Data Protection Policy for Social-Media-Platforms
We hereby inform you about the processing of your personal data when using the social media platforms of Indivumed GmbH, Falkenried 88, House D, 20251 Hamburg, Germany (hereinafter “Indivumed” or “we”/”us”).
Personal data means any information relating to an identified or identifiable natural person, in this context, e.g. profile data (such as your name, username, profile picture, your e-mail address), your usage data (such as information about the time of your visit to our social media platforms), and interaction data (such as your comments and recommendations, sharing of posts), as well as other data generated when visiting our social media platforms.
I. Controller
The Controller within the meaning of the EU General Data Protection Regulation (hereinafter “EU GDPR”) and for the content on Indivumed’s social media platforms is:
Indivumed GmbH
represented by its Managing Director Prof. Dr. Hartmut Juhl
Falkenried 88, House D
20251 Hamburg, Germany
Phone: +49 (40) 41 33 83 0
Fax: +49 (40) 41 33 83 14
E-mail: info@indivumed.com
For information on joint responsibility, please see section III.
Further information about the company (incl. Imprint and general Data Protection Policy) can be found on our website.
II. Processing by Indivumed for its own purposes
We generally process your personal data to provide the social media platforms, to evaluate user behavior and interactive use, including communication with you via our social media platforms (e.g. to present the content we offer via our social media platforms), to carry out marketing campaigns and recruit personnel, to interact with the users of our social media platforms (e.g. by means of direct messages, commenting, recommending, or sharing content), or to respond to your inquiries or concerns.
The legal basis for the operation of the social media platforms is Art. 6 para. 1 lit. f) GDPR, which consists in particular of evaluating the profiles of our users and the reach of our social media platforms with the aim of optimizing the content, information, and services we offer.
In particular, the following personal data about you is processed for these purposes:
If you follow us on social media platforms, Indivumed will have access to your publicly accessible personal data, that is data that you disclose in the public area of your profile (e.g. your first and last name or your username, your location, your job title, your company, your e-mail address, and your profile picture (depending on the social media platform)).
Depending on the privacy settings of your user account with the respective service provider, the service providers (such as LinkedIn, X) may also share with us other information stored in your user account about your profile, your preferences (e.g. recommendations such as “Like”), your contributions (e.g. posts), and your contacts (e.g. your network). You have the option of restricting the sharing of profile data with third parties in the privacy settings of your respective user account. For more information on what information the respective service provider shares with us, please refer to the respective privacy settings of your user account and the respective terms of use and privacy policy of the service provider.
For interactive use of our social media platforms and communication with you, our social media platforms offer you the opportunity to react to our content provided there, to comment on it, to recommend it (e.g. using the “Like” button), and to send us public and private messages (hereinafter referred to as “interaction data”). In addition, your interaction and profile data may also be evaluated by us in order to optimize our content.
To statistically evaluate the use of our social media platforms, with the aim of learning more about the users of our social media platforms and tailoring our content to the needs and interests of our users in the best possible way, we collect statistical data in aggregated form, which provides us with insights into the use of our social media platforms and the interaction with the content provided there (so-called “insights data”). Insights data generally includes, among other things, information about the number of interactions (e.g. using the “Like” button, commenting on or sharing posts), number of comments, length of stay for video posts, key visitor figures (e.g. page views), demographic data about visitors (e.g. age, gender, location, activity) and the number of visitors. age, gender, location, field of activity, industry), reach (describes how many people are reached by a particular post (as a percentage/absolute figures), engagement rate (indicates how many people who see a social media post actually respond to it with likes, comments, or shares), first time impression ratio (impressions generally describe the number of visual contacts with a post; this is used to determine how widely a post has been distributed. “First time impression ratio” describes the proportion of first-time impressions, i.e. the number of newly reached people). We do not have access to the underlying usage data. Insights data can therefore not be used to draw any conclusions about your person. It is therefore also not possible to link this data to your user account with the respective service provider.
III. Processing by the service provider
For the purposes of the technical and administrative provision of the online services on which the social media platforms are operated, processing is carried out by the respective service provider who is responsible for the associated data processing (hereinafter referred to as “service provider”).
In this respect, your personal data in connection with the use of our social media channel (e.g. web server logs, including your IP address) will be processed for the respective service provider’s own purposes, such as the technical and administrative provision of its own online services, including the storage and evaluation of user data generated in the process.
Indivumed itself does not receive access to personal data, with the exception of insights data (as described above).
- Service provider
Indivumed’s LinkedIn profile is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – Controller (LinkedIn Corporation, 605 W Maude Ave, Sunnyvale, CA 94085, USA).
Insofar as data processing in the context of the provision and use of our social media platforms is carried out on the basis of joint responsibility pursuant to Art. 26 para. 1 GDPR by Indivumed and the respective service provider, such as in particular data evaluation for statistical purposes, the Joint Control Agreement applies. Further information on the insights data collected can be found here.
X-Profile by Indivumed is operated by Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland is responsible for the data processing of persons living outside the United States.
- Processing by the service provider for its own purposes
In addition to the technical and administrative provision of the online services, your usage and interaction data is also stored by the respective service provider. These service providers can access your usage and interaction data and evaluate it (possibly with additional analysis and tracking technologies, such as cookies) and use and store it for their own business purposes, such as advertising, optimization of website functions and services, performance measurements, and other analysis and research. Indivumed itself does not have access to this data, with the exception of insights data in aggregated form, and has no influence on the type and scope of processing by the service provider and no effective control options, insofar as the data processing is carried out independently by the respective service provider. Information on the independent processing of your personal data (in particular on the purposes and legal basis of the processing, as well as your data protection rights) by the service provider can be found in the data protection declaration of the respective service provider in accordance with Art. 13 and 14 GDPR:
- Cookies from the service provider
If you use the online services on which the social media platforms are operated and your browser allows cookies to be stored, the respective service provider stores information in the form of small text files in your browser’s memory (hereinafter referred to as “cookies”) in connection with your use of the online service in question and can access this information when you visit the online service or a website that integrates the service provider’s technologies. For more information on the purpose of the cookies used, the integration of these cookies by other websites and your control options in this regard, please refer to the information on cookies provided by the respective service provider:
By means of the cookies used, the service providers are able to track your user behavior (across devices for registered users) on other websites beyond the online service. This applies both to users registered with the online service and to users who are not registered there.
If you are registered or logged in to the respective online service using a personal user account, it is possible that the service provider (LinkedIn) can associate your visit to our social media channel with your personal user account (cookie with your LinkedIn ID). If you wish to avoid this, you should log out of the online service or deactivate the “stay logged in” function, delete the cookies on your device, and close and restart your browser. In this way, LinkedIn information that can be used to directly identify you will be deleted. This allows you to use our LinkedIn page without revealing your LinkedIn identifier. If you access interactive functions on the page (like, comment, share, message, etc.), a LinkedIn login screen will appear. After logging in, you will again be recognizable to LinkedIn as a specific user.
Indivumed itself does not receive any access to personal data, with the exception of insights data in aggregated form, and has no influence on this processing by the service provider.
Information on how to adjust the settings for cookies in your browser can usually be found in the help section of the browser you are using.
Other helpful links may be found here:
IV. Disclosure and data transfer to third countries
Indivumed will not disclose or otherwise disseminate your personal data to third parties unless this is necessary for the provision and use of our social media platforms, content, products, and services (Art. 6 para. 1 lit. f) GDPR), or the disclosure of personal data is permitted by relevant legal provisions, or if we are legally obliged to do so – e.g. by court order or to fulfill legal obligations (Art. 6 para. 1 lit. c) GDPR).
Indivumed is entitled to outsource the processing of your personal data in whole or in part to external service providers who act as processors for Indivumed in accordance with Art. 4 No. 8 GDPR within the framework of data protection regulations. External service providers support us, for example, in the provision and content design of the social media platforms, data management, marketing, and reach measurement. These service providers process your data exclusively in accordance with our instructions, in accordance with contractual regulations (Art. 28 EU GDPR), and Indivumed remains responsible for the protection of your data.
