Privacy policy

Information about how we process your personal data and your rights under data protection law is provided below.

§ 1 Who is the data controller and how can I contact the data protection officer?

The data controller is:

Alexander von Humboldt Foundation
Jean-Paul-Str. 12
53173 Bonn
GERMANY

Tel.: (+49) 0228-833-0
Fax: (+49) 0228-833-199
Email: info[at]avh.de
Represented by: Dr Markus Zanner

You can contact our data protection officer using the above contact details or at: Datenschutzbeauftragter[at]avh.de

§ 2 What is the purpose and the legal basis for processing my data?

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR), Germany's Federal Data Protection Act (BDSG) and all other relevant laws to the extent that this is necessary for providing the information on this website and our services on this website.

If you use this website for information purposes only – in other words, you do not log in or register to use the website or send us any other information – we do not collect any personal data. The only data we collect is the data sent by your browser that makes your visit to the website possible. This consists of:

• IP address
• date and time of request
• time zone difference to Greenwich Mean Time (GMT)
• content of request (specific page)
• access status/HTTP status code
• volume of data transferred in each case
• website from which the request was directed
• browser
• operating system and its interface
• language and version of the browser software.

The above data is stored in log files to ensure the functionality of the website. This data is also used to ensure the security of our IT systems and for website optimisation.

Art.  6 Section 1 sentence 1 lit f GDPR provides the legal basis for the temporary storage of data and log files.

§ 3 Data security

We maintain the latest technical measures to ensure data security, in particular to protect your personal data from risks during data transfer and from third-party access. These measures are kept updated to reflect the state of the art.

§ 4 etracker

The provider of this website uses the services of etracker GmbH, Hamburg, Germany (www.etracker.com) to analyse usage data. We do not use cookies for web analysis by default. If we use analysis and optimisation cookies, we will obtain your explicit consent separately in advance. If this is the case and you agree, cookies are used to enable statistical range analysis of this website, a measurement of the success of our online marketing measures and test procedures, e.g. to test and optimise different versions of our online offer or its components. Cookies are small text files that are stored by the Internet browser on the user's device. etracker cookies do not contain any information that could identify a user.

The data generated by etracker on behalf of the provider of this website is processed and stored by etracker solely in Germany and is thus subject to the strict German and European data protection laws and standards. In this regard, etracker has been independently checked, certified and awarded the ePrivacyseal data protection seal of approval.

Data processing is based on Art.  6 Section  1 lit f (legitimate interest) of the General Data Protection Regulation (GDPR). Our legitimate interest as defined by the GDPR is the optimisation of our online presence and our website. As the privacy of our visitors is very important to us, any data that could allow the identity of an individual to be inferred, such as the IP address, log-in or device IDs, is anonymised or pseudonymised as soon as possible. etracker does not use the data for any other purpose, combine the data with any other data or share the data with third parties.

You can object to the data processing outlined above at any time. Your objection has no disadvantageous consequences.

More information about etracker and data protection can be found here.

§ 5 My Humboldt

As a user of our website, you have the option of registering on our website. To do so, your personal data must be provided. The data entered in a form is then transferred and stored. The data is not shared with third parties at any time. As part of the registration process or at the time of registration, the following data is stored:

• user's IP address
• time of registration (date and time)
• surname, first name, email address and, if applicable, user name

If you have consented to data processing, the legal basis is Art.  6 Section 1 sentence 1 lit a GDPR. If registration is necessary for performance of a contract to which you are party or registration data is necessary in order to take steps prior to entering into a contract, Art. 6 Section 1 sentence 1 lit b GDPR is the legal basis for data processing.

Registration may be necessary for three reasons: As a user, your registration may be required for the provision of certain content and services on our website, for the performance of a contract or for taking steps prior to entering into a contract.

As soon as the data is no longer necessary to achieve the original purpose for which it was collected, it is deleted. Data collected during a registration process is deleted when the registration is cancelled or modified on the website. Data stored as part of registration for the performance of a contract or for taking steps prior to entering into a contract is deleted when it is no longer necessary for performing the contract.

To comply with statutory and contractual obligations, it may also be necessary to store a contracting partner's personal data after a contract is established.

You can amend the data stored about you at any time and you can end your registration at any time.

You can revoke your consent to having your data processed for registration purposes at any time. To do so, you can send a message to the above contact details. You will then no longer be able to use pages that require registration. Such revocation has no impact on the lawfulness of data processing operations already carried out.

§ 6 Newsletter

You can sign up to our newsletter by giving your consent. The newsletter keeps you updated on interesting current programmes. The information contained in the newsletter is outlined in the declaration of consent.

We use the  'double opt-in' process for subscribing to our newsletter. Once you have entered your email address, you will receive a confirmation email to the address you have entered, asking for confirmation that you wish to receive the newsletter. If you confirm that you wish to receive the newsletter, we store your email address until you unsubscribe from the newsletter. Your email address is stored only for the purpose of sending you the newsletter. When you sign up and provide your confirmation, we store your IP address and the time of the sign-up in order to prevent your personal data from being misused.

The only data you must provide to receive the newsletter is your email address. Other, separately marked data can be provided voluntarily. This is used only for individualising the newsletter. This data is also deleted in full when you unsubscribe.

You can revoke your consent to receiving the newsletter at any time. You can do so by clicking the link that is provided in every newsletter email. Such revocation has no impact on the lawfulness of data processing operations already carried out. The data you have entered is shared with the provider rapidmail GmbH.

Please note that we analyse your user behaviour when we send you a newsletter. For this analysis, the emails that are sent contain web beacons, also known as tracking pixels. These are one-pixel image files that link to our website, thus allowing us to analyse your user behaviour. This is done by collecting the data outlined and through web beacons that are associated with your email address and a unique ID. Links contained in the newsletter also contain this ID. Using the data obtained in this way, we create a user profile so we can tailor the newsletter to your interests. We record when you read our newsletter and the links you click in the newsletter, and from this information infer your personal interests. We link this data with actions you make on our website.

The newsletter provider stores the information collected in this way on its server in Germany. Such tracking is not possible if you have disabled the display of images in your email programme by default. In this case, however, the newsletter will not be displayed to you in full and you may not be able to use all the functions. If you manually allow images to be displayed, the tracking outlined above takes place.

Your consent in accordance with Art.  6 Section 1 sentence 1 lit a GDPR forms the legal basis for the processing of data after signing up for the newsletter. As soon as the data is no longer necessary to achieve the purpose for which they were collected, it is deleted. The data of newsletter subscribers are therefore only stored for the duration of their subscription.

§ 7 Contacting us

You can contact us by post, phone, fax or email.

If you contact us by post, we may process, in particular, your address details, the date and time your letter is received and any data provided in your letter. If you contact us by phone, we process in particular your phone number and, if asked during the conversation, your name, your email address, the time of your call and details of your enquiry. If you contact us by fax, we process in particular your fax number or the sender ID and the data provided in the fax. If you contact us by email, we process in particular your email address, the time of your email and any data provided in the message text (including any attachments).

The purpose of processing the above data is to handle your enquiry and to be able to contact you in response.

The legal basis for the processing of personal data outlined here is Art.  6 Section 1 sentence 1 lit f GDPR. It is in our legitimate interest to enable you to contact us at any time and to be able to respond to your queries. The personal data is processed in this context only for as long as this is necessary for handling the enquiry.

You can revoke your consent at any time by sending a message to the above contact details. However, no further communication with you can then be made, as all personal data stored in relation to your enquiry will be deleted in this case.

§ 8 Use of social media

We operate our social media pages to achieve an online presence that is as comprehensive as possible, to provide information on current topics as part of ongoing communication, to publish job vacancies and to adjust our services to the needs of users. This constitutes a legitimate interest as defined in Art. 6 Section 1 sentence 1 lit f GDPR. If you follow or otherwise interact with our company page in a professional network, such as LinkedIn, the networks process your personal data from your profile and enable us to access the statistics on interaction with the page. We have no control over this. We obtain no personal data from the platform operators and cannot infer the identity of any specific individuals. This analysis is used to continuously adjust our services to the needs of users. Where we share your posts or respond to them, we may process your user name and the corresponding content; we have no control over this.

The analysis processes initiated by the social networks may involve other legal bases, which the operators of the social networks must specify (e.g. consent as defined in Art.  6 Section 1 sentence 1 lit a GDPR). Social networks, such as Facebook, are usually able to extensively analyse your user behaviour when you visit their website or a website with integrated social media content (e.g. Like buttons or advertising banners). If you are logged in to your social media account when you visit our social media pages, the operator of the social media portal can associate this visit with your user account. In certain circumstances, however, your personal data can also be collected if you are not logged in or have no account with that particular social media portal. In this case, data is collected for example by collecting your IP address using cookies that are stored on your device. Using data collected in this way, operators of social media portals can create user profiles, in which your preferences and interests are stored. If you have an account with that particular social network, advertising related to your interests can be displayed on all devices where you are or were logged in.

