on the collection of personal data in the context of the use of your personal data in accordance with Art. 13 General Data Protection Regulation (GDPR)
1. Who is responsible and how can I contact you?
Responsible for processing your personal data according to Art. 4 para. 7 of the GDPR is D4L data4life gGmbH, c/o Digital Health Cluster (DHC) im Hasso-Plattner-Institut (HPI), Rudolf-Breitscheid-Straße 187, 14482 Potsdam, Germany, email@example.com.
You can also contact our data protection officer (DPO) by email (firstname.lastname@example.org) or by sending a letter to the controller’s postal address (to the attention of "the data protection officer").
2. What is Data4Life doing with your personal data?
This privacy information informs you about the processing details when you decide to consent to one or more of the following:
- Allow Data4Life using your pictures for Social Media and Data4Life’s websites (“Usage of pictures for Social Media and Website”)
- Allow Data4Life using your pictures and/or video recordings for internal uses at Data4Life (“Internal usage of pictures at Data4Life”)
- Allow Data4Life using your pictures for communication purposes to externals or (potential) partners (“Usage of pictures in materials for externals and potential partners”)
3. Why is Data4Life allowed to process your personal data?
The legal basis for the use of your personal data, e. g. pictures, audio and video recordings is your consent (Art. 6 para. 1 sentence 1 lit. a in conjunction with Art. 9 para. 2 lit. a GDPR).
4. Why does Data4Life process your personal data?
The purpose of processing your data regarding “Usage of pictures for Social Media and Websites” is to make it easier for potential employees and interested parties to gather information about Data4Life.
The purpose of processing your personal data regarding “Internal usage of pictures at Data4Life” is to visualize and recap Data4Life’s achievements and to create a stronger bond within the company.
The purpose of processing your personal data regarding “Usage of pictures in materials for externals and potential partners” is to establish and strengthen relationships with externals and potential partners.
5. What personal data does Data4Life process?
In case you consent to “Usage of pictures for Social Media and Websites” amongst others the following data is collected: pictures, job titles, names, quotes and comments.
In case you consent to “Internal usage of pictures at Data4Life”, amongst others the following data is collected and shared: pictures, video and audio data, job titles, names, quotes and comments, special categories of personal data (e. g. references to ethnic origin, religion or health).
In case you consent to “Usage of pictures in materials for externals and potential partners” amongst others the following data is collected: pictures, name, job title, quotes and comments.
6. With whom will Data4Life share your personal data?
Your pictures, audio and video recordings will be visible by Data4Life’s employees when used in internal presentations, such as the all-hands meetings.
b. Externals and partners
For the purpose of establishing relationships with potential partners or strengthening existing relationships with externals and partners, your personal data might be shared with these parties.
g. Google Workspace
7. Will your personal data be sent outside the European Union?
In order to fulfill the processing purposes listed above, data is also transferred to third parties. This may include the transfer of personal data to European and non-European countries and the storage of data outside the EEA, Switzerland or the United Kingdom.
Insofar as one of the above-mentioned data transfers takes place to a recipient outside the EEA (to so-called "Third Countries"), an adequate level of data protection for the foreign transfer is ensured by appropriate security measures. Such security measures are e. g. Standard Contractual Clauses or Data Protection Agreements, signed with the respective recipients of personal data.
Please note that the processing of your personal data also takes place in the United States of America, among other countries, for which there is no adequacy decision by the Commission. Therefore, the usual level of protection regarding the transfer of personal data granted by the GDPR cannot be guaranteed, as it cannot be excluded that in the third country other parties, for example, authorities, can access the collected data due to local laws and regulations. This may also result in risks for data subjects, because it could make it more difficult to enforce the rights of data subjects.
8. How long does Data4Life store your personal data?
Your personal data will be deleted after you have revoked your given consent.
Pictures in which you are identifiable and which mainly show you will then be removed from Data4Life’s websites as well as Data4Life’s Social Media pages and will no longer be used for further uploads. If you are shown in the picture together with other persons, the picture does not have to be removed, but it is sufficient if you are made unrecognizable in the picture (for example, by pixelation). If you are shown in the picture together with other persons and Data4Life does not want to use the option of pixelation, but wants to replace it directly with a new picture (for example, because the picture has a special significance for the website), the deadline for replacing the picture is one month.
Whenever you don’t revoke your consent, your personal data will be deleted as soon as it is no longer required for the above mentioned specified purposes. Data4Life will store your personal data as following:
- Personal data for internal uses at Data4Life: 2 years
- Presentations for externals: 3 years
- Personal data on Social Media and websites: 3 years
9. What rights do you have?
As a data subject you have the following rights regarding the GDPR:
- Right of access (Art. 15 GDPR)
- Right of rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to object of processing (Art. 21 GDPR)
- Right to data portability (Art. 20 GDPR)
You also have the right to revoke your given consent at any time. Please note that the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. Insofar as another legal basis exists for the further processing of my data, e. g. pending legal disputes, Data4Life is entitled to such. Otherwise, my data will be deleted upon revocation of consent.
Furthermore you also have the right to complain to a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement if you consider that the processing of personal data related to you is unlawful.
The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht
Stahnsdorfer Damm 77
Telephone: 0049 (0)33203/356-0
Telefax: 0049 (0)33203/356-49
Last updated: April 2023