Privacy Information

on the collection of personal data in the context of the use of your personal data in accordance with Art. 13 General Data Protection Regulation (GDPR)

1. Who is responsible and how can I contact you?

Responsible for processing your personal data according to Art. 4 para. 7 of the GDPR is D4L data4life gGmbH, c/o Digital Health Cluster (DHC) im Hasso-Plattner-Institut (HPI), Rudolf-Breitscheid-Straße 187, 14482 Potsdam, Germany, media@data4life.care.

(following: “Data4Life”)

You can also contact our data protection officer (DPO) by email (dataprotection@data4life.help) or by sending a letter to the controller’s postal address (to the attention of "the data protection officer").

2. What is Data4Life doing with your personal data?

This privacy information informs you about the processing details when you decide to consent to one or more of the following:

Allow Data4Life using your pictures for Social Media and Data4Life’s websites (“Usage of pictures for Social Media and Website”)
Allow Data4Life using your pictures and/or video recordings for internal uses at Data4Life (“Internal usage of pictures at Data4Life”)
Allow Data4Life using your pictures for communication purposes to externals or (potential) partners (“Usage of pictures in materials for externals and potential partners”)

3. Why is Data4Life allowed to process your personal data?

The legal basis for the use of your personal data, e. g. pictures, audio and video recordings is your consent (Art. 6 para. 1 sentence 1 lit. a in conjunction with Art. 9 para. 2 lit. a GDPR).

4. Why does Data4Life process your personal data?

The purpose of processing your data regarding “Usage of pictures for Social Media and Websites” is to make it easier for potential employees and interested parties to gather information about Data4Life.

The purpose of processing your personal data regarding “Internal usage of pictures at Data4Life” is to visualize and recap Data4Life’s achievements and to create a stronger bond within the company.

The purpose of processing your personal data regarding “Usage of pictures in materials for externals and potential partners” is to establish and strengthen relationships with externals and potential partners.

5. What personal data does Data4Life process?

In case you consent to “Usage of pictures for Social Media and Websites” amongst others the following data is collected: pictures, job titles, names, quotes and comments.

In case you consent to “Internal usage of pictures at Data4Life”, amongst others the following data is collected and shared: pictures, video and audio data, job titles, names, quotes and comments, special categories of personal data (e. g. references to ethnic origin, religion or health).

In case you consent to “Usage of pictures in materials for externals and potential partners” amongst others the following data is collected: pictures, name, job title, quotes and comments.

6. With whom will Data4Life share your personal data?

a. Data4Life

Your pictures, audio and video recordings will be visible by Data4Life’s employees when used in internal presentations, such as the all-hands meetings.

b. Externals and partners

For the purpose of establishing relationships with potential partners or strengthening existing relationships with externals and partners, your personal data might be shared with these parties.

c. Meta

To communicate with the public, Data4Life uses the social network service Instagram. Instagram is a product by the multinational technology company Meta Platforms, Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA. If you are accessing the social network from within the European Union, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, is the responsible entity. Data4Life has concluded EU standard contractual clauses with Meta Platforms to protect your personal data. You can find more information on how Meta Platforms processes your personal data in their privacy policy: https://help.instagram.com/519522125107875/?helpref=uf_share

d. LinkedIn

In order to reach potential employees and communicate with the public in terms of professional networking and career development, Data4Life uses the business and employment-oriented online service LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Data4Life has concluded a data processing agreement pursuant to Art. 28 para. 3 GDPR and EU standard contractual clauses with LinkedIn. You can find more information on how LinkedIn processes your personal data in their privacy policy: https://de.linkedin.com/legal/privacy-policy

e. Twitter

In order to communicate with the public, Data4Life operates the microblogging and social networking service Twitter, Inc., 1355 Market St., Suite 900, San Francisco, CA 94103, USA. If you are accessing the social network service from within the European Union, Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, is the responsible entity. Data4Life has concluded a data processing agreement pursuant to Art. 28 para. 3 GDPR and EU standard contractual clauses with Twitter. You can find more information on how Twitter processes your personal data in their privacy policy: https://twitter.com/en/privacy

f. Confluence

For the purpose of knowledge sharing and making information easily accessible by Data4Life’s employees, Data4Life uses Confluence as a team workspace. Confluence is a product by Atlassian Pty Ltd., Level 6, 341 George Street, Sydney NSW 2000, Australia. Data4Life has concluded a data processing agreement pursuant to Art. 28 para. 3 GDPR and EU standard contractual clauses with Atlassian. You can find more information on how Atlassian processes your personal data in their privacy policy: https://www.atlassian.com/legal/privacy-policy

g. Google Workspace

For the purpose of storing data, for example, pictures or recordings, Data4Life uses Google Workspace as a cloud based application software, cloud storage solution and cloud infrastructure. Google Workspace is a product by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google stores your personal data on servers based in the European Economic Area (EEA). However, Data4Life cannot exclude that Google accesses and therefore transfers your personal data to the United States. Data4Life has concluded a data processing agreement pursuant to Art. 28 para. 3 GDPR and EU standard contractual clauses with Google. You can find more information on how Google processes your personal data in their privacy policy: https://policies.google.com/privacy?hl=en-US

7. Will your personal data be sent outside the European Union?

In order to fulfill the processing purposes listed above, data is also transferred to third parties. This may include the transfer of personal data to European and non-European countries and the storage of data outside the EEA, Switzerland or the United Kingdom.

Insofar as one of the above-mentioned data transfers takes place to a recipient outside the EEA (to so-called "Third Countries"), an adequate level of data protection for the foreign transfer is ensured by appropriate security measures. Such security measures are e. g. Standard Contractual Clauses or Data Protection Agreements, signed with the respective recipients of personal data.

Please note that the processing of your personal data also takes place in the United States of America, among other countries, for which there is no adequacy decision by the Commission. Therefore, the usual level of protection regarding the transfer of personal data granted by the GDPR cannot be guaranteed, as it cannot be excluded that in the third country other parties, for example, authorities, can access the collected data due to local laws and regulations. This may also result in risks for data subjects, because it could make it more difficult to enforce the rights of data subjects.

8. How long does Data4Life store your personal data?

Your personal data will be deleted after you have revoked your given consent.
Pictures in which you are identifiable and which mainly show you will then be removed from Data4Life’s websites as well as Data4Life’s Social Media pages and will no longer be used for further uploads. If you are shown in the picture together with other persons, the picture does not have to be removed, but it is sufficient if you are made unrecognizable in the picture (for example, by pixelation). If you are shown in the picture together with other persons and Data4Life does not want to use the option of pixelation, but wants to replace it directly with a new picture (for example, because the picture has a special significance for the website), the deadline for replacing the picture is one month.

Whenever you don’t revoke your consent, your personal data will be deleted as soon as it is no longer required for the above mentioned specified purposes. Data4Life will store your personal data as following:

Personal data for internal uses at Data4Life: 2 years
Presentations for externals: 3 years
Personal data on Social Media and websites: 3 years

9. What rights do you have?

As a data subject you have the following rights regarding the GDPR:

Right of access (Art. 15 GDPR)
Right of rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to object of processing (Art. 21 GDPR)
Right to data portability (Art. 20 GDPR)

You also have the right to revoke your given consent at any time. Please note that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. Insofar as another legal basis exists for the further processing of my data, e. g. pending legal disputes, Data4Life is entitled to such. Otherwise, my data will be deleted upon revocation of consent.

Furthermore you also have the right to complain to a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement if you consider that the processing of personal data related to you is unlawful.

The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

Telephone: 0049 (0)33203/356-0
Telefax: 0049 (0)33203/356-49
Email: poststelle@lda.brandenburg.de

Last updated: April 2023