Data protection statement for the Arolsen Archives websites

The Arolsen Archives are pleased that you are visiting our websites. The security and confidentiality of your data during your use of our websites are very important for us. That being the case, we would like to inform you here concerning which personal data we collect from you when you visit our websites, and what purpose they are used for.

The provision of the services relating to the online archive takes place on the basis of the ITS Agreement of 2011. According to this, the use of personal data on the basis of information from the original archives and documents provided by the International Tracing Service in Bad Arolsen, including their distribution through publications, is subject to the Rules for Data Processing by the Arolsen Archives – International Center on Nazi Persecution https://aroa.to/data-processing-rules (hereinafter: “The Rules for Data Processing by the Arolsen Archives”). The EU General Data Protection Regulation applies to the provision of further online services and functionalities on the websites of the Arolsen Archives that do not concern any of the data processing governed by the Rules.

Since changes in the law or changes in the internal processes of our organization may make an adjustment of this data protection statement necessary, we ask you to read the data protection statement through regularly. The data protection statement can be accessed, saved and printed out at any time under data protection statement.

§ 1 Controller and scope

The controller, per the meaning of the EU General Data Protection Regulation (hereinafter: GDPR) and other national data protection laws of the member states as well as other legal data protection provisions, is:

Arolsen Archives/International Tracing Service (ITS)
Große Allee 5 – 9
34454 Bad Arolsen
Germany

Tel.: +49 5691 629-0
E-Mail: info@arolsen-archives.org
Website: https://arolsen-archives.org/

This Privacy Policy applies to the Internet presence of the Arolsen Archives/the International Tracing Service (“ITS”) (hereinafter: “Arolsen Archives”), which can be accessed via the domain https://arolsen-archives.org/ and the subdomains https://enc.arolsen-archives.org/, https://lastseen.arolsen-archives.org/, https://conference.arolsen-archives.org/, https://transrem.arolsen-archives.org/, https://eguide.arolsen-archives.org/ and https://collections.arolsen-archives.org and https://dpcampinventory.its-arolsen.org/, https://digitalcollections.its-arolsen.org/ and https://findmittel.its-arolsen.org/.

§ 2 Data protection officer

The controller’s external data protection officer is:

Karsten Kinast, LL.M. (lawyer)
KINAST Rechtsanwaltsgesellschaft mbH
Hohenzollernring 54
D-50672 Cologne

Tel.: +49 221 222 183 – 0

E-Mail: mail@kinast.eu
Website: https://www.kinast.eu/externer-datenschutzbeauftragter/

§ 3 Bases of data processing

Personal data are any information relating to an identified or identifiable natural person. By way of an example this includes information such as your name, age, address, telephone number, date of birth, e-mail address, your IP address or user behavior information. Information with which we cannot establish a relationship with your person (or can only do so with unreasonable effort), e.g. through anonymization of the information, does not constitute personal data. The processing of personal data (e.g. collection, requesting, use, storage or transfer always requires a legal basis or your consent. Processed personal data are erased as soon as the purpose of the processing has been attained, and if there are no longer any applicable legal obligations to retain them. This excludes the data saved in the collections of the Arolsen Archives, which are subject to the Rules for Data Processing by the Arolsen Archives. The Rules for Data Processing by the Arolsen Archives apply to the processing of data in connection with the collections of the Arolsen Archives, including historical data, data that the Arolsen Archives makes available or are collected by the Arolsen Archives, and to administrative files. If we process your personal data in order to make certain offers available, we will inform you in the provisions below of the specific processing procedures, the scope and the purpose of the data processing, the legal basis for the processing and the relevant retention periods.

§4 Individual processing procedures

1. Provision and use of the website

a. Nature and scope of the data processing

When you access and use our website we collect the personal data that your browser automatically transfers to our server. This data are temporarily stored in a so-called log file. When you use our website, we collect the following data, which are technically necessary for us to display our website to you and guarantee stability and security:

  • (Anonymized) IP address of the accessing computer
  • Date and time of access
  • URL/resource
  • Browser used
  • System used by visitor to site
  • Status code

In addition, an anonymized user statistic may be produced using the data in the log files. This anonymized statistic enables us to improve the experience of users on our website.

b. Legal basis

For the aforementioned data processing, the legal basis is article 6(1)(f) GDPR. The processing of the aforementioned data is necessary for the provision of our website and as such serves the legitimate interest of the Arolsen Archives.

c. Retention period

As soon as the aforementioned data are no longer necessary for displaying the website, they are erased. The collection of data for provision of the website and the storage of data in log files is absolutely essential for the operation of the Internet site. Consequently, the user cannot legitimately object. Continuation of storage may then occur in individual cases when legally required.

2. Newsletter

a. Nature and scope of the data processing

On our website you have the option of subscribing to a free newsletter. In order to send the newsletter to you regularly, we require the following information from you (mandatory fields are indicated with an *):

  • E-mail address*
  • Surname and first name
  • Preferred language of the newsletter (default setting is German)

Voluntary information is processed for the purpose of addressing you personally.

In addition, we process the following data from you for evaluation purposes within the scope of sending out the newsletter:

  • subscriptions, unsubscriptions, bounces (if the newsletter does not arrive), opening and click rates (including date and time), e-mail client, country of origin for the statistical evaluation of reach

When you click the send button, your data is transferred from the browser to our web server. To deliver the newsletter, your data will be transferred to CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede (partner in connection with newsletter dispatch). The open rate and further click behavior within the newsletter or user registrations are recorded and statistically processed via the links embedded in the newsletter. The Arolsen Archives statistically evaluate newsletter use by evaluating the actual use (measuring reach). This serves the purpose of specifying and optimizing our offering and making it more economical.

To send out the newsletter, we use the co-called Double Opt-In procedure, i.e., we will only send you the newsletter and process your data for evaluation purposes if you have first confirmed your subscription and your consent to evaluation via a link contained in a confirmation e-mail sent to an address provided by you for this purpose. In this way, we hope to ensure that only you, as the owner of the e-mail address given, can subscribe to the newsletter. You must send your confirmation promptly after receiving the confirmation e-mail, otherwise your newsletter subscription will be automatically erased from our database. You can withdraw the consent given for storing your data and using it to send the newsletter at any time, e.g., via the “unsubscribe” link in the newsletter.

b. Legal basis

In accordance with article 6 (1)(a), 7 GDPR, the processing of your e-mail address for sending the newsletter is based on your voluntary consent given by means of the declaration below:

„By inputting my data and pressing the “Submit request” button, I declare my consent to the processing of my email address, where applicable my voluntary information in order to be addressed personally (first and last names), and the preferred language for the regular sending of the newsletter and for the evaluation of newsletter use via the processing and evaluation of subscriptions and unsubscriptions, bounces (if the newsletter does not arrive), opening and click rates (including date and time), the e-mail client used, and the country of origin for optimization purposes. I may unsubscribe from the newsletter service at any time, by clicking on the corresponding link in the newsletter.

I can withdraw consent to collect and process my data for the newsletter service at any time without stating reasons and with effect for the future, e.g., by e-mail to: dataprotection-aroa@arolsen-archives.org

c. Retention period

Your e-mail address and your voluntary information (first and last names) will be stored for as long as you have subscribed to the newsletter. Your data are deleted once you unsubscribe from the newsletter or withdraw your consent. We may continue to store them in individual cases when legally required.

3. Entry in the press mailing list

a. Nature and scope of the data processing

We offer representatives of the press the opportunity to be added to the press mailing list via a form provided on our website.