As a rule, we are responsible for data processing operations together with the operator of the social network in question as defined in Art. 26 GDPR. You can assert your rights (right of access under Art. 15 GDPR, right to rectification under Art. 16 GDPR, right to erasure under Art. 17 GDPR, right to restriction of processing under Art. 18 GDPR, right to data portability under Art. 20 GDPR and right to lodge a complaint under Art. 77 GDPR) both against us and against the operator of the social media network in question. Please note that, despite joint controllership under Art. 26 GDPR with the operators of social networks, we have no comprehensive control over the data processing or the assertion of data subject rights against the social networks. In order to assert your data subject rights, please contact the operator of the social network in question directly. If you address your enquiry to us, we will forward this to the respective operator.

Data that we have collected directly are deleted from our systems as soon as the purpose for the storage of this data no longer exists, you ask us to delete the data or object or withdraw your consent. Stored cookies remain on your device until you delete them. Statutory provisions, in particular periods of retention, remain unaffected. We have no knowledge of and no control over the duration for which your data is stored by the operators of social networks for their own purposes. For details about the storage duration, please refer directly to the operators of the social networks.

Depending on the operator, other processing operations may be carried out by operators of social media portals, including in the US and other third countries. You can find details on this in the terms of use and privacy policies of the respective social media portals:

1. Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy
2. Bluesky, https://bsky.social/about/support/privacy-policy
3. LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Privacy policy: www.linkedin.com/legal/privacy-policy; Joint controllership: legal.linkedin.com/pages-joint-controller-addendum; Opting out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

You can object at any time by sending a message to the above contact details. You may then not be able to use all the functions of the website. Alternatively, you can also contact us using the contact channels indicated on the website.

§ 9 Embedding of YouTube videos

We have embedded YouTube videos in our website that are stored at www.YouTube.com and can be played directly from our website. These have all been embedded in advanced data protection mode', i.e. no data about you, the user, is sent to YouTube if you do not play the videos. The data listed in section 2 above is not transferred until you play the videos. We have no control over this data transfer.

By visiting the website, YouTube is informed that you have accessed the corresponding subpage of our website. The data listed in section 2 of this privacy policy is also sent. This happens regardless of whether the third-party provider provides a user account through which you have logged in, or whether there is no user account. If you are logged in to Google, this data is associated directly with your account. If you do not want your visit to be associated with your YouTube profile, you must log out before activating the button.

YouTube stores your data as usage profiles and uses these profiles for advertising and market research purposes and/or for customising its website. Such analysis is carried out in particular (even for users that are not logged in) to provide tailored advertising and to inform other users of the social network about your activities on our website.

The legal basis for the processing of users' personal data is Art.  6 Section 1 sentence 1 lit a GDPR. Details of the third-party provider: Google/YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube also processes your personal data in the USA. An adequacy decision is in place for the USA. Google LLC/YouTube LLC is also a company certified under the EU-US Data Privacy Framework.

You can opt out at any time by sending a message to the above contact details. You may then not be able to use all the functions of the website.

§ 10 Embedding of Google Maps

We use the service Google Maps. This enables us to show you interactive maps directly on the website and facilitates your convenient use of the map functions.

By visiting the website, Google is informed that you have accessed the corresponding subpage of our website (including your IP address). This happens regardless of whether Google provides a user account through which you have logged in, or whether there is no user account. If you are logged in to Google, this data is associated directly with your account. If you do not want your visit to be associated with your Google profile, you must log out before activating the button.

Google stores this data as usage profiles and uses these profiles for advertising and market research purposes and/or for customising its website. Such analysis is carried out in particular (even for users that are not logged in) to provide tailored advertising and to inform other users of the social network about your activities on our website.

You can revoke your consent to having your data processed at any time via the cookie banner settings. Such revocation has no impact on the lawfulness of data processing operations already carried out. You may then not be able to use all the functions of the website.

Details of the third-party provider: Google LLC, 1600 Amphitheater Parkway, Mountainview, California 94043, USA; www.google.de/intl/de/policies/privacy and policies.google.com/technologies/product-privacy. Google also processes your personal data in the USA. An adequacy decision is in place for the USA. Google LLC is also a company certified under the EU-US Data Privacy Framework.

§ 11 Links

On our website, we provide links to external sites in order to offer you access to further information. Where links are clicked, your IP address is sent to the site operator. The provided links change continuously, so a detailed list of links is not included in the following. However, please observe the privacy policies of each site. You use the provided links on a voluntary basis, hence the legal basis for this is Art. 6 Section 1 sentence 1 lit f GDPR. We have no control over possible further processing by the above companies.

You can object at any time by sending a message to the above contact details. You may then not be able to use all the functions of the website.

§ 12 Children

We collect no personal information relating to minors. If this is collected unwittingly, we delete it without delay.

