Data protection is of particular concern to us. We process your personal data (hereinafter referred to as “data”) in accordance with legal requirements and would like to do so in a transparent manner. Therefore, we would like to briefly explain to you which data we process in connection with the use of our website, and for what purposes and on what legal basis this is done. In addition, you will receive information about contact persons and your rights in connection with data processing.

Name and contact details of the controller

Leuphana University Lüneburg
represented by the President
Universitätsallee 1
21335 Lüneburg

Contact details of the data protection officer

Leuphana University Lüneburg
- Data Protection Officer -
Universitätsallee 1
21335 Lüneburg
E-mail: dsb@leuphana.de

Purposes and legal bases of data processing

Log files

As soon as you visit our website, we store so-called log files of you. These files record your IP address, the date and time of the page access, the URL accessed, the URL you last visited (referrer URL), the browser you are using and its version, and the version of the operating system you are using.

In addition, the accessed URL, the browser used and its version, the version of the operating system you are using and the screen size used, together with JavaScript error messages, are sent to a server of our maintenance service provider in order to be able to analyze and eliminate error messages from the JavaScripts used on our site. This helps us to prevent downtime of JavaScripts working on the website. A link with your IP address does not take place. We have concluded a contract for order processing with our maintenance service provider eCentral GmbH for these processing operations.

We use this data to prevent misuse of our website and to enable you to visit our website smoothly and optimally. The legal basis for this processing is § 3 S.1 Nr. 1 NDSG i.V.m. Art. 6 Abs. 1 S. 1 Buchstabe e) DSGVO i.V.m. 3 Abs. 1 S.1 Nr. 10 NHG.

Cookies

Our website uses cookies. The use of cookies enables us to provide users of this website with more user-friendly services that would not be possible without the setting of cookies. In addition, cookies can be used to optimize the information and offers on our website for the benefit of users.

Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A particular internet browser can be recognized and identified by means of the unique cookie ID. The purpose of this recognition is to make it easier for users to use our website.

Insofar as consent allows the use of cookies, the following cookies may be used on our websites:

First-party cookies

1. Contact form

Leuphana.de – PHPSESSID (session ID)

We use a session cookie with a session ID on our website if you use our contact form. This cookie is used to temporarily store the information entered in the fields of the contact form. Temporary cookies are deleted at the latest after you leave our online offer and close your browser.

If you contact us using the contact form or by email, the data you provide (name, surname, email address, subject and message) will be used to process your request. Your request, together with the data provided, will be forwarded by email to the specified contact person on the respective side. The provision of the data is necessary for processing and answering your request – without providing it, we cannot answer your request or can only answer it to a limited extent.

Your data will be deleted provided that your request has been conclusively answered and there are no legal retention obligations to prevent the deletion, such as in the case of a subsequent contract execution. The storage of or access to information in your terminal equipment is carried out in accordance with § 25 para. 2 no. 2 of the law on data protection and the protection of privacy in telecommunications and digital services (TDDDG). The legal basis under data protection law for the technically necessary processing for the presentation and provision of our website on the internet with a contact option is Section 3 S.1 No. 1 NDSG in conjunction with Art. 6 para. 1 sentence 1 letter e) DSGVO in conjunction with Section 3 para. 1 S. 1 No. 10 NHG.

2. Cookie banner

We give you the opportunity to select your preferences regarding cookies via a cookie banner when you first visit our website and then at any time thereafter. To ensure that the settings you have selected can be adhered to on our sub-pages and that no data is processed against your will, it is necessary that your decision is recorded in a machine-readable form. This is done by a cookie that is set by our cookie banner. The legal basis for this data processing is § 25 para. 2 no. 2 TTDSG, in conjunction with Art. 5 para. 2 and Art. 7 para. 1 DSGVO. You can delete cookies that have already been set at any time via an internet browser or other software programs or adjust your cookie settings at the bottom of the website.

Third-party cookies and plug-ins

1. Google Analytics with Google Tag Manager

_ga (Google Analytics)

_gat (Google)

_gid (Google)

googletagmanager.com (Google)

We use Google Analytics on our website. This is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as “Google”.

The service uses cookies to store information about the use of the website on your computer. The information generated by the cookies about the use of our website is usually transmitted to a Google server and stored there. The Google Analytics service is used to analyze user behavior and improve our website. We also use the Google Tag Manager to simplify the administration of Google Analytics.