As part of the subscription process by means of the contact form, reference is made to this Privacy Policy in order to obtain your consent. Should you subscribe to the press mailing list, the following personal data concerning you will be processed (mandatory fields are indicated with an *):

  • Name
  • E-Mail adress*

b. Legal basis

The processing of data for the purpose of entry in the press mailing list takes place, in accordance with article 6 (1)(a) GDPR, based on your voluntary consent given by means of the declaration below:

„By inputting my data, which are indicated above as mandatory fields (*), and pressing the “Submit request” button, I declare my consent to the processing of this data for the purpose of getting in contact via our press mailing list.

I can withdraw consent to collect and process my data for the sending of press information at any time without stating reasons and with effect for the future, e.g., by e-mail to: dataprotection-aroa@arolsen-archives.org

c. Retention period

Your data are deleted once you unsubscribe from the press mailing list or withdraw your consent. We may continue to store them in individual cases when legally required.

4. Contact form for general questions (no inquiries about people)

a. Nature and scope of the data processing

On our website we offer you the option of contacting us using the contact form provided: You can use this contact form to ask general questions about the areas listed below:

  • Questions about current projects
  • Questions about events
  • Questions about educational programs
  • Questions about research programs
  • Questions about the archive and online archive
  • Questions to the Directorate
  • Questions about the website/technology
  • Questions from relatives
  • Miscellaneous (e.g., questions about partnerships)

If it concerns an inquiry about people and information about the fate of people persecuted by the Nazis or information required for research or educational projects (“tracing inquiry”), the nature and scope of the data processing, the legal basis, and the retention period are based on the provisions in § 4 paragraph 5 of this Privacy Policy.

As part of the submission process of your request by means of the contact form, reference is made to this data protection declaration in order to obtain your consent. Should you make use of the contact form, the following personal data concerning you will be processed (mandatory fields are indicated with an *):

  • First name and last name*
  • E-mail address*
  • Your message*
  • Subject*

The provision of the data above serves to process your inquiry and enables us to answer you.

b. Legal basis

The processing of data for the purpose of processing and responding to your inquiry takes place, in accordance with article 6 (1)(a), 7 GDPR, based on your voluntary consent given by means of the declaration below:

By inputting my data, which are indicated above as mandatory fields (*), and pressing the “Submit request” button, I declare my consent to the processing of this data for the purpose of getting in contact about my inquiry.

I can withdraw consent to collect and process my data for the sending of press information at any time without stating reasons and with effect for the future, e.g., by e-mail to: dataprotection-aroa@arolsen-archives.org

c. Retention period

Your personal data processed via the contact form will be deleted once the inquiry submitted by you is complete and the respective subject matter has been conclusively clarified or you withdraw your consent. We may continue to store them in individual cases when legally required.

5. Search requests via the request form for tracing inquiries from and about people persecuted by the Nazis

a. Nature and scope of the data processing

On our website we offer you the option of contacting us using the form provided for tracing inquiries regarding the fate of people persecuted by the Nazis or information required for research or educational projects. As part of the submission process of your inquiry by means of the request form (hereinafter: “tracing inquiry”), reference is made to this Privacy Policy in order to obtain your consent.

Should you make use of the request form, the following personal data concerning you will be processed (mandatory fields are indicated with an *):

  • Subject of the inquiry (the option you selected for the tracing inquiry and the information required to answer the questions)*
  • Title*
  • First name and last name*
  • Birth name
  • E-mail address*
  • Country*
  • Institution
  • Telephone
  • Street and house number
  • ZIP code and town

The data indicated as a mandatory field are used for the purpose of getting in contact with you to answer your tracing inquiry. The other data above serves to better allocate and process your tracing inquiry, and enables us to also answer you by other means. The data “country” is used for statistical purposes.

To fulfill the purposes set down in the ITS Agreement and described in more detail in paragraph (2) of the Rules for Data Processing by the Arolsen Archives, the personal data processed in connection with your tracing inquiry are saved permanently in a TD file once processing is complete. Any sensitive data made available as part of your tracing inquiry within the meaning of paragraph (29) (a) of the Rules for Data Processing by the Arolsen Archives are excluded from permanent saving in the TD file and transfer into the archive of the Arolsen Archives. You can object to the saving of certain parts or all of your personal data at any time for legitimate reasons. This does not apply if it concerns personal data of perpetrators within the meaning of paragraph (39) of the Rules for Data Processing by the Arolsen Archives. The Data Protection Committee decides on the objection.

The data are subject to a term of protection of 25 years from the transfer of your data into the TD file. The data are assigned a blocking note until the term of protection elapses and are not accessible to the public. At the end of this term of protection, the personal data processed in connection with your tracing inquiry will be transferred to the archive of the Arolsen Archives and, in the event of any new inquiry concerning the same subject, communicated to the person(s) making a new tracing inquiry. Private address details, including personal e-mail addresses, telephone numbers and similar information, are only passed on to people submitting a tracing inquiry if you have previously expressly agreed in writing or in text form to your private address details being passed on. Until you grant your consent and in the event of refusal, we will not share your private address details.

Before the term of protection elapses, your personal data processed in connection with your tracing inquiry may be passed on the copyholders stated below in the form of a data copy as part of comparing the data with the partner archives (“copyholders”, partner organizations in the State parties to the ITS Agreement), within the scope of the agreements under international law that exist between the Arolsen Archives and the copyholders according to paragraphs (27), (31), and (32) of the Rules for Data Processing by the Arolsen Archives, and further processed by them in accordance with the applicable provisions of data protection legislation and international law:

  • Archives de l‘État en Belgique, Brussels (Belgium)
  • Archives Nationales, Pierrefitte-sur Seine (France)
  • Centre de Documentation et de Recherche sur la Résistance (Luxembourg)
  • Instytut Pamięci Narodowej (IPN), Warsaw (Poland)
  • The Wiener Library, London (United Kingdom)
  • Yad Vashem, Jerusalem (Israel)
  • US Holocaust Memorial Museum (USHMM), Washington (USA)

b. Legal basis

The data processing described for the purpose of getting in contact, and handling and responding to the tracing inquiry takes place according to paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives.

After responding to your tracing inquiry, we process your data shared with us as part of the tracing inquiry as described under a to fulfill the purposes set down in the ITS Agreement and described in more detail in paragraph (2) of the Rules for Data Processing by the Arolsen Archives. The legal basis for this data processing is paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives.Any sensitive data made available as part of your tracing inquiry within the meaning of paragraph (29) (a) of the Rules for Data Processing by the Arolsen Archives are excluded from transfer into the archive of the Arolsen Archives and permanent saving in the TD file. You can object to the saving of certain parts or all of your personal data at any time for legitimate reasons. The Data Protection Committee decides on the objection.

c. Retention period

The personal data that you transmit to us as part of your tracing inquiry are permanently saved and processed by the Arolsen Archives after responding to your tracing inquiry according to paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives. In addition to fulfilling the archival function of the Arolsen Archives dictated by international law, this serves the purpose of ensuring that after a term of protection of 25 years after your tracing inquiry, your data can be passed on to persons who submit a tracing inquiry concerning the same subject so that people may be reunited as a result of the inquiry. This fulfills the archival function of the Arolsen Archives dictated by international law according to the ITS Agreement. Your data are assigned a blocking note until the term of protection elapses and are not accessible to the public. You can object to the saving of certain parts or all of your data at any time for legitimate reasons. The Data Protection Committee decides on the objection.

