University of Hamburg - to research, to teach, to educate and form, to homepage

Photo: UHH/Denstorf

Privacy Policy for Social Media Pages

When you visit our social media pages, your relevant personal data may be processed. That is why, pursuant to Article 13 General Data Protection Regulation (GDPR), we would like to explain how your data will be processed and your rights.

1. Responsibilities

We, as Universität Hamburg, operate the following social media pages:

You can find our contact data in our legal notice. 

In addition to us, the individual operators of the social media platforms are responsible for processing your personal data. We strive to ensure your data is processed in compliance with data protection law to the extent we can influence the process by setting parameters for data processing using the options available to us. Be aware that the individual social media platforms have their own privacy policies in this regard. 

2. Data processing conducted by us

The data you provide to our social media pages—such as user names, commentaries, videos, images, likes, and public postings—will be published by social media platforms and will not be used by us for any other purpose than those listed here. We only reserve the right to delete content where required. We may share your content on our pages if this is a function of the social media platform and communicate with you via the social media platform. 

If you ask us a question via a social media platform, depending on the content, we may refer you to other secure channels of communication that guarantee confidentiality. You always have the option, for example, to send your queries to us via the postal address or email address provided in the legal notice. Your choice of communication channel is thus completely up to you.

The processing of your data in conjunction with our publicity work and communication via social media platforms is lawful pursuant to Article 6 paragraph 1 sentence 1 letter e GDPR in conjunction with Section 4 Hamburg data protection act (Hamburgisches Datenschutzgesetz, HmbDSG) and Section 3 and 4 Hamburg higher education act (Hamburgisches Hochschulgesetz, HmbHG).

Some social media platforms generate statistics on the basis of user data to provide information about the use of our social media pages. We can neither influence nor prevent the generation and provision of these statistics. We do not make use of the optional statistics of the social media platforms.

We process this information to validate our handling of social media and provide more targeted information to our users. This processing is lawful pursuant to Article 6 paragraph 1 sentence 1 letter e GDPR in conjunction with Section 4 HmbDSG.

We also occasionally use these social media platforms to issue target-group-oriented advertising. 

We use target-group definitions as provided to us by social-media providers. We only use anonymous target group definitions—that is, defining characteristics using general demographic information such as age or location. Social-media-platform operators use these to display appropriate advertising to their users. We never use sensitive personal data as defined in Articles 9 and 10 GDPR for target-group definitions.

This processing is lawful pursuant to Article 6 paragraph 1 sentence 1 letter e GDPR in conjunction with Section 4 HmbDSG in conjunction with Sections 3 and 4 HmbHG. Should you wish to no longer receive targeted advertising, use the opt-out options provided by the provider of the social media platform.

In addition, we generate screenshots and statistics for successful posts on our channels and process these for our internal reporting and archiving purposes. In principle, this does not involve saving screenshots or statistics that can be identified; they are processed only in an anonymized form.  In exceptional cases (e.g., for public figures), personal references may be included. This processing is lawful pursuant to Article 6 paragraph 1 sentence 1 letter e GDPR in conjunction with Section 4 HmbDSG in conjunction with Sections 3 and 4 HmbHG.

In the case of illegal content (e.g., comments that are offensive, defamatory, or threatening) on our channels, we reserve the right to make screenshots for the purposes of making and defending legal claims and to save these as evidence. This processing is lawful pursuant to Article 6 paragraph 1 sentence 1 letter e GDPR in conjunction with Section 4 HmbDSG in conjunction with Sections 3 and 4 HmbHG.

3. Storage period

We will delete your personal data when it is no longer required for processing purposes and no statutory retention period prevents its deletion.

4. Data processing by operators of social media platforms

Operators of social media platforms use web-tracking methods. They may do so whether or not you are registered or logged into social media platforms.

Therefore, we would like to inform you that providers of social media platforms may use information related to your profile and usage data to evaluate your habits, personal relationships, and preferences. We cannot influence this processing of your data by social-media-platform providers; thus, use of such platforms is your own responsibility.

For more information on data processing by social-media-platform providers, configuration options to protect your private sphere, and—where available—an agreement pursuant to Article 26 GDPR can be found in the privacy policy of the individual providers:

5. Other recipients

We use a contracted service provider (agency) to assist us answering questions sent to us via Facebook and Instagram. A data processing agreement pursuant to Article 28 subsection 3 GDPR has been signed.

6. Third countries

Use of social media platforms often leads to personal data being sent to a country outside the EU or the EEA. Such transmission is permitted when the European Commission has determined the third country offers an appropriate level of data protection. This is the case when the recipient of the data is certified under the EU-US Privacy Framework. The attached list of social media platforms have such certification provided they are based in the USA. In addition, social media platform regularly commit to the standard contractual clauses provided by the EU Commission.

Information on measures for safeguarding an appropriate level of data protection are available here:

7. Your rights as a user

As a website user, you have the option of exercising the following rights against us as well as against the provider of a social media platform:

a. Right to information (Article 15 GDPR):

You have the right to confirmation of whether or not your personal data are being processed; where that is the case, you have the right to access the personal data and the information listed in Article 15 GDPR.

b. Right to rectification and deletion (Articles 16 and 17 GDPR):

You have the right to the correction of incorrect personal data and the right to have incomplete data completed.

You also have the right to request that your personal data be deleted immediately where covered by one of the reasons in Article 17 GDPR—for example, when the data are no longer required for the purpose for which it was collected.

c. The right to restriction of processing (Article 18 GDPR):

You have the right to restrict the processing when one of the requirements set forth in Article 18 GDPR applies.

d. The right to data portability (Article 20 GDPR):

In specific cases as set forth in Article 20 GDPR, you have the right to receive your personal data provided in a structured, commonly used, and machine-readable format and to transmit these to a third party.

e. The right to object (Article 21 GDPR):

If data provided to us are processed pursuant to Article 6 subsection 1 sentence 1 letter e GDPR, you have the right to object to that processing at any time for reasons arising from your particular situation. We will then cease processing your personal data unless able to demonstrate compelling reasons that override your interests, rights, and freedoms or the processing is required for establishing, exercising, or defending a legal claim.

8. Right to lodge a complaint with a supervisory authority

Purusant to Article 77 GDPR, you also have the right to lodge a complaint with a supervisory authority where you believe the processing of data related to you is in breach of data protection provisions. The right to lodge a complaint can be exercised particularly before a supervisory authority in the EU member state of your residence, your place of work, or the place of the alleged infringement.

9. Our data protection officer’s contact details

Our external data protection officer is happy to advise you on data protection and can be contacted at:

Datenschutzbeauftragte der Universität Hamburg
Universität Hamburg
Mittelweg 177
20148 Hamburg