Usage and user-related information, such as IP address, location, time or frequency of visits to our website, may also be transmitted in individual cases to a Google server in the US and stored there. Further information on the transmission of data to non-EU countries can be found below in the section “Transmission to third countries”.

We use Google Analytics with the so-called anonymization function. This function causes Google to shorten the IP address within the EU or the EEA before it is transferred to a server in the USA.

The data collected in this way is in turn used by Google to provide us with an evaluation of visits to our website and the usage activities there.

In addition, it is possible that this data will be used by Google to provide further services related to the use of our website and the use of the internet. Google states that it will not associate your IP address with any other data held by Google. Further data protection information on the use of Google Analytics is available from Google at

https://www.google.com/intl/de/policies/privacy/partners

, including, for example, how to prevent the use of data by Google. In addition, Google offers

https://tools.google.com/dlpage/gaoptout?hl=de

a so-called deactivation add-on. This add-on can be installed on the most popular browsers and offers you further control over the data that Google collects when you visit our website. The add-on informs the JavaScript (ga.js) of Google Analytics that information about the visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analysis services.

With Google, there is a shared responsibility with regard to processing.

Data will only be transmitted to Google after obtaining your consent. Your consent or refusal is stored in a cookie set by us. You can revoke your selection at any time via “Cookie Settings” at the bottom of our website.

The legal basis for the storage of third-party cookies in your terminal equipment or access to information already stored in the terminal equipment is Section 25 (1) TTDSG. The legal basis for further data processing in connection with Google Analytics is Art. 6 (1) sentence 1 a) GDPR. With regard to the exceptional transfer to a non-European third country, the data processing is based on Art. 49 (1) sentence 1 (a) GDPR.

The storage period for user and event data collected by Google Analytics is 14 months.

2. YouTube

ytimg.com (YouTube)

googlevideo.com (YouTube)

www.google-analytics.com (Google Analytics)

www.youtube.com (YouTube)

yt3.ggpht.com (YouTube)

doubleclick.net (Google Ads)

We use YouTube on our website. This is a video portal operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as “Google” or “YouTube”.

We use YouTube in “extended data protection mode” to be able to show you videos.

The “extended data protection mode” function ensures that the data specified in more detail below is only transmitted to the YouTube server if you actually start a video by clicking on it a second time. Without this “extended data protection mode”, a connection to the YouTube server in the USA is established as soon as you access one of our web pages on which a YouTube video is embedded.

We would like to point out that in this case, user data may be processed on Google servers outside the European Union. Further information on the transfer of data to non-EU countries can be found below in the section “Transfer to third countries”.

However, this connection is necessary in order to be able to display the respective video on our website via your internet browser. In the course of this, YouTube will at least collect and process your IP address, the date and time, and the website you visited. In addition, a connection to the Google advertising network “DoubleClick” is established.

If you are logged into YouTube or Google at the same time, YouTube will assign the connection information to your Google account. If you wish to prevent this, you must either log out of YouTube/Google before visiting our website or make the appropriate settings in your YouTube/Google user account.

For the purpose of functionality and to analyze user behavior, YouTube permanently stores cookies on your device via your internet browser. If you do not agree to this processing, you have the option to prevent the storage of cookies by making the appropriate settings in your internet browser.

When YouTube videos are displayed on our website, external fonts from the Google Fonts service are used. Google Fonts is also a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. These web fonts are integrated by accessing a server, usually a Google server in the United States. This will tell the server which of our websites you have visited (referrer). The IP address of the browser of the end device of the visitor to this website is also transmitted to the Google servers.

Further information about the collection and use of data as well as your rights and protection options in Google's

https://policies.google.com/privacy.

Data will only be transmitted to Google after you have given your consent via the cookie banner displayed at the beginning or after a two-click confirmation on the displayed video. Your consent or refusal is stored in a cookie set by us. You can revoke your selection at any time by clicking on “Cookie Settings” at the bottom of our website. The legal basis for the storage of third-party cookies in your end device or access to information already stored in the end device is Section 25 (1) TTDSG, as well as Art. 6 (1) (a) GDPR. With regard to the exceptional transfer to a non-European third country, the legal basis for the processing is Art. 49 (1) sentence 1 (a) GDPR.

3. Vimeo

We use Vimeo on our website to integrate videos. This is a video portal of Vimeo.com Inc., 555 West 18th Street, New York, New York 10011, USA, hereinafter referred to as “Vimeo”.

Vimeo videos are only embedded in our website with the “Do-Not-Track” setting. This means that Vimeo does not set any cookies on your device that could enable cross-website identification. Data required for technical reasons (your IP address, country of origin and technical information about your device, such as browser type, operating system, basic device information, date and time of your visit, as well as information about the respective video) is sent to Vimeo for display and playback.

The transmission of the aforementioned data to Vimeo is necessary to provide you with the embedded videos on our websites. We would like to point out that Vimeo processes user data outside the European Union on servers in the United States. Further information on the transmission of data to non-EU countries can be found below in the section “Transmission to third countries”. With regard to the processing for the integration of our videos, we have concluded a contract based on the standard contractual clauses of the EU Commission for the relationship between two controllers (“controller to controller”) with Vimeo.

Information about the collection and use of data by Vimeo alone, as well as your rights and protections as a user in this regard, can be found in Vimeo's privacy policy, which can be accessed at https://vimeo.com/privacy. We will only transfer data to Vimeo with your prior consent via the cookie banner, or subsequently with your “two-click confirmation” on the video that appears in each case. Your consent or refusal is stored in a cookie set by us. You can revoke your selection at any time via “Cookie Settings” at the bottom of our website. The legal basis for the storage of third-party cookies in your terminal equipment or access to information already stored in the terminal equipment is Section 25 (1) TTDSG, as well as Art. 6 (1) (a) GDPR. With regard to the exceptional transfer to a non-European third country, the legal basis for the processing is Art. 49 (1) sentence 1 (a) GDPR.

4. Podcast player

podcaster.de

We integrate the Podcaster.de service into our website so that you can listen to and subscribe to our podcasts in your browser. This is a tool provided by the provider Fabio Bacigalupo, Wattstraße 11-13, 13355 Berlin, hereinafter referred to only as “Podcaster.de”.

When you access a page with the integrated player, the tool is loaded to enable you to view and play a podcast directly. Podcaster.de processes the following data categories for this purpose: meta/communication data (IP address), technical data for retrieval statistics (anonymized IP address, user agent identifier, country of origin, retrieved file). This is necessary to provide you with the podcast player and external links with the option of subscribing to various podcast subscription services. Furthermore, we receive information through data processing about the retrievals from Podcaster.de in order to be able to design our offer according to demand. We have concluded a contract with Podcaster.de for order processing.

Please note that when you click on the subscription links on the respective landing pages, further processing is carried out by the respective subscription service providers on their own responsibility, over which we have no influence.

The legal basis for the storage of third-party information in your end device or access to information already stored in the end device is § 25 para. 2 no. 2 TTDSG, as well as § 3 p.1 no. 1 NDSG i.V.m. Art. 6 para. 1 sentence 1 letter e) DSGVO i.V.m. § 3 Abs. 1 S. 1 Nr. 10 NHG for the technically necessary processing to display and provide our podcasts on our website.

Cookie banner – Deleting or changing your permission settings

You can use the link above to withdraw or change any permissions you have granted via the cookie banner or in a video player.

Social media sites

We maintain profiles on social networks that serve the communication and public relations of Leuphana University Lüneburg. Social networks such as Facebook, Instagram, YouTube and Twitter can generally analyze the user behavior of visitors comprehensively when they visit their websites or a website with integrated social media content (e.g. like buttons or banner ads). When you visit our social media pages or interact with them, data protection-related processing is usually carried out.

If you are logged into your social media account of the respective provider and visit our social media page, the operator of the social media platform can assign this visit to your user account. Your personal data may also be collected even if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection is done, for example, by cookies that are stored on your device or by recording your IP address.

The operators of the social media portals can use the data collected in this way to create user profiles. This allows the operator to display interest-based advertising to you both within and outside of the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are or were logged in.

We have no influence on the data collected by the operator and the data processing operations, nor are we aware of the full extent of the data collection or the purposes of the processing. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Please note that your data collected on the social media site may be processed outside the European Union. We will inform you about our cooperation with the respective social media platform providers in the following sections. Further information on the transfer of data to non-EU countries can be found below in the section “Transfer to third countries”.

In the following sections, we will also inform you about the extent to which a corresponding contract has been concluded with the respective providers for joint responsibility, insofar as the corresponding analysis data (so-called page insights) is provided to us by the provider.