6. Donations

a. Nature and scope of the data processing

We offer you the opportunity to make a donation to the Arolsen Archives via our website. If you click on the “Donate now” field, an online form opens. To process your donation, the following personal data concerning you will be processed via the online form (mandatory fields are indicated with an *):

  • Payment method (PayPal)*
  • Donation amount*
  • Donation purpose*
  • Title*
  • Academic title*
  • First name/last name*
  • Company name* (if donation is provided on behalf of a company)
  • E-mail address*
  • Where applicable, information on whether a donation receipt is required
  • Where applicable, your message

We work with our partner HelpDirect e. V., Ahrweg 107, 53347 Alfter (Germany) to process your donation. With regard to the personal data processed by HelpDirect e.V. for making the donation, we ask you to take note of the data protection declaration available at https://www.helpdirect.org/informationen/datenschutz/.

To process the payment via the online form, we use the external payment service provider PayPal and transmit the data required for processing the payment (mandatory information and payment amount) to PayPal (Europe) S.a.r.l. et Cie, S.C.A. PayPal based in Luxembourg. Data processing is required to carry out the transactions. The entered data are only processed and saved by PayPal. We and our partner HelpDirect e.V. only obtain information regarding whether the payment is confirmed or has failed. PayPal may share the data with credit agencies. This sharing takes place for the purpose of confirming identity and carrying out a credit check.

As a result, the General Terms of Business agreed with you and the Privacy Policy of PayPal also apply to the payment transactions. You can find more information about data processing by PayPal at https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.

b.  Legal basis

The data processing for the purpose of processing your donation takes place on the basis of Art. 6 (1)(b) GDPR (contract initiation and performance).

c. Retention period

Once the processing of the donation is complete, your data will be blocked from further use and deleted after the retention periods under tax and commercial law have elapsed, unless you have expressly consented to the further use of your data. Continuation of storage may then occur in individual cases when legally required.

7. Prior registration for on-site visits

a. Nature and scope of the data processing

We offer you the possibility of registering for an on-site visit via a request form that can be accessed on our website. To process your registration, the following personal data concerning you will be processed via the online form (mandatory fields are indicated with an *):

  • Subject of the inquiry (the option you selected for the search inquiry) and more information about your research request*
  • Title*
  • First name and last name*
  • Birth name
  • Institution
  • Country*
  • E-mail address*
  • Telephone number
  • Street and house number
  • ZIP code and town

The data indicated as mandatory fields are used for the purpose of handling your registration and getting in contact with you to handle your registration. The other data above serves to better allocate and process your registration and inquiry, and enables us to also answer you by other means. The data “country” is used for statistical purposes.

If the registration for an on-site visit takes place for the purposes of viewing documents from the archive of the Arolsen Archives and/or includes a tracing inquiry, your personal data communicated to us in connection with the registration are saved permanently in a TD file once processing is complete. This takes place to fulfill the purposes set down in the ITS Agreement and described in more detail in paragraph (2) of the Rules for Data Processing by the Arolsen Archives. Any sensitive data made available as part of your registration within the meaning of paragraph (29) (a) of the Rules for Data Processing by the Arolsen Archives are excluded from permanent saving in the TD file and transfer into the archive of the Arolsen Archives. You can object to the saving of certain parts or all of your personal data at any time for legitimate reasons. This does not apply if it concerns personal data of perpetrators within the meaning of paragraph (39) of the Rules for Data Processing by the Arolsen Archives. The Data Protection Committee decides on the objection.

The data are subject to a term of protection of 25 years from the transfer of your data into the TD file. The data are assigned a blocking note until the term of protection elapses and are not accessible to the public. At the end of this term of protection, the personal data processed in connection with your tracing inquiry will be transferred to the archive of the Arolsen Archives and, in the event of any new inquiry concerning the same subject, communicated to the person(s) making a new tracing inquiry. Private address details, including personal e-mail addresses, telephone numbers and similar information, are only passed on to people submitting a tracing inquiry if you have previously expressly agreed in writing or in text form to your private address details being passed on. Until you grant your consent and in the event of refusal, we will not share your private address details.

Before the term of protection elapses, your personal data processed in connection with your tracing inquiry may be passed on the copyholders stated below in the form of a data copy as part of comparing the data with the partner archives (“copyholders”, partner organizations in the State parties to the ITS Agreement), within the scope of the agreements under international law that exist between the Arolsen Archives and their copyholders according to paragraphs (27), (31), and (32) of the Rules for Data Processing by the Arolsen Archives, and further processed by them in accordance with the applicable provisions of data protection legislation and international law:

  • Archives de l‘État en Belgique, Brussels (Belgium)
  • Archives Nationales, Pierrefitte-sur Seine (France)
  • Centre de Documentation et de Recherche sur la Résistance (Luxembourg)
  • Instytut Pamięci Narodowej (IPN), Warsaw (Poland)
  • The Wiener Library, London (United Kingdom)
  • Yad Vashem, Jerusalem (Israel)
  • US Holocaust Memorial Museum (USHMM), Washington (USA).

The Terms of Use of the Arolsen Archives apply to user access. These are available here: https://aroa.to/termsofservice-en.

The prerequisite for access to the archive is a declaration by the user to comply with the Terms of Use.

b. Legal basis

The data processing for the purpose of registering for an on-site visit takes place according to paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives. 

Once your on-site visit is completed, we process your data shared with us as part of your registration as described under a to fulfill the purposes set down in the ITS Agreement and described in more detail in paragraph (2) of the Rules for Data Processing by the Arolsen Archives. The legal basis for the data processing is paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives. Any sensitive data made available as part of your registration within the meaning of paragraph (29) (a) of the Rules for Data Processing by the Arolsen Archives are excluded from transfer into the archive of the Arolsen Archives and permanent saving in the TD file. You can object to the saving of certain parts or all of your personal data at any time for legitimate reasons. The Data Protection Committee decides on the objection.

c. Retention period

The personal data that you transmit to us as part of your registration for an on-site visit are permanently saved and processed by the Arolsen Archives according to paragraphs (26) and (27) of the Rules for Data Processing by the Arolsen Archives. In addition to fulfilling the archival function of the Arolsen Archives, this serves the purpose of ensuring that after a term of protection of 25 years after your registration, my data can be passed on to persons who submit a tracing inquiry concerning the same subject so that people may be reunited as a result of the inquiry. This fulfills the archival function of the Arolsen Archives dictated by international law according to the ITS Agreement. The data are assigned a blocking note until the term of protection elapses and are not accessible to the public. You can object to the saving of certain parts or all of your data at any time for legitimate reasons. The Data Protection Committee decides on the objection.

8. Online events (webinars, online readings, etc.)

a. Nature and scope of the data processing

We offer interested parties the opportunity to take part in online events at the Arolsen Archives. For this, we use the tool WebinarNinja from Team ON PTY LTD based in Sydney, Australia, or the tool Zoom from Zoom Video Communications, Inc. based in San Jose, USA.

As part of using the video conferencing tools that we employ, your data are transferred to and saved in third countries without a data protection level comparable with the EU, in particular in the USA. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy.

To participate in online events via WebinarNinja, you are forwarded to the registration page of WebinarNinja following a corresponding notice in order to log in.

WebinarNinja is responsible for the subsequent data processing. You can access information on data protection at WebinarNinja and the Terms of Use here: https://webinarninja.com/privacy/ and https://webinarninja.com/terms/.

