Information to be provided pursuant to Art. 12, 13 et seq. of the GDPR

1. Name and Address of Controller

Your contact and the controller within the meaning of the General Data Protection Regulation of the European Union ("GDPR"), national data protection laws of the member states, and other data protection regulations is:

ifo Institut – Leibniz-Institut für Wirtschaftsforschung an der Universität München e. V.
ifo Institute – Leibniz Institute for Economic Research at the University of Munich
Poschingerstr. 5
81679 München

(hereinafter referred to as "we", "us", "our" or "ifo Institute").

2. Name and Address of Data Protection Officer

The protection of your personal data is of great importance to the ifo Institute – Leibniz Institute for Economic Research at the University of Munich. To demonstrate our commitment to protecting your personal data, we have commissioned a consulting firm specialising in data protection and security to handle these important issues. Our data protection officer is part of a team of highly experienced professionals at our consulting firm. The firm that provides us with consulting services is:

Legaltech GmbH
Augustaanlage 32
68165 Mannheim
https://www.schutz-von-daten.de/impressum/

If you have any questions concerning data protection and data security at the ifo Institute, please contact our data protection officer at Legaltech GmbH directly:

E-Mail: datenschutz@ifo.de
Tel.: +49 43179339

3. General Information on Data Processing

3a. Scope of Personal Data Processing

As a matter of principle, we will only process your personal data to the extent that is necessary to provide our services. Any processing of your personal data is, as a rule, subject to your prior consent, except in cases where prior consent cannot be obtained for factual reasons or the processing of your personal data is permitted by law.

3b. Legal Basis for Processing Personal Data

In cases where we seek your consent to process personal data, the legal basis for doing so is set out in Art. 6(1)(a) of the GDPR.

In cases where we process personal data in the execution of a contract between you and us, the legal basis for doing so is set out in Art. 6(1)(b) of the GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures.

In cases where personal data must be processed to comply with a legal obligation that we are subject to, the legal basis for doing so is set out in Art. 6(1)(c) of the GDPR.

In cases where your vital interests, or those of another natural person, require the processing of personal data, the legal basis for doing so is set out in Art. 6(1)(d) of the GDPR.

In cases where the processing of personal data is necessary for the purposes of the legitimate interests pursued by us or a third party and those interests are not overridden by your interests, fundamental rights and freedoms, the legal basis for doing so is set out in Art. 6(1)(f) of the GDPR.

3c. Deletion and Storage Period

Your personal data will be deleted or blocked if they are no longer required for the purposes for which they were stored or otherwise processed. In addition, data may be stored to meet the legal obligations stipulated by the European or national legislator in EU regulations, laws or other standards that we are subject to. Data will also be blocked or deleted if the storage period stipulated in the above-mentioned regulations, laws or standards expires unless longer storage is necessary for the purpose of entering into or performing a contract.

4. Website provision and creation of log files

4a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of website provision and the creation of log files is set out in Art. 6(1)(f) of the GDPR.

4b. Purpose of Data Processing

The temporary storage of your personal data is necessary to enable us to deliver the website to your computer. To this end, your personal data need to be stored for the duration of the session.

Your personal data are stored in log files to ensure the operability of the website. We also use your personal data to optimise our website and safeguard the security of our information technology systems. In this context we will not analyse your personal data for marketing purposes.

The above is necessary for the purposes of the legitimate interests pursued by us referred to in Art. 6(1)(f) of the GDPR.

4c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed. In cases where your personal data are collected for the purpose of providing the website, they will be deleted each time a session ends.

If personal data are stored in log files, they will be deleted after fourteen days at the latest. In some cases data may be stored for a longer period of time, in which case your personal data will be deleted or masked, thus making identification of the requesting client impossible.

4d. Objection, Removal

Recording your personal data for the purpose of providing the website and storing your personal data in log files are essential for the operation of the website. You therefore have no right to raise any objection to these activities.

5. Use of Cookies

5a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of using cookies required for technical purposes is set out in Art. 6(1)(f) of the GDPR.

5b. Purpose of Data Processing

The use of cookies required for technical purposes is designed to simplify your use of our website. Some features of our website cannot be offered without the use of cookies. For these features it is necessary that your internet browser is recognised even after a page change. The user data collected through cookies required for technical purposes will not be used to create user profiles.

Such processing is therefore necessary for the purposes of the legitimate interests pursued by us as referred to in Art. 6(1)(f) of the GDPR.

5c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed; this will, particularly be the case when cookies are deactivated.

5d. Objection, Removal

Cookies are stored on your computer and transmitted to our website from your computer. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies that have already been saved at any time. This can also be done automatically. If you deactivate cookies in your browser settings for our website, you may not be able to fully use all of the website’s features.

6. Web Shop

6a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of the web shop is set out in Art. 6(1)(b) of the GDPR.

6b.Purpose of Data Processing

The purpose of processing your personal data in the context of the web shop is the execution of a contract for the sale of goods or supply of services between you and us.

6c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed. In the case of processing your personal data in the context of the web shop this will be the case when all claims arising from the contractual relationship have become time-barred and any statutory retention periods have expired.

6d. Objection and Removal

The processing of personal data in the context of the web shop is essential for the sale of goods or supply of services. You therefore have no right to raise any objection.

7. Newsletter

7a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of distributing the newsletter is obtaining your prior consent, as set out in Art. 6(1)(a) of the GDPR, or, as a result of the sale of goods or supply of services, provided by the legal permission pursuant to § 7 (3) of the German Act Against Unfair Competition (§ 7 Abs. 3 UWG).

7b. Purpose of Data Processing

Your personal data are collected for the purpose of distributing the newsletter to you. The purpose of processing your personal data in the context of distributing the newsletter is to promote the sale of goods or supply of services.

7c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed, i.e. your personal data are stored while the subscription to the newsletter is active.

7d. Objection, Removal

You may cancel your newsletter subscription at any time by following the corresponding link featured in each newsletter. By cancelling your subscription you also revoke your consent.

8. Registration

8a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of your registration is set out in Art. 6(1)(b) of the DGPR.

8b. Purpose of Data Processing

Your registration facilitates entry into contracts between you and us. Hence the processing of your personal data in the context of the registration is required to fulfil the contract between you and us or to implement pre-contractual measures.

8c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed. This is the case during the registration process when your personal data are no longer required to fulfil a contract or to implement pre-contractual measures Even after entering into the contract, it may be necessary for us to store personal data of a party to the contract in order to comply with contractual or legal requirements.

8d. Objection, Removal

You may cancel your registration at any time. You can also request modification of your stored personal data at any time. In cases where your personal data are necessary to execute a contract or implement pre-contractual measures, early deletion of your personal data will only be possible if there are no contractual or legal requirements that conflict with their deletion.

9. Contact Form and Contact by Email

9a. Legal Basis for Data Processing

The legal basis for processing your personal data transmitted by using the contact form or sending an email is set out in Art. 6(1)(f) of the GDPR. In cases where you use the contact form or send an email with a view to entering into a contract, Art. 6(1)(b) of the GDPR provides an additional legal basis for processing.

9b. Purpose of Data Processing

In the context of you contacting us via the contact form or by email, your personal data is processed for the sole purpose of handling your contact request.

9c. Storage Period

Your personal data will be deleted once they are no longer required for the purpose for which they were collected or otherwise processed. Personal data transmitted via the contact form or by email will be deleted each time a dialogue with you is over. A dialogue is deemed over when it can be inferred from the circumstances that the facts in question have finally been clarified between you and us.

9d. Objection, Removal

You may at any time object to the processing of your personal data in the future in the context of contacting us via the contact form or email. In this we cannot continue a dialogue with you. All personal data stored in the process of your contacting us will be erased.

10. Web Tracking and Web Analysis by Matomo (formerly PIWIK)

10a. Legal Basis for Data Processing

The legal basis for processing your personal data is set out in Art. 6(1)(f) of the GDPR.

10b. Purpose of Data Processing

Processing your personal data enables us to analyse your surfing patterns. By evaluating the collected data, we are able to compile information on your use of specific components of our website. This helps us to continuously improve our website and its user-friendliness. Such processing is therefore necessary for the purposes of the legitimate interests pursued by us, as referred to in Art. 6(1)(f) of the GDPR. By anonymizing your IP address, your interest in protecting your personal data is sufficiently taken into account.

10c. Storage Period

Your personal data will be deleted once they are no longer required for the above-mentioned purposes. In our case, this will be after 14 days.

10d. Objection, Removal

Cookies are stored on your computer and transmitted to our website from your computer. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies that have already been saved at any time. This can also be done automatically. If you deactivate cookies in your browser settings for our website, you may not be able to fully use all features of our website.

More detailed information on the privacy settings of the Matomo software may be found at: 
https://matomo.org/docs/privacy/

11. Direct Marketing

11a. Legal Basis for Data Processing

The legal basis for processing your personal data for the purpose of direct mail marketing is set out in Art. 6(1)(f) of the GDPR.

11b. Purpose of Data Processing

The purpose of processing your personal data for the purposes of direct mail marketing is to promote the sale of goods or supply of services. This is a legitimate interest pursued by us as referred to in Art. 6(1)(f) of the GDPR.

11c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed; this will particularly be the case if we receive your objection.

11d. Objection, Removal

You may at any time object, with future effect, to the processing of your personal data in the context of direct mail marketing.

12. Legal Defence and Enforcement of Rights

12a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of legal defence and the enforcement of rights is set out in Art. 6(1)(f) of the GDPR.

12b. Purpose of Data Processing

The purpose of processing your personal data in the context of legal defence and the enforcement of rights is the defence against unfounded claims and the legal enforcement of claims and rights. This is a legitimate interest pursued by us as referred to in Art. 6(1)(f) of the GDPR.

12c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed.

12d. Objection, Removal

The processing of your personal data in the context of legal defence and enforcement of rights is essential for legal defence and the enforcement of rights. You therefore have no right to raise any objection.

13. Categories of Recipients

Within our institute, only those entities and departments that need personal data to fulfil the purposes set out above obtain such data. In addition, we work with various service providers and transmit your personal data to other trustworthy recipients such as, for example:

- Banks
- Scan service providers
- Print shops
- Letter shops
- IT service providers
- Lawyers and courts.

14. Rights of the Data Subject

If your personal data are processed by us, you are a data subject within the meaning of the GDPR and have the following rights:

14a. Right of Access

You shall have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed by us.

Where that is the case, you have the right to request the following information from us: 

(1) The purposes for which your personal data are being processed;
(2) The categories of personal data concerned;
(3) The recipients or categories of recipient to whom your personal data have been, or will be, disclosed;
(4) The envisaged period for which your personal data will be stored, or, if precise information is not possible, the criteria used to determine that period;
(5) The existence of the right to request rectification or deletion of your personal data, the right to request a restriction on personal data processing, or the right to object to such processing;
(6) The right to lodge a complaint with a supervisory authority;
(7) Any available information as to the source of the data where the personal data are not collected from you;
(8) The existence of automated decision-making, including profiling, referred to in Art.22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. 

You have the right to obtain access to your personal data and to request information as to whether your personal information will be disclosed to recipients in third countries or international organisations. If so, you shall have the right to be informed of the appropriate safeguards relating to the transfer pursuant to Art. 46 of the GDPR.

14b. Right to Rectification

Where your personal data processed by us are inaccurate or incomplete, you have the right to obtain the rectification and/or the right to have incomplete personal data completed. We are obliged to perform the rectification without undue delay.

14c. Right to Restriction of Processing

You have the right to obtain restriction of processing of your personal data where one of the following applies:

(1) You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data;
(2) Our processing is unlawful and you oppose the deletion of personal data and request the restriction of their use instead;
(3) We no longer need your personal data for processing purposes, but you require them for the establishment, exercise or defence of legal claims, or
(4) You have objected to processing pursuant to Art. 21(1) of the GDPR and the verification as to whether our legitimate grounds override yours is still pending.

In cases where processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.

If you have obtained restriction of processing in accordance with the above requirements, we will inform you before the restriction of processing is lifted.

14d. Right to Deletion

14d i. Obligation to Delete

You have the right to obtain from us the deletion of your personal data without undue delay and we are obliged to delete you’re your personal data without undue delay in cases where one of the following applies:

(1) Your personal data are no longer required for the purposes for which they were collected or otherwise processed;
(2) You withdraw your consent on which the processing is based according to Art. 6(1)(a), or Art. 9(2)(a) of the GDPR, and there is no other legal ground for the processing;
(3) You object to data processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for processing, or you object to processing pursuant to Art. 21(2) of the GDPR;
(4) Your personal data have been unlawfully processed;
(5) Your personal data have to be deleted to comply with a legal obligation under Union or Member State law to which we are subject;
(6) Your personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) of the GDPR.

14d ii. Informing Third Parties

In cases where we have made the personal data public and are obliged to delete them pursuant to Art. 17(1) of the GDPR, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform the controllers processing your personal data that you, the data subject, have requested the data deletion by such controllers of any links to, or copy or replication of those personal data.

14d iii. Exceptions

The right to deletion does not apply if the processing of data is necessary

(1) To exercise the right of freedom of expression and information;
(2) To comply with a legal obligation, which requires processing by Union or Member State law to which we are subject; or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
(3) For reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) as well as Art. 9(3) of the GDPR;
(4) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) of the GDPR in so far as the right referred to in section d. above is likely to render impossible, or seriously impair, the achievement of the objectives of that processing, or
(5) To establish, exercise or defend legal claims.

14e. Notification Obligation

In cases where you have exercised your right to rectification, deletion or restriction of processing, we are obliged to inform all recipients to whom we have disclosed your personal data of such rectification, deletion or restriction of processing unless this proves to be impossible or would involve a disproportionate effort.

You have the right to obtain information on those recipients.

14f. Right to Data Portability

You have the right to receive the personal data, which you have provided us with, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit those data to another controller without hindrance from us, where

(1) The processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6(1)(b); and
(2) The processing is carried out by automated means.

In exercising your right to data portability, you also have the right to have your personal data transmitted directly from us to another controller, where technically feasible. Your rights may not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

14g. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, at any time to any processing of your personal data, which is based on Art. 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, or freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

In cases where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

In cases where you object to processing for direct marketing purposes, your personal data will no longer be processed to such an end.

In the context of the use of information society services you may, notwithstanding Directive 2002/58/EC, exercise your right to object by automated means based on technical specifications.

14h. Right to Withdraw Consent

You have the right to withdraw your consent to the processing of personal data at any time. This withdrawal of consent will not affect the lawfulness of processing based on consent before your withdrawal.

14i. Automated Individual Decision-Making, including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

(1) Is necessary for enter into, or execute a contract between you and us;
(2) Is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) Is based on your explicit consent.

However, those decisions must not be based on the special categories of personal data referred to in Art. 9(1) of the GDPR, unless Art. 9(2)(a) or (g) of the GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

With regard to the cases referred to in (1) and (3), we will implement suitable measures to safeguard your rights, freedoms and justified interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

14j. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State in which you are ordinarily resident, your place of work or the place where the alleged infringement took place, if you consider that processing of your personal data infringes the GDPR.

The competent supervisory authority for the ifo Institute is:

Bayerisches Landesamts für Datenschutzaufsicht
Postfach 606
91511 Ansbach
Deutschland

The supervisory authority with which the complaint has been lodged will inform you of its progress and the outcome of your complaint, including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.

If you have any questions , please do not hesitate to contact our data protection officer.