In the event that Indivumed transfers your personal data to a service provider based in a third country without an adequacy decision by the European Commission pursuant to Art. 45 GDPR, Indivumed will ensure the protection of your personal data by means of appropriate safeguards pursuant to Art. 46 GDPR, such as the conclusion of standard contractual clauses, a copy of which is available to the controller.
Please note that the respective service providers of our social media platforms may be based in the USA or other countries outside the EU/EEA and may therefore also process your personal data in countries in which they do business. These countries may also be so-called third countries that do not have an adequacy decision by the European Commission pursuant to Art. 45 GDPR; there is therefore no guarantee that an adequate level of data protection is guaranteed in these countries in accordance with the requirements of the GDPR. It cannot be ruled out that state authorities in these countries may be able to access your personal data. However, according to the information provided by the respective service providers, they use suitable guarantees in accordance with Art. 46 GDPR to ensure an adequate level of data protection in the respective recipient countries, such as the conclusion of standard contractual clauses to ensure the protection of your personal data. Indivumed has no influence on the type and scope of processing by the service providers in third countries and no effective control options vis-à-vis the service providers.
V. Storage period
Your personal data will only be stored by us for as long as it is necessary to achieve the purposes for which it was collected or – if there are additional statutory retention periods – for the duration of the statutory retention period. Your personal data will then be deleted by us. Only in a few exceptional cases can your data be stored beyond this, e.g. if storage is necessary in connection with the enforcement of and defense against legal claims in favor of Indivumed. If your personal data is stored beyond this by the respective service provider, this is based exclusively on the provisions of the respective service provider, in particular the applicable terms of use and data protection notices.
VI. Your rights under the EU GDPR
You may have the right to request information about your personal data stored by us at any time. In the event that your personal data is incorrect or incomplete, you can request the correction of this data.
You may also have the right to request the erasure or restriction of the processing of your personal data if, for example, your personal data is being processed unlawfully.
You may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format or, where applicable, to transmit those data to another controller.
If you have consented to the processing of your personal data, you can withdraw your consent at any time with effect for the future, but without affecting the lawfulness of processing based on consent before its withdrawal.
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on Art. 6 (1) f) EU GDPR. We will no longer process your personal data following an objection unless we can demonstrate compelling legitimate grounds for the further processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. In this case, you must provide reasons for the objection that arise from your particular situation. Furthermore, you have the right to object to the processing of your personal data for the purposes of direct marketing at any time, even without giving reasons.
If Indivumed is responsible for the processing of your data, you can contact Indivumed’s Data Protection Officer at any time to exercise your rights or if you have any questions about the processing of your personal data.
The Data Protection Officer of Indivumed GmbH is:
Visnja Jankovic
Indivumed GmbH
Falkenried 88, Bldg. D
20251 Hamburg
Germany
E-mail: dpo@Indivumed.com
Phone: +49 (40) 41 33 83 0
In any case, please state the name of the relevant social media channel and include appropriate identification of yourself. If we have any doubts about your identity, Indivumed may request further identification in individual cases (Art. 12 para. 6 EU GDPR).
You have the right to lodge a complaint with the following supervisory authority:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg
Phone: 040 / 428 54 – 4040
Fax: 040 / 428 54 – 4000
E-mail: mailbox@datenschutz-hamburg.de
If the respective service provider is responsible for the processing of your personal data, please contact the service provider to exercise your data protection rights. You can reach the service provider using the following contact details:
VII. General information
The social media platforms may contain links to third-party websites. We have no control over the privacy practices or the content of these other websites.
Please also note that your public interaction on our social media platforms in connection with your username leads to a direct personal assignment and is also visible to other users of the social media channel. We generally have no influence on interactive functionalities and the visibility of your public interaction and profile data on our social media platforms, e.g. if they are recommended or shared by other users.
Indivumed reserves the right to amend or supplement this privacy policy as required. The changes will be published here. You should therefore visit this page regularly to find out about the current status of the privacy policy.