tel.: +49 (0)261 1306 5295 / 5610
Fax: +49 (0)261 1306 5333
E-mail: webinfo@bafg.de

II. General provisions on data processing

1. Scope of personal data processing

We process personal data of our users only insofar as is necessary to provide a functioning website, content and service. The processing of personal data is generally subject to the user’s consent, unless obtaining prior consent is not possible due to factual reasons and data processing is permitted by law.

2. Legal basis for processing personal data of the data subject or other natural persons

If the concerned person has given consent to the processing of their personal data within the scope of processing operations, article 6(1)(a) of the EU-General Data Protection Regulation (GDPR) provides the legal basis. If processing personal data is necessary for the performance of a contract to which the data subject is party, article 6(1)(b) of the GDPR provides the legal basis. This also applies to processing steps which are necessary for implementing measures prior to entering into a contract.

If processing personal data is necessary for compliance with a legal obligation to which we are subject, article 6(1)(c) GDPR provides the legal basis. If processing personal data is necessary for the protection of vital interests of the data subject or of another natural person, article 6(1)(d) GDPR provides the legal basis. If processing is necessary for the purposes of the legitimate interests pursued by our organization or by a third party, and if the interests or fundamental rights and freedoms of the data subject do not override the legitimate interests stated above, article 6 (1)(f) GDPR provides the legal basis.

3. Data erasure and storage period

As soon as the storage purpose ceases to exist, personal data of the data subject will be erased or blocked. It is possible to further store data if stipulated by European or national lawmakers through EU regulations, laws or other provisions to which the controller is subject. Data will also be erased or blocked if a mandatory storage period, as required by the rules mentioned above, expires, except when there is a need for continued storage for the purpose of concluding or fulfilling a contract.

III. Providing the website and creation of log files

1. Description and scope of data processing

At each access to our website, our system collects the following data and information on the calling computer:

• information on the browser type and version
• operating system of the user
• anonymised IP address of the user
• access date and time; transferred data volume
• websites linking the user’s system to our website

2. Purpose of data processing

Log files are stored in order to guarantee for a functioning website. The data are useful for the optimizing the website and ensuring the safety of our IT-systems. These are the legitimate interests in data processing according to article 6(1)(f) GDPR as mentioned above.

IV. Newsletter

1. Description and scope of data processing

The user will receive our newsletter after subscription on our website.

On our website, the user can subscribe to our free newsletter. The data deriving from the entry mask which has been filled in during the subscription process will be transmitted to us.

• e-mail address
• date of registration

During the subscription process, the user will be asked to consent to the data processing and will be referred to the data protection policy.

Within the scope of the data processing needed for sending out the newsletter, no data will be transmitted to third parties. The data will be used exclusively for sending out the newsletter.

2. Purpose of data processing

In order to send the newsletter, the user’s email address will be stored. The newsletter will only be sent out after a previous subscription on our website.

The collection of other personal data during the subscription process is exclusively intended to help prevent the misuse of our services or the used e-mail address.

3. Duration of storage

The data will be deleted as soon as they do not serve the purpose of their collection anymore. The user’s e-mail address will be stored as long as the subscription to the newsletter is active.

4. Objection and removal

At any time, the user has the possibility to cancel the newsletter subscription. Each newsletter contains a link which can be used to unsubscribe.

V. Registration forms

1. Description and scope of data processing

The ReWaM homepage can host temporary registration forms for specific events, which allow the online registration for events organized by the host. If a user choses to use this option, the data from the entry form are transmitted to the host and stored.

The following data might be entered into the form:

• date and time of registration
• title
• academic title
• first name
• last name
• e-mail address
• company/institution
• division/department
• consent to publication of the name on list of participants
• affiliated ReWaM project
• request for vegetarian food option

During the dispatching process, the user consents to the data processing and will be referred to this data protection policy. In this context, no data will be transmitted to third parties. The data will be used exclusively for the preparation of the event.

2. Purpose of the data processing

The processing of personal data from the entry form is destined exclusively to treat the registration for an event. Other personal data which is processed during the dispatching process are used exclusively to help prevent the misuse of the contact form and to ensure the safety of our IT-systems.

3. Storage period

The data will be deleted as soon as they do not serve the purpose of their collection anymore.

VI. Use of cookies

1. Description and scope of data processing

Our website uses cookies. Cookies are text files, which are stored by the browser in the user’s computer system. By opening a website, a cookie can be stored in the operating system of the user. The cookie contains a typical string of random letters and numbers in order to clearly identify the browser the next time it opens the website.

The following data are stored and transferred in the cookies:

• Language settings
• We also use cookies to track the surfing behaviour of the user on our website (see chapter ‘Web analysis by Matomo’ of this Data Protection Policy).

The user data collected by our cookies are necessary for technical reasons and are not used for the creation of user profiles.

2. Detailed description of individual cookies

Language settings

Cookies make our website more user-friendly. As some elements of our website require an identification of a browser even after a change of page, cookies will save the language settings of the used browser.

Web analysis by Matomo

On our website, we use the open source software Matomo (formerly PIWIK) for the analysis of the user’s surfing behaviour. The software adds a cookie to the user’s computer (for more information on cookies, see above). By opening individual pages of our websites, the following data will be stored:

• two bytes of the IP address of the calling system
• name of the accessed website
• search term (leading visitors to our site)
• search engine
• page name (URL), number of pages visited
• geographical region of the visitor (country)
• browser
• operating system
• screen resolution
• browser plug-ins
• access time
• duration of access
• entry pages
• exit page
• downloads
• referring websites

The software is operated exclusively on our website servers. Personal data will not be stored anywhere else. No data will be transferred to third parties.

The information gathered trough cookies will only be used for statistical purposes and optimization of our online presence and our server. The software will not save the complete IP address and will mask two bytes (for example: 192.168.xxx.xxx). Thus, it is not possible to assign the short version of the IP address to the calling computer. The user has the possibility to refuse Matomo tracking at any time.

Cookies from third parties

This website contains videos from YouTube and Vimeo. While loading a page with an embedded YouTube or Vimeo video, cookies from Vimeo, YouTube and other Google services will be set.

We cannot accept any responsibility for information that might be retrieved by YouTube or Vimeo and for the data protection by these parties. You can configure your browser accordingly and thus deactivate cookies from third parties.

3. Storage period, objection and removal

Cookies are stored on the user’s computer and will be transmitted to our website. The user has full control over the use of cookies. In your browser, you can deactivate or limit the transmission of cookies. Cookies that have already been stored can be deleted at any time, either manually or automatically. If you deactivate cookies for this website, it is possible that some features of the website do not function correctly.

4. Storage period

The data will be deleted as soon as they are not needed anymore for recording purposes. In our case, the end of the storage period will be July 2019 after the Networking and Transfer Project ReWaMnet expires.

5. Objection and removal

For more information on privacy settings for Matomo, please visit: https://matomo.org/docs/privacy/.

You have the right to opt out of the analysis by following the instructions below. Thus, a cookie set in your system will signal to our system to refrain from saving the user data. If you delete the cookie from your system, you will have to set it again.

6. Objection to web analysis

You have the right to decide whether or not a web analysis cookie can be set in your browser. This cookie allows the operator of the website to save and analyse various statistical data. If you decide against it, please click on the following link, which will store the Matomo deactivation cookie in your browser.

[EN: Your presence on this website is currently being tracked by Matomo web analysis. If you wish to end tracking, please click here.]

VII. Rights of the concerned data subject

The following list encompasses all rights of the data subject as defined by GDPR. If your personal data is being processed, you are a concerned data subject as defined by GDPR and you have the following rights against the controller:

1. Right to access

You can ask the controller to confirm whether your personal data are being processed by the site provider.

If your data are being processed, you can ask the controller to hand over the following information:

1. purposes of the processing;
2. categories of personal data concerned;
3. recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
6. right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

2. Right to rectification

You have the right to ask the controller to rectify or complete your personal data without undue delay, if your personal data that are being processed are either incomplete or inaccurate.

3. Right to restriction of processing

You have the right to obtain from the controller restriction of processing where one of the following applies:

1. if you contest the accuracy of the personal data for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
4. you object to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If you have obtained restriction of processing, you will be informed by the controller before the restriction of processing is lifted.

4. Right to erasure

Mandatory erasure

You have the right to obtain from the controller the erasure of your personal data without undue delay and the controller has the obligation to erase your personal data without undue delay where one of the following grounds applies:

5. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
6. you withdraw consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
7. you object to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2).
8. the personal data have been unlawfully processed.
9. your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
10. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

5. Information disclosed to third parties

Where the controller has made your personal data public and is obliged pursuant to Article 17(1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

6. Exceptions

The right to erasure does not apply to the extent that processing is necessary:

7. for exercising the right of freedom of expression and information;
8. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
9. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;
10. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
11. for the establishment, exercise or defence of legal claims.

7. Right to notification

If you have notified the controller that you wish to exercise your right to rectification, erasure or restriction of processing, the controller is obligated to notify all recipients of your personal data of the rectification, erasure or restriction of processing, except for when this proves impossible or would involve a disproportionate effort.

You have the right to be informed about these recipients by the controller.

8. Right to data portability

You have the right to receive your personal data, which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR, and
2. the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

The right to data portability does not apply to the processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

9. Right to object

You have the right to object, on grounds relating to his or her particular situation, at any time to processing of your personal you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications

Right to withdraw declaration of consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to notify a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes this Regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

VIII. Photo shoots for PR purposes

Within the scope of our press and public relations activities, pictures of you might be taken during meetings and events. You have the right to object to the picture being taken and/or published. Please use our contact data in order let us know about your objection.