Prior registration by e-mail is required for participation in online events via Zoom. To process your registration and as part of participating in the online events, the following personal data concerning you will be processed (mandatory fields and mandatory data are indicated with an *):

  • First name and last name*
  • Name of the organization
  • Telephone number
  • Where applicable, subject
  • Where applicable, message
  • E-mail address*
  • Where applicable, registration name
  • User data: Meeting ID, IP address, device/hardware information, log data, connection data (time of joining and leaving the meeting)*
  • Image and video data when using the video function (voluntary)
  • Chat and message records*

You can access information on data protection at Zoom and the Terms of Use here: https://explore.zoom.us/en/privacy/ and https://explore.zoom.us/en/terms/.

b. Legal basis

The processing of data for the purpose of registration and participation in an online event takes place, in accordance with article 6 (1)(a), 7, 49 (1)(1)(a) GDPR, based on your voluntary consent given by means of the declaration below:

For participation via WebinarNinja

I consent to forwarding to the registration page of WebinarNinja and the subsequent processing of my data for registration and participation in the online event of the Arolsen Archives via WebinarNinja. This also includes the transfer of data to third countries, particularly the USA, which do not have a data protection level comparable with the EU. Additional information on data protection and the Terms of Use of WebinarNinja can be found in the Privacy Policy https://webinarninja.com/privacy/ on this website.

For participation via Zoom

With your registration via e-mail, you consent to the processing of your data (name, e-mail address and user data) for registration and participation in the online event via Zoom. This also includes the transfer of data to third countries, particularly the USA, which do not have a data protection level comparable with the EU. You can withdraw your consent at any time with effect for the future and without stating reasons. An e-mail is sufficient for this: dataprotection-aroa@arolsen-archives.org. Additional information on data protection and the Terms of Use of Zoom can be found in the Privacy Policy https://explore.zoom.us/en/privacy/ on our website.

c. Retention period

We save your personal data only until the purpose of its collection has ended or you have withdrawn your consent to data processing and as long as no statutory retention obligations or other reasons prevent their deletion. In the event that consent is withdrawn, no further sharing, in particular, will take place.

9. Job applications

a. Nature and scope of the data processing

We offer you the opportunity to apply to us according to the job vacancies published on our website or speculatively by e-mail. As part of the application procedure, we process the application documents submitted by you, the personal data received from you (first name and surname, residential address, nationality, gender, date of birth, disability/equal opportunities, professional qualifications, language skills, statements on occupation performed, weekly working hours, e-mail address, and, if applicable, voluntary information such as cell number, landline number, telephone number, photo, hobbies, and personal interests). If external parties are involved in the selection process, your data are shared with them in the required scope. Naturally, all of the people involved in the selection procedure are subject to non-disclosure and are obliged by us to maintain confidentiality.

b. Legal basis

The processing of data for the purposes of carrying out application procedures, assessing and handling your submitted application takes place according to Art. 6 (1)(b) and (c), 88 GDPR, § 26 (1)(1) of the German Federal Data Protection Act (BDSG) and is required to make a decision about establishing an employment relationship.

c. Retention period

complete, unless you have expressly consented to the further storage of your application documents for any other suitable positions to be filled in the future. Continuation of storage may then occur in individual cases when legally required.

If an employment relationship is established with you, we save your data for the duration of the employment relationship and delete this after the end of this relationship, as long as no statutory retention obligations prevent their deletion.

§ 5 Transfer of data

We only transfer your personal data to third parties if:

  • You have given your express consent to this in accordance with article 6 (1)(1)(a) GDPR, where applicable in conjunction with paragraph (9) of the Rules for Data Processing by the Arolsen Archives
  • This is permitted by law and is necessary for the performance of a contract to which the data subject is party, in accordance with article 6 (1)(1)(b) GDPR
  • There is a legal obligation for the transfer, in accordance with article 6 (1)(1)(c) GDPR
  • The transfer is necessary, in accordance with article 6 (1)(1)(f) GDPR, to protect our legitimate interests and for the establishment, exercise or protection of legal claims, and there is no reason to assume that you have an overriding interest in your data not being transferred.
  • This is required to fulfill our obligations from the ITS Agreement and the transfer is permitted according to the Rules for Data Processing by the Arolsen Archives. This concerns, in particular, the transfer of data to the following copyholders (partner organizations in the State parties to the ITS Agreement):
    • Archives de l‘État en Belgique, Brussels (Belgium)
    • Archives Nationales, Pierrefitte-sur Seine (France)
    • Centre de Documentation et de Recherche sur la Résistance (Luxembourg)
    • Instytut Pamięci Narodowej (IPN), Warsaw (Poland)
    • The Wiener Library, London (United Kingdom)
    • Yad Vashem, Jerusalem (Israel)
    • US Holocaust Memorial Museum (USHMM), Washington (USA)

If we commission third parties/external service providers with the processing of personal data, this takes place on the basis of a processor contract according to Art. 28 GDPR. We inform you about the use of such external service providers as part of the information provided about the individual processing procedures.

§ 6 Use of cookies

a. Nature and scope of the data processing

We use cookies on our website. Cookies are small files which are sent to the browser of your terminal and stored there when you visit our Internet pages. Some functions of our website cannot be offered without use of functional cookies. Other cookies enable us to carry out various analyses. For example, cookies are able to recognize the browser you use when you visit our website again, and transmit different information to us. With the aid of cookies, amongst other things we can make our Internet offer more user-friendly and effective, by tracking your use of our website and ascertaining your preferred settings (e.g. country and language settings). If third parties process information using cookies, they collect this information directly via your browser. Cookies do not cause any harm to your terminal. They cannot run any programs and do not contain viruses.
Different types of cookies are used on our website, the type and function of which is explained in more detail below:

Transient cookies:

On our website transient cookies are used which are automatically deleted as soon as you close your browser. This type of cookies makes it possible to record your session ID. This enables several different requests from your browser to be allocated to a single session.

Persistent cookies:

We use persistent cookies on our website Persistent cookies are cookies that are stored on your browser for a longer period and which transmit information to us. The duration of storage is determined depending on the cookie. You can delete persistent cookies yourself using your browser settings.

Necessary cookies:

These cookies are required for technical reasons so that you can visit our website and use the functions that we offer. This refers, for example, to the following applications: Cookie management via the cookie banner and language settings.

These cookies also contribute to a safe and proper use of the website.

Performance-related cookies:

Using these cookies we are able to make an analysis of the website usage and improve the service and functionality of our website. They collect information on how our website is used by visitors, which pages are visited the most, or whether error messages are displayed on certain pages.

Cookies for marketing and social media:

Advertising cookies (third-party providers) make it possible to show you various offers that correspond to your interests. These cookies allow the user’s web activities to be recorded over a prolonged period of time. You may identify these cookies on various devices that you use.

The following third-party providers receive personal data via cookies integrated into our website:

  • Facebook: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
  • Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
  • Adform ApS, Hovedvagtsgade 6, 1103 Copenhagen K, Denmark
  • WebShop Marketing Ltd, 129 Kassai Street, Debrecen 4028, Hungary.

Furthermore, certain cookies make it possible to establish a connection to your social networks and share content from our website within your networks.

b. Legal basis

The legal basis for the processing of what are known as functional cookies is our legitimate interest in the processing of personal data according to article 6 (1)(f) GDPR. We require your consent for cookies that are not functional cookies or are what are known as third-party provider cookies. If you have given us your consent to the use of cookies as a result of notices we provide on the website (“cookie banners”), the lawfulness of their use is also based on article 6 (1)(1)(a) GDPR. You can withdraw this consent for the future at any time by deactivating the cookies in your browser settings.

c. Retention period

As soon as the data transferred to us via the cookies are no longer necessary to attain the purposes described above, this information will be erased. Continuation of storage may then occur in individual cases when legally required.

d. Configuration of browser settings

You can manage cookie settings via the setting options listed below or by configuring your browser settings.

Most browsers are configured to accept cookies by default. Nevertheless, you can configure your browser to only accept certain cookies, or to not accept any cookies. However, we point out to you that you may not be able to use all the functions of our website if cookies are disabled on our website through your browser settings. You can also delete cookies that have already been saved to your browser through your browser settings, or view the duration of storage. Furthermore, it is possible to configure your browser to notify you before cookies are saved. Since different browsers may have different functionalities, we ask that you use the help menu of your browser for configuration possibilities.

