Thank you for visiting the website of KENFO - German Nuclear Waste Management Fund, a public endowment. In this data protection statement, we will inform you about how we deal with the collection, other processing, and transmission of your personal data. Your personal data will be processed in accordance with the applicable statutory data protection requirements for the purposes listed below. To provide a better overview, we have divided our data protection statement into sections.
2. What is considered personal data?
In accordance with Art. 4 (1) of Directive (EU) 2016/679 of the European Parliament and of the Council dated 27 April 2016 for the protection of natural persons in the processing of personal data, on free data traffic, and on the cancellation of directive 95/46/EC (General Data Protection Regulation – “GDPR”), personal data refers to all information that relates to identified or identifiable natural persons. Identifiable people are natural persons, who can be identified directly or indirectly, in particular by means of assignment to a name, an identification number, location data, an online ID or one or more special features that reveal the physical, physiological, genetic, mental, economic, cultural, or social identity of these natural persons. Personal data can therefore also be collected online (e.g. IP addresses) and relates in particular to personal information such as names and dates of birth or contact details such as email addresses, etc.
3. Who is responsible for data processing?
The person responsible for the processing of personal data as defined in the GDPR is:
KENFO – German Nuclear Waste Management Fund Foundation under public law
If you have any questions or comments regarding data protection at KENFO or want to assert your rights against the German Nuclear Waste Management Fund (for example, to obtain information regarding your personal data or to update it), please contact the data protection office at firstname.lastname@example.org, using the keyword “Data protection”.
4. What functions does the website use?
Each time the website is accessed, an automated system records data and information. This information is saved in the log files on the server. These are files that log processes that run on a computer or network.
This website uses technology provided by etracker GmbH (www.etracker.com) to collect and save data for marketing and optimization purposes. Usage profiles can be created from this data under a pseudonym. The data collected by the etracker technologies will not be used to identify the visitor personally to this website and will not be combined with personal data about the owner of the pseudonym. etracker Analytics is provided by default without cookies. Please find further information regarding data protection with etracker here.
The following data are collected in this process: • Name and URL of the file accessed, • Date and time of access, quantity of data transferred, • Notification of the time of access (HTTP response code), • Information on the browser type and the version used, • The user’s operating system, • The user’s internet service provider, • Date and time of access, • Websites from which the user’s system accesses our website (referrer URL), • Websites that the user’s system accesses from a link on our website, • The user’s IP address and the requesting provider.
The processing of the IP address serves the purpose of protecting against hackers and cyber attacks, as well as ensuring traceability. The purpose of the processing of the other data is to deliver the content of our website, to guarantee the functionality of our information technology systems, to optimize our website and to ensure the functionality of the website. The data in the log files are always stored separately from the user’s other personal data. This processing of your data as mentioned above is necessary to protect the justified interests of the German Nuclear Waste Management Fund and is justified by a balancing of interests in favour of KENFO in accordance with Art. 6 Para. 1 (f) GDPR. KENFO has a justified interest in guaranteeing that the website and the services offered there function from a technical perspective and that the website is protected against attacks. Your legitimate interest in the aforementioned data relating to you not being used for this purpose does not outweigh this justified interest on the part of KENFO because KENFO uses this data appropriately for the processing purpose described and you also benefit from the functioning of the website. You have the right to object to the processing of your data that is performed based on a balancing of interest at any time if there are reasons that result from your particular situation. See item 8.7 . The personal data stored in the log files will be deleted after seven days at the latest, unless KENFO is legally obliged to retain it or storage is permitted on the basis of a legal justification.
