Privacy Policy

If you have any questions or suggestions regarding this information, or if you wish to contact us to exercise your rights, please address your enquiry to

Leibniz Institute for the Analysis of Biodiversity Change
Adenauerallee 127
53113 Bonn
Telephone: +49 228 9122-0
Email: info@leibniz-lib.de

You can contact our Data Protection Officer using the following details:

Email: datenschutz@leibniz-lib.de
Dr Christoph Mayer
Leibniz Institute for the Analysis of Biodiversity Change
Adenauerallee 127
53113 Bonn

The data protection term ‘personal data’ refers to all information relating to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We only process data on the basis of a legal authorisation. We process personal data only with your consent (Section 25(1) of the TDDDG or Article 6(1)(a) of the GDPR), for the performance of a contract to which you are a party, or in response to your request to take pre-contractual measures (Article 6(1)(b) of the GDPR), to comply with a legal obligation (Article 6(1)(c) of the GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not take precedence (Article 6(1)(f) of the GDPR).
If you apply for a vacancy within our company, we also process your personal data for the purpose of deciding whether to enter into an employment relationship (Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG) or Article 6(1)(b) of the GDPR).

Unless otherwise stated in the following information, we will only retain the data for as long as is necessary to fulfil the purpose of processing or to comply with our contractual or legal obligations. Such statutory retention obligations may arise, in particular, from commercial or tax law provisions. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data relating to consents for which proof is required, as well as to complaints and claims, for the duration of the statutory limitation periods. We will delete data stored for marketing purposes if you object to its processing for this purpose.

We use data processors in connection with the processing of your data. The processing operations carried out by such data processors include, for example, hosting, sending emails, maintenance and support of IT systems, customer and order management, bookkeeping and invoicing, marketing activities, and the destruction of files and data storage media. A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively on behalf of the controller and are contractually obliged to ensure appropriate technical and organisational measures for data protection. In addition, we may transfer your personal data to bodies such as postal services, our principal bank, tax consultancy or audit firms, or the tax authorities. Further recipients may be identified in the following information.

Our data processing activities may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is ensured in that third country. Where no such adequacy decision has been adopted by the European Commission, the transfer of personal data to a third country shall only take place if suitable safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions set out in Article 49 of the GDPR is met.
In the absence of an adequacy decision and unless otherwise stated below, we use the EU Standard Data Protection Clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option to receive a copy of these EU Standard Data Protection Clauses or to view them. To do so, please contact us at the address provided under ‘Contact’.
If you consent to the transfer of personal data to third countries, the transfer will take place on the legal basis of Article 49(1)(a) of the GDPR.

If you exercise your rights under Articles 15 to 22 of the GDPR, we will process the personal data provided for the purpose of implementing those rights and to be able to provide evidence of this. We will process data stored for the purpose of providing information and preparing such information solely for this purpose and for the purposes of data protection monitoring; otherwise, we will restrict processing in accordance with Article 18 of the GDPR.
This processing is based on the legal basis of Article 6(1)(c) of the GDPR in conjunction with Articles 15 to 22 of the GDPR and Section 34(2) of the BDSG.

As a data subject, you have the right to exercise your data subject rights vis-à-vis us. In particular, you have the following rights:

• In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.
• You have the right, in accordance with Article 16 of the GDPR, to request that we rectify your data.
• You have the right, in accordance with Article 17 of the GDPR and Section 35 of the BDSG, to request that we erase your personal data.
• You have the right, in accordance with Article 18 of the GDPR, to have the processing of your personal data restricted.
• You have the right, in accordance with Article 20 of the GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
• If you have given us separate consent to the processing of your data, you may withdraw this consent at any time in accordance with Article 7(3) of the GDPR. Such a withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal.
• If you consider that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

In accordance with Article 21(1) of the GDPR, you have the right to object to processing carried out on the legal basis of Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. Where we process your personal data for the purposes of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

When you use our website for purely informational purposes, general information transmitted by your browser to our server is initially stored automatically (i.e. without registration). By default, this includes: browser type and version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.
This processing is carried out to safeguard our legitimate interests and is based on the legal basis of Article 6(1)(f) of the GDPR. This processing serves the purposes of technical administration and website security. The stored data is deleted after ten days, unless there are specific grounds for a legitimate suspicion of unlawful use, in which case further examination and processing of the information is required for this reason. We are unable to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply in accordance with Article 11(2) of the GDPR, unless you provide additional information enabling your identification in order to exercise your rights set out in those articles.

