Data Protection Officer:

LWL-Hauptverwaltung

Karlstr. 11

48133 Münster

Telefon: +49 (0)251 591- 3336

Telefax: +49 (0)251 591-713336

E-Mail: datenschutz@lwl.org

Data Protection Officer:

LWL-Psychiatrie-Verbund Westfalen und LWL-Maßregelvollzugskliniken

Hörsterplatz 2

48143 Münster

Telefon: +49 (0)251 591- 5834

Telefax: +49 (0)251 591- 267

E-Mail: datenschutz.gesundheit@lwl.org

As a basic principle we only process data of our users, in as far it is necessary to provide a functional website as well as our contents and services. The processing of personally identifiable data of our users takes place routinely only after consent by the user. An exception applies in such cases in which the prior obtainment of consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

Providing we obtain consent from the person concerning the processing steps of personally identifiable data, Article 6, Section 1 lit. a of the EU- Data Protection Regulations (GDPR) serves as the legal basis. On processing personally identifiable data, which is necessary to fulfil a contract whose contractual partner is the person concerned, Article 6 Section 1 lit. b of the EU- Data Protection Regulations (GDPR) serves as the legal basis. This is also valid for the processing steps, which are necessary to carry out pre-contractual provisions.

In as far as the processing of personally identifiable data is required to fulfil a legal obligation, which our establishment is governed by, Article 6, Section 1 lit. c of the GDPR serves as legal basis. In the case that the vital interests of the person concerned or another natural person necessitate the processing of personal data, Article 6, Section 1 lit. d of the GDPR serves as legal basis. If the processing is necessary to safeguard a legitimate interest of our establishment or those of a third party and does not outweigh the interests, fundamental rights and basic liberties of the person concerned and the first-named interest, then Article 6 Section 1 lit. f of the GDPR serves as legal basis for the processing.

The personal data of the persons concerned will be deleted or disabled as soon as the purpose of the storage has elapsed. Storage can take place in addition to it, if provided for and it is governed by European or by the national legislature in Union 3 legal regulations, laws or other regulations, which the person responsible is governed by. Disablement or deletion of data can also take place, if the deadline expires as a result of the named norms, unless where a necessity exists for a further storage of the data in order to conclude or fulfil a contract.

With every visit to our website our system automatically gathers data and information from the computer system of the accessing computer.

In so doing the following data is collected:

1. Information concerning the browser type and the version used
2. The user’s operation system
3. The user’s IP-address
4. Date and time of the access
5. Websites, from which the user’s system reached our website
6. Websites, which are accessed by the user’s system via our website

Likewise the data is stored in the logfiles of our system. Storage of this data together with other personal data of the user does not take place.

Legal basis for the temporary storage of data and the logfiles is Article 6, Section 1 lit. f of the GDPR.

The temporary storage of the IP address by the system is necessary, in order to enable the delivery of the website to the user’s computer. For this purpose the user’s IP address must remain stored for the duration of the session. The storage in logfiles takes place in order to ensure the functionality of the website. In addition the data serves the optimization of the website and guarantees the safety of the information technology systems. An analysis of the data for marketing purposes does not take place in this context. In addition, to these ends lay our legitimate interest in the processing of data as per Article 6, Section 1 lit. f of the GDPR.

The data is deleted as soon as it is no longer required in order to achieve the object of their collection. In the case of data collection in order to provide a website, this is the case when the respective sitting is terminated. In the case of storage of data in logfiles, this is the case after seven days at the latest. Storage extending beyond this is possible. In this case the user IP addresses are deleted or alienated, so that an attribution of the client accessing is no longer possible.

The collection of data to provide the website and the storage of the data in logfiles is absolutely necessary for the running of a website. There is no possibility on the part of the user to raise an objection.

Our website uses cookies. In the case of cookies they concern text files, which are stored in the internet browser, or respectively in the user’s computer system. If a user visits a website, then a cookie can be stored on the user’s operating system. This cookie contains a characteristic character string, which enables a distinct identification of the browser when accessing and re-using the website. We utilize cookies in order to design the website more user-friendly. Some elements of our webpage require that the calling browser can also be identified after changing pages.

In the process in the cookies the following data is stored and transmitted:

1. Language settings
2. Showing articles in the shopping cart
3. Cookie-banner / matomo-banner
4. In individual webpages further cookies and respectively cookie-data is stored, e.g. session-ID of press releases on the LWL-portal page, or session-ID of the events calendar on visiting the event calendar.

In addition on our website we use cookies, which make an analysis of the users’ surfing behaviour possible. In so doing the following data can be transported.

1. Random unique visitor ID
2. Time of the first visit for this user
3. Time of the previous visit for this user
4. Number of visits for this user

The users‘ data collected in this way are pseudonymized by technical precautionary measures. Therefore an assignment of the data to a visiting user is no longer possible. The data is not jointly stored with other personal-identifiable data of the users.
On visiting our website the user is informed of the use of cookies for analytical purposes and his consent for the processing of personal data used in this context is obtained. In this context advice concerning this data protection declaration ensues.

Legal basis for the processing of personal data using technically essential cookies is Article 6, Section 1 lit. f of the GDPR. Legal basis for the processing of personal data using cookies for analytical purposes is on the presentation of the user’s consent relating to this is Article 6, Section 1 lit. a of the GDPR.

The purpose of the use of technically-essential cookies is to simplify the use of websites for the user. A number of functions of our webpages cannot be provided without the application of cookies. It is essential for these that the browser is also recognized, even after changing pages.
We require cookies for the following applications:

1. The shopping cart
2. Taking over of language settings
3. Storage of validity characteristics for form dispatching, in order to prevent CSRF (cross site request forgery)-attacks
4. To perceive that cookie-banner was read

The user data collected by the technically-essential cookies are not only used to generate user profiles. The use of analysis cookies takes place for the purpose of improving the quality of our website and its contents. By means of analysis cookies we learn how the website is used and can therefore continually optimize the services we offer.

To these ends there also exists our legitimate interest in the processing of the personal data pursuant with Article 6, Section 1 lit. f of the GDPR.

Cookies are stored on the user’s computer and passed on to our page. Hence, you as a user, also have full control concerning the use of cookies. By a change in your internet browser you can deactivate or limit the transfer of cookies. Cookies already stored can be deleted at any time. This can take place automatically. If cookies for our website are deactivated it is possible that not all the website’s functions can be comprehensively used.

On our internet page the option is provided to subscribe to a free newsletter. In the process on registering for the newsletter the data from the input mask is transmitted to us. In addition the following data is collected on registration:

1. E-Mail address
2. Name (optional)

For the processing of the data your consent is obtained, as a part of the enrolment procedure, your consent is obtained and reference is made to this data protection declaration. In connection with the data processing for the forwarding of newsletters no transfer of data to third parties takes place. The data is used solely for the consignment of newsletters.

Legal basis for the processing of personal data after registration for the newsletter by the user is, on presentation of the consent by the user, Article 6, Section 1 lit. a of the GDPR.

The elicitation of the user’s email address serves the purpose of delivering the newsletter. By the optional declaration of the name, the newsletter can thereby be personalized.
The elicitation of other personal data in connection with the registration procedure serves the purpose of preventing misusage of the services or the email address used.

The data will be deleted as soon as they are no longer required to reach the purpose of their elicitation. The email address and optionally the name of the user are accordingly stored as long as the subscription of the newsletter is active.
The other personal data collected in the course of the registration procedure, will be, as a general rule, deleted after a period of seven days.

The newspaper subscription can be cancelled by the user concerned at any time. For this purpose a corresponding link can be found in every newsletter.

On out internet site we offer the users the opportunity, to register on giving personal data. On doing so the data is entered into an input mask, transferred to us and stored. Passing on of the data to third parties does not take place. The following data is collected in the course of the registration procedure:

1. Form of address, Name, first name,
2. Email address
3. Password
4. Company name
5. Street, Post Code, City, Country
6. Telephone numbers, landline, mobile, telefax number,

At the point in time of registration the following data is also stored:

1. The user’s IP-address
2. Date and time of the registration

In the course of the registration process the user’s consent for the process of this data is obtained.

Legal basis for the processing of the data is the is the existence of the user’s consent, Article 6, Section 1 lit. a of the GDPR.
If the registration serves as fulfilling a contract, whose contractual partner is the user, or for the performance of pre-contractual measures, then the additional legal basis for the processing of the data is Article 6, Section 1 lit. b of the GDPR.

Registration by the user is to fulfill a contract with the user or is necessary to perform pre-contractual measures.

The data will be deleted as soon as it is no longer required to reach the purpose of their collection.
This is the case for the data collected during the registration procedure, if the registration on our internet page is cancelled or amended.
This is the case for data collected during the registration procedure in order to fulfil a contract or for implementation of pre-contractual measures, if the data for the implementation of the contract are no longer required. After the conclusion of a contract a requirement can also exist to store the personal data of a contractual partner, in order to meet contractual or legal obligations.

As a user you have the possibility at any time to terminate the registration. The stored data concerning yourself can be altered at any time.
If the data is required in order to fulfil a contract or for the implementation of pre-contractual measures, a premature deletion of the data is only possible, in as far as contractual or legal obligations are not an obstacle.

On our internet page there is a contact form, which can be used for making electronic contact. If the user takes uses this, then the data entered into the input mask is transmitted to us and stored. This data is:

1. Form of address, Name, first name,
2. Email-address
3. Company name
4. Street, postcode, city, country
5. Landline telephone numbers, mobile, telefax number

At the point in time of the submission of the information the following data is stored in addition:

1. The user’s IP-address of e IP-Adresse des Nutzers
2. Date and time of submission
3. URL oft he form
4. Page language / of the form

For the processing of the data your consent is obtained as part of the submission procedure and reference made to this data protection declaration.
Alternatively making contact is possible via the email-address provided. In this case the personal data transmitted in the email are stored.
In this regard no transfer of data to third parties takes place. The data is used solely for the processing of the conversation.

Legal basis for the data processing is the presence of consent by the user is Article 6 Section 1 lit. a GDPR.
Legal basis for the data processing which are transferred as part of the transmission of an email is Article 6 Section 1 lit. f GDPR. If the reason of the email is to conclude a contract, then the additional legal basis for the processing is Article 6 Section 1 lit. b GDPR.

The processing of personal data from the input mask serves us solely for the processing of the making of contact. In the case of making contact by email there exists in this a necessary legitimate interest in the processing of the data.
The other personal data processed during the submitting procedure serve the purpose to prevent the misuse of the contact form and to ensure the safety of our information technology systems.

The data will be deleted as soon as it is are no longer required to reach the purpose of its collection. This is the case for the personal data from the contact form input mask, which was sent by email, if the conversation with the user has been terminated.
The conversation is terminated at the point in time, if it can be seen from the circumstances, that the issue concerned is conclusively clarified.
The additional data collected during the submitting process will be deleted, latest after a deadline of seven days.

The user has, at any time, the option to revoke his consent to process personal data. If the user contacts us by email, he can then object at any time to the storage of personal data. In such a case the conversation cannot be continued.
All personal data, which was stored in the course of establishing contact, will be, in this case deleted.

On our website we use the open-source software tool Matomo (formerly PIWIK) to analyze the surfing behavior of our users.
The software places a cookie on the user’s computer (re. cookies, as mentioned previously see above). If details of our website are viewed then the following data is stored:

1. The first two bytes of the IP-address of the calling system of the user
2. The website viewed
3. The website, from which the user reached the website viewed (referrer)
4. The subpage, from which the webpage was accessed from
5. The dwell time on the website
6. The frequency of accessing the website

The software operates solely on the servers of our website. Storage of users’ personal data only takes place there. A transfer of data to third parties does not take place.
As the software is configured so that the IP-Addresses are not entirely stored, an association of the shortened IP-Address to the computer calling is no longer possible.

Legal basis for the processing of the users’ data is Article 6, Section 1 lit. f of the GDPR.

The processing of users‘ personal data enables us to analyze the surfing behaviour of our users.
By virtue of the evaluation of the data obtained, we are in a position to compile information concerning the usage of the individual components of our website. This helps us in continually improving our website and its user-friendliness. To these ends lay also our legitimate interest in the processing of the date as per Art. 6 Section. 1 lit. f GDPR. By anonymization of the IP-address the interest of the users in the protection of their personal data is sufficiently taken into account.

The data will be deleted after 5 years.

Cookies are stored on the user’s computer and transmitted from this to our page. Thus, you as user, have full control of the use of cookies. By an ammendment in the preferences in your internet browser you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can take place automatically. If cookies are deactivated for our website it is possible that not all functions of our website can still be comprehensively used.
We offer our users on our website the opportunity of an opt-out from the analysis procedure. For this purpose you must follow the relevant link. In this way a further cookie is placed on your system, which signals our system not to store the user’s data. If the user deletes the relevant cookie in the meantime from his own system, then he must once more place the opt-out cookie.

You can demand confirmation from the body responsible, whether personal information which relates to you, is processed by us.
If such processing exists you can demand from the body responsible the following information:

1. the purposes for which the personal data is to be processed;
2. the categories of personal data, which are to be processed;
3. the recipient, respectively the categories of recipients to whom the personal data related to you were disclosed or are still to be disclosed;
4. the projected duration of storage of the personal data related to you or, if definite particulars concerning this are not yet possible, criteria for the determination of the duration of storage;
5. the existence of the right to amendment or deletion of personal data pertaining to you, of the right to limitation of the processing by the body responsible, or the right of objection to this processing;
6. the existence of the right of complaint to the he regulating authorities;
7. all available information concerning the source of the data, if the personal data was not gathered from the person concerned;
8. the existence of an automatized decision-finding including profiling as per Art. 22 Sections 1 and 4 GDPR and – at least in these cases – convincing Information concerning the logic involved as well as the consequences and the potential effects of such processing for the person concerned.

You have the right to demand information concerning this, whether the relevant personal data are to be transmitted to a third country or to an international organization. In this context you can demand to be informed concerning guarantees as per Article 46 GDPR in relation to the transmission.
This right to information can be restricted in as far, when it is expected that the realization of research- or statistical-purposes would be made impossible or seriously compromised and the restriction is necessary for the accomplishment of the research- or statistical purposes.

You have a right to amendment and/or completeness towards the body responsible, in as far as the processed personal data, which is relevant to you, are incorrect or not complete. The body responsible has to make the amendment immediately
Your right to amendment can be restricted in as far, when it is expected that the realization of research-, or statistical-purposes would be made impossible or seriously compromised and the restriction is necessary for the accomplishment of the research- or statistical purposes.

Under the following preconditions you can demand the limitation of the processing of the personal data relating to you:

1. if you dispute the accuracy of the personal data related to you for a period of time, which makes it possible for the responsible body to examine the accuracy of the personal data;
2. if the processing is illegal and you oppose the deletion of the personal data and instead you demand the limitation of the use of personal data;
3. the body responsible no longer requires the personal data for the purposes of the processing and you, however, require these in order to exercise or defend legal rights, or
4. if you have lodged a protest against the processing as per Article 21 Section 1 GDPR and it is not certain, whether the legitimate rights of the body responsible predominate your reasons.

If the processing of the personal data related to you was restricted, this data may – apart from their storage – only be processed with your consent or the enforcement, exercising or protection of legal rights or to protect the rights of a natural person or corporate entity, or for reasons of an important public interest of the Union or of a member state.
If the restriction of the processing were limited according to the above-mentioned preconditions, you will be informed by the body responsible before the restriction is lifted.
Your right to restriction of the processing can, in as far as it is likely to make the realization of research- or statistical purposes impossible or seriously restrict them and the restriction is necessary for the accomplishment of the research- or statistical purposes.
If your right to restriction of the processing was limited as per the above-named preconditions, you will be informed by the body concerned before the restriction is revoked.

a) Obligation of deletion
You can demand from the body responsible, that he/it immediately deletes the personal data related to you and, that the body responsible is obliged to immediately delete this data, in as far as the following reasons are applicable:

1. The personal data related to you are no longer necessary for the purposes, for which it was collected or in any other manner was processed
2. You revoke your consent, on which the processing, as per Article 6, Section 1 lit. a, or Article 9 Section 2 lit. a GDPR is supported by and the absence of a a further legal basis for the processing.
3. You lodge a protest against the processing, according to Article 21 Section 1 GDPR and no other overriding justified reasons for the processing exist or, you lodge a protest against the processing as per Article 21 Section 2 GDPR.
4. The personal data related to you were processed illegally.
5. The deletion of the personal data related to you is required to fulfill a legal obligation according to Union law or the law of the member states, which the body responsible is bound to.
6. The personal data related to you was collected in relation with the services offered by the information organisation as per Article 8 Section 1 GDPR.

b) Information to third parties
If the body responsible has made public the data related to you and, if it is obliged, according to Article 17 Section 1 GDPR, to delete this, then it is to take appropriate measures in due consideration of the technology available and implementation costs, also technical type, in order to inform the body responsible for the data processing, who processes the personal data that you, as the person affected have demanded the deletion of all links pertaining to this personal data or copies or replications of this personal data.

c) Exceptions
The right to deletion does not exist, in as far as the processing is necessary

1. To exercise rights to freedom of expression of opinion and information;
2. To fulfil a legal obligations, according to the laws of the Union by which the or the member states to which the body is subject to, or in order to , be able to discharge a task, which is in the public interest or in the execution of public authority, which was assigned to the body responsible;
3. For reasons of public interest in the area of public health as per Article 9 Section 3 lit. h und I, as well as Article 9 Section 3 GDPR;
4. For archiving purposes which are in the public interest, scientific, historical research purposes or for statistical purposes as per Article 89 Section 1 GDPR, in as far as the named law in section a) is likely to make impossible or impair this realization of the processing or,
5. In order to enforce, exercise or protection of legal rights.

If you have enforced the right to amendment, deletion or restriction towards the body responsible, he is then obliged to inform all recipients, to whom the person data relating to you was disclosed, of this amendment or deletion of the data or the restriction of processing, unless this proves to be impossible or a disproportionate effort and expenditure is involved.
You have the right to be informed by the body responsible concerning these recipients.

You have the right to receive the personal data, which you provided the body with, in a structured, usual and machine-readable format. Furthermore you have the right to convey this data to another body responsible without hindrance by the body, who you provided the personal data with, in as far as:

1. the processing is based on a consent as per Article 6 Section 1 lit. a GDPR or on a contract as per Article 6 Section 1 lit. b GDPR and
2. the processing takes place with the aid an automated procedure

In exercising this right you furthermore have the right to effect that the personal data relating to you is directly transferred from one body responsible to another body responsible, in as far as this is technically feasible. The liberties and rights of other persons may not be compromised as a result of this.
The right of transferabilty is not only valid for the processing of personal data, which is necessary for performing a task, which is in public interest or in the exercising of public authority, which was transferred to the body responsible.

You have the right, for reasons which result from your particular situation, to lodge at any time a protest against the processing of personal data related to you, which is made owing to Article 6 Section 1 lit. e or f GDPR: this is also valid for profiling supported by these regulations.
The body responsible no longer processes the personal data related to you, unless he can prove compelling reasons for the processing worthy of protection, which outweigh your interests, rights and liberties, or the processing serves the enforcement, exercise or protection of legal rights.
If the personal data related to you is processed in order to conduct direct advertising, you have the right to lodge a protest at any time against the processing of the personal data related to you for the purposes of advertising of this type; this is also valid for profiling, in as far as it stands in direct connection with such direct advertising.
If you object to the processing for the purposes of direct advertising, then the related personal data will not be processed and used for these purposes.
You also have the possibility, in connection with the use of services of an information company – irrespective of the directive 2202/58/EC – to exercise your rights with the aid of automated procedures, in which technical specifications are used.
You have the right, for reasons which result from your particular situation, to lodge at any time a protest against the processing of personal data related to you, which take place for scientific or historical research purposes, or for statistical purposes as per Article 89 Section 1 GDPR.
Your right to protest can be restricted in as far, when it is expected that the realization of research-, or statistical-purposes would be made impossible or seriously compromised and the restriction is necessary for the accomplishment of the research- or statistical purposes.

You have the right to retract declaration of consent regarding data protection law at any time. By the retraction of your consent, the legality of the processing based on the consent until retraction is not affected.

You have the right, not only to be subject to a decision, based on an automated processing – including profiling - which has a legal impact on you or significantly restricts you in a similar manner. This is not valid if the decision:

1. is necessary for the fulfillment or conclusion of a contract between you and the body responsible
2. owing to the legislation of the he Union or the member states, which the body responsible is governed by is permissible and this legislation contains adequate measures to safeguard your rights and liberties or as well your legitimate interests
3. take place with your explicit consent

However, these decisions may not be assigned to special categories of personal data as per Article 9 Section 1, in as far as Article 9 Section 2 lit. a or g of GDPR are valid and appropriate measures were taken to protect your rights and liberties, as well as your legitimate interests.
With respect to the cases named in (1) und (3), the body takes appropriate measures to safeguard your rights and liberties, as well as your legitimate interests, whereby there belongs at least the right of a person to intervene on the part of the body concerned, to presentation of one’s own point of view and to legally challenge the decision.

Regardless of another legal address pertaining to administrative or judicial law, you have the right of complaint to a regulating authority, in particular in the member state of your residence, your place or employment or the place of the alleged offence, if you are of the opinion that the processing of the personal data related to you contravenes the GDPR.
The regulating authority, to which the complaint was submitted, informs the complainant concerning the actual state of affairs and the result of the complaint, including the possibility of a legal challenge as per Article 78 GDPR.