Data Protection Notice for Research Funding from the German Research Foundation (DFG)

We, the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation), take the protection of your personal data and its confidential treatment extremely seriously. Therefore, we wish to inform you about the processing of your personal data in connection with research funding from the DFG and the rights to which you are entitled. The processing of your personal data takes place exclusively within the framework of the applicable statutory provisions of data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

I. Who is responsible for the data processing and who is the data protection officer?

1. The controller for the processing of your personal data is:

2. Joint controllership

In certain funding programmes in which the DFG cooperates with other research funding organisations in Germany and abroad, the DFG is jointly responsible with other organisations for the processing of your personal data. The DFG has concluded a joint controller agreement with these organisations. You can find a list of the relevant funding programmes with information concerning the joint controller organisations (including their contact details), as well as information on the essential content of the joint controller agreements here:

3. You can contact our data protection officer as follows:

  • Attorney-at-law Dr. Karsten Kinast, LL.M.
    KINAST Rechtsanwaltsgesellschaft mbH
    Hohenzollernring 54
    50672 Köln
    Germany
    Tel. +49 221 222 1830

    www.kinast.eu/en

II. What is the subject matter of data protection?

The subject matter of data protection is personal data. This is all information which relates to an identified or identifiable natural person (so-called data subject). For example, this includes information such as name, postal address, email address or telephone number.

III. What personal data relating to me will be processed?

We only process the personal data relating to you which is connected to the proposal, funding, project performance and / or scientific work carried out by you, your employer or cooperation partners and / or connected to the organisation of conferences held with the view to obtaining research funding. Specifically, this may include:

  • Business or private contact information, including your name, title, address, email address and telephone number
  • General external and private data concerning your person (gender, date of birth, nationality etc.)
  • Data concerning previous proposals and nominations at the DFG or other funders of research
  • Data concerning whereabouts and times (participation in meetings, participation in events, hotel reservations etc.)
  • General categorising and assigning data (reference numbers, personal ID, relation to a further process / proposal etc.)
  • Payment details (IBAN, bank, invoice data etc.)
  • Competence data (information concerning knowledge and capabilities, certificates, vocational training completed etc.)
  • Other biographical data and data concerning your CV and career (for example current / previous employment relationships, offices held, memberships, cooperation partners, times to degree, other periods of training, funding received, prizes received etc.)
  • Data concerning evaluation and assessment (expert report texts, references, other reports)
  • Declarations (consent, agreement, other declarations relating to a matter which have been submitted etc.)
  • Content-related data (for example content and time period of a proposal, amount and type of funding applied for and approved, assignment to a subject / topic, summaries, other content [countries, key words etc.], publications and other research results, citation data, authorships etc.)
  • Entitlements (to commence doctoral research, submit proposals etc.)
  • Investigations and so-called measures in accordance with the DFG Rules of Procedure for Dealing with Scientific Misconduct which are issued by the Joint Committee in cases where scientific misconduct has been established
  • Special categories of data, for example health information, periods of maternity leave or data concerning family obligations (see Section IV.)

IV. What are the purposes of the processing of my personal data and on what legal basis does this take place?

Below, we wish to provide you with an overview of the purposes and legal basis for the processing of your personal data within the framework of your proposal, funding, project implementation and / or scientific work and / or that of your employer or cooperation partner.

Description

The proposal which contains personal data is formally checked, assessed and evaluated in accordance with the procedural rules of the DFG and a decision is taken.

Should you obtain advice and / or information from the DFG before submitting the proposal, for example within the framework of letters of intent, personal data may be stored.

Legal basis

Preparation of the funding decision (initiation of contract, point (b) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

The purpose of the elan account is to communicate with the DFG Head Office.

The setting up of the account is necessary for all persons who use elan.

Legal basis

Preparation of the funding decision and ongoing funding (initiation of contract and contractual relationship, point (b) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project and financial administrators at funded institutions.

Description

In case of approval, personal data will be processed, for example in order to provide the required funds and administer changes of institution, project management or extensions of contractual terms etc.

Legal basis

Ongoing funding
(Contractual relationship, point (b) of Article 6 Paragraph 1 GDPR)

Data subjects

Funding recipients, project participants, project and financial administrators at funded institutions.

Description

Personal data is processed in order to check the proper use of project funds. This also includes the processing of personal data from final reports by the DFG. This may take place in writing or within the framework of an on-site inspection of a funded institution. These checks may also be carried out by external bodies via donors (Federal Audit Office, Federal Ministry of Education and Research).

