Privacy policy – Circular Saxony

Circular MTC e.V./ Energy Saxony e.V.

The innovation cluster Circular Saxony, which is funded by the Free State of Saxony, is a collaborative project of the managing associations Circular MTC e.V. and Energy Saxony e.V.

Data protection is a priority for Circular MTC e.V. and Energy Saxony e.V. Using the website of the innovation cluster Circular Saxony is possible without providing any personal data. If a person wishes to use particular services of the innovation cluster, handling of personal data may become necessary. If handling of personal data is necessary and there is no legal basis for doing so, Circular MTC e.V. and Energy Saxony e.V. ask for permission of the website user.

Personal data such as name, address, email address or phone number of a person is always processed in line with General Data Protection Regulation GDPR and in line with Circular MTC e.V. ‘s and Energy Saxony e.V.’s country-specificy data protection regulation. The two managing associations wish to inform the general public on type, extent and purpose of personal data collected, used and processed in connection with the innovation cluster Circular Saxony. Affected parties are informed of their rights by means of this data protection declaration.

Circular MTC e.V. and Energy Saxony e.V. have implemented numerous technological and organisational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, online data transfer can include security gaps; thus absolute protection cannot be guaranteed. For this reason, every person is free to choose alternative ways of transmitting personal data to Circular MTC e.V. and Energy Saxony e.V., e.g. by telephone.

1. Definition of Terms

The data protection declaration for the webpages of the innovation cluster Circular Saxony is based on the terms and conditions defined by the European Legislator in the General Data Protection Regulation (GDPR). This data protection declaration is intended to be easy to read and understand for the public as well as for members and partners of Circular MTC. e.V. and Energy Saxony e.V. respectively. Here you will find explanations of the terms used.

2. Name and Address of the entities processing your data

The following organisations are responsible for processing your personal data in connection with using the website circular-saxony.de and in line with the GDPR, the Federal Data Protection Law and any other data protection laws:

Circular MTC Ev. Energy Saxony e.V.

3. Cookies

The webpages of the innovation cluster Circular Saxony use cookies. cookies are text files that are placed and stored on a computer system via a web browser. Many cookies comprise a Cookie-ID. A cookie-ID is a unique identifier of the cookie. It consists of a sequence of characters by which web pages and servers can be assigned to a specific web browser in which the cookie was stored. This enables the visited web pages and servers to distinguish the individual browser of the person from other web browsers that contain other cookies. A specific web browser can be recognized and identified via the unique cookie ID.

3.1 Technically necessary cookies

Most cookies are technically necessary to facilitate use of the innovation cluster Circular Saxony’s website and services thereof. Some elements of Circular Saxony’s website require the user’s browser to be identifiable even after changing websites.

Circular MTC e.V. and Energy Saxony e.V. have a legitimate interest in data processing in the above-mentioned purposes; legal basis is Art. 6 Abs. 1 UAbs. 1 lit. f DS-GVO. Data processed are not combined with any other personal data and not used commercially. Session cookies are deleted when the browser is closed and will be deleted after seven days at the latest.

Information created by the cookie in a pseudonymous user profile will not be used to personally identify a website user. They will not be combined with personal data of the bearer of the pseudonym.

Alternatively, you can activate the “Do Not Track”- function of your browser which is available for the website of the innovation cluster Circular Saxony.

You can prevent a cookie being placed by this website by adjusting the settings of your browser and thus permanently disallow cookies. You can also delete cookies placed by a browser or other software at any time. This is possible in all common browsers. Please consult the help function of your browser to receive advice on adjusting your browser’s cookie settings. Further information on cookies you can find here http://www.youronlinechoices.com and http://www.allaboutcookies.org.

Please note that you may not be able to use all the features of this website if you do not accept cookies.

4. Collection of general data and information (log files)

The website of the innovation cluster Circular Saxony collects a number of general data and information whenever a user or an automated system visits the page. These data and information are stored in a server’s log files and include:

Browser types and versions used
Type of operating system
Information on the webpage visited prior to visiting Circular Saxony (referral)
Sub pages visited
Date and time of page visit
IP address
Other similar data and information needed to prevent danger in case of attack on information technology systems

Circular MTC e.V. and Energy Saxony e.V. do not use this this general data and information to identify a person during website use. This information is needed to

correctly display website contents
optimise website contents
guarantee permanent functionality of these information technology systems and technology of this website
detect and track attacks on the innovation cluster Circular Saxony’s information systems
provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack

Circular MTC e.V. or Energy Saxony e.V. analyze these data and information on a statistical basis, with the aim of increasing data protection and data security, and with the aim of ensuring an optimal level of protection for the personal data processed by the Circular MTC e.V. or the Energy Saxony e.V..

