Attention: The English version of our privacy notice is for information purposes only. Only the GERMAN VERSION is authoritative.
The Ernst Strüngmann Institute (ESI) gGmbH of the Max Planck Society takes the protection of your personal data very seriously. We process personal data gathered when visiting our website, our social media channels, at events or during applications for jobs in compliance with applicable data protection legislation. We neither publish your data nor transmit them to third parties on an unauthorized basis. In the following sections, we explain which data we record when you visit our website, our social media channels, participate in an event or apply for a job, and exactly how they are utilized.
The entity responsible in the meaning of the General Data Protection Regulation (GDPR) and other national data protection acts as well as other data protection legislation is the
Ernst Strüngmann Institute (ESI) gGmbH of the Max Planck Society
Deutschordenstr. 46, 60528 Frankfurt am Main, Germany
Phone: +49 (0)69 96769 0
Website: https://www.esi-frankfurt.de
HEC Harald Eul Consulting GmbH
Data Protection Officer of Ernst Strüngmann Institute (ESI)
Auf der Höhe 34
D-50321 Brühl, Germany
eMail: datenschutz(at)esi-frankfurt.de
Individuals affected have, in principle, the following rights, to the extent that no legal exceptions are applicable in individual cases:
We only ever collect and use personal data to the extent required to provide a functional website as well as our content and services. The collection and utilization of our users’ personal data is carried out regularly with the users’ consent. An exception applies in instances where processing of the data is permitted by statutory provisions.
If we obtain the consent of the data subject to carry out personal data processing, the legal basis is Article 6, para. 1, lit. a EU General Data Protection Regulation (GDPR). When it is necessary to process personal data in order to fulfil a contract whose contractual party the data subject is, the legal basis is Article 6, para. 1, lit. b GDPR. This also applies to processing operations required in order to implement pre-contractual measures. If processing is required in order to safeguard a legitimate interest of the ESI or a third party and if the interests, fundamental rights and fundamental freedoms of the data subject don’t override the first-mentioned interest, the legal basis for processing is Article 6, para. 1, lit. f GDPR.
The personal data of the data subject is erased or blocked as soon as the purpose of storage no longer applies. Data can also be stored if this is required under European or national legislation in EU directives, laws or other provisions to which the ESI is subject. Data is also blocked or erased if the retention period prescribed by the above-mentioned legislation expires, unless the data is required to be stored longer for the purpose of concluding or performing a contract.
Every time our website is accessed, our servers and applications automatically log data and information from the accessing computer system. The following data is collected:
The data is saved in our systems’ logfiles. This data is not stored together with other personal data relating to the user.
The legal basis for the temporary saving of data and logfiles is Article 6, para. 1, lit. f GDPR. Data is saved in logfiles in order to ensure the functional capability of the website. In addition, the data serves to optimize the websites, eliminate faults and ensure the security of our IT systems. These purposes also constitute our legitimate interest in data processing according to Article 6, para. 1, lit. f GDPR.
The data is deleted as soon as it is no longer required in order to fulfil the purpose of its collection. In the case of the collection of the data for the purpose of providing the website, this applies when the session in question is finished. In the case of saving data in logfiles, this applies after a maximum of seven days. Saving of data beyond this period is possible. In this case, users’ IP addresses are deleted or altered so that they can no longer be attributed to the accessing client.
Data collection for the purpose of providing the website and the saving of data in logfiles are absolutely necessary in order to operate the website. It is therefore not possible for the user to object.
We use the open source web analytics service Matomo to collect statistical data on user behavior. With the help of Matomo, we are able to collect and analyze data on how visitors use our website. This allows us to find out, among other things, when which pages were viewed and from which region they came. In addition, we collect log files from the calling system each time our website is accessed:
The following data is additionally collected, if JavaScript is activated:
The saving and analysis of data is only carried out on servers rented by ESI to run the website www.esi-frankfurt.de. The legal basis for the processing of personal user data is Article 6, para. 1, lit. f GDPR. By processing personal user data we are able to analyse our users’ utilization behaviour. Analysis of the data collected enables us to compile information on the use of the individual components of our website. This helps us to improve our website and their user-friendliness on an ongoing basis. These purposes also constitute our legitimate interest in data processing according to Article 6, para. 1, lit. f GDPR. Anonymization of the IP address sufficiently meets the users’ interest in the protection of their personal data.