5. What data is processed if you contact us by email?
You can contact KENFO by email via the KENFO website for the following purposes: • Job applications, • Press enquiries, • Other/general purposes. If you contact us by email, we will automatically save the personal data you provide voluntarily, i.e. your email address and any personal information you have provided us with in order to process your request and handle any follow-up questions. The saving of your data is used for the purpose of processing your request or contacting you. This processing of your data as mentioned above is necessary to protect the legitimate interests of KENFO and is justified by a balancing of interests in favour of KENFO. KENFO has a legitimate interest in offering you a platform that enables you to contact and communicate with us easily. Your legitimate interest in the data mentioned above belonging to you not being used for this purpose does not outweigh this legitimate interest on the part of KENFO because it is also in your interest that we process your contact request and respond to it. Other personal data that are processed when we contact you are used to prevent the misuse of the opportunity to contact us and to ensure the security of our information technology systems. You have the right to object to the processing of your data at any time, based on a balancing of interests, if there are reasons for this on the basis of your particular situation. See section 8.7. Your personal data will be automatically deleted three months after your contact request has been answered and there is no justification for continuing to store it (e.g. an existing customer relationship) and no statutory retention period applies.
6. Communication with Cloud Services
As part of our business activities, we use services from Microsoft 365 for communication and, in the case of invited guests for audio and video meetings, as well as for document management where applicable. Microsoft 365 is provided by Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18, Ireland. For example, if you are participating in audio and video meetings, email exchanges or file editing, contact data, communication data (such as text, audio, video and image data) and usage data (such as IP address, device data, metadata, log data) may be processed. The processing is carried out to fulfill a contract or to carry out pre-contractual measures with you according to Art. 6 para. 1 lit. b GDPR and otherwise to fulfill a task within our competence according to Art. 6 para. 1 lit. c and lit. e, para. 3 GDPR in conjunction with Section 3 German Data Protection Act (BDSG) or is necessary due to our legitimate interest according to Art. 6 para. 1 lit. f GDPR. We have concluded a data processing agreement (DPA) with Microsoft. Your data will be stored by Microsoft in the EU. In the event that your data is transferred to the USA, Microsoft Ireland Operations Limited has concluded standard contractual clauses with Microsoft Corporation and has taken additional measures. You are entitled to the rights guaranteed under the GDPR pursuant to Art. 15 et seq., 77. To assert these, for further information and contact details, please refer to section 8.
7. Applicant data
We collect and process the personal details of applicants for the purposes of the application procedure and as the basis for any employment relationship. Processing can also be performed electronically. This is the case in particular if an applicant sends us appropriate application documentation electronically, e.g. by email. Please note that transmission by email is not secure. If we enter into an employment contract with an applicant, the data transmitted will be stored as the basis for the employment relationship and for its handling, taking into account the legal provisions. If the applicant is unsuccessful, the application documents will be deleted 6 months after the end of the application process. Storage for a period of 6 months is based on our legitimate interests with regard to the burden of proof in proceedings under the Allgemeine Gleichbehandlungsgesetz (German General Equal Treatment Act). If we want to keep the applicant’s data for a longer period of time, we will ask for your consent.
8. What are your rights?
In accordance with the legal provisions (including any applicable restrictions from the GDPR and/or the Bundesdatenschutzgesetz (German Federal Data Protection Act), you can assert the following rights against us:
8.1 Information You have the right to receive information from us about your personal data stored by us.
8.2 Correction At your request, we will correct the personal data stored about you if it is inaccurate or incorrect.
8.3 Deletion If you wish, we will delete your personal data, unless this is contrary to other legal regulations (e.g. statutory retention requirements) or an overriding interest on our part (e.g. to defend our rights and claims).
8.4 Restriction Taking into account the legal requirements, you can ask us to restrict the processing of your personal data.
8.5 Transfer of data You also have the right to receive your personal data in a structured, current, and machine-readable format under the relevant legal requirements or to transmit it to a third party.
8.6 Complaints You also have the right to file a complaint with a data protection supervisory authority. You are welcome to contact our data protection officer first.
8.7 Objections You can object to the processing of your personal data, which we base on a legitimate interest on our part, at any time, stating these reasons, for reasons that arise from your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise, or defend legal claims.
You can also object to the processing of your personal data for direct marketing purposes at any time without giving any reason. This also applies to profiling if this relates to direct marketing of this kind. After receipt of the objection, we will no longer process the personal data for the purposes of direct marketing and will delete the data if no processing is required for other purposes (e.g. to fulfil the contractual relationship).
If you wish to assert these rights, you can contact us using the contact details provided in section 3.