The Blockchain Research Lab gGmbH as the controller responsible for the processing of data has put in place numerous technical and organisational measures to ensure that the personal data processed at this website are as far as possible seamlessly protected. Nevertheless, Internet-based data transfers may fundamentally exhibit security loopholes, with the result that absolute protection cannot be guaranteed. For this reason, it is open to all data subjects to communicate personal data to us by alternative means, for example by telephone.
a) Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b) Data subject
A data subject is any identified or identifiable natural person whose personal data are processed by the responsible controller.
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
d) Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
g) Controller or controller responsible for processing
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
j) Third party
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
2. Name and address of the controller responsible for processing
The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in Member States of the European Union and other regulations in the nature of data protection legislation is:
Blockchain Research Lab gGmbH
Tel.: +49 40 228634210
3. Name and address of the data protection officer
As of § 4f Abs. 1 Satz 3 BDSG, the Blockchain Research Lab gGmbH does not need a data privacy officer.
For inquiries, please contact:
Blockchain Research Lab gGmbH
Tel.: +49 40 228634210
4. Collection of general data and information
On each occasion on which the website of the Blockchain Research Lab gGmbH is called up by a data subject or automated system, the website records a series of general data and information. The general data and information are stored in the server log files. Data recorded may include (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the Internet website from which an accessing system is referred to our website (known as the referrer), (4) the sub-websites via which an accessing system is directed to our website, (5) the date and time at which the Internet website is accessed, (6) an Internet Protocol address (IP address), (7) the Internet service provider used by the accessing system and (8) other similar data and Information which may used for defensive purposes in the event of an attack on our information technology systems.
The Blockchain Research Lab gGmbH in its use of these data and information draws no conclusions regarding the data subject. On the contrary, this information is required in order (1) to correctly deliver the contents of our website, (2) to optimise the contents of our website for the data subject, (3) to guarantee the sustained functionality of our information technology systems and our website technology, and (4) to provide the law enforcement authorities with the necessary information to enforce the law in the event of a cyber attack. These anonymously collected data and information are therefore analysed by the Blockchain Research Lab gGmbH on the one hand statistically, but also with the object of enhancing data protection and data security at our company, in order ultimately to ensure an optimum level of protection for the personal data processed by us. The anonymous server log file data are stored separately from any and all of the personal data disclosed by a data subject.
5. Online applications
Please read the data protection notes for applicants if you wish to apply to our company.
By using cookies the Blockchain Research Lab gGmbH is able to provide visitors to this website with a user-friendly service which would not be possible without setting cookies.
With the aid of a cookie the information and offerings available on our website can be optimised in the interests of the user. As already mentioned, cookies enable us to recognise visitors to our website. The purpose of this recognition is to make it easier for visitors to use our website. Users of a site which employees cookies for example need not enter their access data on every visit, because this task is performed by the site and the cookie placed on the user’s computer system.
Data subjects may, by entering the appropriate setting in their browser, at any time prevent the setting of cookies by our website and thereby block cookies permanently. Moreover, cookies which have already been set may at any time be deleted via a browser or other software programs. This is possible with all Internet browsers in common use. If, however, the data subject deactivates the setting of cookies in their browser, under certain circumstances not all of our website functions may be fully usable.
7. Routine erasure and blocking of personal data
The controller responsible for processing will process and store personal data relating to data subjects only for the period for which it is necessary to do so in order to achieve the purpose of storage or insofar as is provided for by European legislators or other legislators in laws and regulations to which the controller is subject.
Should the purpose of storage cease to apply or should a time limit specified by European legislators or another competent legislator expire, the personal data will routinely be blocked or erased in accordance with the provisions of the law.
8. Rights of data subjects
a) Right to confirmation
Every data subject has the right, granted by European legislators, to request confirmation from the controllers responsible for the processing of data as to whether personal data pertaining to the subject are being processed by them.
b) Right to receive information
Every data subject has the right, granted by European legislators, to receive information at any time free of charge from the controllers responsible for the processing of data regarding the personal data pertaining to his or her person, and to be given a copy of this information. Moreover, European legislators have granted data subjects the right to receive the following information:
- the purposes for which data are processed
- the categories of personal data that are processed
- the recipients or categories of recipients to whom personal data have been or are being disclosed, in particular recipients in third countries or international organisations
- if possible the planned duration for which personal data are stored, or if this is not possible, the criteria by which this duration is determined
- the existence of a right to the correction or erasure of personal data pertaining to the data subject or to a restriction of processing by the controller or a right to object to said processing
- the right to complain to a supervisory authority
- if personal data have not be collected from the data subject concerned: All available information regarding the origin of the data
- the existence of an automated decision-making process including profiling pursuant to Art. 22 Paras. 1 and 4 GDPR and – at least in these cases – meaningful information regarding the logic involved and the consequences and intended effects of such processing on the data subject.
