Stegle Lab

Data Protection

Name and address

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States of the European Union as well as other data protection regulations is: 

  • Oliver Stegle
  • Im Neuenheimer Feld 280
  • 69120 Heidelberg
  • Germany
  • Email: o.stegle@dkfz.de
      

General information on data processing

1. Extent of processing of personal data

We only process the personal data of our users when it is necessary so that we can offer content and services to our users. We primarily utilise consent as the legal basis for processing of personal data. In certain circumstances however, clearly indicated below, alternate legal bases will be used. 

2. Legal basis for the processing of personal data

When we receive consent from you for the processing of your personal data, Article 6 (1) lit. a) GDPR serves as the legal basis. 

If you agree to a contract, it will be necessary to process your personal data in order to fulfil that contract.
If it is required to process your personal data due to a legal obligation to which we are subject, the legal basis will be Article 6 (1) lit. c) GDPR.

3. Erasure of data and retention duration

Your personal data will be deleted when it is no longer required for its intended purpose. This may vary depending on the reason why it has been collected.

The duration of storage for each data type is described below. You may have the legal right to request the deletion of your data prior to the planned retention period, please see the ‘Your rights’ section.

Provision of the Website 

1. Description and scope of data processing

Each time the website is accessed, our system automatically records data and information about the device used to access the site. This is stored as data and log files.
The following data are collected: 

  • (1) Information on the type and version of the browser being used.
  • (2) The visitor’s operating system.
  • (3) The visitor’s internet service provider.
  • (4) The visitor’s IP address.
  • (5) Time and date of retrieval.
  • (6) Websites from which the visitor’s system accesses our website (for example, if our website was accessed via a link from another website).

2. Legal basis for data processing 

The legal basis for the temporary storage of data and log files is Article 6 (1) lit. f) GDPR. 

3. Purpose of data processing

It is necessary for us to temporarily store IP addresses on our system so that we can ensure the delivery of our website to visitors’ devices. For this purpose, your IP address must be stored whilst you are visiting our website. 

Primarily the data collected are stored in log files which are used to ensure the functionality of our website. In addition, the data may also be used to support the security of our system. We do not use your data collected when you are using our website for marketing purposes.

As we have a legitimate interest to operate our website for you, we use Article 6 (1) lit. f) GDPR as the legal basis for processing.

4. Duration of storage

The data will be deleted when they are no longer necessary for the intended purpose for which they have been collected. The data that are collected for the provision of the Website, are deleted as soon as the session is completed. 

The data stored in log files are usually deleted no later than seven days after the end of the session. In exceptional circumstances, the data may be stored for a longer time, for example for system security purposes. In such cases, your IP addresses are deleted or modified so that you cannot be identified.

5. Options for objection and removal

These data must be collected to ensure the functioning of our website and they must be stored in log files in order to make our website available to you. Consequently, we cannot offer you the right to object to processing in this case.


Social media platforms

We have a presence on social media platforms such as LinkedIn and Twitter. Anyone who registers with social media platforms and uses their functions to interact with us there (such as by commenting, communicating, liking or sharing posts) leaves data behind in the process. It is possible that this data is stored, evaluated, and processed by the social media platform, for example to analyse user behaviour.

We have no influence upon the data protection policies of these social media platforms. For more information about the data they processed and your rights please see their respective privacy policies:


Your rights

As soon as your personal data are processed, you assume the role of the data subject as pursuant to GDPR and are therefore granted the rights vis-à-vis the data controllers listed above. Please contact the holder of the website listed under ‘Name and address’ or o.stegle@dkfz.de if you wish to exercise any of your rights. Your rights are as follows:

1. Right to revoke consent to data processing (Art. 7 para. 3 GDPR)

You have the right to revoke your consent to data processing at any time. Upon revoking consent, the legality of the data processing already carried out on the basis of the consent will not be affected by the revocation of consent.

2. Right of access (Article 15 GDPR)

You have the right to obtain from the controllers confirmation as to whether or not personal data concerning you are being processed by us.
If this is the case, you may request access to the following information from the controller:

  • (1) The purposes of the processing of personal data;
  • (2) The categories of personal data concerned;
  • (3) The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • (4) The envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;
  • (5) The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
  • (6) The right to lodge a complaint with a supervisory authority;
  • (7) Where the personal data are not collected from the data subject, any available information as to their source;
  • (8) The existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You are also entitled to the right to request information on whether your personal data are transferred to a third country or to an international organisation. In this context, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

Please note that the first request for access to the data from you is provided by the controllers without charge, but that a reasonable charge for the work required to provide access may be required for subsequent requests.

