PrivacyPolicy

Wuppertal Institut für Klima, Umwelt, Energie gGmbH
Döppersberg 19
42103 Wuppertal
Germany
Tel.: +49 202 2492-0
info@wupperinst.org
www.wupperinst.org

2B Advice GmbH
Joseph-Schumpeter-Allee 25
53227 Bonn
Germany
Tel.: +49 228 926165-120
dsb@wupperinst.org

The following terms among others are used by us in this Privacy Policy:

a) Personal data 
Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity. This therefore also includes IP addresses or unique identifiers stored in cookies.

b ) Controller
The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

c) Processor
A data processor is a natural or legal person, public authority, agency, or other entity that processes personal data on behalf of the data controller.

d) Processing 
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of disclosure, the comparison or linking, the restriction, erasure, or destruction.

e) Data subject 
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

f) Third country
A third country is any country outside the European Union or outside the European Economic Area (EU/EEA).

When you visit our website, the following information – which may be personally identifiable – is collected:

• User Agent
• The website from which an accessing system reaches our website (known as the referrer)
• Subwebsites accessed on our website via the accessing system
• Date and time of access 
• Amount of data transferred
• Directory protection user 
• Log 
• Status code
• IP address (IP addresses are stored anonymously; to do this, the last one to three digits are removed.)

We use the web analytics software AWStats. This is free web analytics software that uses log files – generated by the servers when you visit our website  for statistical analysis.

This data is stored to ensure the website functions properly, to further develop the website, and to identify and prevent malfunctions or other disruptions. In addition, the data helps us optimize the website, ensure the security of our IT systems, and provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyberattack. For these purposes, the data is stored only for a period of 30 days.

We do not draw any conclusions about the data subject when using this data. The data is not analyzed, except for statistical purposes in anonymized form. These purposes also constitute our legitimate interest in data processing, in accordance with Article 6(1)(f) of the GDPR.

The data from the server log files is stored on servers in Germany at the web hosting provider Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp.

The data from the server log files is stored separately from the personal data provided by the data subject themselves when contacting us (see Section 5).

a) E-mail
Our website offers you the option to contact us directly via e-mail. Your personal data – such as your e-mail address, your first and last name (if applicable), and the information you provide in your inquiry – will be used exclusively to contact you and to process and respond to your inquiry. This processing is based on our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. We store your personal data only for as long as is necessary to process your inquiry or as required by statutory retention obligations.

b) Online Application
As part of the application process via our website, we collect and process the following information: application documents (e.g., resume, cover letter, certificates) as well as identification and contact information (e.g., name, e-mail, address, date of birth). The purpose of the processing is to conduct the application process and fill positions within our institute. The legal basis for advertised positions and the conclusion of a contract is Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG (implementation of pre-contractual or contractual measures). For unsolicited applications and applications to our talent pool, processing is based on your consent, in accordance with Art. 6(1)(a) GDPR. However, if no contract is concluded, your transmitted data will be deleted via the automatic data reduction 6 months after rejection or termination of the application process, before it is permanently deleted after 5 years. The system-required core data consists exclusively of title, first name, date of birth, application type, and how you found us. Only our employees in the Human Resources and Talent Development team have access to this core data. The data is not shared with third parties. For more information on data protection regarding job applications, please refer to the following privacy policy: jobs.wupperinst.org/datenschutz.html

c) Sign Up for the Institute's Newsletter, Information Service, and Events
On our website, you can subscribe to our institute's newsletter and/or sign up for our information service.
We use the open-source software CiviCRM, which is a customer relationship management (CRM) system for nonprofit organizations, to send out these communications. For more information, visit civicrm.org. The CiviCRM database is hosted on a server commissioned by the Wuppertal Institute. Only the Wuppertal Institute’s communications team has access to the collected data. Data is not shared with third parties unless explicitly stated (e.g., when registering for events that we organize in collaboration with partners).
For the stated purpose, we use the personal data you entered in the registration form, and in any case, your e-mail address. We use the so-called double opt-in procedure to verify your e-mail address. The legal basis for the processing is your consent pursuant to Article 6(1)(a) of the GDPR. After you confirm, we store your data so that we can send you the relevant information. We store the respective IP address and the times of registration and confirmation in order to verify your registration and, if necessary, to investigate any potential misuse of your personal data. The data you provide will be deleted as soon as it is no longer necessary to achieve the purposes described above. You may revoke your consent at any time by unsubscribing via the corresponding link in the header of an e-mail we have sent you. Alternatively, you may also send us an e-mail to the address provided there.

d) Registration for the Alumni Network
Former employees of our institute have the opportunity to become members of our alumni network. You can sign up for this through our website. We use the service provider CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, to send out the alumni newsletter. To this end, e-mail addresses and names are transmitted via a secure connection to CleverReach’s database and stored as a mailing list. For more information, please visit: www.cleverreach.com/de-de/datenschutz/

By giving your consent, you agree that we may contact you via e-mail to maintain contact with our institute and inform you about events, publications, and activities of the alumni network and the institute. Data will only be disclosed to third parties with your express consent. Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent in writing at any time with future effect. Your personal data will then be deleted.  To do so, please send us an e-mail at: alumni@wupperinst.org

Our online services may contain links to third-party websites (e.g., Bluesky, YouTube, Flickr, LinkedIn, Instagram) operated by providers not affiliated with us. Once you click on a link, we no longer have any influence over the collection, processing, and use of any personal data (such as your IP address or the URL of the page on which the link is located) that may be transmitted to the third party when you click the link, as the actions of third parties are, by their very nature, beyond our control. We assume no responsibility for the processing of such personal data by third parties.

If you click on a link to a third-party offering or activate it by clicking, personal data may be transferred to providers in countries outside the European Economic Area that, from the perspective of the European Union ("EU"), do not guarantee an "adequate level of protection" for the processing of personal data in accordance with EU standards. Please refer to the respective provider’s privacy policy for further information on data processing.

a) Stage
Current information and news about our institute from the social media platforms mentioned above are made available to you via the "Stage" platform on our website. The provider is Jaimo Solutions GmbH, Friedrichstraße 52, 76669 Bad Schönborn, Germany. Jaimo Solutions GmbH does not process any personal data but rather provides you with social media content stored on German servers without linking to the original servers of these services. For more information on data protection, please visit: about.stage.bio/datenschutz

b) Google Fonts
Our online content (e.g., embedded YouTube videos) may include fonts – known as Google Fonts – provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you visit such pages, your browser loads the required web fonts into your browser cache to display text and fonts correctly. To do this, the browser you are using must connect to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. The use of Google Web Fonts is intended to ensure a consistent and visually appealing presentation of our website.
If your browser does not support web fonts, a standard font from your computer will be used. For more information about Google Web Fonts, visit developers.google.com/fonts/faq and see Google's Privacy Policy: www.google.com/policies/privacy/

c) OpenStreetMap / uMap
On our website, we use the services of the open-source project uMap to provide custom maps with markers via an API (application programming interface) from the OpenStreetMap mapping service. This is done to display interactive maps directly on the website, make it easy for you to locate the places we list on the website, and ensure a convenient user experience when using the map feature. The provider is the OpenStreetMap Foundation (OSMF for short), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.
Each time a user accesses a corresponding page, data is retrieved from OSM caching servers (typically the one closest to the user’s location; a list is available at hardware.openstreetmap.org/#tile-caches) as well as from servers in France for uMap, and displayed in the browser. At the same time, data is also sent to these servers and temporarily processed in a log file. Specifically, the following data is stored for each access/request:

• Date and time of the request (timestamp) as well as the IP address of the
  accessing device or server,
• Request details and destination address (protocol version, HTTP method, referrer, User-Agent string),
• Name of the retrieved file and amount of data transferred (requested URL including query string, size in bytes), as well as
• Indication of whether the retrieval was successful (HTTP status code).

This log data is stored for a certain period of time. It is used for statistical analysis, error analysis, and to defend against attacks. Processing the IP address is necessary to enable communication on the Internet. OpenStreetMap’s privacy policy can be found at wiki.osmfoundation.org/wiki/Privacy_Policy and wiki.osmfoundation.org/wiki/Services_and_tile_users_privacy_FAQ.

d) MyFonts
Our website also uses fonts ("MyFonts") provided by Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, MA 01801, USA, to ensure consistent content display. In accordance with the license terms, page-view tracking is performed by counting the number of visits to the website for statistical purposes and transmitting this data to Monotype. The data may be transmitted through the activation of JavaScript code in your browser. To prevent Monotype's JavaScript code from running, you can install a JavaScript blocker (e.g., www.noscript.net). For more information on Monotype's privacy policy, please visit: www.monotype.com/legal/privacy-policy/

e) Hoefler & Co. Fonts
To ensure consistent content display, our website also uses fonts provided by Hoefler & Co., 611 Broadway, Room 725, New York, NY 10012-2608, USA. In accordance with the license terms, page-view tracking is performed by counting the number of visits to the website for statistical purposes and transmitting this data to Hoefler & Co. We have no control over the scope of the data collected in this manner by Hoefler & Co. You can find out what data Hoefler & Co. collects and how it is used at: www.typography.com/home/privacy.php

We use cookies to make our website more user-friendly. Some features of our website (e.g., the OpenStreetMap and uMap mapping services) cannot be provided without the use of cookies, because they require the browser to be recognized even after the user navigates to another page.

Cookies are text files that are stored in or by the web browser on the user’s computer system. Cookies contain a unique string of characters that allows the browser to be uniquely identified when the website is visited again. The legal basis for processing personal data using cookies is Article 6(1)(f) of the GDPR. The purpose of using technically necessary cookies is to simplify the use of websites for users.

The user data collected through technically necessary cookies is not used to create user profiles. The data subject may prevent our website from setting cookies at any time by adjusting the settings of the web browser being used, thereby permanently objecting to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via a web browser or other software programs. This is possible in all common web browsers. If the data subject disables the setting of cookies in the web browser they are using, not all features of our website may be fully usable under certain circumstances.

a) Right of access by the data subject under Article 15 of the GDPR
You have the right at any time to request information regarding whether we are processing personal data concerning you.

b) Right to rectification under Article 16 of the GDPR
You also have the right to have inaccurate or incomplete data corrected.

c) Right to erasure under Article 17 of the GDPR
You have the right to request the erasure of your data if, for example, the data is no longer necessary for the purposes for which it was stored, or if we are not permitted to store the data for other reasons. However, if a law allows us to store data or even requires us to do so, we cannot comply with the request for erasure.

d) Right to Restriction of processing under Article 18 of the GDPR
You have the right to have data restricted if, for example, the accuracy of the data has not been established or you have filed an objection and the review has not yet been completed.

e) Right to data portability under Article 20 of the GDPR
You may request to receive your personal data, which you have provided to the controller, in a structured, commonly used, and machine-readable format.

f) Right to object under Article 21(1) of the GDPR
You have the right to object to the processing. This objection must include an explanation of the specific circumstances under which further processing would be acceptable to you.

g) Right to withdraw consent under Article 7(3) of the GDPR
You have the right at any time to withdraw your consent, in whole or in part, with future effect.

h) Right to lodge a complaint with a supervisory authority under Art. 77 of the GDPR
In the event of data protection violations, you have the right to file a complaint with a supervisory authority. The supervisory authority with jurisdiction over us is:
LDI North Rhine-Westphalia
P.O. Box 20 04 44
40102 Düsseldorf
poststelle@ldi.nrw.de

We reserve the right to change this Privacy Policy at any time in accordance with legal requirements. We therefore recommend that you check our website periodically to stay informed about our current privacy practices.