The Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH attaches great importance to responsible and transparent management of personal data.
Below we provide users with information as to
- who they can contact at GIZ on the subject of data protection
- what data is processed when they visit the website
- what data is processed when users contact us, subscribe to newsletters or press releases or use other GIZ online services
- how they can opt out of the storage of data
- what rights they have with respect to us
1. Data controller and data protection officer
Data processing is the responsibility of Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH.
Address:
Friedrich-Ebert-Allee 32 + 36, 53113 Bonn, Germany
Dag-Hammarskjöld-Weg 1–5, 65760 Eschborn, Germany
Contact: info [at] globalndcconference.org
Please contact GIZ’s data protection officer if you have questions specifically about how your data are protected: datenschutzbeauftragter [at] giz.de
2. Information on the collection of personal data
2.1 General
GIZ processes personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Personal data are, for example, name, address, email addresses and user behaviour.
GIZ only processes personal data to the extent necessary. Which data is required and processed for which purpose and on what basis is largely determined by the type of service you use or the purpose for which the data is required.
2.2 Collection of personal data when visiting our website
When visiting the NDC Conference website, the browser used automatically transmits data that is saved in a log file. GIZ itself processes only the data that is technically required in order to display the website correctly and to ensure its stability and security.
Each time the website is accessed, the data stored includes, but is not limited to, the page that is viewed, the anonymized IP address of the accessing device, the page from which the user was
redirected, as well as the date and time of access.
Please note that all IP addresses in these logs are anonymized for data protection reasons. The last part of the IP address was replaced by a random value. A detailed list of the data stored is shown below.
Log file fields
| Field | Displayed as | Description |
|---|---|---|
| Date | date | The date on which the activity occurred. |
| Time | time | The time, in coordinated universal time (UTC), at which the activity occurred. |
| URI Stem | cs-uri-stem | The target of the action, for example, Default.htm. |
| URI query | cs-uri-query | The query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages. |
| Server port | s-port | The server port number that is configured for the service. |
| Client IP address | c-ip | The anonymized IP address of the client that made the request. |
| User agent | cs(User-Agent) | The browser type that the client used. |
| Referrer | cs(Referrer) | The site that the user last visited. This site provided a link to the current site. |
| HTTP status | sc-status | The HTTP status code. |
| Protocol substatus | sc-substatus | The substatus error code. |
| Win32 status | sc-win32-status | The Windows status code. |
| Time taken | time-taken | The length of time that the action took, in milliseconds. |
The data in the log file is deleted after five days.
Further information on data storage and transfer
GIZ is obliged to store the data beyond the time of the visit in order to ensure protection against attacks against GIZ’s internet infrastructure and federal communications technology (legal basis: Article 6 (1) e GDPR in conjunction with Section 5 of the German Act on the Federal Office for Information Security (BSIG). In the event of attacks on communications technology, this data is analysed and used to initiate legal and criminal action. Data that is logged when accessing the GIZ website is only transferred to third parties if there is a legal obligation to do so or if the transfer is necessary for legal or criminal prosecution in the event of attacks on federal communications technology. Data will not be passed on in any other cases. This data is not merged with other data sources at GIZ.
2.3 Cookies
When you visit the Global NDC Conference website, no cookies are stored in your computer, beyond the strictly necessary cookies (e.g., for ensuring the technically correct operation of the website).
2.4 Matomo analysis service (user analysis)
For statistical purposes, to measure the reach of our website and to improve our service, this website uses the tracker technology operated by Matomo. Data is stored and evaluated completely anonymously. Furthermore, we have set Matomo so that no cookies are set on the user’s end device.
Every time you visit a page on the Global NDC Conference website and every time you download a file, information about the activity is processed and stored in a temporary log file. Before it is stored, each data set is rendered anonymous by altering the IP address. The last part of the IP address of the user is automatically replaced by a random value, so that it is no longer possible to draw conclusions about individual persons. Among other things, the approximate geographical location, terminal device, screen resolution, browser and visited pages including the duration of stay are evaluated.
The data generated with Matomo is stored by Talleux & Zöllner on behalf of GIZ in Germany only.
Further information on data protection at Matomo can be found here Privacy Policy – Analytics Platform – Matomo.
3. Processing of personal data when contacting us
When users contact us on the above-mentioned addresses in (1), the data provided is processed in order to be able to respond to the enquiry. The following contact options are available:
- Letter
3.1 Contact by email
Alternatively, it is possible to contact us via the email addresses provided (info [at] globalndcconference.org). In this case, at least the email address but also any other personal user data transmitted with the email (e.g. family and given name, address) as well as the information contained in the email are stored solely for the purpose of contacting the user and processing the request.
The legal basis for the processing of data in connection with email communication is Article 6 (1) e GDPR.
3.2 Contact by letter
When contacting us by letter, the personal data transmitted (e.g. family and given name, address) and the information contained in the letter is stored for the purpose of establishing contact and processing the enquiry.
The legal basis for the processing of data in connection with communication by letter is Article 6 (1) e GDPR.
4. Processing of personal data for the registration form
4.1 Registration form
Selected persons will receive a link for the registration form, where personal data is collected for the purpose of doing the registrations for the conference. The registration form will include information on (family and given name, gender, position, organisation, country, e-mail address, phone number and food preferences).
The legal basis for the processing of data in connection the registration is Article 6 (1) e GDPR.
