Data Privacy Policy

In accordance with the intentions of the European legislators, a privacy policy should be both easy to read and easy to understand for everyone. To ensure this, our privacy policy is based on the definitions set out in Article 4 of the EU General Data Protection Regulation (hereinafter “GDPR”). Accordingly, we use the following terms, amongst others, in this privacy policy:

“personal data”: any information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“data subject“: any identified or identifiable natural person whose personal data is processed by the controller;

“processing“: any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction;

“restriction of processing”: the marking of stored personal data with the aim of limiting its future processing;

“profiling”: any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“controller“: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“recipient”: a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not that body is a third party. However, public authorities which may receive personal data in the course of a specific investigation mandate under Union law or the law of the Member States shall not be regarded as recipients; the processing of such data by the aforementioned authorities shall be carried out in accordance with the applicable data protection regulations in line with the purposes of the processing;

“third party”: a natural or legal person, public authority, agency or other body, other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data;

“consent” of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

“processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection regulations, is:

Klinikum Bremerhaven-Reinkenheide gemeinnützige GmbH
Postbrookstraße 103
27574 Bremerhaven

Management: Dr Witiko Nickel, Dr Susanne Kleinbrahm, Frank Kühl

Telephone: 04747 299-0
Fax: 04747 299-3573
E-mail: info@klinikum-bremerhaven.de

The Data Protection Officer is:

Oliver Stutz
c/o Datenschutz Nord GmbH
Konsul-Smidt-Str. 88
28217 Bremen

Contact person: Mr Dominik Bleckmann
Telephone: 0421 696632-0
E-mail: datenschutz@klinikum-bremerhaven.de

The data protection supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information
Arndtstraße 1
27570 Bremerhaven

• Master data (e.g. names and addresses)
• Contact details (e.g. email address, telephone number)
• Content data (e.g. text entered)
• Usage data (e.g. web pages visited, times of access)
• Communication data (e.g. information from end devices used to access our website, IP addresses)

In individual cases, we may also process other data. This is described in more detail in the full version of our privacy policy in connection with the respective type of data processing in each individual case.

The GDPR applies to all visitors and users of our website (hereinafter collectively referred to as “users”).

We process users’ data primarily for the following purposes:

• To enable us to provide our website, including its content and features.
• To enable users of our website to communicate with us.
• To protect our website from unauthorised access.

In the full version of our privacy policy, we set out these purposes in more detail in relation to the specific type of data processing involved.

We generally collect and use the personal data of users of our website only to the extent necessary to provide a fully functional website and to deliver our content and services. We will neither collect nor use the personal data of our users without their prior consent. Data will only be used or collected without prior express consent in exceptional cases where obtaining prior consent is not possible for practical reasons and a statutory provision permits the processing of the data in such exceptional cases.

Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) provides the legal basis in cases where we obtain the explicit consent of the data subject prior to processing personal data.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) of the GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing (e.g. when using web hosts, etc.).

The data subject’s personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may be stored for longer if this is provided for by European or national legislation in EU regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

1.1 Description and scope of data processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. This usually occurs because the browser used on the user’s device automatically forwards information to our website’s server, where this information is temporarily stored in a so-called log file. This involves the following information, which is collected without your active involvement solely through the transmission by the browser you are using and is subsequently stored on our website’s server until it is automatically deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the file accessed,
• Website from which access to our website’s server is made (referrer URL),
• Browser used and, where applicable, the computer’s operating system, as well as the name of the internet service provider.

We process the data described above for the following purposes:

• To ensure a smooth connection to the website,
• To ensure a user-friendly experience on our website,
• To evaluate system security and stability, and
• For other administrative purposes.

1.2 Legal basis for data processing

The legal basis for the processing of data is Article 6(1)(f) of the GDPR.

1.3 Purpose of data processing

The system needs to store the IP address temporarily in order to deliver the website to the user’s computer. To do this, the user’s IP address must be stored for the duration of the session.

1.4 Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs once the relevant session has ended.

1.5 Right to object and right to erasure

The collection of data for the purpose of providing the website and the storage of data in log files is essential for the operation of the website. Consequently, users do not have the right to object.

2.1 Description and scope of data processing

You are welcome to contact us via the email addresses provided. When you contact us by email, we store the personal data sent to us in the email.

We do not pass this data on to third parties. We use the data solely for the purpose of handling the correspondence or processing your application.

2.2 Legal basis for data processing

The legal basis for data processing for the purpose of establishing contact is Article 6(1)(a) of the GDPR, in conjunction with the user’s consent.

In the specific case of an application submitted by email, data processing takes place in response to your application and is necessary, in accordance with Article 6(1)(b) of the GDPR, for the purposes stated, namely the proper processing of the application and the mutual implementation of pre-contractual measures.

2.3 Purpose of data processing

Where contact is made by email, this also constitutes the necessary legitimate interest in the processing of the data.

2.4 Retention period

We delete the data as soon as it is no longer required to fulfil the purpose for which it was collected.

With regard to data sent by email, this means that deletion takes place once the relevant conversation with the person concerned has ended. We consider the conversation to have ended in this sense as soon as it can be inferred from the circumstances that the matter in question has been conclusively resolved.