Moreover, the data subject has the right to receive information as to whether personal data have been transmitted to a third country or to an international organisation. Should this be the case, the data subject also has the right to receive information regarding suitable guarantees in connection with said transmission.
c) Right to rectification
Every data subject has the right, granted by European legislators, to demand immediate rectification of incorrect data concerning their person. Moreover, the data subject has the right in consideration of the purposes for which data are processed to demand completion of incomplete personal data – including by means of a supplementary explanation.
d) Right to erasure (right to be forgotten)
Every data subject has the right, granted by European legislators, to demand that the controller shall immediately erase data relating to his or her person provided that one of the following grounds applies and insofar as the processing is not necessary:
- The personal data were collected for purposes or processed in other ways for which they are no longer required.
- The data subject withdraws his or her consent as a basis for processing pursuant to Art. 6 Para. 1 Letter a GDPR or Art. 9 Para. 2 Letter a GDPR, and there are no other legal grounds for processing this data.
- The data subject lodges an objection to the processing of his or her data pursuant to Art. 21 Para. 1 GDPR, and there are no legitimate priority grounds for said processing, or the data subject lodges an objection to the processing of his or her data pursuant to Art. 21 Para. 2 GDPR.
- The personal data have been unlawfully processed.
- The erasure of personal data is necessary for the fulfilment of a legal obligation under European Union law or the laws of Member States to which the controller is subject.
- The personal data were collected in respect of information society services pursuant to Art. 8 Para. 1 GDPR.
If personal data have been publically disclosed by the Blockchain Research Lab gGmbH, and if our company as controller pursuant to Art. 17 Para. 1 GDPR is obliged to erase such personal data, the Blockchain Research Lab gGmbH in consideration of the available technology and the costs of implementation will take appropriate measures, including such of a technical nature, to inform other controllers involved in the processing of personal data that have by now been made public that the data subject has demanded that said other controllers delete all links to these personal data or copies or replications of these personal data insofar as the processing thereof is not necessary.
e) Right to restriction of processing
Every data subject has the right, granted by European legislators, to demand that the controller restrict the processing of data if one of the following conditions is met:
- The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
- The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
- The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
- The data subject has objected to processing pursuant to Art. 21 Para. 1 GDPR and it has yet to be determined whether the legitimate grounds of the controller override those of the data subject.
f) Right to data portability
Every data subject has the right, granted by European legislators, to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. Data subjects additionally have the right to transmit those data to another controller without hindrance from the controller to which the personal data were provided, provided that processing is based on consent pursuant to Art. 6 Para. 1 GDPR or Art. 9 Para. 2 Letter a GDPR or on a contract pursuant to Art. 6 Para. 1 Letter b GDPR and takes place by automated means, insofar as processing is not required for the performance of a task that is in the public interest or in the exercise of public authority vested in the controller.
Moreover, data subjects in exercising their right to data portability pursuant to Art. 20 Para. 1 GDPR also have the right to have their personal data transmitted directly from one controller to another insofar as this is technically feasible and the rights and liberties of other persons are not thereby impaired.
g) Right to object
Every data subject has the right, granted by European legislators, at any time on grounds arising from their particular situation to object to the processing of their personal data on the basis of Art. 6 Para. 1 Letters e or f GDPR. This also includes profiling based on those provisions.
In the event of an objection, the Blockchain Research Lab gGmbH will cease to process personal data, unless we are able to demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or the processing is undertaken for the establishment, exercise or defence of legal claims.
Where personal data are processed by the Blockchain Research Lab gGmbH for direct marketing purposes, data subjects have the right at any time to object to the processing of their personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. Should a data subject lodge an objection with the Blockchain Research Lab gGmbH against processing for direct marketing purposes, the Blockchain Research Lab gGmbH will cease to process these personal data for these purposes.
In addition, data subjects also have the right on grounds arising from their particular situation to object to the processing of their personal data by the Blockchain Research Lab gGmbH for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 GDPR, unless such processing is necessary for the fulfilment of a task which is in the public interest.