4.2 Travel form for optional flight and hotel bookings
For sponsored participants, a travel form will be sent out individually as an optional service. The travel form will collect data on passport details, addresses, family and given name and meal preferences, to be shared with the partners NDC Partnership and the United Nations Development Programme (UNDP) for booking hotels and flights.
The travel form will include information on (family and given name, date of birth, place of birth, nationality, gender, passport number, passport type, passport issuing date, passport expiration date, and if participants require a Schengen visa), which will be used for booking transportation and accommodation. For the participants requiring a visa letter, the collected data (family and given name, date of birth, nationality, passport information, information on requiring a Schengen visa) will be used to issue an official invitation.
The NDC Partnership, which is also part of the Global NDC Conference organising team will be responsible within the conference to make the hotel bookings for sponsored participants. Therefore, the NDC Partnership will receive personal data on: family and given name, date of birth, nationality, date of arrival and date of departure.
The partner UNDP will be responsible for booking the flights for sponsored participants. Therefore, the following data will be transferred: family and given name, date of birth, nationality, and passport information.
The legal basis for the processing of data in connection the travel form is your prior consent according to Article 6 (1) a GDPR.
Consent to the transfer of personal data to a non-secure third country in accordance with Art. 49 para. 1 a) GDPR
For the country to which the data are transmitted, there is currently neither an adequacy decision within the meaning of Art. 45 para. 1, 3 GDPR, nor suitable guarantees pursuant to Art. 46 para. 2, 3 GDPR. This means that the EU Commission has not yet positively determined that the country-specific level of data protection of the country corresponds to the data protection level of the European Union. Likewise, for the transfer to the third country or to the international organisation(s), there are no so-called standard contractual clauses as “appropriate guarantees” according to Art. 46 para. 2, 3 GDPR.
Possible risks that cannot currently be ruled out in connection with the aforementioned transmission are in particular:
- You may not be able to assert or enforce your rights as a data subject against the data recipient in a sustained manner.
- It cannot be completely ruled out that incorrect data processing may occur, as the technical and organisational measures of the data recipient for the protection of personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.
- In particular, as the data recipient is located in the USA, there is a risk that the state (US) authorities will address requests for information against this company as the data recipient and thus the state (US) authorities may see your personal data. In principle, this also corresponds to European legal regulations, for example for the purpose of averting danger. However, the admissibility threshold for such data processing is higher in the EU than in the country concerned of the data recipient. In this context, possible legal protection for Europeans would also be practically impossible.
- Your personal data could possibly be passed on to other third parties by the data recipient beyond the actual purpose of fulfilling the order.
Revocation of consent
You have the right to revoke this consent at any time without giving a reason with effect for the future. All you need to do is send an e-mail to info [at] globalndcconference.org. The legality of the processing carried out on the basis of the consent until the revocation is not affected by the revocation.
Consequences of no-consent
The described service in “4.2 Travel Form” is an optional and voluntarily service offer for sponsored participants. You can still register and participate in our event without consenting to the data transfer to our partners NDC Partnership, United Nations Framework Convention on Climate Change (UNFCCC) and the United Nations Development Programme (UNDP) for the purpose of booking hotels and flights. However, in this case you do not consent to the data processing for the described service you cannot use the optional service we described above under “4.2 Travel Form”.
5. Disclosure to third parties
GIZ will only pass on your data to GIZ partners mentioned under “4.2 Travel form for optional flight and hotel bookings” if you previously consented to the data transfer. Otherwise GIZ does not pass on personal data to third parties unless it is otherwise legally obliged or entitled to do so by law.
6. Transfer of data to countries outside Germany
GIZ does not transfer personal data to third countries without your prior consent. In case you consented to the data transfer to GIZ partners mentioned under “4.2 Travel form for optional flight and hotel bookings”, your data will be transfers to countries outside Germany.
With your prior consent that the Global NDC Conference will take care as a sponsored participant for your flight, the personal data stated under 4.2 will be transferred to the United States. From there, UNDP takes full responsibility to protect your personal data, store it properly and delete it after the Global NDC Conference.
7. Duration of data retention
User data will not be kept any longer than is necessary for the purpose for which it is processed or as required by law.
8. IT security of user data
GIZ accords great importance to protecting personal data. For this reason, technical and organisational security measures ensure that data is protected against accidental and intentional manipulation and unintended erasure as well as unauthorised access. These measures are updated accordingly based on technical developments and adapted continuously in line with the risks.
9. Reference to user rights
Visitors to the Global NDC Conference website have the right
- To obtain information about their data stored by us (Article 15 GDPR)
- To have their data stored by us rectified (Article 16 GDPR)
- To have their data stored by us erased (Article 17 GDPR)
- To obtain restriction of processing of their data stored by us (Article 18 GDPR)
- To object to the storage of their data if personal data are processed on the basis of the first sentence of Article 6 (1) 1 f and e GDPR (Article 21 GDPR)
- To receive their personal data in a commonly used and machine-readable format from the controller such that they can be potentially transmitted to another controller (right to data portability, Article 20 GDPR)
- To withdraw their consent to the extent that the data has been processed on the basis of consent (Article 6 (1) a GDPR). The lawfulness of the processing on the basis of the consent given remains unaffected until receipt of the withdrawal.
Users also have the right in accordance with Article 77 GDPR to lodge a complaint with the competent data protection supervisory authority. The competent authority is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
Last updated: 13.03.2023