If you would like to obtain a comprehensive overview of all instances of access to your Internet browser by third parties, we recommend you install the plug-ins specially developed for this purpose.

Configuration and explanation table

§ 7 Tracking and analysis tools

We use tracking and analysis tools in order to ensure continuous optimization and needs-based design of our website. With the aid of tracking measures we are also able to statistically record visitors’ use of our website and further develop our online offer for you with the help of the information we obtain from this. If you have given us your consent to the use of the following tracking and analysis procedures as a result of notices we provide on the website (“cookie banners”), the lawfulness of their use is based on article 6 (1)(1)(a) GDPR and additionally according to article 49 (1)(a) GDPR, where data transfer takes place to a third country without an adequate data protection level. The following description of tracking and analysis tools provides information on the purposes of the processing concerned, the data that are processed, and the legal basis for data processing.

Google Tag Manager

Our website uses the Tag Manager service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The Tag Manager organizes all tags (HTML snippets of text that are integrated into websites to set cookies) of third-party providers, such as Google Analytics, and controls the activation of the same. It initiates the forwarding of data when the website is used by identifying if an analysis program wants to collect data and forwards this to the relevant program. The Tag Manager is a cookie-free domain that initiates the activation of other tags and does not access the collected data itself. The Tag Manager therefore does not collect any personal data itself.

Article 6 (1)(f) GDPR is the legal basis for using Google Tag Manager, in that our legitimate interests lie in guaranteeing the website’s technical functionality and in organizing third-party tags/tools.

You will find further information about Tag Manager and the use of the data collected by Google here: https://www.google.com/analytics/terms/tag-manager/.

Google Analytics web analysis service

We use Google Analytics, a web analysis service from Google (see above), on this website. Google Analytics uses cookies (cf. § 6), i.e. text files that are stored on your computer and enable your usage of the website to be analyzed.

The information generated by cookies, for example, about time, place and frequency of your usage of the website is generally transmitted to one of Google’s servers in the USA and stored there. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy. When Google Analytics is used, it is not possible to rule out that the cookies set by Google Analytics may not also collect other personal data alongside the IP address. Please note that Google may disclose this information to third parties, if this is required by law, or if third parties process this data on Google’s behalf.

We use Google Analytics to be able to analyze and regularly improve usage of our website. We are able to improve our offering using the statistics gained and present them in a more interesting way for you as a user.

Article 6 (1)(1)(a), 49 (1)(a) GDPR is the legal basis for usage of Google Analytics and the transfer of data to Google in the USA, namely your consent granted via the cookie banner. You can revoke the consent you have given at any time and easily via the cookie settings by unselecting the choices you have made. The user identifiers sent by us and with cookies (e.g. user ID) or data linked to advertising IDs are deleted automatically after 14 months. Data that has reached its retention period is deleted automatically once a month.

To ensure the best possible protection of your personal data, Google Analytics was extended on this website with the code “anonymizeIp”. This code causes the last 8 bits of the IP addresses to be deleted and your IP address is therefore collected anonymized (‘IP masking’). Google will always truncate your IP address within Member States of the European Union or in other contracting states to the Agreement of the European Economic Area. The full IP address will only be transmitted to one of Google’s servers in the USA and truncated there in exceptional circumstances.

You can prevent cookies from being stored by selecting the appropriate setting in your browser software. Please note, however, that you will not be able to make full use of all this website’s functions in this case.

It is not possible to rule out that the cookies set by Google Analytics may also collect other personal data alongside the IP address. To prevent information about your use of the website from being collected by Google Analytics and transferred to Google Analytics, you can download and install a plug-in for your browser at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

This plug-in prevents this information about your visit to the website from being transmitted to Google Analytics. This plug-in does not prevent any other analysis.

Please note that you cannot use the aforesaid browser plug-in when you visit our website via the browser of a mobile end device (smartphone or tablet). When using a mobile end device, you can prevent Google Analytics from collecting the data about your usage by clicking on the following link:

By clicking on this link, what is known as an opt-out cookie is saved in your browser. This prevents information about your visit to the website from being transmitted to Google Analytics. Please keep in mind that the opt-out cookie is only valid for this browser and only for this domain. If you delete cookies in this browser, this will also delete the opt-out cookie. You will have to click the link again to continue to prevent Google Analytics from collecting data. To prevent Google Analytics from collecting data across a variety of devices, you must set the opt-out on all systems used. It is also possible to use the opt-out cookie as an alternative to the above plug-in when using the browser on your computer.

You can obtain further information about Google and about the handling of personal data from the following addresses:

Google Ads

We also use the services Google AdWords on our website and specifically conversion tracking. Google Conversion Tracking is an analysis service from Google (see above).

Google Ads allow us to place ads with Google but also in Google’s advertising network. We are able to define certain key words in advance, which can be used to display an ad in Google’s search engine results, when, as the user, you retrieve a search result relevant to the key words. The purpose of Google Ads is to advertise our website by displaying advertising on the website of third-party companies and in Google’s search engine results and displaying third-party advertising on our website.

We use ‘conversion tracking’ as part of Google Ads. A cookie (cf. § 6) is set for conversion tracking when you click a Google ad. Cookies set in this way cease to be valid after 30 days. The conversion cookies are not intended to reveal the users’ identity. If you visit certain pages on our website before the cookie has expired, Google and also we will be able to see that you have clicked a specific ad and were directed to this page. Google Ads customers each receive a different cookie. There is therefore no possibility of tracking cookies via the websites of Google Ads customers. The information that is collected with the help of the conversion cookie (server logs: web request, the IP address, browser type, browser language, the date and time of your request, and one or more cookies that may uniquely identify your browser) helps to generate statistics for ourselves. This gives us the total number of users who have been forwarded by clicking the ad on our website. We do not obtain any personal information that would enable a user to be identified.

It cannot be ruled out that the information generated by cookies, for example, about which ad forwarded you to our website, is generally transmitted to one of Google’s servers in the USA and stored there. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy.

Our website uses conversion cookies in the opt-in process. This means that the user must actively consent to the use of these cookies via the cookie banner upon their first visit to our website. The user may also object to usage after activation by deleting these cookies under settings in their browser. A user may also control their cookie management by using the relevant browser functions. They may either conditionally permit or generally prohibit the use of cookies. Equally, they are able to determine if cookies are to be deleted as soon as the browser is closed. If cookies are generally deactivated, this may affect the website’s functionality.

The saving of the stated conversion cookies and the transfer of your data to Google in the USA takes place on the basis of Article 6 (1)(a), 49 (1)(a) GDPR, namely your consent granted via the cookie banner. You can revoke the consent you have given at any time and easily via the cookie settings by unselecting the choices you have made.

If you do not want to participate in conversion tracking, you can also prevent this by making corresponding settings in your browser, e.g., in the form that generally prevents the installation of cookies. You can also deactivate cookies for conversion tracking by setting your browser in such a way that only cookies from the web address “googleadservices.com” are blocked.

Adform

This website uses pixel and cookie technologies provided by Adform ApS, Hovedvagtsgade 6, 1103 Copenhagen K, Denmark (hereinafter: Adform), a European company that provides us with digital advertising services where your personal data is processed exclusively within the EU or EEA.

When you visit our website, a cookie file is generated by Adform in the browser you are using via an image file (known as a pixel) embedded in it. This allows Adform to recognize your computer for us, both when you visit our website and when you visit certain other websites. Adform may use the cookie to collect information about your device and search behavior, including:

  • the IP address – however, this is always anonymized before further use to prevent direct identification to that extent;
  • the cookie identifier, which is a random string of characters stored on your device;
  • Information about your operating system and other technical information (screen resolution, language settings, country settings, device ID and device type and type of browser you use to visit a website); and
  • The date, time and region of your website visit, domain you visit, and URLs you have previously visited.

This cookie and the listed data collected about you are used to create promotional messages that may be relevant to you, which includes the following functions: Preventing the constant repetitive display of the same advertisements, measuring and reporting the effectiveness of advertisements, determining pricing and bidding decisions for specific elements of advertising opportunities, selecting advertisements and content based on your interests, and ensuring the integrity and security of the services Adform provides, including analyzing whether a visit to a website originates from a robot or software. Of course, there are appropriate agreements required by data protection law for the use of Adform’s services.

The cookie used has a lifespan of 21 days, so that all personal data processed in the process will be completely deleted again at this time at the latest, unless you have already deleted it yourself beforehand. After deletion of the cookie, your data can no (longer) be used by Adform within the scope of the advertising services.

The legal basis for the processing of your data is the consent given by you in the cookie banner on this website for the use of cookies (Art. 6 (1)(1)(a) GDPR). You can revoke the consent you have given at any time and easily via the cookie settings by unselecting the choices you have made. In addition, you can easily turn off data processing by Adform as follows (https://site.adform.com/privacy-center/platform-privacy/right-to-be-forgotten/) or by deactivating or deleting the Adform cookies via your browser settings. We would like to point out that this revocation is only browser-related and must be resubmitted when the cookies are deleted in the browser. If you access the website via a different browser, you must also declare the revocation again.

You can find out more about the use of the pixel or cookies and Adform’s data protection principles here: https://site.adform.com/privacy-center/platform-privacy/product-and-services-privacy-policy/.

Custom Audience function from Facebook using Facebook Pixel (Facebook Remarketing).

On our websites, we use the “Custom Audiences” remarketing function of the social network Facebook, which is operated by Meta Platforms Ireland Limited., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for conversion measurement. However, according to Meta, the data collected are also transferred to the USA and other third countries. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy.

The so-called “Facebook Pixel” is used to display interest-based advertising (“Facebook Ads”) to visitors to our websites when they visit the social network Facebook. When visiting our website, a direct connection to the Facebook servers is established. In the process, it is transmitted to the Facebook server that you have visited this website and Facebook assigns this information to your personal Facebook user account. When you visit the Facebook social network, you will then be shown personalized, interest-based Facebook ads.

It cannot be ruled out that the information generated by “Facebook-Pixel”, for example, about which ad forwarded you to our website, was also transmitted to one of Facebook’s servers in the USA and stored there. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy.

The cookies used have a lifespan of 3 months to 2 years, so that all personal data processed in the process will be completely deleted again at this time at the latest, unless you have already deleted it yourself beforehand.

The processing and transfer to the USA are based on the consent you have given in the cookie banner on this website for the use of cookies (Art. 6 (1)(1)(a), Art. 49 (1)(a) GDPR). You can revoke the consent you have given at any time and easily via the cookie settings by unselecting the choices you have made.

You can find further information on protecting your privacy in Facebook’s privacy notices: https://en-us.facebook.com/about/privacy/.

You can deactivate the “Custom Audiences” remarketing function at https://www.facebook.com/adpreferences/advertisers, but you must be logged into Facebook to do so.

If you do not have a Facebook account, you can also deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance:
https://www.youronlinechoices.com/de/praferenzmanagement/.

For more information on the collection and use of data by Facebook, as well as your rights in this regard and options for protecting your privacy, please visit https://www.facebook.com/about/privacy/.

OptiMonk

We use OptiMonk, an onsite retargeting service provided by WebShop Marketing Ltd (https://www.optimonk.com, 129 Kassai Street, Debrecen 4028, Hungary).

With OptiMonk, it is possible to display personalized content or redirect users based on their behavior (mouse movement, clicks, scroll height, page visits, etc.) on our website. For this purpose, OptiMonk uses cookies on users’ end devices and saves the following user data: browser information, operating system, time spent on the page, campaign ID (internal system ID to uniquely identify a pop-up window that has been set up), date and time of the first visit, date and time of the last visit, number of page views, variant ID (identifier for a pop-up variant), campaign status, and number of impressions for the visitor (defines how often a particular pop-up was displayed to the user).

We use this data to display information to users via popup windows. As part of this, we save which popup window has been displayed to the user when and how often in order to be able to specifically control and restrict the frequency of the popups. The cookies have a lifespan of one year. The session ID cookie expires after the session.

The legal basis for the processing of your data in this context is the consent given by you in the cookie banner on this website for the use of cookies (Art. 6 (1)(1)(a) GDPR). You can revoke the consent you have given at any time and easily via the cookie settings by unselecting the choices you have made. In addition, you can prevent the data processing by OptiMonk very easily as follows by disabling the use of cookies in your web browser settings and deleting cookies that are already active. You can find out more about data processing by OptiMonk here: https://www.optimonk.com/privacy_policy.

§ 8 Map services

We use Google Maps on our website to visually display geographical information. When using Google Maps, data about the use of the map function by users are also collected, processed and used by Google. You can find more information about the processing of data by Google in the Google Privacy Policy (https://policies.google.com/privacy). You can also change your personal data protection settings there in the data protection center.

You can find detailed guides on managing your own data in connection with Google products at https://support.google.com/accounts/answer/3024190.

Without additional precautions, map services use technical methods that cause data (including personal data) to be exchanged with the respective map service (here Google) even when the website that uses the map is displayed or loaded. In these cases, users have no way of rejecting this exchange of data.

To protect you from such an unalterable data exchange and the forwarding of data to the respective map service when using our websites, we have incorporated a corresponding technical precaution, called a “2-step solution.” The two-step solution gives you the opportunity to consent to the use of the map service (and thus to exchange data with this map service), even after loading our websites. However, the default setting of the 2-step solution does not transfer any data to the map service. This option to make a decision can be used once or permanently and can also be changed again later on. As a result, if you do not want a map service to collect data about you via our website, you can choose not to click on the corresponding map, which would activate it.

Maps from Google Maps are initially displayed as buttons, as shown below.

Use of external content

Caption: Use of external content

By clicking on this button, you consent to the one-time data exchange between the respective website and Google. The default setting does not transfer any data to Google. Click on the Permanent button to grant permanent consent in the data exchange between the websites and the respective map service, for which a cookie is used on our side (see § 6). This decision can be amended again at a later time.

§ 9 Use of external content

In part, content from external providers (such as videos, presentations or news feeds) is displayed on our website. We use the tool “Curator.io” for this. The provider of this is Sydney, 69 Ruthven Street, Bondi Junction, NSW 2022, Australia (https://curator.io/contact). Data from various social media platforms such as Twitter, Instagram and Facebook are thus selected, and displayed and linked on the website. No data from our website users are communicated to social media platforms. Only media content from third-party websites is visualized on our website in order to offer you an interesting online experience.

You can find more information on data protection at Curator.io here: https://curator.io/privacy-policy.

§ 10 Social media channels

The Arolsen Archives operate various social media channels on the following platforms as part of their public relations work. If you visit these channels, your personal data will be processed.

1. Facebook and Instagram fan pages

Facebook and Instagram are operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA (“Meta”). Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland is responsible for data processing in Europe.

Meta makes comprehensive information available about what personal data is processed by Meta and how. Meta uses information about you, among other things, to create use profiles corresponding to your interests, including by using cookies. Data may be processed by Facebook outside of Europe.