Data subjects are also at liberty in connection with the use of information society services, notwithstanding Directive 2002/58/EG, to exercise their right to object by automated means using technical specifications.
h) Automated individual decision-making including profiling
Every data subject has the right, granted by European legislators, not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning him or her or similarly significantly affects him or her, insofar as the decision (1) is not required for the conclusion or fulfilment of a contract between the data subject and the controller, or (2) is permissible under the laws of the European Union or Member States to which the controller is subject and these laws include adequate measures to uphold the rights and freedoms as well as the legitimate interests of the data subject, or (3) takes place with the express consent of the data subject.
If the decision (1) is required for the conclusion or fulfilment of a contract between the data subject and the controller, or (2) takes place with the express consent of the data subject, the Blockchain Research Lab gGmbH will take appropriate measures to uphold the rights, freedoms and legitimate interests of the data subject, including as a minimum the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
i) Right to withdraw consent given in accordance with data protection legislation
Every data subject has the right, granted by European legislators, at any time to withdraw consent to the processing of personal data.
9. Contact Form
The Blockchain Research Lab gGmbH uses the Akismet contact form to allow website users to get into contact.
The contact form submission data — IP address, user agent, name, email address, website, and message — is submitted to the Akismet service for the sole purpose of spam checking. The actual submission data is stored in the database of the site on which it was submitted and is emailed directly to the owner of the form (i.e. the site author who published the page on which the contact form resides). This email will include the submitter’s IP address, timestamp, name, email address, website, and message.
10. Legal basis for processing
Art. 6 I Letter a GDPR provides our company with a legal basis for processing operations in connection with which we obtain consent for specific purposes. Where the processing of personal data is necessary for the fulfilment of a contract entered into with the data subject, as for example in the case of processing operations that are required for the supply of products or performance of some other service or consideration, such processing is based upon Art. 6 I Letter b GDPR. This likewise applies to such processing operations as may be required for the execution of pre-contractual measures, for example in the case of inquiries concerning our products or services. Where our company is subject to a legal obligation which necessitates the processing of personal data, as for example in the fulfilment of tax obligations, such processing is based upon Art. 6 I Letter c GDPR. In rare cases the processing of personal data may be required in order to protect the vital interests of the data subject or another natural person. This would, for example, be the case if a visitor to our company were to suffer injury, thereby necessitating the communication of his or her name, age, health insurance details or other vital information to a doctor, hospital or other third parties. Processing would then be carried out on the basis of Art. 6 I Letter d GDPR. Lastly, processing operations may also be based on Art. 6 I Letter f GDPR. This provides the legal basis for processing operations not covered by any of the above bases in law, where processing is required to uphold a legitimate interest on the part of our company or a third party, provided that the interests, basic rights and freedoms of the data subject do not take precedence. We are permitted to undertake such processing operations in particular because they have been mentioned specifically by European legislators. The latter were of the opinion that a legitimate interest may be assumed to exist if the data subject is a customer of the controller (Recital 47 Sentence 2 GDPR).
11. Legitimate interests in processing pursued by the controller or a third party
Where the processing of personal data is based upon Art. 6 I Letter f GDP, our legitimate interest lies in carrying out our business activities for the benefit of all our employees and our shareholder.
12. Duration for which personal data are stored
The criterion determining the duration of storage of personal data is the respective statutory time limit. Upon expiry of this time limit the corresponding data are routinely erased insofar as they are no longer required for the fulfilment or initiation of contracts.
13. Regulations regarding the provision of personal data; necessity for entry into contract; obligation on the part of the data subject to provide personal data
We would make it clear that the provision of personal data is in some cases required by law (e.g. tax regulations) or may arise from contractual provisions (e.g. details of the contracting party). Occasionally it may be necessary for the purpose of entering into a contract for a data subject to make personal data available to us which must then subsequently be processed by us. For example, a data subject is obliged to provide us with personal data if our company proposes to enter into a contract with said person. Failure to provide personal data would then lead to the consequence that the contract could not be entered into with the data subject.
14. Social Media
The Blockchain Research Lab gGmbH operates channels on different social platforms in order to communicate directly with its followers and visitors and to inform them about interesting news and projects from the Blockchain Research Lab gGmbH. Within this context, the Blockchain Research Lab gGmbH processes the data of visitors to its channels, in particular information about user interactions (e.g. likes, comments, retweets), demographic and statistical data, as well as the data transmitted in the context of news and comments.
The Blockchain Research Lab gGmbH would like to point out that when using these social networks, the respective providers will also have access to the data of the users. The Blockchain Research Lab has no control over the data that the social platforms collect, or over the extent of the data they collect. It has no further knowledge of data processing by the providers of the social platforms concerned. The references to the respective platforms included on the site of the Blockchain Research Lab gGmbH are pure links.
The processing of the personal data of visitors to our online presences is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to ensure communication with our followers and visitors and to inform them about news related to Blockchain Research Lab gGmbH.
Furthermore, the Blockchain Research Lab gGmbH would like to point out that the data processed when using social platforms and networks may be processed outside the European Economic Area. The operators of the networks on which the Blockchain Research Lab gGmbH operates a channel are certified according to the EU/US Privacy Shield (https://www.privacyshield.gov/).
Detailed information regarding the data processing and opt-out possibilities of the social platforms can be found here:
LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland):
- Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA):
- Opt-Out: https://twitter.com/personalization
15) Social Media Management Hootsuite
The Blockchain Research Lab gGmbH is managing its different social media channels with the help of Hootsuite. Hootsuite is a social media management tool operated by Hootsuite Inc. (5 East 8th Avenue Vancouver, BC, Canada V5T 1R6). Hootsuite enables the Blockchain Research Lab gGmbH to centrally manage and support its social networking sites. The tool allows Blockchain Research Lab gGmbH to publish cross-network posts, to process user reactions, to search the social networks for mentions and to analyse the users interactions with the Blockchain Research Lab gGmbH as well as actions of the Blockchain Research Lab gGmbH.
Whenever users interact with the social networking profiles of the Blockchain Research Lab gGmbH, the data stored in the profiles of the users are stored within the Hootsuite account of the Blockchain Research Lab gGmbH. This may include name, gender, profile picture, profile URL, handle/username. Moreover, the Blockchain Research Lab gGmbH does also record the times users interact with its social media profiles. The legal basis for this is Art. 6 para. 1 lit. f GDPR.
Further information on data protection at Hootsuite can be found at: https://hootsuite.com/de/legal/privacy
Data protection provisions about the application and use of Mailchimp
If you have given your express consent in accordance with Art. 6 para. 1 sent. 1 lit a) GDPR, we use your email address to regularly send you our newsletter. Only an email address need be provided to receive the newsletter.
The newsletter is sent via MailChimp, a newsletter distribution platform of the US-provider The Rocket Science Group LLC (”MailChimp”), 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.
The newsletters contain a so-called “web-beacon”, i.e. a file the size of a pixel, which is retrieved from the MailChimp server when the newsletter is opened. Within the scope of this retrieval, technical information such as information about the browser and your system, as well as your IP address and time of retrieval are first collected. This information is used to technically improve the services on the basis of the technical data or the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times.
The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our nor MailChimp’s aim to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our contents to them or to send different contents according to the interests of our users.
We trust in the reliability and the IT- and data security of MailChimp. MailChimp is certified under the US-EU privacy agreement ”Privacy Shield” and thereby undertakes to comply with EU data protection requirements. Moreover, we have concluded a ”Data-Processing-Agreement” with MailChimp. It is a contract in which MailChimp undertakes to protect the data of our users, to process it on our behalf in agreement with our data protection regulations and especially not to pass it on to third parties.
You can cancel the receipt of our newsletter, i.e. revoke your consent, at any time. Thereby, your consent to the dispatch of the newsletter via MailChimp and the statistical analyses will expire. A separate revocation of the dispatch via MailChimp or the statistical analysis is unfortunately not possible. You will find a link to cancel the newsletter at the end of each newsletter. Alternatively, you can also send an email to firstname.lastname@example.org at any time to let us know that you wish to unsubscribe.
17. Information regarding donations
By submitting your donor data, you consent to the processing of your personal data in accordance with Art. 6 para. 1 b) GDPR. The data processing serves to process your donation.
The Blockchain Research Lab gGmbH processes first name, last name, address, possible company names and company additions, contact data for queries regarding the handling of donations (e-mail address, telephone number), donation amount, donation purpose, date, account data (account holder, account number/BLZ or IBAN), related accounting data for bookkeeping and information regarding a standing order (type, period, amount, frequency, status).
The data mentioned above will only be collected and processed if they are necessary for the handling of donations.
18. Utilisation of analysis services
Google Tag Manager
This website uses Google Tag Manager. Google Tag Manager is a solution with which the marketer can manage the website tags over an interface. Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not record any personal data. The tool ensures the activation of other tags, which for their part may record data. Google Tag Manager does not access this data. If a deactivation was carried out on domain or cookie level, this continues to exist for all existing tracking tags which are implemented with Google Tag Manager.
Use of Google Analytics
This website uses Google Analytics, a web analysis service of Google Inc. “(“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, Google will reduce your IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand.