The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on the subject of data protection can be found in our data protection declaration listed below this text.

General notes, mandatory information and legal bases

Why we protect data

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission over the Internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Security when transmitting data
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Storage period of your data
Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place after these reasons no longer apply.

Information on the responsible body
The responsible body for data processing on this website is:
Prof. Dr Christoph Michalski Medical Director of the Clinic for General, Visceral and Transplant Surgery

Heidelberg University Hospital Institution under Public Law
Im Neuenheimer Feld 420
69120 Heidelberg

Phone: +49 6221 56-6110
E-mail: christoph.michalski@med.uni-heidelberg.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special categories of data are processed in accordance with Art. 9 para. 1 GDPR. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have consented to the storage of cookies or access to information in your end device (e.g. via device fingerprinting), the data processing is also carried out on the basis of Section 25 (1) TTDSG. Consent can be revoked at any time. If your data is required to fulfil a contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR.

Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.

Data protection officer
We have appointed a data protection officer
Data protection officer
Heidelberg University Hospital
Im Neuenheimer Feld 672
69120 Heidelberg

Phone: +49 6221 56-7036
E-mail: datenschutz@med.uni-heidelberg.de

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the "Information on the controller" section of this privacy policy.

How do we collect your data?
Your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of page view). This data is collected automatically as soon as you enter this website.

Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
1) Browser type and browser version, 2) Operating system used, 3) Referrer URL, 4) Host name of the accessing computer, 5) Time of the server enquiry and 6) IP address
This data is not merged with other data sources. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website - the server log files must be recorded for this purpose.

Contact form
If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We will not pass on this data without your consent. This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any time. We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory provisions - in particular retention periods - remain unaffected.

Applications
(see: own services)

Enquiry by email, telephone or fax
If you contact us by email, telephone or fax, we will store and process your enquiry including all personal data (name, enquiry) for the purpose of processing your request. We will not pass on this data without your consent. This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

What do we use your data for?
Some of the data is collected in order to ensure error-free provision of the website. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?
You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and other questions on the subject of data protection.

Recognition technologies and data storage - cookies

What are "cookies" actually?

Our Internet pages use so-called "cookies". Cookies are small data packets and do not cause any damage to your end device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies can be used to analyse user behaviour or for advertising purposes.

Cookies that are required to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping basket function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimised provision of its services. If consent to the

storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG); the consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

You can find out which cookies and services are used on this website in this privacy policy.

Consent with Cookiebot
Our website uses the consent technology of Cookiebot to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies and to document this in compliance with data protection regulations. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "Cookiebot").
When you enter our website, a connection is established to Cookiebot's servers to obtain your consent and other declarations regarding the use of cookies. Cookiebot then stores a cookie in your browser in order to be able to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to delete it, delete the Cookiebot cookie yourself or the purpose for data storage no longer applies. Mandatory legal requirements

Order processing
We have concluded an order processing contract (AVV) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that the service provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Retention obligations
Retention obligations remain unaffected. Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.

Note on data transfer to the USA

and other third countries

Among other things, we use tools from companies based in the USA or other third countries that are not secure under data protection law. If these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in these countries. For example, US companies are obliged to disclose personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. secret services) may process, analyse and permanently store your data on US servers for surveillance purposes. We have no influence on these processing activities.

Analysis tools and tools from third-party providers

When you visit this website, your surfing behaviour may be statistically evaluated. This is primarily done using so-called analysis programmes. Detailed information on these analysis programmes can be found in the following privacy policy.

Website hosting

We host the content of our website with Mittwald CM-Service GmbH

Web hosting
provider is Mittwald CM Service GmbH & Co KG, Königsberger Straße 4-6, 32339 Espelkamp (hereinafter Mittwald).
Details can be found in Mittwald's privacy policy:

https://www.mittwald.de/datenschutz

Mittwald is used on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Order processing
We have concluded an order processing contract (AVV) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that the personal data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.

So-called social media

and public platforms

Facebook
On this website, elements of the Facebook social network are linked via an icon. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries. An overview of the Facebook social media elements can be found here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When the social media element is active, a direct connection is established between your end device and the Facebook server. Facebook receives the information that you have visited this website with your IP address. If you click on the Facebook "Like" button while you are logged into your Facebook account, you can link the content of this website to your Facebook profile.

This allows Facebook to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Facebook. Further information on this can be found in Facebook's privacy policy at https://de-de.facebook.com/privacy/explanation

If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility in social media. If personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in an agreement on joint processing. You can find the wording of the agreement at

https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php

Twitter
The Twitter service function is linked on this website. These functions are offered by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. When the social media element is active, a direct connection is established between your device and the Twitter server. Twitter thereby receives information about your visit to this website. By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and made known to other users. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Twitter. Further information on this can be found in Twitter's privacy policy at https://twitter.com/de/privacy

If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility in social media. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html

You can change your data protection settings on Twitter in the account settings at https://twitter.com/account/settings change.

Instagram
Functions of the Instagram service are integrated on this website. These functions are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When the social media element is active, a direct connection is established between your device and the Instagram server. Instagram thereby receives information about your visit to this website.
If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Instagram.
If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility in social media.

If personal data is collected on our website with the help of the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook or Instagram. The processing carried out by Facebook or Instagram after forwarding is not part of the joint responsibility.

The joint obligations incumbent on us have been set out in a joint processing agreement. You can find the wording of the agreement at https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook or Instagram tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook and Instagram products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook or Instagram directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and

https://de-de.facebook.com/help/566994660333381

Further information can be found in Instagram's privacy policy: https://instagram.com/about/legal/privacy/

LinkedIn
This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Each time you access a page on this website that contains elements of LinkedIn, a connection to LinkedIn servers is established. LinkedIn is informed that you have visited this website with your IP address. If you click on the LinkedIn "Recommend" button and are logged into your LinkedIn account, LinkedIn will be able to associate your visit to this website with you and your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by LinkedIn.
If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility in social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://www.linkedin.com/help/linkedin/answer/62538/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de

Further information on this can be found in LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy

XING
This website uses elements of the XING network. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. Each time one of our pages containing XING elements is accessed, a connection to XING servers is established. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored or usage behaviour evaluated.
If consent has been obtained, the use of the above-mentioned service is based on Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility in social media.

Further information on data protection and the XING Share button can be found in XING's privacy policy at https://www.xing.com/app/share?op=data_protection

Analysis tools

Matomo
This website uses the open source web analysis service Matomo. With the help of Matomo, we are able to collect and analyse data about the use of our website by website visitors. This enables us to find out, among other things, when which pages were accessed and from which region. We also record various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.).
This analysis tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Cookie-free analysis: We have configured Matomo so that Matomo does not store any cookies in your browser.
Hosting: We host Matomo exclusively on our own servers so that all analysis data remains with us and is not passed on.
IP anonymisation: We use IP anonymisation for analysis with Matomo. This means that your IP address is shortened before it is analysed so that it can no longer be clearly assigned to you.

Hotjar
This website uses Hotjar. The provider is Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (Website:
www.hotjar.com.
Hotjar is a tool for analysing your user behaviour on this website. Hotjar allows us to record your mouse and scroll movements and clicks, among other things. Hotjar can also determine how long you remain with the mouse pointer in a certain place. Hotjar uses this information to create so-called heat maps, which can be used to determine which website areas are favoured by the website visitor.
We can also determine how long you stayed on a page and when you left it. We can also determine at which point you cancelled your entries in a contact form (so-called conversion funnels).
In addition, Hotjar can be used to obtain direct feedback from website visitors. This function serves to improve the website operator's web offers.
Hotjar uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or the use of device fingerprinting).
If consent has been obtained, the use of the aforementioned service is based exclusively on Art. 6 para. 1 lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If consent has not been obtained, this service is used on the basis of Art. 6 para. 1 lit. f GDPR; the website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.

Deactivating Hotjar: If you wish to deactivate data collection by Hotjar, click on the following link and follow the instructions there: https://www.hotjar.com/policies/do-not-track/

Please note that Hotjar must be deactivated separately for each browser or end device. For more information about Hotjar and the data collected, please refer to Hotjar's privacy policy at the following link: https://www.hotjar.com/privacy

Order processing: We have concluded an order processing contract (AVV) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that the service only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Communication and advertising

Sending, subscribing to and unsubscribing from the newsletter

CleverReach
This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co KG, Schafjückenweg 2, 26180 Rastede, Germany (hereinafter "CleverReach"). CleverReach is a service that can be used to organise and analyse the sending of newsletters. The data you enter for the purpose of receiving the newsletter (e.g. email address) is stored on CleverReach's servers in Germany or Ireland.
Our newsletters sent with CleverReach enable us to analyse the behaviour of newsletter recipients. Among other things, we can analyse how many recipients have opened the newsletter message and how often which link in the newsletter was clicked on. Conversion tracking can also be used to analyse whether a predefined action (e.g. purchase of a product on this website) has taken place after clicking on the link in the newsletter. Further information on data analysis by CleverReach newsletters can be found at https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.
The data processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the cancellation.

If you do not want CleverReach to analyse your data, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message.
The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest. For more information, please refer to CleverReach's privacy policy at https://www.cleverreach.com/de/datenschutz/

Order processing: We have concluded an order processing agreement (AVV) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Plugins and APIs

YouTube - with enhanced data protection
This website embeds videos from the YouTube website. The operator of the pages is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. For example, YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video.

As soon as you start a YouTube video on this website, a connection to the YouTube servers is established. The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, YouTube can store various cookies on your end device after starting a video or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to record video statistics, improve user-friendliness and prevent fraud attempts.

If necessary, further data processing operations may be triggered after the start of a YouTube video, over which we have no influence.

The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Further information about data protection at YouTube can be found in their privacy policy at https://policies.google.com/privacy?hl=de

Vimeo - without tracking (Do-Not-Track)
This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.
When you visit one of our pages equipped with Vimeo videos, a connection to the Vimeo servers is established. This tells the Vimeo server which of our pages you have visited. Vimeo also obtains your IP address. However, we have configured Vimeo so that Vimeo does not track your user activities and does not set any cookies.

The use of Vimeo is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on "legitimate business interests". Details can be found here: https://vimeo.com/privacy

Further information on the handling of user data can be found in Vimeo's privacy policy at https://vimeo.com/privacy

Google Maps
This site uses the map service Google Maps. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is activated, Google may use Google Fonts for the purpose of standardising the display of fonts. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
Google Maps is used in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/

You can find more information on the handling of user data in Google's privacy policy: https://policies.google.com/privacy?hl=de

Tools

Display tools

Google Fonts - Fonts
This site uses so-called Google Fonts, which are provided by Google, for the uniform display of fonts. Google Fonts are installed locally (local hosting). There is no connection to Google servers. You can find more information about Google Fonts at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=de.

Font Awesome - Iconography
This site uses Font Awesome for the uniform display of fonts. Font Awesome is installed locally (local hosting). There is no connection to servers of Fonticons, Inc.

Further information about Font Awesome can be found in the Font Awesome privacy policy at https://fontawesome.com/privacy

Own services

Handling of applicant data
We offer you the opportunity to apply to us (e.g. by e-mail, post or via an online application form). In the following, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

Scope and purpose of data collection
If you send us an application, we will process your associated personal data (e.g. contact and communication data, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6 para. 1 lit. b GDPR (general contract initiation) and - if you have given your consent - Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data submitted by you will be stored in our data processing systems on the basis of § 26 BDSG and Art. 6 para. 1 lit. b GDPR for the purpose of implementing the employment relationship.

Data retention period
If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application).

The data will then be deleted and the physical application documents destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is evident that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will only be deleted when the purpose for further storage no longer applies. Longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the applicant pool
If we do not make you a job offer, it may be possible to include you in our applicant pool. If you are accepted, all documents and information from your application will be transferred to the applicant pool in order to contact you in the event of suitable vacancies.
Admission to the applicant pool is based exclusively on your express consent (Art. 6 para. 1 lit. a GDPR). Giving consent is voluntary and is not related to the current application process. The data subject can withdraw their consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless statutory provisions apply.

Registration and application forms
On this website, it is possible to register for training courses or workshops online and to complete and send online application forms or checklists. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence. We process this data if you have given your consent - Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in the further processing of this data.

Author of this privacy policy

This privacy policy has been edited by Nora Winter (FAKTENHAUS GmbH) and created with the help of the e-recht 24 Premium Service: https://www.e-recht24.de

Privacy policy of the EPZ

Why we protect data

Data protection and data security for our company's customers and partners as well as for interested parties and users of our website are of great importance to our company. Transparency regarding the processing of your personal data and the protection of your data are therefore particularly important to us.

This statement provides you with an overview of how your personal data is collected and processed when you use our website and what you can do yourself to improve the protection of your data.

CONTROLLER RESPONSIBLE FOR THE PROCESSING

Heidelberg University Hospital
Im Neuenheimer Feld 672
69120 Heidelberg

Institution under public law represented by theExecutive Board of the University Hospital

Telephone: 06221 56-0
Fax: 06221 56-5999
E-mail:klinikumsvorstand(at)med.uni-heidelberg.de

DATA PROTECTION OFFICER OF THE COMPANY

Heidelberg University Hospital
Data Protection Officer
Im Neuenheimer Feld 672
69120 Heidelberg
06221 56 7036
datenschutz(at)med.uni-heidelberg.de

WHAT IS PERSONAL DATA?

Personal data is any information relating to an identified or identifiable natural person. The decisive factor is therefore whether a personal reference can be established through the data collected. This includes information such as your name, address, telephone number and e-mail address. Information that is not directly associated with your real identity - such as favourite websites or the number of users of a site - is not personal data.

HOW WE COLLECT AND PROCESS YOUR PERSONAL DATA

When you visit our websites, our web servers temporarily store the connection data of the requesting computer, the websites you visit, the date and duration of the visit, the identification data of the browser and operating system type used and the website from which you visit us as standard for the purpose of system security. Additional personal data such as your name, address, telephone number or e-mail address will not be collected unless you provide this information voluntarily, e.g. as part of a registration, a survey, a competition, to fulfil a contract or a request for information.

HOW WE USE YOUR PERSONAL DATA, HOW WE PASS IT ON

If the opportunity for the input of personal or business data (e-mail addresses, names, addresses) is given, the input of these data takes place voluntarily. E-mails are sent via a contact form. If you send us such a message, your personal data will only be collected to the extent necessary for a reply. The e-mail is transmitted unencrypted.

We use the personal data provided by you exclusively for the purpose of technical administration of the websites and to fulfil your wishes and requirements, i.e. generally to process the contract concluded with you or to answer your enquiry.

We only use this data for product-related surveys, marketing purposes and statistical purposes if you have given us your prior consent or if you have not objected to this - insofar as this is provided for by law.

Your personal data will not be passed on, sold or otherwise transferred to third parties unless this is necessary for the purpose of contract fulfilment or you have expressly consented to this.

Any consent given can be revoked at any time with effect for the future.

HOW LONG WILL YOUR DATA BE STORED

In principle, we store all information that you transmit to us until the respective, e.g. contractual, purpose has been fulfilled. E.g. in the case of enquiries until they have been dealt with, in the case of newsletters until you unsubscribe from the newsletter. If longer storage is required by law, the data will be stored for this period.

If you no longer wish us to use your data, we will of course comply with this request immediately (please contact us at the address given under "Contact").

WHEN WILL YOUR DATA BE DELETED

Stored personal data will be deleted if you revoke your consent to storage, if knowledge of the data is no longer required to fulfil the purpose for which it was stored or if storage is inadmissible for other legal reasons. Data for billing and accounting purposes are not affected by a request for deletion.

USE OF COOKIES

When you visit our website, we use so-called cookies. These are small text files that are stored on your computer. Cookies help us to determine the frequency of use and the number of users of our website, as well as to make our services as convenient and efficient as possible for you.

On the one hand, we use so-called "session cookies", which are only stored temporarily for the duration of your use of one of our Internet pages. On the other hand, we use "permanent cookies" to store information about visitors who repeatedly access one of our Internet pages. The purpose of using these cookies is to be able to offer you optimal user guidance, to "recognise" you and to be able to present you with a website that is as varied as possible and new content in the event of repeated use. The content of a permanent cookie is limited to an identification number. Name, IP address etc. are not stored. An individual profile of your usage behaviour is not created.

It is also possible to use our website without cookies. You can deactivate the storage of cookies in your browser, restrict it to certain websites or set your browser so that it notifies you as soon as a cookie is sent. Please note, however, that if you deactivate cookies, you will have to reckon with a restricted display of the site and limited user guidance.

Cookies that are required to carry out the electronic communication process or to provide certain functions that you have requested (e.g. shopping basket function) are stored on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimised provision of its services. Insofar as other cookies (e.g. cookies for analysing your surfing behaviour) are stored, these are treated separately in this privacy policy.

WHAT WE DO TO ENSURE THE SECURITY OF PROCESSING

Our company takes all necessary technical and organisational security measures to protect your personal data from loss and misuse. For example, your data is stored in a secure operating environment that is not accessible to the public. In certain cases, your personal data is encrypted during transmission using Secure Socket Layer (SSL) technology. This means that communication between your computer and our company's servers takes place using a recognised encryption method if your browser supports SSL.

THESE ARE THE LEGAL BASES

"Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the fulfilment of a contract to which the data subject is a party, Art. 6 para. 1b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1f GDPR serves as the legal basis for the processing. Legitimate interests are, in particular, ensuring the operation and security of the website, analysing the way in which visitors use the website and simplifying the use of the website."

THESE ARE YOUR DATA PROTECTION RIGHTS

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and possible recipients and the purpose of data processing (Art. 15 GDPR) and, if applicable, a right to rectification of incorrect data (Art. 16 GDPR), erasure of this data (Art. 17 GDPR), the right to restriction of processing in accordance with Art. 18 GDPR, the right to object (Art. 21 GDPR) and the right to data portability of data provided by you in accordance with Art. 20 GDPR). The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure.

In addition, you have the right to lodge a complaint with the competent supervisory authority in the event of breaches of data protection law (Art. 77 GDPR in conjunction with Section 19 BDSG). The competent supervisory authority for data protection issues is the state data protection officer of the federal state in which our company is based. A list of data protection officers and their contact details can be found at the following linkhttps://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

HOW YOU CAN WITHDRAW YOUR CONSENT TO DATA PROCESSING

Many data processing operations are only possible with your express consent. You can withdraw any consent you have already given at any time. All you need to do is send us an informal email. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

You can prevent the collection of your data by Google Analytics by clicking on the following button. An opt-out cookie will be set to prevent the collection of your data on future visits to this website. By clicking again, you can cancel this and help us to further improve the website.

DEACTIVATE GOOGLE ANALYTICS

CHANGES TO THE PRIVACY POLICY

Changes may be made to this privacy policy, which will be announced on this page in good time.

GOOGLE WEB FONTS

This site uses so-called web fonts provided by Google for the standardised display of fonts. When you access a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

For this purpose, the browser you are using must connect to Google's servers. This informs Google that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

If your browser does not support web fonts, a standard font will be used by your computer.

You can find more information about Google Web Fonts at developers.google.com/fonts/faq and in Google's privacy policy:https://www.google.com/policies/privacy/.

GOOGLE MAPS

This site uses the Google Maps map service via an API. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer.

The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

You can find more information on the handling of user data in Google's privacy policy:https://www.google.de/intl/de/policies/privacy/.

DEPLOYMENT AND USE OF YOUTUBE

YouTube components are integrated on this website. YouTube is an Internet video portal that enables video publishers to post video clips free of charge and other users to view, rate and comment on them free of charge. YouTube allows the publication of all types of videos, which is why complete film and television programmes as well as music videos, trailers or videos made by users themselves can be accessed via the Internet portal.

The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Each time you access a page of our website on which a YouTube component (YouTube video) has been integrated, your Internet browser is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information about YouTube can be found at www.youtube.com/yt/about/de/ can be retrieved. As part of this technical process, YouTube and Google receive information about which specific subpage of our website you are visiting.

If you are logged in to YouTube at the same time, YouTube recognises which specific sub-page of our website the data subject is visiting when a sub-page containing a YouTube video is accessed. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.

YouTube and Google always receive information via the YouTube component that the data subject has visited our website if you are logged in to YouTube at the same time as accessing our website. This takes place regardless of whether you click on a YouTube video or not. If you do not want this information to be transmitted to YouTube and Google, you can prevent it by logging out of your YouTube account before accessing our website.

The data protection provisions published by YouTube, which can be accessed at www.google.de/intl/de/policies/privacy/ provide information about the collection, processing and use of personal data by YouTube and Google.

REGISTRATION

The data subject has the option of registering on the controller's website by providing personal data. Which personal data is transmitted to the controller is determined by the respective input mask used for registration. The personal data entered by the data subject is collected and stored exclusively for internal use by the controller and for the controller's own purposes. The controller may arrange for the data to be passed on to one or more processors, such as a parcel service provider, who will also use the personal data exclusively for internal use attributable to the controller.

By registering on the controller's website, the IP address assigned by the data subject's Internet service provider (ISP), the date and time of registration are also stored. This data is stored against the background that this is the only way to prevent the misuse of our services and, if necessary, to make it possible to investigate criminal offences and copyright infringements. In this respect, the storage of this data is necessary to safeguard the controller. This data is not passed on to third parties unless there is a legal obligation to pass it on or the passing on serves the purpose of criminal or legal prosecution.

The registration of the data subject with the voluntary provision of personal data serves the controller to offer the data subject content or services which, due to the nature of the matter, can only be offered to registered users. Furthermore, the registration of the data subject (in the data protection declaration generator) serves to monitor the use of the texts issued by us and protected by copyright, as well as to check the setting of links and the naming of authors, as well as for our own documentation purposes. We also use the data collected via the data protection declaration generator for customer acquisition, in particular for contacting customers by telephone and sending advertising by post and e-mail. Registered persons are free to have the personal data provided during registration completely deleted from the controller's database.

The data controller shall provide any data subject at any time upon request with information about which personal data relating to the data subject is stored. Furthermore, the controller shall rectify or erase personal data at the request or notice of the data subject, provided that this does not conflict with any statutory retention obligations. The data protection officer named in this privacy policy and all of the controller's employees are available to the data subject as contact persons in this context.

FACEBOOK

Our website contains links to the external social network Facebook. This website is operated exclusively by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA (Facebook). The links on our website are identified by the Facebook logo or the addition "Like" (no Facebook plugins are used).

When you visit our website, functions and data transfers to Facebook are not automatically activated. The Facebook plugins are only activated when you click on the links and your browser establishes a direct connection with Facebook servers. If you follow the links and are logged into your Facebook user account at the same time, the information that you have visited our website will be forwarded to Facebook. Facebook can assign the visit to the website to your account. This information is transmitted to Facebook and stored there. To prevent this, you must log out of your Facebook account before clicking on the link.

For the purpose and scope of data collection by Facebook and the further processing and use of your data there, as well as your rights in this regard and settings options for protecting your privacy, please refer to Facebook's privacy policy (http://de-de.facebook.com/privacy/explanation.php).

BUZZSPROUT

Our website contains an integrated podcast provided by the provider Buzzsprout. Buzzsprout is a hosting software service to offer, promote and keep track of podcasts. Buzzsprout is owned and managed by Higher Pixels, Inc. Higher Pixels is a small web application company based in Jacksonville, Florida, USA. Buzzsprout's primary data and servers are located at Rails Machine's data centre in Atlanta, Georgia, USA, and are rendered from this platform. For this purpose, we integrate so-called Buzzsprout widgets into our website. These are playback software with which users can play the podcasts. Buzzsprout can measure which podcasts are listened to and to what extent and process this information pseudonymously for statistical and business purposes. For this purpose, cookies may be stored in users' browsers and processed to create user profiles, e.g. for the purpose of displaying adverts that correspond to users' potential interests. In the case of users who are registered with Buzzsprout, Buzzsprout can assign the listening information to their profiles. The use is based on our legitimate interests, i.e. interest in the secure and efficient provision, analysis and optimisation of our audio offer in accordance with Art. 6 para. 1 lit. f. GDPR. GDPR. Further information and objection options can be found in Buzzsprout's privacy policy: https://www.buzzsprout.com/privacy