Our website contains contact forms which you can use to send us messages. Your data is transferred in encrypted form (as indicated by ‘https’ in the browser’s address bar). All data fields marked as mandatory are required to process your enquiry. Failure to provide this information means that we will be unable to process your enquiry. The provision of any further data is voluntary. Alternatively, you can send us a message via our contact email address or contact us by telephone. We process the data for the purpose of responding to your enquiry.
If your enquiry relates to the conclusion or performance of a contract with us, the legal basis for data processing is Article 6(1)(b) of the GDPR. Otherwise, we process the data on the basis of our legitimate interest in contacting enquirers. The legal basis for data processing in such cases is then Article 6(1)(f) of the GDPR.

a. Creating a user account
To register for events and book guided tours, you can create a user account. The required details are shown on the registration form. You must provide the information marked as mandatory in order to complete your registration. The data you provide will be processed for the purpose of providing the service.
Once you have registered for a user account, the details you have provided will be automatically entered into the booking form when you make a booking. You can also use your user account to check the status of your bookings.
A valid email address is required for registration. To confirm your registration, you will first receive a registration email, which you must confirm by clicking on a link (double opt-in). Once registered, you can log in to your customer account by entering your email address and the password you have chosen. The processing of the data provided as part of the registration and use of the customer account is based on the legal basis of Article 6(1)(b) of the GDPR.
The processing is based on the legal basis of Article 6(1)(b) of the GDPR.

b. Booking
Where you book a guided tour or event via our website, we process personal data solely for the purpose of fulfilling the contract. As part of the booking process, we process only the data that you yourself have entered in the form and, where applicable, payment details if you pay by bank transfer in advance. The legal basis for the processing is Article 6(1)(b) of the GDPR in each case. All data fields marked as mandatory are required to process your booking. It is not necessary to register a user account to make a booking.
The provision of any further data is voluntary. We process such voluntarily provided data on the basis of Article 6(1)(f) of the GDPR.
For the purpose of conducting the guided tour or event, only the data provided that is necessary for this purpose will be passed on to third parties where necessary (such as freelance guides or nature interpreters who have been commissioned to conduct the guided tour or event).

c. Payment service providers
To pay for events and guided tours that incur a charge, you can choose from various options. To this end, we work with various payment service providers.
The payment details you provide during the ordering process will be transmitted by us to the payment service provider to the extent that such transmission is necessary to process the payment.
The legal basis for this transmission is Article 6(1)(b) of the GDPR.
Please note that, in all other respects, the respective payment information is processed by the relevant payment service providers on their own responsibility.
We use the following payment service providers:

• Adyen
  You have the option of making payment by credit card via the payment service provider Adyen N.V. (Netherlands, EU). Further information on Adyen’s data protection policy can be found here: https://www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy
• PayPal
  You have the option to pay via the PayPal service provided by PayPal Europe S.a.r.l. et Cie s.c.a. (Luxembourg, EU). In doing so, PayPal may provide us with your address details stored with PayPal, which we process solely for the purpose of contract fulfilment. Further information on data protection at PayPal can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#r5.
  

You can apply via the ‘Careers’ section of our website. To this end, we collect personal data from you, including, in particular, your name, address, date of birth, telephone number, email address, information regarding any severe disability, your CV (including your religious affiliation where applicable), references/certificates, a photograph where applicable, work samples, your cover letter and any other content you provide.
Your personal application data will be processed exclusively for purposes relating to your interest in current or future employment with us and the processing of your application. Your application will only be processed and reviewed by the relevant contact persons within our organisation.
All staff entrusted with data processing are obliged to maintain the confidentiality of your data. Should we be unable to offer you a position, we will retain the data you have provided for up to six months after the conclusion of the application process for the purpose of answering any questions relating to your application and the decision not to offer you a position. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purposes of providing evidence, or if you have expressly consented to longer-term storage.
The legal basis for data collection is Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG).
Should we retain your application data for a period of six months and you have expressly consented to this, we would like to point out that this consent may be freely withdrawn at any time in accordance with Article 7(3) of the GDPR. Such a withdrawal does not affect the lawfulness of the processing carried out on the basis of your consent prior to the withdrawal.

On our website, we offer the option to subscribe to our newsletter. Once you have subscribed, we will keep you regularly updated on the latest news regarding our offers. A valid email address is required to subscribe to the newsletter. To verify your email address, you will first receive a registration email which you must confirm by clicking on a link (double opt-in). When you subscribe to the newsletter on our website, we process personal data such as your email address on the basis of the consent you have given.
We also analyse the open rates of our newsletter. To this end, we collect and process pseudonymised usage data, which we do not link to your email address or IP address.
The processing is based on the legal basis of Article 6(1)(a) of the GDPR. You may withdraw the consent you have given at any time with future effect, for example via the ‘Unsubscribe’ link in the newsletter or by contacting us via the channels mentioned above. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal.
When you subscribe to the newsletter, we also store your IP address, as well as the date and time of your subscription. The processing of this data is necessary to be able to provide evidence of the consent given. The legal basis stems from our legal obligation to document your consent (Article 6(1)(c) in conjunction with Article 7(1) of the GDPR).

We use cookies and similar technologies (“cookies”) on our website. Cookies are small data files that are stored by your browser when you visit a website. This identifies the browser being used and allows it to be recognised by web servers. You have full control over the use of cookies via your browser. You can delete cookies at any time via your browser’s security settings. You can object to the use of cookies via your browser settings, either in general or in specific cases.
The use of cookies is, in part, technically necessary for the operation of our website and is therefore permitted without the user’s consent. In addition, we may use cookies to offer specific functions and content, as well as for analytical and marketing purposes. These may also include third-party cookies. We only use such cookies that are not technically necessary with your consent in accordance with Section 25(1) of the TDDDG and, where applicable, Article 6(1)(a) of the GDPR.

This website uses a consent management tool to manage cookies and the processing of personal data.
The consent banner enables users of our website to give their consent to specific data processing activities or to withdraw consent they have previously given. By clicking the ‘I accept’ button or by saving individual cookie settings, you consent to the use of the associated cookies.
The legal basis under data protection law is your consent within the meaning of Article 6(1)(a) of the GDPR.
Furthermore, the banner helps us to provide evidence of the declaration of consent. To this end, we process information regarding the declaration of consent and further log data relating to this declaration. Cookies are also used to collect this data. The processing of this data is necessary in order to be able to provide evidence of consent given. The legal basis stems from our legal obligation to document your consent (Article 6(1)(c) in conjunction with Article 7(1) of the GDPR).
You can withdraw your consent to cookies here:

Cookie settings

We use the Matomo service on our website. Matomo is a web analytics service that enables us to collect and analyse data on user behaviour on our website.
Matomo uses cookies for this purpose, which enable us to analyse the use of our website. We also process personal data in the form of IP addresses and information about interactions with our website. The IP address is anonymised immediately after processing and before storage. We use the on-premises version of Matomo. This means that data processing takes place on our own servers.
The setting of cookies and the further processing of personal data described here is carried out with your consent. The legal basis for data processing in connection with the Matomo service is therefore Article 6(1)(a) of the GDPR. You may withdraw this consent at any time with future effect via our Consent Management Tool.

We use the YouTube service provided by Google Ireland Limited (Ireland, EU) on our website to embed videos. For such embedding, processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google, and Google may set its own cookies. We use YouTube in ‘enhanced privacy mode’, which means that YouTube does not set any cookies to analyse user behaviour. 
The processing of your data is based on your consent in accordance with Article 6(1)(a) of the GDPR. Your consent is managed via our consent management system and can be withdrawn at any time via that system.
When using this service, the transfer of your data to the USA cannot be ruled out. Please refer to the information in the section ‘Data transfers to third countries’. Further information on data protection at Google can be found in Google’s privacy policy at https://www.google.com/policies/privacy.

When you visit our social media page, through which we showcase our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, to which we provide links below:

• Meta https://www.facebook.com/privacy/explanation Meta offers the option to object to certain data processing activities; relevant information and opt-out options can be found at https://www.facebook.com/settings?tab=ads;
• LinkedIn https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
• YouTube https://policies.google.com/privacy?hl=de
• Bluesky https://bsky.social/about/support/privacy-policy

The operators of the social media platforms collect and process certain event data and profile data, and provide us with statistics and insights for our pages in anonymised form, which help us gain an understanding of the types of actions that people carry out on our page (so-called ‘page insights’). These page insights are generated on the basis of specific information about people who have visited our site. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in analysing the types of actions carried out on our site and improving our site based on these insights. The legal basis for this processing is Article 6(1)(f) of the GDPR.
We cannot link the information obtained via Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms regarding processing as joint controllers, which set out the allocation of data protection obligations between us and the operators. Details regarding the processing of personal data for the generation of Page Insights and the agreement concluded between us and the operators can be found via the following links:

• Meta https://www.facebook.com/legal/terms/information_about_page_insights_data
• LinkedIn https://legal.linkedin.com/pages-joint-controller-addendum

You also have the option of exercising your rights with the operators. Further information on this can be found via the following links:

• Meta https://www.facebook.com/privacy/explanation
• LinkedIn https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de

It has been contractually agreed with Meta, LinkedIn and TikTok that the Irish Data Protection Commission is the lead supervisory authority responsible for monitoring the processing of Page Insights data. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or with any other supervisory authority.

We also process information that you have provided to us via our company page on the relevant social media platform. Such information may include your username, contact details or a message sent to us. We carry out this processing as the sole data controller. We process this data on the basis of our legitimate interest in contacting enquirers. The legal basis for the data processing is Article 6(1)(f) of the GDPR. Further data processing may take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR).

If you apply for a role with our company, we will process your application data solely for purposes relating to your interest in current or future employment with us and the processing of your application. Your application will only be processed and reviewed by the relevant contact persons within our organisation. All staff entrusted with data processing are obliged to maintain the confidentiality of your data. Should we be unable to offer you a position, we will retain the data you have provided for up to six months following any rejection, for the purpose of answering any queries relating to your application and the rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purposes of providing evidence, or if you have expressly consented to longer-term storage. The legal basis for data processing is Section 26(1), first sentence, of the Federal Data Protection Act (BDSG) or Article 6(1)(b) of the General Data Protection Regulation (GDPR). Should we retain your application data for longer than six months and you have expressly consented to this, we would like to point out that this consent may be freely withdrawn at any time in accordance with Article 7(3) of the GDPR. Such a withdrawal does not affect the lawfulness of the processing carried out on the basis of your consent up to the point of withdrawal.

If you call us or send us a message via the contact email address provided, we will process the data you provide for the purpose of responding to your enquiry. We process this data on the basis of our legitimate interest in contacting enquirers.
The legal basis for data processing is Article 6(1)(f) of the GDPR.

When you, as a customer or prospective customer, contact our company, we process your data to the extent necessary to establish or fulfil the contractual relationship. This typically involves processing the personal master data, contractual data and payment details provided to us, as well as the contact and communication details of our points of contact at business customers and business partners. The legal basis for this processing is Article 6(1)(f) of the GDPR.
We also process customer and prospective customer data for analysis and marketing purposes. This processing is carried out on the legal basis of Article 6(1)(f) of the GDPR and serves our interest in further developing our services and providing you with targeted information about our offerings.
Further data processing may take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR).