University of Hamburg - to research, to teach, to educate and form, to homepage

Photo: UHH/Denstorf

Information pursuant to Article 13 of the General Data Protection Regulation (GDPR)

The following outlines our data protection information obligations regarding external parties and provides a transparent overview of how we handle your personal data.

In principle, anyone who is not automatically issued with a uni username by the University of Hamburg (students and employees) is classified as “external.” In exceptional cases, external parties may be granted a uni username for a limited amount of and for a specific purpose, for example, when working under contract to provide agreed services or when performing review procedures required by law.

1. Personal and contact information

a. The Controller as per the GDPR

The Controller as per the General Data Protection Regulation is the University of Hamburg, a legal entity under German public law. Contact details:

University of Hamburg
represented by the President
Mittelweg 177
20148 Hamburg
praesident"AT"uni-hamburg.de

b. Data protection officer

You can also contact the data protection officer at:

Datenschutzbeauftragte/r der Universität Hamburg
Mittelweg 177
20148 Hamburg
dsb"AT"uni-hamburg.de 

2. Purpose(s) of data processing

Your personal data will be processed for the following purpose(s):

  • requesting individual quotes or cost estimates for work or services
  • awarding tenders or issuing calls for tender
  • processing as part of a teaching authorization for Privatdozent:innen or guest lecturers
  • concluding service or work contracts, executing orders, or concluding other contracts
  • settling invoices
  • cooperating with other universities and other cooperation partners
  • corresponding with courts and solicitors for the purpose of defending or asserting legal claims to fulfill legal obligations
  • when granting temporary uni usernames, ensuring IT security and IT operations: which includes, in particular, measures for ensuring comprehensive visibility with regard to potential attacks on networks or on the University’s infrastructure as well as the preparation, aggregation, refinement, and presentation in a portal as a basis for the work conducted by the University of Hamburg Security Operation Center.

3. Legal basis

The legal basis for the data processing is:

We process your personal data on the following legal basis:

  • Article 6 paragraph 1 letter b GDPR (contractual necessity), for example, to conclude contracts with service providers, cooperation partners, or Privatdozent:innen
  • Hamburg procurement regulations (Hamburgische Vergaberichtlinie, HmbVgRL) in conjunction with Article 6 paragraph 1 letter c GDPR
  • Article 6 paragraph 1 letter e, paragraph 3 GDPR in conjunction with Section 4 Hamburg data protection act (Hamburgisches Datenschutzgesetz, HmbDSG), in conjunction with Section 3 and 4  Hamburg higher education act (Hamburgisches Hochschulgesetz, HmbHG) for the performance of a task carried out in the public interest, e.g., Section 3 subsection 12 HmbHG  agreements with companies, as well as the respective duties the University of Hamburg is required to perform
  • The University of Hamburg processes your personal data as part of the procedure for issuing a temporary uni username as well as for the purposes of IT security, information security, data security, and ensuring the ongoing proper operation of IT services. In particular, processing for the purpose of detecting attacks on the University’s IT infrastructure and IT services. The legal basis for individual measures may be in either Article 6 paragraph 1 letters c and e GDPR, in conjunction with Article 32 of the GDPR, or Sections 4 and 6 subsection 1 HmbDSG, the fulfillment of which is served by the corresponding IT system, or in conjunction with measures ordered by special legislation.

4. Categories of personal data

The following categories of personal data will be processed:

  • Address information:
    street and house number, postal code, town or city
    Alternative address or recipient: district, country, street, house number
  • Communication information:
    telephone number, email address
  • Financial information:
    IBAN, BIC, credit institution
  • Identification data:
    academic title, first name and last name, date of birth
  • Authentication information:
    username, password, password clue, security question
  • Information related to research activity:
    activities as a guest professor and lecturer, publications, participation in national and international teaching or research cooperations, academic presentations
  • Protocol data:
    IP address, MAC address, IMEI number, time stamp, computer or server name

5. Categories of data subjects

The following categories of data subjects will be processed:

a. Externals without a uni username

  • visiting scholar
  • external service providers
  • cooperation partners
  • interested individuals

b. Externals without a uni username eligible for one

  • contract teaching staff as defined in Section 17 HmbHG:
  • professors
  • Privatdozent:innen
  • cooperation partners in the context of cross-university degree programs
  • State and University Library Carl von Ossietzky (cooperation partner)

c. Externals with temporary uni usernames

  • external auditors (e.g., tax authorities, German pension insurance)
  • former University members who wish to continue to use the University’s IT resources (requires detailed justification)
  • external service providers as part of contractual IT support services       

6. Recipients and categories of recipients

The personal data will be transmitted to the following recipients or categories of recipients:

Your data will only be transmitted internally within the University of Hamburg to fulfill contractual obligations or additional tasks related to the purposes listed in point 2.

Your data will only be transmitted to parties external to the University of Hamburg in the following circumstances:

  • forwarding your contact information to coordinate between several contractors, in the event another service provider/supplier is commissioned to fulfill the contractual obligations as agreed with you in the scope of our cooperation
  • contracting support services that require access to personal data or where such access cannot be completely ruled out, which includes, for example, IT support services, services as part of settling invoices, or the engagement of tax advisory services
  • disclosing your personal data due to legal obligations  (e.g., tax authorities or customs)

Service providers acting under instructions for the University of Hamburg are engaged under appropriate processing agreements. Responsibility for the processing of this data remains with the University of Hamburg under the data processing agreement.

7. Communication of personal data to a third country

Generally, we do not plan to communicate your personal data to a third country or international organization.

In exceptional cases (e.g., use of IT services) where data must be transmitted to a third country or access from a third country cannot be ruled out, specific preventative privacy law measures will be taken. An adequacy decision for the recipient in a third country issued by the EU Commission ensures an appropriate level of data protection pursuant to Article 45 GDPR. In addition, an appropriate level of data protection can be provided by concluding standard contract provisions pursuant to Article 46 paragraph 2 letter c GDPR. These standard contract provisions are available on request.

8. Period of storage

Personal data will be stored for the following period:

Data will be stored according to the applicable periods, either

as required by law or for the shortest storage period possible as determined by the processing purpose. You can find an overview of the applicable retention periods in the University of Hamburg retention period list. 

On expiry of the retention period, the University of Hamburg must submit the data processed to the University Archives.

If appropriate for archiving, the file—including your personal data—will be forwarded to the University Archives for permanent storage.

9. Your rights

You have the following rights:

a. Right to withdraw consent

If the processing of your data is based on your consent, you may withdraw your consent at any time with future effect and without observing any formal requirements. Upon receipt of withdrawal of your consent, your data may no longer continue to be processed and must be deleted immediately if there is no other legal basis for their processing. This does not affect any previous processing of data and information.

b. Right to information

You have a right to information from the Controller pursuant to Article 15 GDPR.

c. Right to rectification

You may request that the Controller rectify any inaccurate data pursuant to Article 16 GDPR.

d. Right to erasure (“right to be forgotten”)

You have the right to have your personal data and information deleted by the Controller—that is, “the right to be forgotten” pursuant to Article 17 GDPR.

e. Right to restriction of processing

You have the right to restrict the processing of your personal data pursuant to Article 18 GDPR.

f. Right to data portability

If you have granted your consent to the processing of your data or an application for data processing has been made and the processing is conducted using automated means, you have a right to data portability (Article 20 GDPR).

g.  Right to object

If the processing of your data is based on Article 6 paragraph 1 letters e or f GDPR, you have a right to lodge an objection to this processing with the Controller pursuant to Article 21 GDPR.

h. Right to lodge a complaint

You have the right to lodge a complaint with the Hamburg Commissioner for Data Protection and Information (HmbBfDI) against the processing of your personal data.

i. General information on these rights

In some cases, your request cannot or may not be complied with. If there are statutory grounds why your request cannot be complied with, you will be informed of the reason for denial.

10. Provision of personal data

You are not obliged to provide the University of Hamburg with your personal data and information; however, failure to do so may render the University of Hamburg unable to process and handle your query or conclude a contract with you.

In individual cases, personal data may be required to fulfill legal obligations (e.g., documentation requirements) or within the framework of contractual obligations.

Failure to provide personal information may result in a contractual penalty for contracts where these data are part of a contractual agreement, or legal consequences where legal obligations are subject to fines or penalties.

11. Advice on exercising your rights

To exercise your rights, contact datenschutz"AT"uni-hamburg.de.

In some cases, your request cannot or may not be complied with. If there are statutory grounds why your request cannot be complied with, you will be informed of the reason for denial. For example, according to Section 11 subsection 5 HmbDSG, your rights may be restricted in cases where data is further processed for scientific research, historical research, or statistical purposes and the exercise of your rights would likely render the purpose impossible or seriously impair it.