According to Art. 4(2) of the GDPR the legislator understands to mean the term ‘processing’ the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination erasure or destruction related to personal data
In accordance with Art. 13 and 14 of the GDPR we inform you about the processing of personal data that may have been collected and/or may be collected by us in the provision, procurement, acquisition or conservation of archive resources or library stocks.
1. Name and Contact Details of the Controller Responsible Under Data Protection Law
Franckeplatz 1, Haus 37
represented by their director Prof. Dr. Thomas Müller-Bahlke
Telephone: 0345 2127-400
Fax: 0345 2127-433
The Francke Foundations are a foundation under public law, registered in the foundation register of the federal state of Saxony-Anhalt.
Name and Contact Details of the Data Protection Officer
Franckeplatz 1, Haus 37
Dr. Jürgen Gröschl
If you have any questions on the protection of data at the Francke Foundations or on your rights, please contact our data protection officer.
2. What categories of personal data do we process?
The following personal data may have been collected and/or may be collected by us in the provision, procurement, acquisition or conservation of archive resources or library stocks:
- First name and surname
- Academic degree/title
- Date of birth
- Name/description of the institution/organisation/community, etc. represented by you
- Postal address
- Telephone number
- E-mail address
- Research topic
- Date of registration/date of use
- Shelf mark of the used sources
- Order date, date of return of the used sources
3. For what purposes and on what legal basis do we process personal data?
We use your data for the following purposes:
- To register the users of the archive resources and of the library stock in the reading room. The registration by stating the main interest and/or research topic is the basis for ensuring that the employees working in the Study Centre can provide professional advice. The legal basis for the owner-user relationship is point (b) of Article 6(1) GDPR (rules governing use); the legal basis for professional advice is point (f) of Article 6(1). The legitimate interest of the Study Centre is the provision of information to the employees about current research topics in order to guarantee its statutory tasks.
- For the daily registration of the users in the user book in the reading room for statistical purposes and for the investigation of any potential loss or damage. The legal basis for this is point (f) of Article 6(1) GDPR. The legitimate interest of the Study Centre is the fulfilment of its statutory accountability and responsibility for the preservation of historical cultural assets.
- So that the employees of the Study Centre are able to provide the archive materials, books and other media ordered by the users by means of library tickets, e-mail or the online ordering system. The relevant legal basis is point (b) of Article 6(1) GDPR (rules governing use) and point (f) of Article 6(1). The legitimate interest of the Study Centre is the obligation to be able to trace any loss of or damage to the sources.
- To handle the photo jobs and invoicing at the photo service point. This is done on the basis of point (c) of Article 6(1) in conjunction with Section 147 AO (Fiscal Code of Germany) and point (f) of Article 6(1) GDPR. The legitimate interest of the Study Centre is the provision of proof of the sources that have been reproduced, and for what purpose of use.
- So that our qualified personnel can answer the enquiries of users submitted by letter, e-mail or phone. The legal basis for this is point (f) of Article 6(1) GDPR. The legitimate interest is the statutory obligation to document the fulfilment of the Study Centre’s tasks.
- To issue a donation receipt and/or to conclude a gift agreement. Where desired by the person making the gift, a provenance entry can be made in the OPAC of the library and/or in the database of the archive consisting of the name and date of the gift. The legal basis is point (a) and (b) of Article 6(1) GDPR.
- To document the restoration of existing archive or library media by stating information on the persons who have supported such restoration by a donation and/or by taking on a sponsorship. The legal basis is point (a), (b) and (f) of Article 6(1) GDPR. The Study Centre’s legitimate interest is the comprehensive documentation in order to pass on the restoration works to the following generations.
- To conclude contracts on the lease of guest apartments of the Francke Foundations. The legal basis is point (b) of Article 6(1) GDPR.
4. What categories of data recipients are there?
The Head of the Study Centre as well as the Study Centre employees who handle the use of our resources and, for technical reasons, our IT administrators have access to the data collected from you. During daytime use in the reading room, your name stated in the user book can be accessed by other reading room users. To support scientific topics, the Director of the Francke Foundations and the Head of the Research Department receive information on your contact details and research priorities. Photo job invoices are handed over to the employees in the Francke Foundations Accounting Department. Agreements on gifts are processed by employees in the Francke Foundations Administrative Department. If you agreed to take on a sponsorship for a restoration, this will be notified to the Director, the President and the Secretary of the Association of Friends as well as the accounting staff members of the Francke Foundations. If a lease contract is concluded on a guest apartment, the head of administration and the accounting staff of the Francke Foundations receive your data.
5. Are the data intended to be transmitted to third countries?
Your data will not be transmitted to any country outside the European Union.
6. How long will your data be retained?
Your personal data will be erased as soon as the purpose for which it was saved no longer applies. We erase data collected for the purpose of proving permission 3 years after the end of the processing work for which the permission was granted according to Section 31 of the German Act on Regulatory Offences (OWiG).
Your registration data will be reviewed at the start of every new year. The data of inactive users will be erased 36 months after our resources have last been used. Library tickets will be retained 24 months after lending and then destroyed. Data transmitted for pre-orders by e-mail are erased regularly at the end of each year. Order forms for photo jobs are destroyed 2 years after the order was completed; related invoices are destroyed 10 years after the relevant annual financial statement. Enquiries submitted in writing are stored jointly with their replies for 10 years for the purpose of proof (in the form of a printout if sent by e-mail). Selected enquiries may be permanently archived to document the Study Centre’s work for historical research purposes.
Donation receipts are stored after the statutory period of 10 years in the Accounting Department of the Francke Foundations or in the secretariat of the Association of Friends. Contracts are stored in the Administrative Department and are passed on from there to the archive for permanent storage. A copy of the contracts is situated in the office of the Head of the Study Centre; this copy will be destroyed after archiving. The provenance entries are permanently documented in the archive database and/or in the catalogue of the Common Library Network (Gemeinsamer Bibliotheksverbund, GBV), which is hosted in Göttingen. The related declarations of consent are retained permanently.
As the restoration records need to be permanently retained and archived for reasons of stock protection documentation, the personal data of the donors will also be permanently archived. Bank transfer confirmations are destroyed after 10 years according to the accounting regulations.
Any approvals granted by you as an author for the digital publication of your works will be permanently archived. Requests for approval of publication sent by e-mail are deleted after three years.
Lease contracts for guest apartments are stored for 10 years.
7. Which rights do you have?
In accordance with applicable law, you have various rights concerning your personal data. If you would like to assert your rights, please direct your enquiry by email or by post to the data protection officer named above and clearly identify yourself. Please find an overview of your rights below.
7.1 Right of Access of the Data Subject Pursuant to Art. 15 GDPR and Section 34 FDPA
You have the right to obtain from us confirmation as to whether or not personal data concerning you is processed. You may obtain free information from us about the personal data on your identity we store. This includes information about the purposes of processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data has been or will be disclosed, and, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
7.2 Right to Rectification acc. to Art. 16 of the GDPR
You have the right to request us to immediately rectify inaccurate personal data concerning you. Taking the purposes of processing under consideration in this context, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
7.3 Right to Erasure acc. to Art. 17 of the GDPR and Section 35 FDPA
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and processing is not necessary:
- The purpose for which personal data was processed has ceased to apply.
- You withdraw your consent on which the processing is based and there is no other legal ground for the processing.
- You object to the processing on grounds relating to a particular situation pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for the processing.
- The personal data has been unlawfully processed.
- The erasure of personal data is required in order to fulfil a legal obligation under EU law or the law of the EU member states to which we are subject.
7.4 Right to Restriction of Processing acc. to Art. 18 of the GDPR
You have the right to obtain from us restriction of processing where one of the following applies:
- The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
- The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
- We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims.
- You have objected to processing pursuant to Art. 21(1) of the GDPR pending the verification whether our legitimate grounds override yours.
7.5 Right to Data Portability acc. to Art. 20 of the GDPR
Acc. to Art. 20 of the GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit such data to another controller without hindrance from us where the processing is based on consent pursuant to point (a) of Art. 6(1) of the GDPR or point (a) of Art. 9(2) of the GDPR or on a contract pursuant to point (b) of Art. 6(1) of the GDPR and the processing is carried out by automated means, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising your right to data portability according to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.
7.6 Right to Object acc. to Art. 21 of the GDPR
You have the right to object, on grounds relating to a particular situation, at any time to processing of personal data concerning you which is necessary due to a legitimate interest on our part or to perform a task carried out for reasons of public interest or for the exercise of official authority.
If you make use of your right, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
7.7 Right to Withdraw Consent Given Under Data Protection Law
If you have given us consent, you have the right to withdraw your consent at any time. In this case, any data processing performed by us until such withdrawal will remain lawful. You can send us a message to email@example.com in that regard.
7.8 Right to Lodge a Complaint with a Supervisory Authority acc. to Art. 77 of the GDPR
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes applicable law.
Nevertheless, we would appreciate it if you could contact us before doing so.
The supervisory authority in charge for us is:
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Telephone: +49 (0)391 81803-0
Fax: +49 (0)391 81803-33
8. Is it Necessary to Provide my Personal Data?
The provision of your personal data is not mandatory. However, we will not be able to accept your registration unless you provide us with the necessary data.
9. Is Automated Decision-Making incl. Profiling applied?
We do not apply automated decision-making incl. profiling (Art. 22 of the GDPR).
10. Security Note
We protect your personal data by taking all technical and organisation measures possible to us to meet the protection goals.
We are unable to guarantee data security when communicating by e-mail so we recommend communication of confidential information by mail.
Halle, 15 August 2019