The legal basis for the processing of personal data on fan pages by the Arolsen Archives is Art. 6(1)(1)(f) GDPR. The legitimate interests of the Arolsen Archives lie in effective public relations work and, in this connection, offering information and communications channels for interested parties.

The Arolsen Archives have also concluded a contract with Meta regarding the joint responsibility to operate fan pages. You can object to data processing at any time by sending an e-mail to dataprotection-aroa@arolsen-archives.org. If you want to exercise rights of the data subject, such as your right to information, you can contact Arolsen Archives or Meta directly.

You can find more information about data processing by Facebook at https://www.facebook.com/about/privacy/ and https://www.instagram.com/legal/privacy/.

2. Twitter

Twitter is operated by Twitter Inc., Twitter, Inc. 1355 Market St, Suite 900, San Francisco, CA 94103, USA (“Twitter”). Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland is responsible for data processing in Europe.

Twitter makes comprehensive information available about what personal data is processed by Twitter and how. Twitter uses information about you, among other things, to create use profiles corresponding to your interests, including by using cookies. Data may be processed by Twitter outside of Europe.

The legal basis for the processing of personal data on fan pages by the Arolsen Archives is Art. 6(1)(1)(f) GDPR. The legitimate interests of the Arolsen Archives lie in effective public relations work and, in this connection, offering information and communications channels for interested parties.

You can object to data processing at any time by sending an e-mail to dataprotection-aroa@arolsen-archives.org. If you want to exercise rights of the data subject, such as your right to information, you can contact Arolsen Archives or Twitter directly.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be obtained directly in the data protection declarations of the website of Twitter. There you will also find further information on the data protection rights that correspond to you, and settings options for the protection of your privacy: https://twitter.com/privacy?lang=en.

3. YouTube

YouTube is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (“Google”). Google Ireland Limited, Gordon House 4, Barrow St, Dublin, Ireland is responsible for data processing in Europe.

We would like to indicate that the offered channel and, in particular, the “discussion” function are used under your own responsibility. Furthermore, the Arolsen Archives process personal data when you communicate with the Arolsen Archives via YouTube.

The legal basis for the processing of personal data on fan pages by the Arolsen Archives is Art. 6(1)(1)(f) GDPR. The legitimate interests of the Arolsen Archives lie in effective public relations work and, in this connection, offering information and communications channels for interested parties.

You can object to data processing at any time by sending an e-mail to dataprotection-aroa@arolsen-archives.org. If you want to exercise rights of the data subject, such as your right to information, you can contact Arolsen Archives or Google directly.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be obtained directly in the data protection declarations of the website of Google. There you will also find further information on the data protection rights that correspond to you, and settings options for the protection of your privacy: https://policies.google.com/privacy.

4. LinkedIn

LinkedIn is operated by the LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA, 94085-2810 USA (“LinkedIn”). LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland is responsible for data processing in Europe.

LinkedIn makes comprehensive information available about what personal data is processed by LinkedIn and how. LinkedIn uses information about you, among other things, to create use profiles corresponding to your interests, including by using cookies. Data may be processed by LinkedIn outside of Europe.

The legal basis for the processing of personal data on fan pages by the Arolsen Archives is Art. 6(1)(1)(f) GDPR. The legitimate interests of the Arolsen Archives lie in effective public relations work and, in this connection, offering information and communications channels for interested parties.

The Arolsen Archives have also concluded a contract regarding the joint responsibility to operate the profile. You can object to data processing at any time by sending an e-mail to dataprotection-aroa@arolsen-archives.org. If you want to exercise rights of the data subject, such as your right to information, you can contact Arolsen Archives or LinkedIn directly.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be obtained directly in the data protection declarations of the website of Google. There you will also find further information on the data protection rights that correspond to you, and settings options for the protection of your privacy: https://www.linkedin.com/legal/privacy-policy.

5. Xing

Xing is operated by New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany, (“Xing”).

Xing makes comprehensive information available about what personal data is processed by Xing and how. Xing uses information about you, among other things, to create use profiles corresponding to your interests, including by using cookies.

The legal basis for the processing of personal data on fan pages by the Arolsen Archives is Art. 6(1)(1)(f) GDPR. The legitimate interests of the Arolsen Archives lie in effective public relations work and, in this connection, offering information and communications channels for interested parties.

You can object to data processing at any time by sending an e-mail to dataprotection-aroa@arolsen-archives.org. If you want to exercise rights of the data subject, such as your right to information, you can contact Arolsen Archives or Xing directly.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be obtained directly in the data protection declarations of the website of Xing. There you will also find further information on the data protection rights that correspond to you, and settings options for the protection of your privacy: https://privacy.xing.com/en/privacy-policy.

§ 11 Plugins

To raise public awareness of our institution, on our website we use social plug-ins of the social media sites Facebook, Instagram, WhatsApp, Twitter and YouTube as well as the career networks Xing and LinkedIn. Data protection compliant operation of social plug-ins is the responsibility of the respective provider. In order to offer you the best possible protection, we have integrated the social plug-ins used into our website by means of the two-click method. By clicking twice on the respective plug-in, you agree to the data processing associated with the use of the plug-in and shown below (consent within the meaning of Art. 6 (1)(a) and, if applicable, Art. 49 (1)(a) GDPR).

This also includes any data transfers by the providers into insecure third countries, such as the USA at present. The USA is assessed by the European Court of Justice as a country with an inadequate level of data protection according to EU standards. Due to the lack of an adequacy decision and without appropriate safeguards, there is a particular risk that your data may be processed by U.S. authorities for control and for monitoring purposes, possibly also without any legal remedy.

1. Facebook, Instagram, WhatsApp, Twitter and YouTube

Our website contains social plug-ins of the social media “Facebook” (Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, California 94304, USA), “Instagram” (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), “WhatsApp” (WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), “YouTube” (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and “Twitter” (Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA). It is possible that personal data about the visitors to the website is also collected via these plug-ins, transmitted to the respective service, and linked to the visitor’s respective service. These services are provided by the respective companies (“providers”). As part of our online presence, the social plug-ins are identified by the respective buttons belonging to the service.

We do not collect any personal data via the social plug-ins and their use. To prevent data from being transferred to the third providers in the USA without the user’s knowledge, we have used what is known as the Shariff solution on our website. This means that the respective social plug-ins are initially only incorporated into the website as a graphic. These graphics contain a link to the website of the respective provider of the plug-in. Only when you click on one of the graphics will you be transferred to the respective provider’s service. This solution ensures that personal data is not automatically passed on to the provider of the respective social plug-ins when you visit our website. If you click on one of the graphics for the social plug-ins, data can be transferred to the respective service provider and saved there. If you do not click on any of the graphics, no data transfer takes place between you and the respective provider of the social plugin. More information about the Shariff solution can be found on the following website: https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html

After clicking on a social plug-in, the respective service provider obtains the information that you have visited the corresponding page on our website. Please note that, for this, you neither need a user account with the respective service nor need to be logged in there already. However, if you already have a user account with the respective service provider and are also already logged into this account during the visit to our website, the data collected by the social plug-in is also directly assigned to your account. If you do not want this assignment to your profile with the service provider, you must log out from your user account before clicking on one of the social plug-ins.

Please note that we have no influence over whether and to what extent the respective service providers collect personal data. We have no knowledge of the scope, purpose, or retention periods for the respective data collection. However, we would like to indicate that it must be assumed that at least the IP addresses and device-related information are used and collected via social plug-ins. It is also possible that the respective services use cookies.

The scope and purpose of the data collection by the respective service as well as the further processing and use of your data there can be obtained directly in the data protection declarations of the website of the service in question. There you will also find further information on the data protection rights that correspond to you, and settings options for the protection of your privacy.

a) Facebook: Meta Platforms, Inc., 1601 S California Ave, Palo Alto, California 94304, USA

https://www.facebook.com/policy.php
https://www.facebook.com/help/186325668085084

b) Instagram: Meta Platforms Limited, 4 Grand Canal Square, Dublin 2, Ireland

https://help.instagram.com/519522125107875

c) WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

https://www.whatsapp.com/legal/privacy-policy-eea?lang=en

d) YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

https://policies.google.com/privacy?hl=en

e) Twitter Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA

https://twitter.com/privacy?lang=en

2. XING und LinkedIn

Buttons to the career networks “Xing” and “LinkedIn” are used on our website. When you click on these buttons, a connection is quickly established via your browser with the servers of New Work SE, Dammtorstraße 29-32, 20354 Hamburg (“XING”) and the LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA, 94085-2810 USA (“LinkedIn”), with which the “XING/LinkedIn button” functions are provided.

XING does not save any personal data about you when you access this website. In particular, XING does not save any IP addresses. Your usage behavior is also not evaluated by using cookies in connection with the “XING share button.” You can access the respective current data protection information on the “XING share button” and supplementary information on this website:

https://www.xing.com/app/share?op=data_protection and https://www.xing.com/privacy. If you click on the “Recommend button” from LinkedIn and are logged into your LinkedIn account, it is possible for LinkedIn to assign your visit to our website to you and your user account. We would like to indicate that, as the provider of the website, we have no knowledge of the content of the data transferred, nor do we know how it is used by LinkedIn.

You can access the respective current data protection information on the “LinkedIn Recommend Button” and supplementary information on this website: https://www.linkedin.com/legal/privacy-policy.

§ 12 Hyperlinks

Our website contains so-called hyperlinks to websites of other providers. When you activate these hyperlinks, you will be rerouted directly to the other providers’ website. You can recognize this by the change in URL, among other things. We accept no responsibility for the confidential handling of your data on these third party websites, as we have no influence on whether these companies observe data protection regulations. Please find out about the way in which these companies handle your personal data directly on the websites in question.

§ 13 Data subject rights

In accordance with GDPR as well as the Rules for Data Processing by the Arolsen Archives, as a data subject whose personal data are processed, you have various rights.

1. Archive and documents (together “collections”) of the Arolsen Archives and tracing inquiries, including registrations for on-site visits to the archive

If the processing of your data is subject to the Rules for Data Processing by the Arolsen Archives (data and information saved in the collections of the Arolsen Archives and documents with data, as well as data that are not contained in the collections but are made available to the Arolsen Archives in connection with the collections of the Arolsen Archives by users or other persons, including private and public organizations, (e.g., as part of a tracing inquiry), the following rights arise for you:

  • In accordance with paragraph (27) of the Rules for Data Processing by the Arolsen Archives, you have the right to object to the permanent saving of certain parts or all of the data that you make available in connection with your tracing inquiry, registration for an on-site visit or other request in connection with the collections at any time for legitimate reasons. This does not apply if it concerns personal data of perpetrators within the meaning of paragraph (39) of the Rules for Data Processing by the Arolsen Archives. The Data Protection Committee decides on the objection.

  • In accordance with paragraph (44) of the Rules for Data Processing by the Arolsen Archives, you can request information about the data saved about you (including a copy of the data). The provision of information can also take place by granting access to view the collections and is regularly free of charge. If the provision of information causes particular expense at the Arolsen Archives, a reimbursement of costs can be requested if you were informed about the incurred costs in advance and have nevertheless maintained your request for information.

  • In accordance with paragraph (42) of the Rules for Data Processing by the Arolsen Archives, you can also request at any time information according to paragraph (40) of the Rules for Data Processing by the Arolsen Archives about the purpose, duration and basis of data processing, about the sharing of information with other persons (in particular copyholders), and about further information options.

  • In accordance with paragraph (45) of the Rules for Data Processing by the Arolsen Archives, you have the right to correct incorrect personal data, supplement incomplete personal data, and have your personal data erased. If it concerns personal data of perpetrators within the meaning of paragraph (39) of the Rules for Data Processing by the Arolsen Archives, rectification and/or deletion are not possible. Otherwise, the decision lies with the Data Protection Committee. If the implementation of a corresponding request is not possible or not possible with reasonable effort, the rectification or erasure can be replaced in that the respective data is blocked.

  • In accordance with paragraph (44) of the Rules for Data Processing by the Arolsen Archives, you can contact the Data Protection Committee at any time to ask questions about data protection according to the Rules for Data Processing by the Arolsen Archives, exercise your rights, or if you believe that your rights are infringed during the processing of your personal data (see para. 3).

     

2. Functionalities on the website, data processing to initiate and/or perform a contract

If GDPR or other data protection laws apply to the processing of your data (e.g., within the scope of providing our website including the use of functionalities that are not required for this such as cookies, tracking and analysis tools, and processing to initiate and/or perform a contractual relationship), the following rights arise for you:

  • In accordance with article 15 GDPR you can request information about your personal data processed by us. In particular, you may obtain information about the purposes of processing, the categories of the personal data, the categories of recipients to whom your data have been or will be disclosed, the planned duration of storage, the existence of a right to correction, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if not collected from us, about a transfer to third countries or international organizations and the existence of automated decision-making, including profiling and where applicable, meaningful information about the details involved.
  • In accordance with article 16 GDPR, you can immediately demand the correction of incorrect data or the completion of your personal data stored with us.
  • In accordance with article 17 GDPR, you may request the erasure of your personal data stored with us, provided processing is not necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.
  • In accordance with article 18 GDPR, you may request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful, or if we no longer need the data and you oppose their erasure because you require them for the establishment, exercise or defense of legal claims. The right stemming from article 18 GDPR is also applicable to you if you have objected to the processing in accordance with article 21 GDPR.
  • In accordance with article 20 GDPR, you have the right to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to demand those data be transmitted to another controller.
  • In accordance with article 7 paragraph 3 GDPR, you have the right to withdraw the consent you have given us at any time. As a result of this, we may no longer continue with the data processing based on this consent in the future.
  • In accordance with article 77 GDPR, you have the right to lodge a complaint with a supervisory authority. To do so, generally speaking you may contact a supervisory authority of your habitual residence, place of work or the registered address of our company.

§ 14 Right to object

In instances of processing of your personal data based on legitimate interests in accordance with article 6 (1)(1)(f) GDPR and on the basis of the Rules for Data Processing by the Arolsen Archives, you have the right, pursuant to article 21 GDPR or according to paragraph (27) of the Rules for Data Processing by the Arolsen Archives, to object to the processing of your personal data on (legitimate) grounds relating to your particular situation or where the objection is against direct marketing. In the case of direct marketing, you have a general right to object, which will be implemented by us without your indicating a particular situation. Please address your objection to: dataprotection-aroa@arolsen-archives.org

§ 15 Data security and security measures

We undertake to protect your privacy and treat your personal data confidentially. To prevent manipulation, loss or misuse of your data stored with us, we take comprehensive technical and organizational security precautions, which are regularly checked and adjusted to technological advances. Among others, these include the use of accepted encryption procedures (SSL). However, we would like to point out that due to the structure of the Internet, it is possible that the rules of data protection and the aforementioned security measures may not be observed by other persons or institutions for which we are not responsible. In particular, data which are divulged in unencrypted form – e.g. when this takes place by e-mail – can be read by third parties. We have no technical influence over this. It is the responsibility of the user to protect the data provided by him or her against misuse with encryption or in any other way.

Support us
Learn more