The legitimate interest of Circular MTC e.V. or Energy Saxony e.V. in the data processing lies in these purposes; the legal basis is Art. 6 para. 1 UAbs. 1 lit. f DS-GVO.

The data of the server log files are stored separately from any personal data provided by a user/ data subject. The log files are deleted after 14 days, unless their further storage is necessary for the above-mentioned purposes.

5. Processing of data you provide to the innovation cluster Circular Saxony

The website of the innovation cluster Circular Saxony contains, due to legal requirements, parameters which allow quick electronic contact with the innovation cluster Circular Saxony as well as immediate communication with Circular Saxony, also by general email.

The assocations Circular MTC e.V. and Energy Saxony e.V. process your data to answer your query; legal basis for data processing is Art. 6 Abs. 1 UAbs. 1 lit. f DSGVO (the legitimate interest of the associations is to be able to answer your query).

Insofar as data processing is necessary for the implementation of pre-contractual measures (e.g. in the case of inquiries about products or services) or the fulfillment of a contract, the legal basis is also Art. 6 para. 1 UAbs. 1 lit. f DSGVO.

The data from your inquiries will be deleted when the respective conversation has ended and the facts concerned have been conclusively clarified and legal, statutory or contractual retention periods have expired. Retention periods apply in particular if your inquiry leads to the conclusion of a contract with Circular MTC e.V. or Energy Saxony e.V. (§ 147 para. 1, para. 3 AO, § 257 para. 1, para. 4 HGB: 6-year retention period for correspondence in connection with the conclusion of a contract, 10-year retention period for accounting vouchers).

6. Forwarding of your data

Entities within the managing associations Circular MTC e.V. and Energy Saxony e.V. who need access to your personal data to fulfil contractual and legal obligations are granted access to your personal data.

No data is transferred to third countries (countries outside the European Economic Area – EEA). The associations Circular MTC e.V. and Energy Saxony e.V. only disclose personal data if required by law (Art. 6 Abs. 1 UAbs. 1 lit. c DS-GVO) or in case of consent given by the data subject (Art. 6 Abs. 1 UAbs. 1 lit. a DS-GVO). The following entities may receive personal data under these conditions: public authorities and institutions in the event of a legal or regulatory obligation.

7. Your data protection rights

You have the right to information (Art. 15 DS-GVO), the right to correction (Art. 16 DS-GVO), the right to deletion (Art. 17 DS-GVO), the right to restriction of processing (Art. 18 DS-GVO) and the right to data portability (Art. 20 DS-GVO) from Circular MTC e.V. or Energy Saxony e.V.. With regard to the right to information and the right to deletion, the restrictions according to §§ 34 and 35 BDSG apply.

You also have the right to object to data processing by Circular MTC e.V. or Energy Saxony e.V. (Art. 21 DS-GVO).

Insofar as the processing of your personal data is based on your consent (Art. 6 para. 1 UAbs. 1 lit. a DSGVO), you may revoke this consent at any time; it remains legal to process your data based on your consent given until the time of revocation.

To assert all these rights and in case of further questions related to personal data, you can contact the innovation cluster Circular Saxony or the associations Circular MTC e.V. and Energy Saxony e.V. at any time at mailto:info@circular-saxony.de or by using the contact details provided above in section 2.

Furthermore, you have the right to lodge a complaint with a supervisory authority – in particular in the EU member state of your place of residence, place of work or place of the alleged infringement – if you believe that the processing of your personal data violates the GDPR or other applicable data protection laws (Art. 77 GDPR, Section 19 BDSG).

8. Duty to provide data

When entering in a business relationship with Circular MTC e.V. or Energy Saxony e.V., the contractual partners only provide personal data which is necessary for the establishment, conduct and termination of a business relationship or which Circular MTC e.V. or Energy Saxony e.V. are legally obliged to collect. Without this data, Circular MTC e.V. or Energy Saxony e.V. will usually have to refuse the conclusion of the contract or the execution of the order or will not be able to execute an existing contract and may have to terminate it.

The provision of personal data is partly required by law (e.g. tax regulations) or it may also result from contractual regulations (e.g. information on the contractual partner).

9. NO AUTOMATED DECISION MAKING (ART. 22 PARA. 1 AND 4 DS-GVO)

As responsible associations, Circular MTC e.V. and Energy Saxony e.V. do not use automated decision-making or profiling.