3. Right to rectification (Article 16 GDPR)

You have a right to rectification and/or completion if the processed personal data concerning you is incorrect or incomplete. The controllers must make the correction without undue delay.

4. Right to erasure (Article 17 GDPR)

a) Duty to delete
You may request that the controllers delete personal data concerning you without undue delay, and the controller is required to so without undue delay, if one of the following reasons applies: 

  • (1) The personal data concerning you are no longer required for the purposes for which they were collected or processed.
  • (2) You revoke your consent to data processing based on Article 6 (1) lit. a) or Article 9 (2) lit. a) GDPR and there is no other legal basis for the data processing.
  • (3) You object to the processing as pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing as pursuant to Article 21 (2) GDPR.
  • (4) The personal data concerning you have been processed unlawfully.
  • (5) The erasure of personal data concerning you is required to fulfil a legal obligation based on laws of the European Union or of a Member State to which the controller is subject.
  • (6) The personal data concerning you have been collected in relation to services offered by the information society as pursuant to Article 8 (1) GDPR.

b) Information transferred to third parties
If the controllers make the personal data concerning you available to other parties and are obliged to erase the data as pursuant to Article 17 (1) GDPR, they must take appropriate measures, taking into account the available technology and the cost of their implementation and technical nature, to inform the other parties who process the personal data that you as the data subject have requested the erasure of all links to these personal data or copies or replication of such personal data.

c) Exceptions
The right to erasure does not apply insofar as the processing is required:

  • (1) to exercise the right to freedom of expression and information;
  • (2) to fulfil a legal obligation that requires processing according to the laws of the European Union or its Member States to which the controller is subject, or the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • (3) based on considerations of the public interest in the field of public health as pursuant to Article 9 (2) lit. h) and i) as well as Article 9 (3) GDPR;
  • (4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as pursuant to Article 89 (1) GDPR insofar as the right listed under a) is expected to render impossible or seriously impair the achievement of the objectives of this processing; or
  • (5) for the assertion, exercise or defence of legal claims.

5. Right to restriction of processing (Article 18 GDPR)

You may request the restriction of processing of personal data concerning you under the following conditions: 

  • (1) You have contested the accuracy of the personal data for a period enabling the controller to verify the accuracy of the personal data;
  • (2) The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  • (3) The controller no longer needs the personal data for the purposes of the processing, but you require them to assert, exercise or defend legal claims; or
  • (4) You have objected to processing pursuant to Article 21 (1) GDPR pending the verification of whether the legitimate grounds of the controller override yours.

Where processing of personal data concerning you has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

Where the restriction of processing is carried out pursuant to the aforementioned conditions, you will be informed by the controllers before the restriction of processing is lifted.

6. Right to be informed (Article 19 GDPR)

If you have asserted your right to rectification, erasure or restriction pertaining to the data processing vis-à-vis the controllers, they are thus obliged to inform all recipients to whom the personal data have been disclosed of this rectification or erasure of the data or the limitation of the processing, unless this proves to be impossible or involves a disproportionate effort. 

You are entitled to the right to be informed by the controller about these recipients.

7. Right to data portability (Article 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to the controllers, in a structured, commonly used, and machine-readable format. Moreover, you also have the right to transmit those data to another controller without hindrance from the controllers to which the personal data have been provided insofar as:

(1) the processing is based on a granted consent as pursuant to Article 6 (1) lit. a) GDPR or Article 9 (2) lit. a) GDPR or on a contract pursuant to Article 6 (1) lit. b) GDPR, and
(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, wherever technically feasible. This may not adversely affect the rights and freedoms of others.

8. Right to object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1) lit. e) or f), including profiling based on those provisions. 

The controllers shall no longer process the personal data unless they demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the assertion, exercise or defense of legal claims.

Wherever personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you may no longer be processed for such purposes.

Within the context of the use of information society services, notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

9. Automated decision-making, including profiling (Article 22 GDPR)

You have the right not to be subject to a decision that is based solely on an automated processing of data, including profiling, and that may have a legal effect on you or any similarly significant restrictive effect. 

Please note, no automated decision-making is made by the controllers when using your data.

10. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You also have the right to lodge a complaint with a supervisory authority, if you believe that the processing of your personal data is in violation of the GDPR. You can do so in the Member State where you reside or work or where the alleged violation takes place. 

The supervisory authority to which the complaint is submitted will inform you on the status and the results of the complaint including the possibility of a judicial remedy as pursuant to Article 78 GDPR.