Data protection information for the femto survey

Status: 10/02/2024

1. Responsible for data processing
DESY – Deutsches Elektronen-Synchrotron, represented by the Directorate,
Notkestraße 85
22607 Hamburg
 

2. Contact person for the survey
Diana von Ilsemann, DESY-PR
If you have any questions regarding the survey, please contact the femto editorial team at 
femto@desy.de
 

3. Data protection officer
Anna-Christina Jauch
datenschutz.desy.de

4. Description of PR / femto and the survey
The DESY PR department conducts an online survey for the qualitative evaluation of the research magazine femto. Participation is voluntary and is open to anyone who can access and answers the questionnaire online by entering the URL or scanning the QR code. The survey results will serve DESY-PR as a valuable data basis for the further development of focussed and interdisciplinary science communication via the research magazine. The magazine's circulation and production methods are also to be reviewed from a sustainability perspective.

5. Purpose of processing
Participation in the survey is voluntary. It can also be cancelled at any time during the survey. Canceled surveys are only included in the evaluation up unto the last answered question.

If you take part in the survey, no personal data will be collected by answering questions for which there are options to choose. We ask about the evaluation of femto content, the form of implementation, design and the usage behaviour of the readers. The answers cannot be assigned to email addresses or other personal data. For free-text fields, we ask you not to provide any personal information, i.e. no data that could be used to identify you or other persons.

If you take part in the survey, you can assign yourself to an age group and an occupational group and either to the group of people who would like to read the magazine in German or to the group of people who would like to read the magazine in English. This categorisation is important for achieving the purpose of the survey, as DESY-PR would like to get to know the target groups of the research magazine femto better in order to be able to respond precisely to target group needs for future topic planning and preparation.

The aim of the survey is to obtain a meaningful data basis on which to further develop the research magazine in a customised way. The survey will also ask about the need for print editions, so that the sustainability aspect will also be focussed on in addition to the wishes of the target group.

6. Legal bases of the processing
The data required for technical reasons when accessing the survey home page (see 5.) are processed on the basis of Article 6(1)(f) GDPR.

7. Categories and recipients of personal data
For technical reasons, the following data is automatically collected from you for a period of three days when you access the survey homepage: domain, IP address, time, bytes transferred. After completion or cancellation of the survey, they are automatically stored separately from your content data and automatically deleted after three days.

The survey is conducted using a survey tool called Lime Survey. We use this tool via Deutsches Krebsforschungszentrum e.V., dkfz. DESY has concluded an order processing contract with the dkfz for this purpose, i.e. the dkfz processes the collected data only on instruction and only within the framework specified by DESY.

8. Storage period
The content of the responses will be stored after collection for as long as is necessary for the stated purpose and the resulting archiving purposes. The data will be deleted no later than two years after the survey results have been analysed.

9. Rights of the data subjects
If you take part in the survey, we will not process any of your personal data as described above. With regard to the technically mandatory data, see 4. and 5., you are a data subject within the sense of the GDPR. You have the following rights against the processing of the technically mandatory data in accordance with Art. 6 para. 1 f) GDPR:

a) Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. The controller must make the rectification without undue delay. Your right to rectification may be restricted to the extent that it is likely to render impossible or seriously impair the realisation of the research or statistical purposes and the restriction is necessary for the fulfilment of the research or statistical purposes.

b) Right to restriction of processing
You may request the restriction of the processing of your personal data under the following conditions:

1. if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
4. if you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
   
    

If the processing of personal data concerning you has been restricted, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Your right to restriction of processing may be restricted to the extent that it is likely to render impossible or seriously impair the realisation of the research or statistical purposes and the restriction is necessary for the fulfilment of the research or statistical purposes.

c) Right to erasure
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

1. The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

2. You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 1 GDPR.

3. The personal data concerning you has been processed unlawfully.

4. The deletion of personal data concerning you is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the controller is subject.

5. The personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

d) Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You also have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you which is carried out for scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR.

Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the realisation of the research or statistical purposes and the restriction is necessary for the fulfilment of the research or statistical purposes.

e) Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Translation: deepl.com & staff