§ 13 Recipients of personal data

We share personal data with our data processors. These include:

• data centres
• IT service providers

Personal data can be shared with our IT service providers in order to provide this website. In this context, the information listed in section 2 is usually shared.

As part of the remote maintenance of standard IT components, situations cannot be ruled out in which, for the purpose of troubleshooting individual cases, an IT service provider from a third country (e.g. USA) is given controlled and restricted access to personal data in rare cases. Personal data is sent to service providers outside the European Economic Area (EEA) only if an adequate level of security has been confirmed for the third country by the European Commission or other adequate data protection guarantees (e.g. binding company-internal data protection rules or EU standard contractual clauses) are in place.

If the prerequisites are given, we share personal data with law enforcement authorities.

§ 14 How long will my personal data be stored?

Your personal data is processed until the purposes outlined above have been achieved. The data is deleted as soon as it is no longer necessary for the purposes on which the processing is based. Log data is anonymised after 9 months and cookie information after 18 months. Once we have handled your enquiry through the contact form and no contractual relationship results from said enquiry, your data is not processed further and is then deleted.

If, however, you have withdrawn your consent or objected under Art. 21 of the GDPR, your data is also not processed further and then deleted. Once the purpose has been achieved, the above-mentioned data, provided the system permits this, is either deleted or any reference to an individual is removed by anonymisation and access to your data is blocked. We will continue to send you contractual and statutory information for as long as the contract with you is in place and/or we are required by law to do so.

Statutory or contractual retention periods may restrict deletion or blocking of data. Periods of limitation may be up to thirty years on the basis of Section 195 ff of the German Civil Code; the usual period of limitation is three years. In addition, retention periods stipulated under tax law, commercial law, public charges law and other laws must be observed. The periods specified in these laws for retention/documentation are six to eight years plus the period of limitation for assessment of a further five years. In order not to violate statutory rules and lose the ability to enforce a claim or defend against a claim, we reserve the right to delete the data only after the last period authorising data storage has expired.

§ 15 Is there any automated decision-making or profiling?

No automated decision-making or profiling takes place in the data processing relating to the use of our website. We have no control over automated decision-making or profiling by external service providers.

§ 16 Do I have to provide my personal data?

When using our website and the application options contained therein, you are required neither by contract nor by law to provide your personal data to us. You use our website and the services offered therein on a voluntary basis, so not providing your data has no adverse legal consequences for you.

If you use our website for information purposes only, you do, however, provide us with the data listed in section 2 that your browser provides.

If you contact us using the contact channels set out above via a contact form, email, letter, fax or phone, we process your personal data in order to associate your enquiry with you and to handle your enquiry. If you send us enquiries as part of an existing contract, data processing is necessary on the basis of the contract in place with you. The legal basis for data processing is therefore Art. 6 Section 1 sentence 1 lit b GDPR. If you are unable to provide us with this data, we cannot process your enquiry.

§ 17 What rights under data protection law do I have as a data subject?

You have the right:

• under Art. 7 Section 3 GDPR to revoke your consent at any time. This means that we will not be permitted to continue the data processing based on this consent in the future. Such revocation has no impact on the lawfulness of data processing operations already carried out.
• under Art. 15 GDPR to obtain access at any time to the personal data we process about you. In particular, you can obtain access to the purposes of the processing, the category of the personal data and its source, the categories of recipients to whom your data has been or will be disclosed, and the purpose and the intended storage duration, the existence of a right to request rectification, erasure, restriction of processing or to object, the existence of a right to lodge a complaint, the source of your data where it is not collected by us, and the existence of automated decision-making, including profiling, and, if applicable, any meaningful information about the details of such processes,
• under Art. 16 GDPR to request the rectification of inaccurate or the completion of personal data we store about you without undue delay,
• under Art. 17 GDPR to request the deletion of personal data we store about you, provided the processing is not necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence against legal claims,
• under Art. 18 GDPR to request the restriction of processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful but you refuse deletion and we no longer need the data but you need it for the establishment, exercise or defence against legal claims or you have objected under Art. 21 GDPR against the processing,
• under Art. 20 GDPR to receive the personal information which you have provided to us in a structured, commonly used and machine-readable format or to have your personal information transmitted to another controller.

Please direct any requests for information, access or objections to data processing to the above contact details.

§ 18 Can I object to processing?

Under Art. 21 Section 1 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 Section 1 sentence 1 lit f GDPR. We will then no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence against legal claims.

You can object at any time by sending a message to the above contact details.

§ 19 Can I file a complaint?

If you believe that our processing of your personal data is unlawful or could violate data protection law for other reasons, you can file a complaint with a supervisory authority. You can contact a supervisory authority in the Member State where you live or work, or where the alleged violation has occurred.