Data protection information for donors of the Bernhard Nocht Institute for Tropical Medicine (foundation under public law) according to Article 13 DSGVO
With the following information, we would like to give you an overview of the processing of your personal data by us and your rights.
Who is responsible for data processing and to whom can I turn?
The responsible body is:
The Board of Directors of the Bernhard Nocht Institute for Tropical Medicine (BNITM)
- Foundation under public law -
Bernhard-Nocht-Straße 74
20359 Hamburg
Phone: +49 40 285380-0 (24 h daily)
Fax: +49 40 285380-265
URL: www.bnitm.de
E-Mail: bni@bnitm.de
You can reach our Data Protection Officer under:
Bernhard Nocht Institute for Tropical Medicine (BNITM)
Data protection representative
Bernhard-Nocht-Straße 74
20359 Hamburg
E-Mail: datenschutz@bnitm.de
What sources and data do we use?
We process personal data that we receive from our donors in the course of our relationship. In addition, we process personal data that we have obtained from publicly accessible sources (e.g. press, media, internet) and are permitted to process. We store at most the following data:
- Main data (such as surnames, first names, title and academic degree, if applicable)
- Address data
- Contact data (such as telephone number, e-mail address, etc.)
- Date of birth
- Bank data
- Donation history (such as amount, designated purpose)
Personal data of other persons will be processed, as far as they have been transmitted by donors. This may include, in particular, employees or contact persons in the donors' companies, but also private partners who have been named as companions for events. As a rule, only the name and partial contact details of these persons are processed. The processing is based on the legitimate interest of the donors and the BNITM according to Art. 6 (1) f) DSGVO in the communication of the BNITM with the respectively affected persons.
Do you need to provide your data?
There is no obligation to provide data. However, donations without the name and address of the donor may not be accepted.
What do we process your data for (purpose of processing) and on what legal basis?
We process the above mentioned personal data in accordance with the regulations of the EU General Data Protection Regulation (DSGVO) and the Federal Data Protection Act (BDSG):
a) For the fulfillment of contractual obligations (Article 6 para. 1 b DSGVO). The processing of personal data takes place for the handling of donation transactions or for the implementation of measures that take place upon your request.
b) Within the framework of the balancing of interests (Article 6 para. 1 f DSGVO).
If necessary, we process your data beyond the actual purpose of use for information or market and opinion research, unless you have objected to the use of your data. The personal data of donors is also used to inform them about projects and the use of funds, to invite them to BNITM events, to conduct donor surveys and to prepare business policy evaluations about donations and donation developments.
c) Based on your consent (Article 6 para. 1a DSGVO).
Insofar as you have given us consent to process personal data for certain purposes (e.g. processing of donations), the lawfulness of the processing is based on your consent. Any consent given can be revoked at any time. This also applies to the revocation of declarations of consent given to us before the EU General Data Protection Regulation came into force, meaning before May 25, 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.
d) Due to legal requirements (Article 6 para. 1 c DSGVO).
In addition, as a foundation under public law, we are subject to various legal obligations, i.e. legal requirements (e.g. preparation of donation certificates). The legal basis for the documentation of the donors is, in addition to the above-mentioned article, also § 147 of the German Fiscal Code (AO) for the storage of documents while the issuance of donation receipts is based on Art. 6 para. 1 c) DSGVO in conjunction with § 50 EStDV.
Who receives your data?
Within the BNITM, only those bodies will have access to your data that need it to process donation transactions and for member support.
In addition, the BNITM uses various service providers, some of which also process the personal data. For example, printers may receive personal data for the mailing of catalogs, invitations and similar products. These service providers process the data only for the purposes specified by the BNITM and are contractually and legally bound to secrecy
We may only pass on information about you if this is required by law, if you have given your consent and/or if processors commissioned by us guarantee compliance with the requirements of the EU General Data Protection Regulation/Federal Data Protection Act in the same way.
Other data recipients may be those bodies for which you have given your consent to the data transfer.
Is data transferred to a third country or to an international organization?
No data is transferred to countries outside the EU or the EEA (so-called third countries).
How long will your data be stored?
We process and store your personal data as long as it is necessary for the fulfillment of our contractual and legal obligations. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its (temporary) further processing is necessary for the following purposes:
- Compliance with retention periods under commercial and tax law: The retention or documentation periods specified there are two to ten years.
- Preservation of evidence under the statutes of limitations. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.
What data protection rights do you have?
You have the right to information about the personal data stored concerning you according to Art. 15 DSGVO and, under certain conditions, a right to rectification according to Art. 16 DSGVO. Incomplete data must be completed taking into account the purpose of the processing. Insofar as the requirements of Art. 17 DSGVO are met, in particular the data is no longer required for the original purpose and retention periods have expired, you may request that we delete the data. According to Art. 18 DSGVO, you may, under certain circumstances, demand that BNITM restricts further processing of the data. This means that your data will not be deleted, but will be marked to block it from further processing.
Insofar as the processing of your data is based on a public or legitimate interest within the meaning of Art. 6 (1) e), f) DSGVO, you may object to the processing on the grounds of your particular personal situation in accordance with Art. 21 DSGVO. As far as you object to any processing for information and contact purposes, a specific personal situation is not required. In this case, we will only contact you reactively or in case of existing legal obligations.
The BNITM takes every effort to process personal data in accordance with the legal requirements. Should you nevertheless be of the opinion that the processing of your personal data is permitted under data protection law, you are welcome to contact the BNITM data protection representative:
Bernhard Nocht Institute for Tropical Medicine (BNITM)
Data protection representative
Bernhard-Nocht-Straße 74
20359 Hamburg
E-Mail: datenschutz@bnitm.de
Concerned parties can also submit a complaint to a responsible data protection supervisory authority. The responsible supervisory authority depends on the federal state of the (residential) registered office or the alleged data protection violation. A list of supervisory authorities with addresses can be found here.
You can informally revoke your consent to the processing of personal data at any time. To do so, you should preferably contact the data protection representative. This also applies to the revocation of declarations of consent given to us before the EU General Data Protection Regulation came into force, meaning before May 25, 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.
