Privacy

Responsible

Dr. Matthias Lauterbach
(Chairman of the supporting association Musica innova e.V.)
Leisewitzstrasse 26
D 30175 Hannover
lauterbach@musica-innova.com

Authorised representatives

Helge Burggrabe and Elisabeth Bremekamp
+49 171 273 32 08
contact@human-project.net

Imprint

https://human-project.net/impressum/

Relevant legal bases

Relevant legal basis according to the DSGVO: Below you will find an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

  • Consent (Art. 6 para. 1 p. 1 lit. a) DSGVO) – The data subject has given consent to the processing of personal data relating to him or her for a specific purpose or purposes.
  • Contract performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO) – The processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the data subject’s request.
  • Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO) – Processing is necessary for the purposes of the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, the processing for other purposes and the transmission as well as automated decision-making in individual cases including profiling. Furthermore, data protection laws of the individual federal states may apply.

Overview of the processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Inventory data
  • Payment data
  • Location data
  • Contact details
  • Content data
  • Contract data
  • Usage data
  • Meta, communication and procedural data

Categories of persons concerned

  • customers
  • interested parties
  • communication partner
  • users
  • members
  • Business and Contractual Partners

Purposes of the processing

  • Provision of contractual services and customer service
  • Contact requests and communication
  • Security measures
  • Direct marketing
  • Reach measurement
  • Managing and responding to requests
  • feedback
  • marketing
  • profiles with user-related information
  • provision of our online offer and user friendliness
  • Information technology infrastructure

Security measures

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, entry into, disclosure of, assurance of availability of and segregation of the data. We also have procedures in place to ensure the exercise of data subjects’ rights, the deletion of data and responses to data compromise. Furthermore, we already take the protection of personal data into account in the development or selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

TLS encryption (https): In order to protect your data transmitted via our online offer, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements that serve to protect your data with the recipients of your data.

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements that serve to protect your data with the recipients of your data.

International data transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is only done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer (see Art. 49 of the GDPR), we only process or leave the data in third countries with a recognised level of data protection (Art. 45 of the GDPR), in the presence of and compliance with contractual obligations through so-called standard protection clauses of the EU Commission (Art. 46 of the GDPR) or in the presence of certifications or binding internal data protection regulations (see Art. 44 to 49 of the GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Trans-Atlantic Data Privacy Framework (TADPF): Within the framework of the so-called “Trans-Atlantic Data Privacy Framework” (TADPF), the EU Commission has also recognised the level of data protection for certain companies from the USA. The list of certified companies as well as further information on the TADPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). Information in German and other languages can be found on the website of the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_de We also inform you about the companies we use that are certified under the Trans-Atlantic Data Privacy Framework.

Use of cookies

Cookies are small text files or other memory tags that store information on end devices and read information from the end devices. For example, to store the login status in a user account, a shopping cart content in an e-shop, the content accessed or functions used of an online offer. Cookies can also be used for various purposes, e.g. for purposes of functionality, security and convenience of online offers as well as the creation of analyses of visitor flows.

Consent Notes: We use cookies in accordance with the law. Therefore, we obtain prior consent from users, except when it is not required by law. In particular, consent is not required if the storage and reading of information, including cookies, is absolutely necessary in order to provide the user with a telemedia service (i.e., our online offering) expressly requested by the user. The strictly necessary cookies usually include cookies with functions related to the display and operability of the online offer , load balancing, security, storage of users’ preferences and choices or similar purposes related to the provision of the main and secondary functions of the online offer requested by the users. The revocable consent will be clearly communicated to the users and will contain the information about the respective cookie use.

Notes on the legal basis for data protection: The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is their declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in a business operation of our online offer and improvement of its usability) or, if this is done in the context of the fulfillment of our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which we process the cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his end device (e.g. browser or mobile application).
  • Permanent cookies: Persistent cookies: For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.


General information on revocation and objection (so-called “opt-out”): Users can revoke the consent they have given at any time and object to processing in accordance with the legal requirements. For this purpose, users can, among other things, restrict the use of cookies in their browser settings (whereby this may also restrict the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be made via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/ .

  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Consent (Art. 6 para. 1 p. 1 lit. a) DSGVO).



Further guidance on processing operations, procedures and services:

  • Processing of cookie data on the basis of consent: We use a cookie consent management procedure in which the consent of users to the use of cookies, or the processing and providers named in the cookie consent management procedure, can be obtained and managed and revoked by users. Here, the declaration of consent is stored in order not to have to repeat its query and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies), in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. A pseudonymous user identifier is created and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system and end device used; Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a) DSGVO).

Performance of duties under the Articles of Association or the Rules of Procedure

We process the data of our members, supporters, interested parties, business partners or other persons (collectively “data subjects”) if we have a membership or other business relationship with them and perform our tasks and are recipients of services and benefits. In addition, we process the data of data subjects on the basis of our legitimate interests, e.g. when it is a matter of administrative tasks or public relations work.

The data processed in this context, the type, scope and purpose and the necessity of its processing, are determined by the underlying membership or contractual relationship, from which the necessity of any data disclosures also arise (in addition, we refer to required data).
We delete data that is no longer required to fulfill our statutory and business purposes. This is determined according to the respective tasks and contractual relationships. We retain the data for as long as they may be relevant for business processing, as well as with regard to any warranty or liability obligations based on our legitimate interest in regulating them. The necessity of retaining the data is reviewed regularly; in all other respects, the statutory retention obligations apply.

  • Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. e-mail, telephone numbers); contract data (e.g. subject matter of contract, term, customer category).
  • Affected persons: Users (e.g., website visitors, users of online services); members; business and contractual partners.
  • Purposes of processing: Providing contractual services and customer service; contact inquiries and communications; managing and responding to inquiries.
  • Legal basis: Provision of contractual services and customer service; Contact inquiries and communication; Management and response to inquiries.aContractual performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Payment procedure

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions for this purpose (collectively, “payment service providers”).

The data processed by the payment service providers includes inventory data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as the contract, total and recipient-related information. The information is required in order to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. I.e., we do not receive any account or credit card related information, but only information with confirmation or negative information of the payment. Under certain circumstances, the payment service providers transmit the data to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the terms and conditions and the privacy policy of the payment service providers.

The terms and conditions and the data protection notices of the respective payment service providers apply to the payment transactions, which can be accessed within the respective websites or transaction applications. We also refer to these for the purpose of further information and assertion of revocation, information and other data subject rights.

  • Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contract data (e.g., subject matter of contract, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, consent status).
  • Affected persons: Customers; Interested Parties.
  • Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO).

Provision of the online offer and web hosting

We process the users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or terminal device.

  • Types of data processed: Usage data (e.g., web pages visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.).); security measures.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Further guidance on processing operations, procedures and services -. Collection of access data and log files: Access to our online offer is logged in the form of so-called “server log files”. The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used, on the one hand, for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

Blog and publication media

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this data protection notice.

  • Types of data processed: Inventory data (e.g., names, addresses); contact data (e.g., e-mail, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; feedback (e.g. collecting feedback via online form); provision of our online offer and user-friendliness; security measures; administration and response to inquiries.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Contact and request management

When contacting us (e.g. by mail, contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

  • Types of data processed: Contact data (e.g., e-mail, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, consent status).
  • Affected persons: Communication partner.
  • Purposes of processing: Contact requests and communication; managing and responding to requests; feedback (e.g., collecting feedback via online form); providing our online offering and user experience.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, the enforcement of the users’ rights could be made more difficult.

Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, usage profiles can be created based on the usage behavior and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behavior and interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the usage profiles (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the privacy statements and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

  • Types of data processed: Contact data (e.g., e-mail, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, consent status).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online form); marketing.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).



Further guidance on processing operations, procedures and services:

  • Instagram: Social network; Service provider: Meta Platforms Irland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
  • facebook pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not further processing) of data from visitors to our Facebook page (so-called “Fanpage”). This data includes information about the types of content users view or interact with, or the actions they take (see under “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see under “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). Wie in den Facebook-Datenschutzrichtlinien unter “Wie verwenden wir diese Informationen?” erläutert, erhebt und verwendet Facebook auch Informationen, um Seitenbetreibern Analysedienste, so genannte “Page Insights”, zur Verfügung zu stellen, die ihnen Einblicke in die Art und Weise geben, wie Menschen mit ihren Seiten und den mit ihnen verbundenen Inhalten interagieren. Wir haben eine spezielle Vereinbarung mit Facebook getroffen (“Page Insights Information”), https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e. users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority), are not restricted by the agreements with Facebook. Further information can be found in the “Information on Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guaranteeing the level of data protection in the case of processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Shared Accountability Agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint responsibility is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • LinkedIn: Social network; Service provider: LinkedIn Irland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Irland; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Order processing contract: https://legal.linkedin.com/dpa; Standard contractual clauses (guaranteeing the level of data protection in the case of processing in third countries): https://legal.linkedin.com/dpa; Possibility of objection (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plugins and embedded functions and content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These can be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required for the presentation of this content or function. We strive to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer as well as be linked to such information from other sources.

  • Types of data processed: Usage data (e.g., web pages visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, time information, identification numbers, consent status); location data (information about the geographic position of a device or person).
  • Affected persons: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offer and user-friendliness.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Legal text by Dr. Schwenke – please click for more information.

WordPress Cookie Notice by Real Cookie Banner