Personal data collected in connection with a job application is stored for 6 months after the application process has been completed and is then deleted, unless we are obliged to store it for a longer period under Article 6(1)(c) of the GDPR due to tax and commercial law retention and documentation obligations (under the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)), or you have consented to further storage in accordance with Article 6(1)(a) of the GDPR.

2.5 Right to object and right to erasure

You may withdraw your consent to the processing of your personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. In such cases, the conversation cannot be continued or the application processed. All personal data stored in the course of establishing contact will be deleted in this case.

3.1 Description and scope of data processing

For many of our events, we ask you to register in advance. We provide online registration forms on our website for this purpose. You can also register by email, fax or post. We require the following details for registration:

• Surname, first name, title
• Email
• Address (if applicable)
• Telephone number (if applicable)
• Professional qualifications, employer, role (for work-related training events) (if applicable)

We store the data for the purpose of organising the event and use it to communicate with participants. For online events, we use the email address to send participants the access details for the event and to request their feedback on the event.

The data will not be passed on to third parties in this context. We use the data exclusively for the purpose of organising the event.

3.2 Legal basis for data processing

The legal basis for data processing for the purposes of registration is Article 6(1)(1)(b) of the GDPR.

3.3 Purpose of data processing

The legitimate interest lies in the organisation of the event.

3.4 Retention period

We delete the data as soon as it is no longer required to fulfil the purpose for which it was collected. With regard to the data submitted in the event registration, this means that deletion takes place once the event has taken place and all subsequent processes (such as sending a certificate of attendance or requesting feedback) have been completed.

For tax or other legal reasons, we may be obliged to retain data on participants for a period defined by law. Should this be the case, the data will be deleted once the prescribed retention period has expired.

3.5 Right to object and right to erasure

You may withdraw your consent to the processing of your personal data at any time. In this case, all personal data stored during the registration process will be deleted, provided there is no other legal obligation to retain it. Once your registration data has been deleted, you will no longer be able to attend this event.

4.1 Description and scope of data processing

You can submit an online application via the careers portal on our website for a job, apprenticeship or work placement at Klinikum Bremerhaven-Reinkenheide gGmbH (KBR) or at Medizinisches Versorgungszentrum am Klinikum Bremerhaven-Reinkenheide GmbH (MVZ). It is also possible to send us applications by email, post or in person. When you apply to us, we collect the following information:

• Title, first name, surname
• A valid email address
• Postal address
• Telephone number(s)
• Date of birth
• Position or type of employment you are applying for
• Whether you already work for us or are currently undergoing training with us
• Details of your qualifications and availability
• Application documents (e.g. cover letter, CV, references, proof of qualifications)

4.2 Legal basis for data processing

Data processing is carried out in response to your application and is necessary, in accordance with Article 6(1)(b) of the GDPR, for the purposes stated, namely the proper processing of your application and the implementation of pre-contractual measures by both parties.

4.3 Purpose of data processing

This data is collected for the purpose of processing your application, in particular to assess your qualifications and to communicate with you. Your personal data will not be disclosed to third parties.

4.4 Duration of storage

The personal data we collect for the purposes of your application will be stored for the duration of the application process and will then be automatically deleted, unless we are obliged to store it for a longer period under Article 6(1)(c) of the GDPR due to retention and documentation obligations under tax and commercial law (under the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)), or you have consented to further storage in accordance with Article 6(1)(a) of the GDPR.

4.5 Right to object and right to erasure

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right, under Article 21 of the GDPR, to object to the processing of your personal data and to request the erasure of the data, provided there are grounds for doing so arising from your particular situation. As a result, we will not be able to proceed with your application. 

5.1 Description and scope of data processing

In certain situations, we use so-called cookies. A ‘cookie’ is a small text file that is stored in or by the web browser on the user’s computer system. A cookie can only contain information that we ourselves send to your computer – it cannot be used to retrieve personal data. If you have accepted the cookies on our website, we do not have access to your personal information. With the help of cookies, we are able to identify your computer and, using a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again, recognise your computer when you visit our website again.

Cookies serve to make our website more user-friendly, effective and secure, as well as to analyse usage patterns and structures on our website, thereby providing us with insights to optimise the site in line with user behaviour. These cookies are deleted as soon as you end the session or close your browser.

5.2 Legal basis for data processing

The legal basis for the processing of personal data using cookies is Article 6(1)(f) of the GDPR.

The legal basis for the processing of personal data using technically necessary cookies is Article 6(1)(f) of the GDPR.

The legal basis for the processing of personal data using cookies for analytical purposes is Article 6(1)(a) of the GDPR, provided the user has given their consent.

5.3 Purpose of data processing

The purpose of using technically necessary cookies is to make it easier for users to use websites. Some features of our website cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognised even after the user has navigated to another page.

5.4 Duration of storage, right to object and removal options

Cookies are stored on the user’s computer and transmitted from there to our website. You therefore have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all the website’s functions to their full extent.

5.5 Cookie Policy

This website uses cookies. We use cookies to personalise content and advertisements, to provide social media features, and to analyse traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected through your use of their services. You consent to our use of cookies by continuing to use our website.

Cookies are small text files used by websites to make the user experience more efficient.

By law, we may store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we require your permission.

This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages.

You can change or withdraw your consent at any time via the cookie policy on our website.

Find out more in our privacy policy about who we are, how you can contact us and how we process personal data.

More about your settings

6.1 Description and scope of data processing

We have embedded videos from the social network ‘YouTube’ on our website; this service is operated by YouTube LLC, whose registered office is at 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google Inc., whose registered office is at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

As soon as you, as a user, click on the link to a video embedded by YouTube, you will be asked for your consent. This is because when you watch an embedded video, YouTube or Google may collect personal data from you. You can find further details in the privacy policies of YouTube and Google at https://policies.google.com/privacy?hl=de. Please note that we have neither knowledge of nor any influence over the content of the data transmitted or its use by YouTube or Google. If you refuse to give your consent when prompted, you will not be able to view the video in question. 

6.2 Legal basis for data processing

The legal basis for the processing of data is Article 6(1)(f) of the GDPR.

6.3 Purpose of data processing

We use YouTube to make the videos on our website easily accessible and to raise awareness of our website. The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

For information regarding the purpose and scope of data collection and the further processing and use of personal data by YouTube itself, the rights you have in this regard, and the settings options provided by YouTube itself to protect users’ privacy, please refer to YouTube’s privacy policy, which can be found at the following link: https://policies.google.com/privacy 

6.4 Duration of storage

Please note that we have no knowledge whatsoever of the content of the data transmitted, how it is used, or the duration of its storage by YouTube.

6.5 Option to object and opt out

If you do not agree that YouTube should be able to associate your visit to our website with your viewing of videos on the YouTube platform, or that it should collect data about you via our website and subsequently link this data to the account details you have provided to YouTube and/or Google, you should log out of your personal YouTube account and any other user accounts held with Google Inc. and YouTube LLC before visiting our website or watching YouTube videos via our website, and also delete the relevant cookies from the aforementioned companies.

Matomo (formerly Piwik)

This website uses the open-source web analytics service Matomo. Matomo uses so-called ‘cookies’. These are text files that are stored on your computer and enable an analysis of your use of the website. To this end, the information generated by the cookie regarding your use of this website is stored on our server. The IP address is anonymised before storage.

Matomo cookies remain on your device until you delete them.

The storage of Matomo cookies and the use of this analytics tool are based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the anonymised analysis of user behaviour in order to optimise both its website and its advertising. Where relevant consent has been sought (e.g. consent to the storage of cookies), processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

The information generated by the cookie regarding your use of this website will not be passed on to third parties. You can prevent cookies from being stored by adjusting your browser settings accordingly; however, please note that in this case you may not be able to make full use of all the features of this website.

If you do not consent to the storage and use of your data, you can deactivate this here. In this case, an opt-out cookie will be stored in your browser, which prevents Matomo from storing usage data. If you delete your cookies, this will also result in the Matomo opt-out cookie being deleted. The opt-out must be reactivated when you visit this website again.

You have the option to prevent the actions you take here from being analysed and linked. This will protect your privacy, but will also prevent the site owner from learning from your actions and improving the user experience for you and other users.

You may request confirmation from the controller as to whether we are processing personal data relating to you.

If such processing is taking place, you may request the following information from the controller:

• the purposes for which the personal data is processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the envisaged period for which your personal data will be stored, or, if it is not possible to specify this, the criteria used to determine that period;
• the existence of a right to have your personal data rectified or erased, a right to restrict processing by the controller, or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• any available information on the origin of the data, where the personal data are not collected from the data subject;
• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

You have the right to request that the controller rectify and/or complete your personal data if the personal data processed concerning you is inaccurate or incomplete. The controller must rectify the data without delay.

a) Obligation to erase data

You may request that the controller erase your personal data without delay, and the controller is obliged to erase such data without delay if any of the following grounds apply:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
• The personal data concerning you has been processed unlawfully.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.

b) Notification to third parties

Where the controller has made personal data concerning you public and is obliged to erase such data in accordance with Article 17(1) of the GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers who process the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replicas of such personal data.

c) Exceptions

The right to erasure does not apply where processing is necessary

• for the exercise of the right to freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, in so far as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
• for the establishment, exercise or defence of legal claims.

You may request the restriction of the processing of your personal data under the following circumstances:

• if you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data;
• if the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
• the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
• if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

If the processing of your personal data has been restricted, such data – apart from its storage – may only be processed with your consent, or for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or of a Member State.

If the restriction on processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller of these recipients.

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
• the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. The freedoms and rights of other individuals must not be prejudiced thereby.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for the purposes of direct marketing, personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by means of automated procedures using technical specifications.

To exercise your right to object, it is sufficient to send us an email to the following address: datenschutz(at)klinikum-bremerhaven.de 

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

To exercise your right to object, simply send an email to the following address: datenschutz(at)klinikum-bremerhaven.de 

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the controller,
• is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, or
• is based on your explicit consent.

However, such decisions may not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.