This data protection declaration serves to fulfill the information obligation required under Article 13 EU GDPR when collecting data from Data Subjects at the time of collection.

Name and address of responsible party
Universitätsklinikum Frankfurt
Theodor-Stern-Kai 7
60590 Frankfurt am Main

Post office address
Universitätsklinikum Frankfurt
Theodor-Stern-Kai 7
60590 Frankfurt
T +49 69 63 01 -0
F +49 69 63 01 -6301
Internet: www.unimedizin-ffm.de

If the Data Subject has any queries or complaints about data protection, the Data Protection Officer at Universitätsmedizin Frankfurt can be contacted.

Datenschutzbeauftragte/Data Protection Officer
Universitätsklinikum Frankfurt am Main
Theodor-Stern-Kai 7
60590 Frankfurt am Main
T +49 69 63 01-7235
E-Mail:  datenschutz@unimedizin-ffm.de

Data Processing
When the Data Subject visits and uses our website, various personal data is processed, depending on the functions chosen. Information on the respective functions can be found below.

First contact
When contacting members of the Universitätsmedizin Frankfurt (e.g. via contact form or e-mail), personal details will be saved for the purpose of processing the request as well as in the event that follow-up questions arise. After the request has been processed or after the legal obligation or the service used has been fulfilled, this data will be deleted, unless the storage of the data is necessary to implement the legitimate interests of the Universitätsmedizin Frankfurt or due to a legal regulation (e.g. law, ordinance, statutes of the Universitätsmedizin Frankfurt, etc.).

Scheduling an appointment
If questions of any kind arise, the contact forms provided on our website can be used to contact us. In addition to contact forms for general requests, contact forms are availed for special requests (e.g. registration for events or further training, contacting applicants).
Our contact forms are provided as an additional, optional means of contact which can be used on a voluntary basis. Alternatively, we can be contacted via the contact details in the legal notice of the respective website.
Data
When using our contact forms, specific data must be provided for us to determine the person who sent the request so that we can respond accordingly. We might require one’s name, e-mail address and, if applicable, other contact details (e.g. telephone number) as well as information about that particular request. In addition to the data that is clearly marked as mandatory, further information can be provided on a voluntary basis.
When the form is requested and sent, the respective browser automatically transmits the data listed below – to our server, which is then logged for technical reasons:
The anonymized IP address of the Data Subject,
Date and time of the web call or transmition,
Name of the file retrieved by the browser(URL) of the Data Subject.
Purpose
We process the data sent us using the contact form in order to process the request and to be able to make contact in this regard.
Legal basis
Data processing for the purpose of contacting us is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of consent that is voluntarily given.
Consent can be revoked at any time using the contact details provided in the legal notice of the respective website. As a result, we may no longer continue processing the data based on this consent in the future and may no longer be able to process and fully respond to a respective request.
Duration
The personal data collected by us via the contact form will be deleted after a request has been processed, provided that there are no retention obligations to the contrary.
The data collected for technical reasons (log data) when the form is accessed and sent will be deleted after two months at the latest. 

Social Media
Data processing in connection with our social media channels.
We would like to point out that any decision to visit online platforms, social networks and their functions is undertaken at the own responsibility of the Data Subject. This applies in particular to interactive functions (e.g. commenting, sharing, rating). The providers of the respective online platforms and social networks use cookies and similar technologies to document browsing patterns based on the data associated with usage. If one uses online platforms and social networks, the type, scope and purposes of data processing in social networks are primarily determined by the providers of the social networks. We have no influence on the data processing by the respective providers for their own purposes, which is why we can only refer to the respective data protection declarations in this regard.
Privacy policies of the providers can be found as follows:
Instagram: https://help.instagram.com/519522125107875
LinkedIn: https://www.linkedin.com/psettings/data-privacy
XING: https://privacy.xing.com/de/datenschutzerklaerung
The social media plugin in a job advertisement redirects the Data Subject to the respective Universitätsmedizin Frankfurt social media career page. 
We also use social networking services such as LinkedIn to present our company profile and share interesting content in a professional and business context. 
Third-party content (such as videos from YouTube, maps from Google Maps, RSS feeds, graphics, etc.) from other websites is integrated on some pages of these online services. This always presupposes that the providers of this content (hereinafter referred to as “third-party providers”) are aware of the IP address of the Data Subject. Without the IP address, the third-party providers would not be able to send the content to the respective browser. The IP address is therefore required to display this content. We endeavor to only use content whose respective providers only use the IP address to deliver the content. However, we have no influence on any further use of data (e.g. if the third-party providers store the IP address for statistical purposes).


Video
Our website gives you access to videos on various topics. You have the option of watching videos via the players displayed.
We use plugins from the Google-operated YouTube site to provide videos. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We also use the following video streaming service: Pionierfilm GmbH, Großer Stellweg 23, 68519 Viernheim, Germany We have no influence on the data processing by the respective providers for our own purposes, which is why we only refer to the respective data protection information of the providers Google. https://www.google.de/intl/de/policies/privacy
DataIn connection with the provision of videos on our website, personal data is only processed if you have consented to the YouTube service in the Consent Management Tool and a video is displayed on the website you are visiting.
The integration of YouTube videos takes place in the so-called ‘extended data protection mode’, which, according to the provider, only leads to the processing of data when videos are played. In this case, Google can (similar to accessing an external website via a link) receive in particular your IP address and the address of the website (URL) from which you activate the video. Google may also receive information from any Google cookies stored in your browser. To access YouTube videos, you must therefore activate this service in the Usercentrics Consent Management Tool (see section 2a. (‘Visiting the website and log files’)). In this case, you also consent to your data being transferred to the USA in accordance with Art. 49 para. 1 lit. a GDPR. This tool can be opened by clicking on the ‘Cookie settings’ link in the page footer. You can view and manage your personal settings there at any time. You can change your selection at any time and give or withdraw your consent.
If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
Further information on the handling of user data can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy
If you want to watch the videos provided and start playback, we collect the following data for technical reasons, which your browser automatically transmits to our server so that you can watch the video:
Your IP address, information about your browser type and the version used the operating system of your end device, Date and time of the page view, the name of the file retrieved by your browser, i.e. the content you view on our website and the amount of data transferred (URL). No cookies are stored when videos are used.

Intention
Your data is processed in order to make the videos available for playback on our website.

Legal basis
Your data is processed for the purpose of providing YouTube videos based on your consent (§ 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time by changing your personal settings in the Consent Management Tool. This tool can be opened by clicking on the ‘Cookie settings’ link in the page footer. If you withdraw your consent, you will no longer be able to use YouTube videos on our website.
Your data is processed for the purpose of providing videos on the basis of Section 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR. Art. 6 para. 1 lit. f GDPR. Our legitimate interest here is to provide the digital service you have expressly requested (viewing the video).
DurationThe processed data will be deleted as soon as the purpose for processing this data no longer applies and provided that the deletion does not conflict with any statutory retention obligations.
The data generated for technical reasons when using videos provided by YouTube will be deleted after 60 days at the latest. Details on the deletion of your data in connection with the use of YouTube videos can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy

Job application process
In the course of an online job application via our career portal (https://kgu-karriere.softgarden.io/de/vacancies) and when applying in writing, data is transmitted to us which we will use as part of the application process. When using the application form, the following personal application data in particular will be transmitted by the Data Subject and processed by ourselves:

• Surname, First Name
• Adresse
• Telephone Number
• E-Mail
• Application documents (e.g: Letter of application, CV, references, certificates, etc.)

Purposes and legal basis
This data will be used in the selection process and will help us to decide on wheter to establish an employment relationship with you. The legal basis for this is consent of the Data Subject pursuant to Art. 6 (1) (a) GDPR, Section 26 (1); (8) sentence 2 BDSG.
Furthermore, personal data of the Data Subject may be processed if this is necessary to submit a defence against legal claims asserted against us in the application process. The legal basis for this is Art. 6 para. 1 lit. f GDPR. The legitimate interest in the processing also lies in the stated purposes.
The Data Subject’s application data will be sent directly to the Human Resources Department – Recruiting and Employer Brand Unit and will of course be treated confidentially.
Suitable technical and organizational measures ensure that this personal data is treated confidentially in compliance with the statutory provisions. All decision-makers involved in the application process in Recruiting and the specialist departments have access to data from the Data Subject. This group of persons may be extended to include, for example, head physicians, the nursing service management or employees from employee representative bodies.
This can be a larger group of people when an unsolicited application is sent, because the application does not specifically refer to a job advertisement.
All persons who have access to personal data are obliged to maintain confidentiality.
The Data Subject’s application data will not be processed beyond the use described above.

Duration
The Data Subject’s personal data will be deleted after completion of the application process, even in the case of unsolicited applications that have not led to employment, after 7 months at the latest, unless deletion conflicts with any other legitimate interests on our part or the Data Subject has not given us consent for longer storage, e.g. if the said application is to be considered for a later job advertisement.
Another legitimate interest in this sense is, for example, burden of proof in proceedings under the General Equal Treatment Act (AGG).

Recipient
The Data Subject’s personal data will be passed on to service providers commissioned by us, primarily in the context of so-called order processing, within the context of applicant management. This is in particular the company softgarden e-recruiting GmbH based in Berlin.
Furthermore, data may be transferred to other recipients, such as authorities to fulfill statutory reporting obligations, or to persons who are obliged to maintain professional secrecy, or to other legally obligated recipients.

Visit to the website, Type of data stored, purpose and legal basis, deletion periods
When accessing the pages of this web server, the following data is generally stored in the server log files

• IP-Address
• Date and time
• Type of browser client
• URL of activated website
• If applicable, the error message for the error that has occurred
• The requesting provider, if applicable

This data is used exclusively for the purpose of checking functionality, security and troubleshooting. This use is based on EU GDPR Article 6 paragraph 1 f). All log files are automatically deleted or anonymized after 7 days at the latest.

General information of Recipient / Categories of recipients
The Data Subject’s data will only be passed on to the recipients listed below for the purposes described:

• Internal departments involved in the operation of the website and the provision and use of functions and content (e.g. IT and marketing employees) 
• Internal and external contractors pursuant to Art. 28 GDPR (processors) who provide us with technical or content-related support for our website, in particular IT service providers in the areas of hosting, maintenance, support, error analysis and the provision of individual website functions.

Transfer to a third country
Transfer of data to a third country outside the EU/EEA does not take place and is not planned.

No obligation to provide data
There is no obligation for data provision. However, individual functions of our website (e.g. contact form, appointment booking, online application, newsletter order) cannot be used without providing certain data.

Automated decision making
Automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR does not take place.

Rights of the Data Subject
Universitätsmedizin Frankfurt is obligated to accord the Data Subject the following rights:
(1) Right to information
In accordance with Art. 15 GDPR, the Data Subject has the right to request information from us at any time as to whether and which of personal data is processed by ourselves. This also includes information on the purposes of the processing, any recipients to whom we have disclosed the said data, the planned storage period and, if applicable, informationpertaining to the origin of this data if we have not collected it directly from you. In addition, the Data Subject has the right to a one-off copy of personal data stored by us free of charge. 
(2) Right to rectification
In accordance with Art. 16 GDPR, the Data Subject has the right to request that we rectify any inaccurate personal data that we have stored. This also includes the right to have incomplete personal data completed.
(3) Right to erasure
The Data Subject has the right to demand that we erase data we have stored, unless processing is necessary for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims. 
(4) Right to restriction of processing
In accordance with Art. 18 GDPR, the Data Subject has the right to demand that we restrict the processing of data that we have stored. This data can then only be processed with consent of the Data Subject or for legally defined purposes.
(5) Right to object to the processing
Insofar as we base the processing of personal data on the balancing of interests, you can object to data processing in accordance with Art. 21 GDPR. This is the case if, in particular, the processing of the said data is not necessary for the performance of a contract. When exercising such an objection, we will request the Data Subject to substantiate the reasons why we should not process personal data as we have done. In the event of justified objection from the Data Subject, we will examine the situation and either discontinue or adapt the data processing or show our compelling reasons worthy of protection on the basis of which we will continue processing the said data. The Data Subject is certainly oblidged to object to the processing of the personal data for advertising and data analysis purposes at any time. The Data Subject can object to advertising via the contact channels listed above.
(6) Right to withdraw consent under data protection law
If the Data Subject has given Universitätsmedizin Frankfurt consent to process data, this consent can be revoked at any time in accordance with Art. 7 para. 3 GDPR. Such a revocation affects the permissibility of the processing of personal data after it has been given to us.
(7) Right to data portability
Pursuant to Art. 20 GDPR, the Data Subject has the right to receive the personal data concerning the Data Subject, which has been provided to us, in a structured, commonly used and machine-readable format for the purpose of transmitting it to another controller. At request of the Data Subject and taking into account the available technical possibilities, this also includes the direct transfer from us to another controller.
(8) Right to lodge a complaint with a supervisory authority
In accordance with Art. 77 GDPR, the Data Subject has the right to lodge a complaint with the competent data protection supervisory authority about the processing of personal data of the Data Subject. The data protection supervisory authority responsible for the Universitätsmedizin Frankfurt is

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden

Automated decision-making including profiling
Automated decision-making/profiling does not take place.

Duration of data processing
We only store data that we collect from the Data Subject in connection with a visit to or use of our website for as long as we need it to fulfill the purpose for which it was collected (e.g. visiting the website, responding to inquiries) or if this is required by law (e.g. statutory retention periods).
Further details on the duration of data processing can be found in the information on the respective data processing.

Use of Matomo
Our website uses Piwik/Matomo. This is a so-called web analysis service. Matomo uses so-called ‘cookies’, which are text files that are stored on the computer of the Data Subject. We only use this cookie if the Data Subject refuses to have their visit to the Universitätsmedizin Frankfurt website analysed. The information generated by the cookie about a refusal will not be passed on to third parties. The Data Subject may reject the application of cookies by selecting the appropriate settings on the browser of the Data Subject, however it is important to note that access to the full functionality of this website might not be possible.

Changes to our privacy policy
We reserve the right to amend this privacy policy from time to time so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to the next visit of the Data Subject.