Data is also processed in order to check the proper content-related and financial project progress and completion.

Furthermore, in the event of financial assistance for conferences which are held with the view to obtaining research funding, the data of the participants is processed in order to ensure and docu-ment the correct use of the funding.

This also includes individual comparisons with data of other funding organisations or joint checks with third parties in order to exclude unlawful double funding.

Legal basis

Ongoing funding (contractual relationship, point (b) of Article 6, Paragraph 1 GDPR)

Fulfilment of a legal obligation (point (c) of Article 6 Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants, project and financial administrators at funded institutions

Description

In the event of voluntary notification of special personal circumstances, personal data are processed for the purpose of verification and in order to arrive at a decision on the respective proposal or on a specific compensation for disadvantages as requested by an applicant.

This may also concern special categories of data such as health data, information on maternity leave, pregnancy, long-term or chronic illness, disability, a case of hardship, third gender or ethnic origin.

Legal basis

Ongoing funding (contractual relationship, point (b) of Article 6, Paragraph 1 GDPR)

Should you provide us with special categories of personal data, for example health information, you are expressly consenting to the processing of this data for the named purposes by the DFG (consent, point (a) of Article 9 Paragraph 2 GDPR, see DFG form 73.01).

With the provision of (special categories of) personal data concerning your family members or other third parties (such as staff members involved in a research project), you are providing an assurance that statutory legitimation under Paragraph 1 GDPR and / or Article 9 Paragraph 2 GDPR exists for the notification provided by you and in relation to the processing of this data by the DFG for the named purposes.

Data subjects

Applicants, funding recipients, project participants, family members of the persons named above

Description

The DFG uses personal data in order to award scientific prizes for excellent work and enable further research without a project proposal being necessary.

Legal basis

Preparation of the funding decision (initiation of contract, point (b) of Article 6 Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Nominated persons, proposing persons

Description

Should a proposal at the DFG be connected to a funding programme which is carried out together with other funding organisations in Germany or abroad (for example within the framework of a multilateral call with other funding organisations), personal data is processed in order to carry out the necessary coordination with other funding organisations in the individual case.

Legal basis

Preparation of the funding decision (initiation of contract, point (b) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

In individual funding programmes, the DFG publishes personal data for the purpose of networking and contact initiation for future proposals on the DFG website and as information for researchers and similar purposes. This concerns the names and contact information of contact persons in particular.

Legal basis

Preparation of the funding decision (initiation of contract, point (b) of Article 6 Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subject

Applicants, funding recipients, project participants, project and financial administrators at funded institutions

Description

Personal data is processed in connection with the carrying out of procedures in accordance with the Rules of Procedure for Dealing with Scientific Misconduct. This also includes disclosure to the institution where the data subject is employed (see Section VIII. “Who has access to my personal data and which recipients obtain it?”).

Legal basis

Consent (point (a) of Article 6 Paragraph 1 GDPR), unless the data processing is covered by one of the following legal bases:

Preparation of the funding decision (initiation of contract, point (b) of Article 6 Paragraph 1 GDPR)

Ongoing funding (contractual relationship, point (b) of Article 6, Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, nominated persons, funding recipients, project participants, providers of information

Description

In order to safeguard the interest of the public in relation to the use of public funds, the DFG reports on the research it funds, for example in the GEPRIS project information system. For ERA-Net projects, data is forwarded to the European Commission as the source of funding for publishing and evaluation.

To evaluate the progress and success of the project, inform the public about DFG funding and further develop funding programmes, the DFG collects information concerning participants and associated researchers, cooperation and qualification work etc.

These reports and information which is obtained through questionnaires and the processing of proposals serve as the basis for DFG publications concerning its funding programmes (e.g. statistical evaluations of DFG funding activities and studies on the effects of DFG funding).

In order to assess and further develop the funding instruments of the DFG (evaluation), questionnaires and scientific investigations are also carried out, which may use personal data.

In addition, personal data from final reports is processed by the DFG for evaluative purposes (e.g. examining the impact of participation in DFG-funded projects on the success of doctoral projects).

The analysis for statistical purposes is carried out in order to evaluate and analyse the impact of DFG funding, thereby establishing an overall pattern as a basis for assessing the effectiveness of DFG funding mechanisms. This is also the reason for the DFG’s legitimate interest in processing data for statistical purposes. Analysis at the individual level is not the object of the DFG’s statistical analyses. The statistics are generally kept in anonymised form. In individual cases, internal statistics may also contain personal data. However, publication or forwarding to external recipients only takes place after complete anonymisation.

Legal Basis

Ongoing funding (Contractual relationship, point (b) of Article 6 Paragraph 1 GDPR)

Fulfilment of a legal obligation (point (c) of Article 6 Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

The participating reviewers will be informed of the content of the co-reviews, in order to ensure transparency as to the results of the review process and to contribute to the further development of quality criteria and the formation of standards in DFG reviews.

Legal basis

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

Data is processed in order to respond to research-related queries from third parties (for example other funding organisations or media departments). This applies, for example, to queries relating to funding recipients, scientific experts, potential prize winners or other awards.

Legal basis

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

In some cases, the DFG uses personal data in order to publicise its activities, for example in articles and brochures.

The names of participants with a prominent / representative function are also published in selected documentation relating to conferences held with the view to obtaining research funding (e.g. DFG annual report). The same applies for stakeholders acting in a representative capacity for a group or persons upon whom the publication confers a scientific reputation.

Legal basis

Consent (point (a) of Article 6 Paragraph 1 GDPR)

Ongoing funding (contractual relationship, point (b) of Article 6, Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

Under certain circumstances, we will also process your personal data in order to comply with legal obligations, for example under commercial, tax, budget or criminal law. In such a case, the purposes of the processing are determined by the legal obligation. As a rule, the processing takes place in order to comply with state monitoring and information obligations.

Legal basis

Fulfilment of a legal obligation (point (c) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

The DFG will process your personal data in order to foster exchange between you as participants or speakers at a workshop / an event and other researchers (e.g. in the run-up to a workshop).

The DFG provides lists of participants to presenters to prepare for the event and to participants to enable them to engage in discussion about new research findings emerging in the relevant subject area. In addition, lists of participants are published on the internet, e.g. as an appendix to a results report.

Legal basis

Consent (point (a) of Article 6 Paragraph 1 GDPR)

Preparing for and holding an event with the view to obtaining research funding
(Contractual relationship, point (b) of Article 6 Paragraph 1 GDPR)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Funding recipients, project participants, other researchers

Description

The DFG will use personal data to invite funding recipients and alumni to DFG events. The aim is to create a network of new funding recipients and alumni as well as to make and maintain contact both among funding recipients as well as between funding recipients and the DFG.

Legal basis

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Funding recipients

Description

The DFG investigates allegations of discrimination against it with regard to the formally correct conduct of its proposal processing procedures and takes action against discrimination if necessary.

Legal basis

Initiation of contract and contractual relationship, point (b) of Article 6 Paragraph 1 GDPR (preparation of the funding decision and ongoing funding)

Enforcement, exercise or defence of legal claims (point (f) of Article 9 Paragraph 2 GDPR)

For reasons of substantial public interest (point (g) of Article 9 Paragraph 2 GDPR in conjunction with § 22 (1) (d) BDSG, § 24 (1) (1) and (2), Paragraph 2 BDSG and in conjunction with the relevant provisions of the General Equality Treatment Act (AGG), in particular § 12 AGG)

Safeguarding legitimate interests (point (f) of Article 6 Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants

Description

In connection with the settlement of travel expenses, we process data in order to reimburse these costs.

Legal basis

Consent (point (a) of Article 9 Paragraph 2 GDPR), insofar as special categories of personal data such as health data, are processed in this connection.

Ongoing funding (contractual relationship, point (b) of Article 6, Paragraph 1 GDPR)

Data subjects

Applicants, funding recipients, project participants, award winners, advisers

In addition, in individual cases, we will also process your personal data on the basis of a declaration of consent which you have submitted. In such a case, the purpose of the processing is contained in the content of the declaration of consent. Data processing is carried out based on point (a) of Article 6 Paragraph 1 GDPR or based on point (a) of Article 9 Paragraph 2 GDPR in the event of special categories of personal data being processed.

Consent can be withdrawn at any time. Please also note that this withdrawal shall only apply with future effect, meaning the lawfulness of the data processing which took place with your consent prior to withdrawing remains unaffected.

We will erase your data once the storage period specified in the consent has expired or should you have withdrawn your consent and no other legal basis is present. Should the latter situation apply, we erase the data once the other legal basis is no longer applicable.

V. Will my personal data also be collected from third parties?

We primarily process the personal data which we obtain from you directly in connection with research funding. In addition, the DFG also processes personal data which is provided to us by the applicants or applicant institutions and their representatives concerning project participants.

In a few cases, we also obtain your personal data from third parties, for example:

  • From your employer or research institution, for example the university
  • From your cooperation partners or those of your employer
  • From third parties, for example proposing persons, reviewers, organisers of research funding conferences that are financially supported by the DFG
  • From organisations in Germany and abroad with which the DFG cooperates within the framework of the research funding
  • If necessary, data is also exchanged with other organisations in individual cases, for example in order to exclude unlawful double funding
  • Via public sources, for example websites or publication databases

If necessary, we will provide you with more precise information about the above in separate form.

VI. Does automated decision-making or profiling take place?

We do not use automated decision-making or profiling in accordance with Article 22 GDPR.

VII. Am I required to provide my personal data?

In connection with research funding, you are required to provide the personal data which is necessary for the clear identification of your person, decision-making on and preparation and carrying out of the funding, and the fulfilment of the associated contractual or statutory obligations, or which we are legally obliged to process. Without this data, we may not be able to carry out the research funding.

Additional information, for example in order to check compensation for disadvantages, need not be provided; however, in such a case, it may not be possible to take a decision concerning the application.

VIII. Who has access to my personal data and which recipients obtain it?

Within the DFG, only employees of the DFG Head Office and the committee members who require access to your personal data in order to carry out their functions or tasks have access to it.

We only pass your personal data on to external recipients if a legal basis exists for this or if you have given your consent to such. In such a case, we comply with the principle of data economy and as a general principle only pass on data to the extent which is necessary for the concrete purpose. This applies in particular to special categories of data. No data is shared with third parties solely for their commercial purposes. External recipients may be:

  • Other applicants and participants:
    • In individual funding programmes, the DFG publishes personal data for the purpose of networking and contact initiation for future proposals on the DFG website as information for researchers and similar purposes. Lists of participants including personal data are also published on the DFG website, for example as an appendix to a results report following round-table discussions, reviews or similar events.
    • In calls for proposals for Priority Programmes, the DFG passes proposals on to other researchers involved in the review process (e.g. coordinators), who are asked to comment on the project proposals before a decision is made.
    • Following the decision, applicants and other researchers involved in the proposal receive information and appraisals from the review process. Should the proposal have been submitted by multiple applicants, information concerning proposals / parts of proposals of individual applicants and participants may also be shared with other applicants and participants in this proposal.
  • Consortia spokespersons: In connection with the programmes for the funding of consortia, i.e. larger-scale cooperations consisting of several projects, the applying consortia have a spokesperson who acts as the consortium contact and coordinates the application and implementation of the project. The DFG passes on information and appraisals from the review process to these spokespersons.
  • Higher education administrations: In the case of programmes where applications are submitted by the higher education administration, the DFG passes on information and appraisals from the review process to these higher education administrations.
  • Reviewers: Within the framework of research funding, the DFG passes personal data on to reviewers, who are requested to provide a statement concerning project proposals, scientific projects, final reports or persons who have been nominated for a prize. In the case of a complaint of discrimination by applicants, there may be a need to discuss this complaint with the reviewers.
  • Bodies who are joint controllers with us: In the area of research funding in cooperation with other organisations, these may be joint controllers with us concerning the data processing (for example joint processing/administration of proposals with German or foreign funding organisations in the case of multilateral measures). The necessary data will then be exchanged with these organisations. Further information will be made available in the individual case within the framework of the call for a funding programme to which these requirements apply.
  • Service providers: We use service providers who are responsible for supplying services in the area of information provision, the creation of statistics and evaluative studies, or the maintenance of our IT systems. These service providers work for us as processors or are themselves responsible for data processing; they are carefully selected by us and are regularly audited in order to ensure that your personal data remains protected. The service providers may only process your personal data for the purposes stated by us. This is also ensured by means of contract.
  • Public bodies: In individual cases, we may be required to provide personal data to authorities and state institutions such as public prosecutor's offices, courts, financial authorities, the Federal Audit Office or the federal and state ministries with jurisdiction over the DFG. For ERA-Net projects, we must also forward data to the European Commission as the source of funding for publishing and evaluation.
  • Universities / research institutions or research funding organisations:
    • The evaluation of funding proposals (reviews and decision notifications) is made available to other parties involved in the proposal (for example universities, project participants) as well as to the applicant. If necessary, data is also exchanged with other funding organisations in the individual case, for example in order to exclude unlawful duplicate support.
    • In order to respond to research-related queries, data is passed on to individual institutions in individual cases. For example, this includes calls to nominate potential prizewinners or recipients of other awards, as well as scientific experts.
    • Following the conclusion of investigations into allegations of scientific misconduct, personal data is disclosed if there is a legitimate interest and in accordance with the Rules of Procedure for Dealing with Scientific Misconduct. This applies in particular to the institution / employer for which you work.
  • Media and cooperation partners: In order to respond to research-related queries from third parties (for example other funding organisations or the media), data is passed on in individual cases. For example, this concerns queries relating to funding recipients, scientific experts, (potential) prizewinners or other awards.
  • Private bodies: Private bodies to whom we pass on your personal data in accordance with a legal regulation or with your consent, for example law firms, auditors or tax advisers. For example, within the framework of the annual financial audit by the DFG's auditors, random samples are taken from DFG research funding.

Ja 330 VIII. Who has access to my personal data and which recipients obtain it? 20200625114038

IX. Will my personal data be transferred to third countries?

Within the framework of the research funding, your personal data may be transferred to bodies whose headquarters or data processing location is not in a Member State of the European Union or another Member State of the European Economic Area. In such a case, prior to the transfer, we ensure that either an adequate level of data protection exists (for example by means of an adequacy decision of the European Commission, suitable guarantees, such as the agreement of so-called EU standard data protection clauses of the European Commission with the recipient) or you have given your express consent, with the exception of exemption cases which are permitted by law.

Specifically, transfers to third countries take place within the framework of the review process, should the reviewers be located in such countries. As the selection of the reviewers is based solely on scientific criteria and it is therefore necessary to take into account aspects concerning the exclusion from the review process of persons in relation to whom there are concerns as to potential conflict of interest, it may be absolutely necessary to transfer data to a reviewer who is based in a third country. In such a case, the transfer is justified by the regulation set out in point (b) or (c) of Article 49 Paragraph 1 GDPR.

Furthermore, transfers to third countries may take place if the research funding takes place within the framework of a funding programme where cooperation takes place with third countries, for example because the research funding which has been applied for is intended to take place with researchers from third countries. In such cases, the transfer is justified by the regulation set out in point (b) or (c) of Article 49 Paragraph 1 GDPR.

X. For how long will my data be stored?

We will erase the data once it is no longer necessary for the purposes pursued by us and provided that no other legal requirements, in particular statutory or contractual retention periods, apply.

XI. What are my rights as a data subject?

You are entitled to the following rights in connection with the processing of your personal data:

1. Right of access

You have the right to receive confirmation from us as to whether we process personal data relating to you or not. Should this be the case, you have the right to receive information concerning your personal data and to receive further details concerning the processing.

2. Right to rectification

You have the right to request the rectification of incorrect personal data relating to you and to have incomplete personal data completed.

3. Right to erasure (“right to be forgotten”)

Under certain circumstances, you have the right to request that we erase your personal data. For example, this right exists if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed or if the personal data was processed unlawfully.

4. Restriction of processing

Under certain circumstances, you have the right to request that the processing of your personal data be restricted. In such a case, we will only store such personal data in relation to which you have given your consent or processing is permitted by the GDPR. For example, you may have a right to restrict processing if you have disputed the correctness of your personal data.

5. Data portability

Should you have provided us with personal data under a contract or with your consent, then provided that the statutory requirements are met, you can request to receive the data which you have provided in a structured, commonly used and machine-readable format or request that we transfer this data to another controller.

6. Withdrawal of consent

Should you have given us your consent to the processing of your personal data, you can withdraw this at any time with effect for the future. The lawfulness of the processing of your personal data prior to the withdrawal remains unaffected by this.

7. Objection against processing on the basis of a “legitimate interest”

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6 Paragraph 1 GDPR (data processing in accordance with a balancing of interests). Should you raise an objection, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

8. Right to complain to the supervisory authority

You also have the right to lodge a complaint with the responsible supervisory authority, should you consider that the processing of your data breaches applicable laws. For this purpose, you can contact the data protection authority which is responsible for your place of residence, place of employment or the location of the alleged breach or the data protection authority which has jurisdiction over us. The supervisory authority of the German Federal State in which you reside or work or where an alleged breach which forms the subject of the complaint has taken place holds jurisdiction.

XII. Who can I contact if I have any questions or wish to assert my rights as a data subject?

Should you have any questions concerning the processing of your personal data or should you wish to assert your rights as a data subject which are set out in Number XI. 1-7, you can contact us free of charge. Please use the contact details under Number I., 1. To withdraw your consent, you can also use the contact channel which you selected when submitting the declaration of consent.