Glossary

The data protection declaration for the Circular Saxony innovation cluster is based on the terms used by the European Directive and Regulation Authority when adopting the General Data Protection Regulation (DS-GVO). This data protection declaration should be easy to read and understand for the public as well as for clients and business partners. To ensure this, the associations would like to explain in advance the terminology used.

The associations Circular MTC e.V. and Energy Saxony e.V. use the following terms, among others, in this data protection declaration:

a) personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) data subject

Data subject means any identified or identifiable natural person whose personal data is processed by the processing organisation.

c) processing

Processing means any (with or without the help of automated procedures) operation or set of operations which is performed upon personal data, such as collection, recording, organization, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, deletion or destruction.

d) restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting any future processing.

e) profiling

Profiling is any type of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, particularly to analyze or predict aspects relating to that natural person’s job performance, economic situation, health, personal preferences, interests, reliability, behavior, location or change of location.

f) pseudonymization

Pseudonymization is the processing of personal data in such a way that personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separate and is subject to technical and organizational measures to ensure that personal data is not attributed to an identified or identifiable natural person.

g) responsible organisation or person responsible for processing

The responsible organisation or person responsible for processing is the natural or legal person, public authority, institution or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the responsible organisation or the specific criteria for its nomination may be specified under Union or Member State law.

h) contract processor

A contract processor is a natural or legal person, public authority, institution or other body that processes personal data on behalf of the organisation responsible for processing.

i) recipient

A recipient is a natural or legal person, public authority, institution or other body to whom personal data is disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific investigative task under Union or Member State law shall not be considered as recipients.

j) Third Party

Third party means a natural or legal person, public authority, institution or other body other than the data subject, the organisation responsible for processing, the contract processor and the persons authorized to process the personal data under the direct responsibility of the organisation responsible for procesing or the contract processor.

k) consent

Consent shall mean any freely given indication of the data subject’s wishes for the specific case in an informed and unambiguous manner, in the form of a statement or any other unambiguous affirmative act, by which the data subject indicates that they consent to the processing of personal data relating to them.

10. Rights of the data subject

a) Right to confirmation

Every data subject has the right, granted by the European Directive and Regulation, to obtain confirmation from the organisation responsible for processing as to whether personal data concerning him or her are being processed. If a data subject wishes to exercise this right to obtain confirmation, he or she may, at any time, contact any employee of the organisation responsible for processing.

b) Right of access

Every person affected by the processing of personal data has the right, granted by the European Directive and Regulation Authority, to obtain from the organisation responsible for processing, at any time and free of charge, information about the personal data stored about him or her and a copy of that information. Furthermore, the European Directive and Regulation has granted the data subject access to the following information:

the purposes of data processing,
the categories of personal data processed,
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular in the case of recipients in third countries or international organizations,
if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration,
the existence of a right to obtain the rectification or deletion of personal data concerning him or her, or to obtain the restriction of processing by the organisation responsible for processing, or a right to object to such processing,
the existence of a right of appeal to a supervisory authority,
if the personal data is not collected from the data subject: Any available information about the origin of the data,
the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

Furthermore, the data subject shall have the right to obtain information as to whether personal data has been transferred to a third country or to an international organization. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

If a data subject wishes to exercise this right of access, he or she may, at any time, contact an employee of the organisation responsible for processing.

c) Right to rectification

Any person affected by the processing of personal data has the right granted by the European Directive and Regulation Authority to request the rectification of inaccurate personal data concerning him or her, without delay. Furthermore, the data subject has the right, taking into account the purposes of the data processing, to request the completion of incomplete personal data, including by means of a supplementary declaration.

If a data subject wishes to exercise this right to rectify, he or she may, at any time, contact any employee of the organisation responsible for processing.

d) Right to deletion (right to be forgotten)

Any person concerned by the processing of personal data has the right granted by the European Directive and Regulation Authority to demand from the organisation responsible for processing to have their personal data deleted without delay in case one of the following reasons applies and insofar processing the data is not necessary:

The personal data were collected or otherwise processed for such purposes for which they are no longer necessary.
The data subject revokes the consent on which the processing was based pursuant to Art. 6(1)(a) DS-GVO or Art. 9(2)(a) DS-GVO and there is no other legal basis for the processing.
The data subject objects to the processing pursuant to Article 21(1) DS-GVO and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) DS-GVO.
The personal data has been processed unlawfully.
The deletion of personal data is necessary for compliance with a legal obligation under Union or Member State law to which the organisation responsible for processing is subject.
The personal data has been collected in relation to information society services offered pursuant to Article 8(1) DS-GVO.

If one of the aforementioned reasons applies, and a data subject wishes to arrange for the deletion of personal data stored by the Innovationscluster Circular Saxony, he or she may, at any time, contact any employee of organisation responsible for processing. The respective employee of Circular MTC e.V. or of Energy Saxony e.V. shall arrange for the deletion request to be complied with immediately.

If the personal data has been made public by Circular MTC e.V. or Energy Saxony e.V., and Circular MTC e.V. and Energy Saxony e.V., as the organisations responsible for processing, is obliged to erase the personal data pursuant to Article 17 (1) of the Data Protection Regulation, Circular MTC e.V. or Energy Saxony e.V., respectively, shall, taking into account the available technology and the cost of implementation, implement reasonable measures, including those of a technical nature, to inform other data controllers which process the published personal data, that the data subject has requested from those other data controllers the deletion of all links to the personal data or copies or replications of the personal data, unless the processing is necessary. The employee of Circular MTC e.V. or Energy Saxony e.V. will arrange for the necessary steps to be taken in individual cases.

e) Right to restriction of processing

Any person concerned by the processing of personal data has the right granted by the European Directive and Regulation Authority to obtain from the organisation responsible for processing the restriction of processing where one of the following conditions is met:

The accuracy of personal data is contested by the data subject for a period enabling the organisation responsible for processing to verify the accuracy of the personal data.
The processing is unlawful, the data subject objects to the deletion of personal data and requests instead the restriction of the use of the personal data.
The organisation responsible for processing no longer needs personal data for the purposes of the processing, but the data subject needs it for the assertion, exercise or defence of legal claims.
The data subject has objected to the processing pursuant to Article 21 (1) of the GDPR and it is not yet clear whether the legitimate grounds of the organisation responsible for processing override those of the data subject.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of personal data stored by the innovation cluster Circular Saxony, he or she may, at any time, contact any employee of the organisation responsible for processing. The employee of Circular MTC e.V. or Energy Saxony e.V. will arrange the restriction of the processing.

f) Right of data portability

Any person concerned by the processing of personal data has the right, granted by the European Directive and Regulation Authority, to receive the personal data concerning him or her, which has been provided by the data subject to an organisation responsible for processing, in a structured, commonly used and machine-readable format. He or she also has the right to transmit this data to another organisation responsible for processing without hindrance from the organisation responsible for processing to whom the personal data has been provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the organisation responsible for processing.

Furthermore, when exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to obtain that the personal data be transferred directly from one organisation responsible for processing to another, to the extent that this is technically feasible and given the fact that this does not adversely affect the rights and freedoms of other individuals. In order to assert the right of data portability, the data subject may at any time contact any employee of Circular MTC e.V. or Energy Saxony e.V..

g) Right to appeal

Any person affected by the processing of personal data has the right granted by the European Directive and Regulation Authority to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out on the basis of Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

Circular MTC e.V. or Energy Saxony e.V. shall no longer process personal data in the event of an objection, unless the respective associations can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims.

If Circular MTC e.V. or Energy Saxony e.V. process personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data processed for such marketing. This also applies to any profiling, insofar as it is related to such direct marketing. If the data subject objects to use his/ her personal data for direct marketing purposes, Circular MTC e.V. or Energy Saxony e.V. will no longer process personal data for these purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her which is carried out by Circular MTC e.V. or Energy Saxony e.V. for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the Data Protection Regulation (DS-GVO), unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the data subject may directly contact any employee of Circular MTC e.V. or Energy Saxony e.V.. The data subject is also free to exercise his/her right to object by means of automated procedures using technical specifications in connection with the use of information society services, notwithstanding Directive 2002/58/EC.

h) Automated decisions in individual cases including profiling

Any data subject concerned by the processing of personal data shall have the right, granted by the European Directive and Regulation Authority, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the organisation responsible for processing, or (2) is permitted by Union or Member State law to which the organisation responsible for processing is subject and that law contains suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the organisation responsible for processing, or (2) it is made with the data subject’s explicit consent, Circular MTC e.V. or Energy Saxony e.V. shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, which include at least the right to obtain the intervention of a subject on the part of the organisation responsible for processing, to express his or her point of view and to contest the decision.

If the data subject wishes to exercise the rights concerning automated decisions, he or she may, at any time, contact any employee of the organisation responsible for processing.

i) Right to revoke consent under data protection law

Every person affected by the processing of personal data has the right granted by the European Directive and Regulation Authority to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact any employee of the organisation responsible for processing the data.