The data is deleted after the final annual totals for the access statistics are formed.
Of course, you have the opportunity to object to your data being collected: In your browser, activate the Do-Not-Tracksetting. If this setting is active, our server does not save any of your data. Important: Do-Not-Trackgenerally only applies to the one device and browser on which the setting is activated. If you use several devices/browsers, you must activate Do-Not-Track separately on each one.
This data is not saved together with other personal data relating to the user.
This website uses the open source web analytics service Matomo.
With the help of Matomo, we are able to collect and analyze data about how visitors use our website. This allows us to find out, among other things, when which pages were viewed and from which region they came. We also collect log files (e.g., IP address, referrer, browsers and operating systems used) and can measure whether our website visitors perform certain actions (e.g., clicks, purchases, etc.).
The use of this analysis tool is based on Art. 6 (1) lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user's terminal device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
We use IP anonymization for analysis with Matomo. This means that your IP address is shortened before analysis so that it can no longer be clearly assigned to you.
We have configured Matomo so that Matomo does not store any cookies in your browser.
We host Matomo with the following third-party provider:
Hetzner Online GmbH
Industriestraße 25
D-91710 Gunzenhausen
Germany
Phone: +49 (0)9831 505-0
Fax: +49 (0)9831 505-3
eMail: info[at]hetzner.com
Ernst Strüngmann Institute (ESI) gGmbH of the Max Planck Society
Administration
Deutschordenstraße 46
60528 Frankfurt am Main, Germany
Email: administration@esi-frankfurt.de
HEC Harald Eul Consulting GmbH
Data Protection Officer Ernst Strüngmann Institute (ESI) gGmbH of the Max Planck Society
Auf der Höhe 34
50321 Brühl, Germany
Email: datenschutz@esi-frankfurt.de
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and other applicable data protection regulations. Details are provided below. Further details or additional information regarding the purposes of data processing can be found in the respective contractual documents, forms, a declaration of consent, and other information provided to you.
Your personal data is processed to handle your application for a specific job posting or as a speculative application, and in this context, in particular for the following purposes: reviewing and assessing your suitability for the position to be filled; evaluating your performance and conduct to the extent permitted by law; where applicable, for registration and authentication for the application via our website; where applicable, for drafting the employment contract; to provide evidence of transactions, orders, and other agreements, as well as for quality control through appropriate documentation; to fulfill general due diligence obligations; to conduct statistical analyses for corporate management; for travel and event management, travel booking, and travel expense reimbursement; for access rights and ID management; for cost tracking and controlling; for reporting; for internal and external communication; accounting and tax assessment of employee benefits, occupational safety and health protection, contract-related communication (including scheduling appointments) with you, asserting legal claims and defending against legal disputes; ensuring IT security (including system and plausibility tests) and general security, such as building and facility security; ensuring and enforcing property rights through appropriate measures, including, where necessary, video surveillance to protect third parties and our employees, as well as to prevent criminal offenses and secure evidence in the event of such offenses; Ensuring data integrity, preventing and investigating criminal offenses; ensuring data authenticity and availability, and facilitating oversight by supervisory bodies or audit authorities (e.g., internal audits).
Beyond the actual fulfillment of the (preliminary) contract, we may process your data if necessary to safeguard our legitimate interests or those of third parties. Your data will only be processed if and to the extent that no overriding interests on your part preclude such processing, in particular for the following purposes: Measures to further develop existing systems, processes, and services; where applicable, training and (further) development of AI applications; cross-checks against European and international counterterrorism lists, as well as other fraud or abuse prevention measures, to the extent that these go beyond statutory obligations; enrichment of our data, including through the use or research of publicly available data where necessary; benchmarking and other comparison and selection procedures, where applicable using artificial intelligence (AI); development of scoring systems or automated decision-making processes; building and facility security (e.g., through access controls and video surveillance), to the extent that this goes beyond general duties of care; internal and external investigations, security checks.
The processing of your personal data may also be based on your consent for certain purposes (e.g., obtaining references from previous employers or using your data for future job openings). As a general rule, you may withdraw this consent at any time. You will be informed separately about the purposes and the consequences of withdrawing or refusing consent in the corresponding consent form.
As a general rule, the withdrawal of consent takes effect only for the future. Processing that took place prior to the withdrawal is not affected and remains lawful.
ESI is also subject to a wide range of legal obligations. These primarily include statutory requirements (e.g., the Works Constitution Act, the Social Code, commercial and tax laws), but may also include regulatory or other official requirements (e.g., the employers’ liability insurance association). The purposes of processing may include identity and age verification, fraud and money laundering prevention (e.g., cross-checks against European and international counterterrorism lists), occupational health management, ensuring workplace safety, fulfilling tax-related audit and reporting obligations, and archiving data for data protection and data security purposes, as well as for audits by tax advisors/auditors, tax authorities, and other government agencies. In addition, the disclosure of personal data may be required in the context of administrative or judicial proceedings for the purposes of gathering evidence, criminal prosecution, or the enforcement of civil claims.
To the extent necessary for the contractual relationship with you and the job application you have submitted, we may process data lawfully obtained from other agencies or other third parties. In addition, we process personal data that we have lawfully obtained, received, or acquired from publicly accessible sources (such as commercial and association registries, resident registries, the press, the Internet, and other media), to the extent that this is necessary and we are permitted to process this data in accordance with legal provisions.
Relevant categories of personal data may include, in particular:
Information about you on the Internet or on social media
Within our organization, your data is provided to those internal departments or organizational units that require it to fulfill our contractual and legal obligations (such as managers and department heads who are seeking a new employee or are involved in the decision-making process for filling a position, the accounting department, the company physician, occupational safety, etc.) or in connection with the processing and pursuit of our legitimate interests. Your data will be disclosed to external parties exclusively
We will not otherwise disclose your data to third parties unless we inform you separately. To the extent that we engage service providers under a data processing agreement, your data is subject to the security standards we have specified to ensure that your data is adequately protected. In all other cases, recipients may use the data only for the purposes for which it was transmitted to them.
We generally process and store your data for the duration of your application. This also includes the initiation of a contract (pre-contractual legal relationship).
In addition, we are subject to various retention and documentation requirements arising, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified therein extend up to ten years beyond the end of the contractual relationship or the pre-contractual legal relationship. If you are not hired, your application documents will be destroyed upon completion of the application process. Electronic data will be deleted accordingly after six months. If we wish to store your data for longer in case of future vacancies, or if you have added your data to an applicant pool, the data will be deleted at a later date; details regarding this will be provided to you in connection with the respective process.
If the data is no longer necessary for the fulfillment of contractual or legal obligations and rights, it will be deleted on a regular basis, unless its—temporary—further processing is necessary to fulfill the purposes listed in Section 2.2 based on an overriding legitimate interest of our company. Such an overriding legitimate interest exists, for example, when deletion is not possible—or is possible only with disproportionately high effort—due to the specific nature of the storage. In these cases, we may continue to store your data for a period consistent with the purposes, even after the termination of our contractual relationship, and may use it to a limited extent if necessary. In principle, in such cases, erasure is replaced by a restriction on processing. In other words, the data is blocked from its usual use through appropriate measures.
Data may be transferred to entities in countries outside the European Economic Area (EU/EEA) (so-called third countries) if this is necessary to fulfill a contractual obligation to you (e.g., applying for a job abroad), or if it is based on a legitimate interest of ours or a third party’s, or if you have given us your consent.
In this context, the processing of your data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on our behalf. If no decision by the European Commission regarding an adequate level of data protection exists for the country in question or for specific sectors within a third country, appropriate contracts (such as EU Standard Contractual Clauses) and additional measures may be used as the basis for the transfer. Information regarding the appropriate or adequate safeguards and the possibility of obtaining a copy of them may be requested from the company’s data protection officer.
Under certain conditions, you may exercise your data protection rights with us.
Every data subject has the right of access under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, and the right to data portability under Article 20 of the GDPR. With regard to the right of access and the right to erasure, the restrictions set forth in Sections 34 and 35 of the Federal Data Protection Act (BDSG) apply. In addition, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR in conjunction with Section 19 of the BDSG).
Your requests to exercise your rights should, if possible, be submitted in writing to the address provided above or directly to our Data Protection Officer.
You are only required to provide the data necessary for processing your application or for a pre-contractual relationship with us, or data that we are legally obligated to collect. Without this data, we will generally not be able to continue with the application and selection process. If we request additional data from you, you will be separately informed that providing such information is voluntary.
We do not use purely automated decision-making processes pursuant to Article 22 of the GDPR. Should we nevertheless use such a process in individual cases in the future, we will inform you of this separately, provided this is required by law.
The objection may be submitted in any form and should, if possible, be addressed to
Ernst Strüngmann Institute (ESI) gGmbH of the Max Planck Society
Data Protection
Deutschordenstraße 46
60528 Frankfurt am Main, Germany
Email: datenschutz@esi-frankfurt.de
Please note that this information regarding our data processing in accordance with Articles 13, 14, and 21 of the GDPR may change from time to time.
We collect, process and store your data exclusively for the purpose of contacting you for studies at the Ernst Strüngmann Institute (ESI) for Neuroscience. To collect and process your data, we use the survey tool LimeSurvey, provided by the GWDG. The privacy notice of LimeSurvey, operated by the GWDG, can be found here: LimeSurvey. The legal basis is your consent according to Art. 6 para. 1 lit. a GDPR.
In addition to your contact details and the data requested in the form, we also store the date and time at which you made the entry, as well as whether you have consented to the processing of your personal data. If we contact you, we also store the date and time of the contact. In addition, you can chose to be contacted for other studies in the future, and be added to our subject database for this purpose. For this you must give your consent separately. You can find more information on our subject database attached to the LimeSurvey form, and also attached here. The information on whether you have agreed to be included in the subject database will also be stored. If you agree, further recruitment attributes such as handedness or mother tongue can be asked for and stored in the database in order to be able to propose suitable studies to you in the future. For more details, please refer to the consent form for our subject database. Your data will not be passed on to third parties. If you participate in a study, you will be informed about this study separately and your consent to participate will be obtained separately for each study.
Your data will be stored for as long as the purpose of the storage, i.e. contacting you to participate in a study, is fulfilled. You can revoke your consent at any time and request the deletion of your contact data. To do so, write an e-mail to studien(at)esi-frankfurt.de.
We hold events in person at our institute as well as virtually or hybrid (meaning in person and online at the same time). For this purpose we collect and process personal data, for which software solutions can also be employed. If the event takes place online resp. hybrid, video conferencing systems are used. Depending on the event format, we use other communication platforms or chat services, provide file exchange systems or use event management software.
The purpose of the data processing is the effective content-related and technical organization and implementation of events such as conferences, workshops, lectures, discussions or talks. Depending on the format of the event, video conferencing systems as well as other software solutions such as chat or cloud systems may be provided to facilitate the smooth exchange of information and files between the persons participating in the event. Those affected by the data processing are the participants in our events. These can be employees of the ESI as well as external third parties (e.g. alumni, interested parties, conference participants, contractual partners).
If personal data of employees of the ESI is processed during the event, insofar as this is necessary for the establishment, implementation or termination of the employment relationship, § 26 BDSG is the legal basis for the data processing. In the context of contractual relationships with external third parties, Art. 6 para. 1 lit. b GDPR is the legal basis for the data processing. If there is no contractual relationship, Art. 6 para. 1 lit. f GDPR is the legal basis. Our legitimate interest here is the effective organization and implementation of the event. Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 para. 1 lit. a GDPR is the legal basis.
We collect and process the following data of the participants before, during, and after the event for the purpose of organization and execution as well as for accounting purposes, usually by means of an online survey tool of the GWDG (see below): Name, title, contact details, gender, country, institute affiliation as well as content that participants provide us with (e.g. abstracts).
When using software solutions, especially if the event takes place online or is held hybrid using video conferencing systems, data can be additionally processed by the software providers.
In the case of online or hybrid events, the scope and type of this data essentially depend on the information you yourself provide before or during participation in the online event. The following data may be processed by the software providers: Details of the user (e.g. name, e-mail address, password, institute affiliation), metadata (IP addresses, device information) and, in case of dial-in by telephone, phone number, country, start and end time of the dial-in. If the microphone and/or video camera are switched on, this data from your terminal device is also processed for the purpose of transmission during the meeting.
Depending on the event format and software used, you yourself may share content such as files or presentations with other participants, which may then also become part of the processing. This also includes the use of survey, question or chat functions in the video conferencing solutions used.
(Online or hybrid) events can be recorded and/or broadcast. The recorded material can be published after the event, for example on an internet video platform. If recording and/or publishing is planned, you will be informed in advance and, depending of the legal basis for the processing, may be asked for your consent.
The personal data that are the subject of processing are generally deleted when there is no need to prevent their deletion. This is regularly the case when the purpose for which the data was collected ceases to apply. If there is no requirement preventing the deletion, the data is regularly deleted before the end of one year after the end of the respective event. A requirement contrary to this may be, for example, the fulfillment of contractual services, the examination of warranty and guarantee claims as well as legal documentation and retention obligations.
As a matter of principle, we do not disclose personal data to third parties unless it is intended for disclosure. The data intended for disclosure are those processed by the respective software providers used to fulfill the order, for example your email address when registering for an event using a survey tool (see below). In the case of online or hybrid events where you join online independently, you provide most of the data yourself to the respective provider and can thus determine its type and scope yourself.
We have concluded a data processing agreement (DPA) with all software providers whose services are (or can be) currently used, in accordance with Art. 28 GDPR. This regulates the manner in which the data is processed by the provider. If the provider is based in the USA, the EU standard contractual clauses are also part of the data processing agreement. These clauses regulate the lawful transfer of data to the USA. For information on how the individual providers process personal data, please consult their privacy notices as indicated below:
Zoom: Video conferencing service provided by Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, California (95113), USA. Your data may be processed in a third country because Zoom is based in the US. See Zoom’s Privacy Statement.
Thank you for your interest in employment opportunities at ESI, Frankfurt. We welcome any …
Privacy notice for our social media channels
The ESI provides the following social media websites:
As the provider of these websites, we work together with the provider of the respective social media platform in the sense of Art. 4 No. 7 GDPR as well as Art. 26 GDPR:
Mastodon is an open source, non-commercial microblogging service. In its decentralized structure, our account is located on the privacy-friendly, privately operated instance of hessen.social: https://hessen.social Accordingly, we are jointly responsible with the operator of the Mastodon instance hessen.social.
When you visit our social media websites, the controllers process personal data. Below we inform you of which data these are, how they are processed and what rights you have in this context. We as the controller of these websites have concluded agreements with the provider of the respective social media platform which e.g. set out the conditions for using the websites. The terms of use of the respective provider as well as the conditions and guidelines listed there at the end are authoritative.
Use of insights and cookies
The providers of the social media platforms also provide us with user statistics (so-called analytical services or page insights data) for our websites on the social media platforms based on the actions and interactions of our followers (e.g. likes, shares, comments etc., the number of followers, individual page area access, scope of a post as well as statistics about the followers based on age, language, place of origin or interests), which help us to contact our followers and interested parties, understand the use and scope of our contributions, evaluate contents and identify user preferences and design our websites on the social media platforms to be as target-group-friendly as possible. We cannot influence or access the creation or processing of these user statistics and the underlying data; this is performed on the sole responsibility of the provider of the respective social media platform.
The provider of the respective social media platform receives, records and processes the information stored in the cookies. This also includes services provided by the provider or the provider group of the social media platforms as well as services provided by other companies that use the social media platforms and which are visited by the user. In addition, other positions such as partners or even third parties can use cookies on the social media platforms to provide services to the companies advertising on the social media platforms. For more information on the use of cookies by the provider, please see the latter’s Cookie Policy.
Purposes of data processing
The data entered on our websites on social media platforms such as comments, questions, videos, images, likes, public messages, job preferences and selection etc. are published by the provider of the social media platform and only used or processed by us for the purposes listed below. We reserve the right to delete contents, where necessary. If applicable, we will share your contents on our social media websites, if this is a function of the website, and communicate with you via the website.
The websites provided by us contain links to our other company sites on social media platforms. You can identify links to the websites of the social media platforms e.g. by the respective company logo. If you follow this link, you can reach our company sites on the respective social media platforms. When you click on a link to a social media platform, a connection is established with the servers of the social media platform. This informs us that you have visited our website. In addition, further data is transmitted to the providers of the social media platform. These are, for example:
If you are already logged into the respective social media platform at the time that you activate the link, the provider of this social media platform may be able to determine your user name or even your real name based on the transmitted data and attribute this information to your personal user account on the social media platform. You can prevent this allocation to your personal user account, if you log out of your user account first.
In some cases, we include external content (our own or from third parties) on our website to complement a post, e.g. YouTube videos. The content is only loaded after the user has clicked on it and is provided with an overlay that explains the data transfer and revocation options. When clicking on the content, personal data may be transmitted to the respective third-party platforms. No data is transmitted until the user clicks on the content. Consent to the transmission can be revoked at any time for the future by reloading the website.
Establishing contact
You can contact us via some of our websites on social media platforms. We process your data in order to answer your query and, if applicable, to send you the requested information materials. Your data may also be transmitted to the position responsible for your query. This position may be a third party. A transmission only takes place, if we are authorized to carry out the transmission under data protection law.
If you send us a query on the social media platforms, we may, depending on the required response, also refer to other, secure communication channels which guarantee confidentiality.
You always have the option to send us confidential enquiries via our address listed under contact details.
Statistical evaluations
Information processing is intended to allow us as the provider of the social media website to receive statistics (so-called page insights data) which the provider of the social media platform makes available based on the visits to our website. For example, it enables us to gain knowledge about the profiles of the visitors who like our website or use the applications on our website, so that we can provide them with more relevant contents and develop functions which may be of greater interest to them.
In order for us to better understand how to use our website to better reach interested users, the recorded information is also subjected to demographic and geographical analyses which are then made available to us. We can use this information in order to offer targeted interest-based contents without obtaining direct knowledge of the visitor’s identity. Where visitors use social media platforms on several devices, the recording and analysis can also be implemented across several devices, if these are registered users who are logged into their profiles.
The created visitors’ statistics are transmitted exclusively in an anonymized format. We do not have any access to the underlying data.
You can find more information on the processing of your personal data by the provider of the respective social media platform in the context of creating and processing user statistics by checking the information about user statistics on the following websites by the respective social media platform:
By its nature, the Mastodon instance hessen.social does not collect and process such visitor statistics or insights.
Legal basis, storage period, recipients and source of the data
Legal basis for data processing
We provide these social media websites in order to present ourselves to the users and other interested parties who visit our websites and to communicate with them. The personal user data are processed on the basis of our legitimate interests in an optimized company and product presentation (Art. 6 para. 1 lit. f GDPR).
Recipients or categories of recipients
We do not transfer the data to third parties.
The servers of the social media platforms are located in the USA and in other countries outside the European Union. As a result, the providers of the social media platform can also use the data in countries outside the European Union. Please note that companies in these countries are subject to data protection law that does not generally protect personal data to the same extent as is the case in the European Union.
Please note that we cannot influence the scope, type and purpose of the data processing by the provider of the social media platform. For more information on the use of your data by the social media platform linked to on our website, please see the privacy policies of the respective social media platforms:
Duration of storage
We do not save the data.
Source of data
The data are not collected directly from the data subjects but instead made available by the provider of the social media platform: