Provision of website and creation of log files
Description and scope of data processing
Each
time our website is accessed, our system automatically collects data
and information from the computer system accessing the website.
The following data is collected in this process:
- Your IP address (in partially anonymised form, i.e. without the last number block (e.g. 192.168.100.xxx))
- URL of the websites visited
- The type of browser used
- The user's operating system
- Date and time of access
- Search engines used
- Names of files downloaded
- Websites from which the user's system accesses our website
- Websites accessed by the user's system via our website
The
data are also stored in the log files of our system. This does not
apply to the IP addresses of the user or other items of data permitting
assignment of the data to a user. Such data is not stored together with
other personal data of the user. The information processed is stored on
our server at a data centre in Germany. This is the only place where the
personal data of users is stored. Data is not passed on to third
parties.
Legal basis for data processing
Art. 6 Para. 1 Point f of the GDPR serves as legal basis for the temporary storage of data.
Purpose of data processing
Temporary
storage of the IP address by the system is necessary to allow delivery
of the website to the user's computer. For this purpose, the IP address
of the user has to be retained for the duration of the session.
The
purpose of storage in log files is to ensure the functionality of the
website. We also use the data to optimise the website and to guarantee
the security of our IT systems. Evaluation of the data for other
purposes does not take place in this context.
These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 Para. 1 Point f of the GDPR.
Period of retention
The
data is erased as soon as it is no longer required for the fulfilment
of the purpose of its collection. With regard to the collection of data
for provision of the website, this is the case at the end of each
particular session.
With regard to the storage of data in log
files, this will be the case after 14 days at the latest to permit
subsequent tracing of misuse of the website. Storage above and beyond
this is also possible in this connection.
Objection and removal option
The
collection of data for provision of the website and storage of the data
in log files are absolutely essential for operation of the website. To
this extent, no objection option is consequently available to the user.
Use of the VDZ learning platform
Description and scope of data processing
The
central element of this website is our learning platform, with which
every registered user can expand their knowledge about the production of
cement and lime as well as in the field of concrete technology. The
following personal data is only processed via our platform to the extent
necessary for technical and didactic purposes:
- First name and surname
- E-mail address
- User name
- IP-Address
- Address (optional)
- Telephone number (optional)
- Profile picture (optional)
- Learning achievements in the courses
- Browser and operating system used
The
processed information is stored on our server in a data centre in
Germany. Users' personal data is stored there and for administrative
tasks in the VDZ network. It is not passed on to third parties.
Legal basis for data processing
The legal basis for the processing of users' personal data is Art. 6 para. 1 lit. b DSGVO.
Purpose and duration of storage
The
processed data is necessary for registration on the learning platform.
Further personal data on learning success in the individual knowledge
modules is used to monitor the individual success of the respective
user. If a user is inactive for more than two years, the profile is
deactivated. After a further year, the account and all data will be
deleted.
Rights of the data subject
If
your personal data is processed, you are deemed to be the data subject
as defined by the GDPR and you have the following rights vis-à-vis the
data controllers:
Right of access
You have the right to demand information from the data controllers about whether we process personal data affecting you.
If this is the case, you have the right to demand information on the following items from the data controllers:
- The purposes for which the personal data is being processed;
- The categories of personal data being processed;
- The recipients or categories of recipient to whom your personal data has been or is still being disclosed;
- The
envisaged period of retention of your personal data or, if no concrete
information is possible, the criteria used to determine the period of
storage;
- The existence of a right to rectification or erasure of
your personal data, of a right to restriction of processing by the data
controllers or of a right to object to such processing;
- The existence of a right to lodge a complaint with a supervisory authority;
- All available information on the origin of the data if the personal data is not collected from the data subject;
- The
existence of automated decision-making, including profiling in
accordance with Art. 22 Para. 1 and 4 of the GDPR and - at least in such
cases - meaningful information about the logic involved, as well as the
significance and the envisaged consequences of such processing for the
data subject.
You have the right to demand
information on whether your personal data is being transmitted to a
third country or to an international organisation. In this context you
can demand to be informed of the appropriate safeguards in accordance
with Art. 46 of the GDPR relating to transmission.
Right to rectification
Insofar
as your processed personal data is inaccurate or incomplete, you have a
right to rectification and/or completion vis-à-vis the data
controllers. The data controllers are obliged to perform rectification
without delay.
Right to restriction of processing
Given the following prerequisites, you have the right to demand restriction of the processing of your personal data:
- If
you contest the accuracy of your personal data for a period enabling
the data controller to check the accuracy of the personal data;
- If
processing is unlawful and you decline erasure of the personal data and
demand restriction of use of the personal data instead;
- If the
data controller no longer requires the personal data for the purposes of
processing, but you require this data to assert, exercise or defend
legal claims, or
- If you have objected to processing in
accordance with Art. 21 Para. 1 of the GDPR and it has not yet been
established whether the legitimate grounds of the data controllers
override your grounds.
Where processing of your
personal data has been restricted, such data shall - with the exception
of storage - only be processed with your consent or to assert, exercise
or defend legal claims, or for the protection of the rights of some
other natural or legal person, or for reasons of important public
interest of the European Union or of a member state.
If processing
has been restricted on the basis of the above-mentioned prerequisites,
you will be informed by the data controllers before the restriction is
lifted.
Right to erasure
a) Erasure obligation
You
have the right to demand that the data controllers erase your personal
data without delay, and the data controllers are obliged to erase this
data without delay insofar as one of the following grounds applies:
- Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- You
withdraw your consent on which processing in accordance with Art. 6
Para. 1 Point a or Art. 9 Para. 2 Point a of the GDPR was based, and
there is no other legal basis for processing;
- You object to
processing in accordance with Art. 21 Para. 1 of the GDPR and there are
no overriding legitimate grounds for processing, or you object to
processing in accordance with Art. 21 Para. 2 of the GDPR;
- Your personal data has been unlawfully processed;
- Erasure
of your personal data is necessary for compliance with a legal
obligation in accordance with European Union or member state law to
which the data controller is subject;
- Your personal data was
collected in relation to information society services offered in
accordance with Art. 8 Para. 1 of the GDPR.
b) Information to third parties
Where
the data controllers have made your personal data public and are
obliged, in accordance with Art. 17 Para. 1 of the GDPR, to erase this
data, they shall, taking into account the technology available and the
costs of implementation, take reasonable action, also of a technical
nature, to inform data controllers who process the personal data that
you as data subject have demanded that they erase all links to this
personal data as well as copies or replications of this personal data.
c) Exceptions
The right to erasure shall not apply insofar as processing is necessary
- For exercising the right to freedom of expression and information;
- To
comply with a legal obligation which requires processing in accordance
with European Union or member state law to which the data controller is
subject, or for the performance of a task which is in the public
interest or is performed in the exercising of official authority
conferred on the data controller;
- For reasons of public interest
in the area of public health in accordance with Art. 9 Para. 2 Point h
and i as well as Art. 9 Para. 3 of the GDPR;
- For archiving
purposes in the public interest, for scientific or historical research
purposes or for statistical purposes in accordance with Art. 89 Para. 1
of the GDPR, insofar as the right referred to in clause a) is likely to
render impossible or seriously impair the achievement of the objectives
of such processing, or
- To assert, exercise or defend legal claims.
Right to notification
If
you have asserted your right to rectification, erasure or restriction
of processing vis-à-vis the data controllers, they shall be obliged to
notify all recipients to whom your personal data has been disclosed of
this rectification or erasure of data or restriction of processing,
unless this proves to be impossible or is associated with
disproportionate effort.
You have the right to be notified of these recipients by the data controller.
Right to data portability
You
have the right to receive the personal data you have supplied to the
data controllers in a structured, commonly used and machine-readable
format. You also have the right to transmit this data to another data
controller without hindrance by the data controllers to whom the
personal data has been supplied, insofar as
- Processing
is based on consent in accordance with Art. 6 Para. 1 Point a of the
GDPR or Art. 9 Para. 2 Point a of the GDPR or on a contract in
accordance with Art. 6 Para. 1 Point b of the GDPR and
- Processing is carried out by automated means.
In
exercising this right, you additionally have the right to have your
personal data transmitted directly from one data controller to another
data controller, where this is technically feasible. This must not
adversely affect the freedoms and rights of others.
The right to data
portability does not apply to the processing of personal data which is
necessary for the performance of a task which is in the public interest
or is performed in the exercising of official authority conferred on the
data controllers.
Right to object
You have the right, for
reasons arising from your particular situation, to object at any time
to the processing of your personal data performed on the basis of Art. 6
Para 1 Point e or f of the GDPR.
Following your objection, the data
controllers shall no longer process your personal data, unless they can
furnish proof of compelling legitimate grounds for processing which
override your interests, rights and freedoms, or processing serves the
purposes of asserting, exercising or defending legal claims.
If your
personal data is processed for direct marketing purposes, you have the
right to object at any time to the processing of your personal data for
the purposes of such advertising; this also applies to profiling,
insofar as this is in connection with such direct marketing.
If you
object to processing for the purposes of direct advertising, your
personal data will no longer be processed for such purposes.
In the
context of the use of information society services – and notwithstanding
Directive 2002/58/EC – you have the option of exercising your right to
object by automated means using technical specifications.
Right to withdraw data protection declaration of consent
You
have the right to withdraw your data protection declaration of consent
at any time. Withdrawal of consent does not affect the lawfulness of the
processing performed by reason of the consent prior to withdrawal.
Automated individual decision-making, including profiling
You
have the right not to be subject to a decision based solely on
automated processing – including profiling – which produces a legal
effect for you or has a similar significant adverse effect on you. This
does not apply if the decision
- Is necessary for the conclusion or performance of a contract between you and the data Controllers;
- Is
permissible on the basis of European Union or member state law, to
which the data controllers are subject, and such legal provisions
contain appropriate measures for safeguarding your rights and freedoms
as well as your legitimate interests, or
- Is taken with your express consent.
These
decisions must however not be based on special categories of personal
data in accordance with Art. 9 Para 1 of the GDPR, insofar as neither
Art. 9 Para 2 Point a nor g applies and appropriate measures have been
taken to safeguard rights and freedoms as well as your legitimate
interests.
With regard to the cases referred to in (1) and (3),
the data controllers shall take appropriate action to safeguard rights
and freedoms as well as your legitimate interests, which at least
include the right to obtain human intervention on the part of the data
controllers, to express your point of view and to contest the decision.
Right to lodge a complaint with a supervisory authority
Without
prejudice to any other administrative or judicial remedy, you have the
right to lodge a complaint with a supervisory authority, in particular
in the member state of your place of residence, your place of work or
the place of the presumed infringement, if you are of the opinion that
the processing of your personal data contravenes the GDPR.
The
supervisory authority with which the complaint was lodged shall inform
the complainant of the progress and outcome of the complaint, including
the possibility of a judicial remedy in accordance with Art. 78 of the
GDPR.