1. Name and address of the responsible controller
The responsible controller as defined in the EU General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states as well as other data protection-related provisions is:
Westfälische Wilhelms-Universität Münster (WWU) / University of Münster (WWU)
represented by its Rector, Prof Dr Johannes Wessels,
Schlossplatz 2, 48149 Münster, Germany
Tel.: + 49 251 83-0
For any queries you may have concerning the project please contact:
Dr. Torsten Prinz
Institute for Geoinformatics
2. Name and address of the data protection officer
The data protection officer appointed by the responsible controller is:
Schlossplatz 2, 48149 Münster
Tel.: + 49 251 83-22446
3. General information on data processing
We collect and use the personal data of our users insofar as necessary for operating a functional website and delivering our content and services, and to the extent to which the law permits.
Legal basis for processing personal data
Whenever we obtain the consent from a data subject to process personal data, Art. 6 (1 a) GDPR serves as the legal basis for processing this personal data.
Whenever processing such data is necessary for compliance with a legal regulation, to which the University of Münster is subject, Art. 6 (1 c) GDPR serves as the legal basis.
In cases for which processing is necessary to protect the vital interests of the data subject or of another natural person, Art. 6 (1 d) GDPR serves as the legal basis.
If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, Art. 6 (1 e) GDPR serves as the legal basis for processing this data.
If processing is necessary for safeguarding the legitimate interests of the University of Münster or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 (1 f) GDPR serves as the legal basis for processing this data. This does not apply to processing tasks which the University of Münster is obliged to perform as a public authority.
Duration of storage of personal data
We reserve the right to retain the data subject’s personal data for as long as the purpose of such storage exists. If processing is permitted on the basis of the subject’s consent, his/her personal data is only stored until the data subject withdraws his/her consent, except in cases where processing is governed by a different legal basis.
Right to rectification and erasure of personal data
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. The data subject also has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay as soon as the purpose of storage is no longer necessary. In cases where data processing is performed on the basis of consent, the right to erasure exists if the data subject withdraws his/her consent and no other legal grounds exist for processing the data.
Personal data must be erased if the data subject objects to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or if the personal data has been unlawfully processed, or if the personal data must be erased in order to comply with a legal requirement mandated by an EU or member state law, to which the University of Münster is subject.
The right to erasure as put forth in the cases stated above does not apply, however, if it would prevent compliance with a legal obligation which requires processing by European Union or member state law, to which the University of Münster is subject, or hinder the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, or if extended storage is necessary for the establishment, exercise or defence of legal claims.
Right to withdrawal
If permission to process personal data was granted by the consent of the data subject, he or she may withdraw his/her consent at any time. All processing of personal data performed prior to withdrawal remains lawful irrespective of the subject’s withdrawal.
Right to information
The data subject has the right to obtain confirmation from the University of Münster whether it is processing any personal data concerning him or her. If such is the case, the data subject has a right to information regarding the type of personal data and the purpose for which it is being processed. The data subject also has the right to obtain information on the duration of the planned storage of his/her data, or on the criteria for determining how long his/her data is to be stored.
4. Provision of the website and creation of log files
Scope of data processing
For every access query to our website, our server automatically collects
data and information from the querying computer system.
The following data is collected in this process:
- information on the browser type and version
- the user’s operating system
- the user’s Internet service provider
- the user’s IP address
- the date and time of the query
- websites from which the user’s system was directed to our website
- websites which the user’s system accesses via our website
This data is compiled in log files and saved on our server. No further personal data is stored together with the log file data.
Legal basis for processing
The legal basis for temporarily processing data and log files is provided in Art. 6 (1 f) GDPR.
Purpose of processing
The temporary storage of the IP address on our server is necessary for granting the user’s system access to our website. For this purpose, the user’s IP address must remain stored on our server for the duration of the session.
Data storage in log files is required to ensure the functionality of the website. Furthermore, the data enables us to optimise the website and guarantee the security of our IT systems. Data analysis for marketing-related purposes is not performed in this context.
These purposes correspond to the legitimate interests of data processing as indicated in Art. 6 (1 f) GDPR.
Duration of storage of personal data
The data is erased at the conclusion of the respective session.
All data stored in log files is erased within seven days. A longer period of data storage is possible. In such cases, the user’s IP address is erased or anonymised in such a way that renders it impossible to identify the querying client.