1. General

WTSH, the Business Development and Technology Transfer Corporation of Schleswig-Holstein, Lorentzendamm 24, 24103 Kiel, Germany, is responsible for data processing on this website within the meaning of the European General Data Protection Regulation (GDPR). We respect your personal rights, and we understand the importance of personal information we receive from you as a user of our website. We respect the protection of your personal data and will collect, store or process all data obtained exclusively in accordance with the relevant data protection regulations within the scope of our business purpose.

2. Definitions

Personal data is any information relating to an identified or identifiable natural person. Identifiable is a natural person who can be identified, directly or indirectly, in particular by assignment to an identifier, such as a name, an identification number, location data, an online identifier or one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

3. Legal Basis of Data Processing

If we obtain your consent for the processing of personal data, Art. 6 Sect. 1 Sentence 1 lit. a of the European General Data Protection Regulation (GDPR) serves as the legal basis.

The processing of personal data required to fulfil a contract with you is based on Art. 6 Sect. 1 Sentence 1 lit. b GDPR. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, this is done within the scope of Art. 6 Sect. 1 Sentence 1 lit. c GDPR.

If the processing is necessary to protect a legitimate interest of us or a third party and your interests, fundamental rights and freedoms do not outweigh these legitimate interests, Art. 6 Sect. 1 Sentence 1 f GDPR serves as the legal basis for the processing. As a rule, the legitimate interests of our company lie in the provision of our services owed and/or ongoing optimization of our services and presentations.

4. Data Erasure and Storage Duration

Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Furthermore, data may be stored if this has been provided for by European or national legislators in EU regulations, laws or other provisions. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

5. Collection of Personal Data

In principle, we do not collect or use any personal data when you visit our website. This only happens if it is necessary to provide a functioning website as well as providing our contents and services. The collection and use of personal data of our users take place regularly only after the users’ consent. This does not apply in cases where prior consent cannot be obtained for factual reasons and where processing of the data is permitted by law.

In the following we would like to inform you about the type, scope and purpose of our data handling within the scope of this website:

5.1 Server Log Files

Every time you visit our website, the user’s access data required for use and billing purposes are stored on our server in a protocol file (log file) which your browser automatically transmits to us.
These are:

• browser type/ browser version
• operating system used
• date and time of the server request
• IP address of the computer requesting the website;
• Website from which access was made (referrer URL)
• files called;
• amount of data transferred.

The log file is stored for the following purposes:

• Evaluation of file retrieval for statistical purposes;
• System security and stability of the website
• Checking for non-contractual or otherwise illegal use, provided that there are actual indications for this.

The legal basis for this data processing is Art. 6 Sect. 1 Sentence 1 lit. f GDPR. Our legitimate interests follow from the above-mentioned purposes for data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally. We do not merge this data with any other data sources.

5.2 Cookies

After the user logs on to our website, so-called “cookies” are stored on the user’s computer.
A cookie is a small text file in a designated directory on your computer. This file is used to identify the user’s computer for the duration of the session. Cookies cannot generate any manipulations at the respective end device of the user and can – most easily in the browser – be deleted manually at any time.
You can individually set the handling of cookies in your Internet browser so that cookies are rejected or only accepted after confirmation. The cookies, here so-called “session cookies”, serve the purpose of expanding the functions of our Internet offer and to make your use as comfortable as possible. We would like to point out that if you refuse cookies, not all components of our application will function properly.
The processing of data by cookies is necessary for the aforementioned purposes in order to safeguard our legitimate interests and, where applicable, those of third parties pursuant to Art. 6 Sect. 1 Sentence 1 lit. f GDPR.

5.3 Usage Data

We collect and use personal data on the basis of Art. 6 Par. 1 Sentence 1 b) GDPR from you, as far as this is necessary to enable the use of our Internet offer (usage data).
If pseudonyms are used, we may also create user profiles for the purposes of advertising, market research and the demand-oriented design of our Internet offer.
You have the right to object to this use of your data at any time. We may not combine the user profiles with data about the bearer of the pseudonym.

5.4 Data in Connection with your Contact

If you send us enquiries using the contact form, your details from the form, or via the e-mail address provided, will be stored for the sole purpose of processing the respective enquiry and in the event of follow-up questions. We will not pass this data on to any third parties without your consent. The corresponding data is used on the basis of Art. 6 Sect. 1 Sentence 1 b) GDPR in the context of processing your request.

5.5 Webshop

If you would like to order from our webshop, it is necessary for the conclusion of the contract that you provide personal data which we need for the processing of your order. Required information for the execution of the contracts are marked separately, additional information is voluntary. We process the data provided by you to process your order. The legal basis for this is Art. 6 Sect. 1 Sentence 1 lit. b GDPR.
We may also process the information you provide to inform you of other interesting products in our portfolio or to send you e-mails containing technical information.
We are obliged by commercial and tax law to store your address, payment and order data for a period of ten years. However, after two years we will limit the processing, i.e. your data will only be used to comply with legal obligations.
To prevent unauthorized access to your personal data, especially financial data, the order process is encrypted using TLS technology.

5.6 Tracking Procedure

The use of tracking tools is based on Art. 6 Par. 1 Sentence 1 lit. f GDPR. In this way, within the framework of our legitimate interests in this respect, we want to ensure that our website is designed to meet requirements and continuously optimized (by means of statistical evaluations).
Use of Google Analytics
Our website uses Google Analytics, a web analysis service of Google Inc. (“Google”), 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies” which are text files placed on your computer to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, Google will reduce your IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and Internet use. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link (http://tools.google.com/dlpage/gaoptout?hl=de). An opt-out cookie is set to prevent future collection of your data when you visit this website.
Please note that the code “anonymizeIp” has been added to Google Analytics on this website to ensure anonymous collection of IP addresses (so-called IP masking). We use Google Analytics exclusively to evaluate data from double-click cookies and also AdWords for statistical purposes. If you do not want this, you can disable it using the Ads Preferences Manager (http://www.google.com/settings/ads/onweb/?hl=de).
Furthermore, as the provider of this website, we have no knowledge of the content of the transmitted data or its use by Google. For more information, please see Google’s privacy policy and terms of use at http://www.google.com/analytics/terms/de.html, or at https://www.google.de/intl/de/policies/.
The use of tracking tools is based on Art. 6 Par. 1 Sentence 1 lit. f GDPR. In this way, within the framework of our legitimate interests in this respect, we want to ensure that our website is designed to meet requirements and continuously optimized (by means of statistical evaluations).

5.10 Using YouTube Plug-Ins

Our website uses the plugin function of the YouTube platform of Google Inc. (“Google”), San Bruno, California, USA.
Every time you visit our website, a connection to YouTube’s servers is established. The YouTube server will be informed of your visit to our website. To our knowledge, personal data will not be stored. However, if you are logged into your YouTube account, you would allow YouTube to associate your browser history directly with your personal profile.
You have the option of deactivating this assignment if you log out of your account beforehand.
For more information, please see YouTube’s privacy policy at https://www.youtube.de/t/privacy.

5.12 Use of Google Maps

On this website we use the offer of Google Maps. This allows us to display interactive maps directly on the website and enables you to conveniently use the map function.
By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the above data (5.1) will be transmitted. This is regardless of whether Google provides a user account that you are logged into or whether no user account exists. If you are logged into Google, your information will be directly associated with your account. If you do not wish to be associated with your profile on Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such evaluation takes place in particular (even for not logged-in users) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles whereby you must contact Google to exercise this right.
For more information about the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information about your rights in this regard and setting options for the protection of your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

6. Your Rights

As far as we process your personal data on our website, you are a “data subject” in the sense of the GDPR. You have the following rights vis-à-vis us:

6.1 Right to Information

6.1 Right to Information
You can ask us to confirm whether we are processing your personal data. If such processing is available, you can request the following information from us:

• the purposes for which the personal data are processed;
• the categories of personal data processed;
• the recipients or categories of recipients to whom your personal information has been or will be disclosed;
• the planned duration of the storage of your personal data or, if specific information on this is not possible, criteria for determining the storage period;
• the existence of a right of appeal to a supervisory authority;
• any available information about the origin of the data if the personal data is not collected from you;
• the existence of automated decision-making, including profiling in accordance with Art. 22 Sect. 1 and 4 GDPR and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for you.

You also have the right to request information as to whether your personal data is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.

6.2 Right to Correction

You have the right to correct and/or complete your personal data if your processed data is incorrect or incomplete. If this is the case, we will make the correction immediately.

6.3 Right to Limitation of Processing

You have the right to restrict the processing of your personal data if:

• you dispute the accuracy of your personal data for a period of time that enables us to verify the accuracy of the data;
• the processing is unlawful and you refuse to delete your personal data and instead request the restriction of use;
• we no longer need your personal data for the purposes of processing, but you do need them to assert, exercise or defend legal claims, or
• you have filed an objection to the processing pursuant to Art. 21 Sect. 1 GDPR and it is not yet clear whether our justified reasons outweigh your reasons.

If you have requested the restriction of the processing of your personal data, these data may only be processed – apart from their storage – with your consent or for the purpose of asserting, exercising or defending rights, or for the protection of the rights of another natural or legal person, or on grounds of an important public interest of the Union or a Member State. You will be informed by us before the restriction is lifted.

6.4 Right to Cancellation

You can ask us to delete your personal data immediately. We are obliged to delete this data immediately if one of the following reasons applies:

• Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You revoke any existing consent on which the processing was based pursuant to Art. 6 Sect. 1 Sentence 1 lit. a or Art. 9 Sect. 2 lit. a GDPR, and there is no other legal basis for further processing.
• You file an objection against the processing pursuant to Art. 21 Sect. 1 GDPR and there are no overriding legitimate reasons for the processing.
• You file an objection against the processing by direct advertising pursuant to Art. 21 Sect. 2 GDPR.
• Your personal data have been processed unlawfully.
• The deletion of your personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which we are subject.
• Your personal data have been collected in relation to information society services offered pursuant to Art. 8 Sect. 1 GDPR.

If we have made your personal data public and we are obliged to delete them in accordance with Art. 17 Sect. 1 GDPR, we will take appropriate measures, taking into account the available technology and the implementation costs, to inform those responsible for data processing that you have requested them to delete all links to these personal data, copies or replications.

Your right to cancellation does not exist if the processing is necessary

• to exercise freedom of expression and information;
• to fulfil a legal obligation required for processing under the law of the Union or of the Member States to which we are subject, or to perform a task in the public interest or in the exercise of official authority conferred on us;
• for reasons of public interest in the field of public health in accordance with Art. 9 Sect. 2 lit. h and i and Art. 9 Sect. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Sect. 1 GDPR, insofar as the right referred to in Sect. 1 is likely to make it impossible or seriously impair the attainment of the objectives of such processing, or
• to assert, exercise or defend legal claims.

6.5 Right to Information

If you have exercised your right to rectification, deletion or restriction of processing against us, we are obliged to inform all recipients to whom your personal data have been disclosed of this rectification or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed about these recipients.

6.6 Right to Data Transferability

You have the right to receive any personal data that you may have provided to us in a structured, common and machine-readable format. You also have the right to transfer this data to another person in charge without our interference, provided that

• processing is based on consent pursuant to Art. 6 Sect. 1 Sentence 1 lit. a GDPR or Art. 9 Sect. 2 lit. a GDPR or on a contract pursuant to Art. 6 Sect. 1 Sentence 1 lit. b GDPR, and
• processing is carried out using automated methods.

In addition, you have the right to request the transfer of your personal data directly from us to another person responsible, insofar as this is technically feasible. The rights and freedoms of other persons may not be affected by this.
The right to transferability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on us.
We currently do not assume that data subject to the right to data transferability will be processed within the scope of our website offer.

6.7 Right of Objection

You have the right to object at any time to the processing of your personal data on the basis of Art. 6 Sect. 1 Sentence 1 lit. e or f GDPR for reasons arising from your particular situation; this also applies to profiling based on these provisions.
We will then no longer process your personal data unless we can prove compelling reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to any related profiling.
If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

You have the possibility to exercise your right of objection in connection with the use of Information Society services by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

6.8 Right to Revoke the Data Protection Statement of Consent

You have the right to revoke your data protection statement of consent at any time. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until such revocation.

6.9 Automated Decision in Individual Cases Including Profiling

You have the right not to be subject to a decision based exclusively on automated processing – including profiling – that has legal effect against you or significantly impairs you in a similar manner. We do not carry out such processing.

6.10 Right of Appeal to a Supervisory Authority

You have the right of appeal to a supervisory authority, in particular in the Member State where you are staying, working or suspected of having infringed the GDPR, without prejudice to any other rights of appeal.

7. Responsibility for Linked Contents

On our website we may also use links to websites of other providers. This data protection statement does not apply in this respect. If personal data is collected, processed or used when using the websites of these other providers, please note the information on data protection of the respective providers. We are not responsible for their data protection handling.

8. Passing on of Personal Data to Third Parties

Your personal data will only be stored on our servers or on servers used on our behalf. Access to and use of the data is only possible for authorized employees or service providers and is also limited to the data required to perform the respective task.

Your data will not be transmitted to third parties without your consent. A data transfer to third countries (countries outside the European Economic Area – EEA) does not take place, unless otherwise stated in this data protection statement, and is also not intended in the future.

9. Data Security

To protect your personal data, we have taken technical and organizational measures to ensure that your data is protected against accidental or intentional loss, destruction or manipulation as well as access by unauthorized persons. Our protective measures are reviewed at regular intervals and adapted to technical progress if necessary.

10. Data Protection Officer

Should you have any further questions regarding the processing of your personal data, please contact our data protection officer: Raimund Stieler, stieler@wtsh.de

11. Changes to the Data Protection Statement

We hereby reserve the right to change this data protection statement at any time if necessary and in consideration of the data protection regulations applicable at the time of the change.

Status: August 2018