Our social media sites are designed to ensure that we have as comprehensive and up-to-date a presence as possible, with appropriate opportunities for interaction on the internet, in order to inform the public about how we carry out our tasks. The legal basis for the processing of data by us with the help of sites on social media platforms is therefore Article 6(1), sentence 1, point (e) of the GDPR in conjunction with Section 3(1), no. 10 of the Lower Saxony Data Protection Act (NHG). The analysis processes initiated by the social networks may be based on different legal bases, which are to be indicated by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 letter a) DSGVO or § 25 para. 1 TTDSG).

Person responsible and assertion of rights

When you visit one of our social media sites (e.g. Facebook), the providers provide us with anonymized statistics and analyses of the use of our social media sites. This gives us insights into the use of our sites (so-called page insights). The statistics provided to us do not allow any conclusions to be drawn about individual profiles. In these cases, we and the respective social media provider are jointly responsible for the processing of personal data (Art. 26 GDPR) used to generate the aforementioned statistics and analyses. Insofar as we are jointly responsible with the respective platform provider, we will inform you in the following sections about the details of the cooperation available to us.

We use the statistics and analyses provided to improve our social media presence and to gain knowledge about its distribution. Please note that despite our shared responsibility with the social media portal operators, we do not have full influence over the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider. Insofar as you visit our respective presence on social networks, the networks process personal data.

We therefore ask you to initially address any requests to assert your rights to the respective platform provider. However, you can generally assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

The data collected directly by us via the social media site will be deleted from our systems as soon as the purpose for its storage no longer applies, you ask us to delete it or revoke your consent to storage. Mandatory statutory provisions – in particular, retention periods – remain unaffected. In all other respects, the regulations in the general information apply.

We have no influence on the storage duration of your data that is stored by the social network operators for their own purposes. For details, please contact the social network operators directly (e.g. in their data protection declaration, see below).

Social media sites in detail

1. Facebook and Instagram

We have a profile on Facebook at https://www.facebook.com/Leuphana/ and on Instagram at www.instagram.com/leuphana/. The provider of both social networks is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc., 1601 Willow Rd, Menlo Park CA 94025, USA, hereinafter referred to as “Meta”.

We have an agreement with Meta regarding joint responsibility for the processing of data (Controller Addendum). This agreement determines which data processing operations we or Facebook are responsible for when you visit our Facebook profile. The Controller Addendum can be viewed at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum

For details, please refer to the Meta privacy policy on Facebook or Instagram:

https://www.facebook.com/about/privacy/

https://help.instagram.com/519522125107875

2. YouTube

We have a channel or profile on the video platform YouTube, available at https://www.youtube.com/channel/UC9RGFj6J1yCTLrz7EAdClcA, which we use to provide video content. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, hereinafter referred to as “Google” or “YouTube”.

For details, please refer to the YouTube privacy policy:

https://www.youtube.com/t/terms

3. Vimeo

We also have a channel or profile on the video platform Vimeo, available at vimeo.com/leuphana, through which we provide video content. Vimeo is an offer from Vimeo.com Inc., 555 West 18th Street, New York, New York 10011, USA and is operated by the provider on its own responsibility.

For details on how Vimeo processes your data, please refer to Vimeo's privacy policy:

https://vimeo.com/privacy.

4. Twitter

We also have a profile on the short message service Twitter, available at twitter.com/Leuphana. Twitter is a service provided by Twitter International Company, One Cumberland Place, Fenian Street Dublin 2, D02 AX07 Ireland, a subsidiary of Twitter Inc., 1355 Market Street #900, San Francisco, California 94103, USA, hereinafter referred to as “Twitter”.

There is an agreement with Twitter regarding joint responsibility for the processing of data (Controller to Controller Data Protection Addendum). This determines which data processing operations we or Twitter are responsible for when you visit our Twitter page. The Controller to Controller Data Protection Addendum can be viewed at the following link:

gdpr.twitter.com/en/controller-to-controller-transfers.html&nbsp

For details, please refer to Twitter's privacy policy:

https://twitter.com/de/privacy

5. XING

We have a group on the social network XING, which can be accessed at https://www.xing.com/communities/groups/offizielle-gruppe-der-leuphana-universitaet-lueneburg-c974-1071385. XING is provided by New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany.

For details, please refer to XING's privacy policy:

https://privacy.xing.com/de/datenschutzerklaerung

6. LinkedIn

We have a profile on the social network LinkedIn, which can be accessed at https://www.linkedin.com/school/universitat-luneburg?pathWildcard=600057. LinkedIn is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

We have entered into an agreement with LinkedIn for joint responsibility when processing data (Page Insights Joint Controller Addendum). This agreement determines which data processing operations we or LinkedIn are responsible for when you visit our LinkedIn page. The agreement can be viewed at the following link:

https://legal.linkedin.com/pages-joint-controller-addendum

For details, please refer to the LinkedIn privacy policy:

https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

General information

Even if you do not exercise any of your rights as described below, we will only store your data for as long as is necessary for the purposes mentioned above. Log files are generally stored for a maximum of seven days. The specified storage periods do not apply if, in deviation from them, a longer storage or retention period is required by law or is necessary for law enforcement within the statutory limitation periods. If data is only stored for the aforementioned purposes, data access is restricted to the extent necessary for these purposes.

Unless we have provided you with any information to the contrary, we generally keep your data to ourselves and only make it available to those employees who need it to perform their duties. This does not apply if we are legally obliged to pass it on.

To ensure that your data is transmitted securely, all data is encrypted using a TLS certificate.

We would like to inform you that the provision of your data is not required by law or contract. If you do not provide your data, this may mean that the website cannot be displayed to you or can only be displayed to you in a limited way.

Automated decision-making, including profiling within the meaning of Article 22(1) and (4) GDPR, does not take place.

Transfer to third countries

We would like to point out that when using optional services on our site or when using our social media sites, user data may be processed outside the European Union. In particular, there is a possibility that data may be stored on servers in the United States or that security authorities may access the data at subsidiaries of US parent companies. In such cases, there is a possibility that your data may be processed by US authorities in exceptional cases.

This may result in risks for you, because, for example, it could make it more difficult to enforce your rights, as there are insufficient official or judicial legal protection options against such processing. Furthermore, there are no specific guarantees under Art. 46 f. GDPR to compensate for any deficits. For these reasons, the European Court of Justice has deemed the level of data protection in the USA to be insufficient, measured against the EU standards of the GDPR.

Use of the services affected in this way will therefore only take place in view of the exceptional transfer to a non-European third country with your consent in accordance with Art. 49 (1) (a) GDPR. Your consent or refusal will be stored in a cookie set by us. You can revoke your selection at any time with effect for the future by clicking on “Cookie Settings” at the bottom of our website.

Your right to object in accordance with Art. 21 DSGVO

If we process your data on the basis of tasks in the public interest on the legal basis of Art. 6 (1) sentence 1 letter e), you have the right to object to the processing of personal data concerning you at any time for reasons arising from your particular situation; this also applies to profiling based on Art. 6 (1) sentence 1 letter e) DSGVO within the meaning of Art. 4 No. 4 GDPR.

In this case, we will no longer process this data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims.

Your right of withdrawal in accordance with Art. 7 para. 1 sentence 1 GDPR

If we process your data on the basis of your consent, you have the right to revoke your consent at any time with effect for the future. This means that the lawfulness of the processing that has taken place on the basis of the consent until revocation is not affected. The declaration of revocation can be made informally and does not require any justification. You can revoke your selection at any time via “Cookie Settings” at the bottom of our website. If you revoke your consent, you will not suffer any disadvantages as a result.

Your other rights:

You have the right to request information from us about the processing of data concerning you. In addition to a copy of the data, this right to information also includes the purposes of the data processing, the data recipients and the storage period.

If incorrect data is processed, you can demand that we correct this data immediately. If the legal requirements according to Art. 17 or 18 GDPR are met, you also have the fundamental right to the immediate deletion or restriction of the processing of the data. Please note that restricted processing of the data may not be possible under certain circumstances.

Furthermore, you can exercise your right to data portability under the conditions of Art. 20 GDPR.

You can also assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) in the case of joint responsibility, e.g. with regard to our social media presence, against the operator of the respective service with which we are jointly responsible (e.g. against Facebook). We therefore ask you to initially address any inquiries regarding the assertion of your rights to the respective platform provider.

Otherwise, to assert your rights, please contact:

Leuphana University Lüneburg
Thomas Puls
Universitätsallee 1
21335 Lüneburg
E-mail: thomas.puls@leuphana.de

If you have any further questions, please do not hesitate to contact our data protection officer.

You can also contact a competent data protection authority with complaints regarding data protection.