Information on Data Protection PubData

2. Create an account
If you wish to submit datasets and metadata to our database or receive restricted content, you need a user account for identification and allocation, as the database in certain parts can only be made accessible to a specified and identified user group to protect the data it contains. Furthermore, identification of the contracting party is required in order to be able to provide you with legally protected datasets.

To create an account, we store your contact details (surname, first name, email address, official address, academic institution) for the conclusion and implementation of archiving and/or publication agreements. In case of changes of your contact details during the contract period, we will also store these for the duration of the contractual relationship. Leuphana account owners can also login to PubData using this account. In this case, we use the contact data you have provided to Accounting (surname, first name, Leuphana email address, official address, assigned Leuphana institution) to conclude and implement the necessary archiving and/or publication agreements.

This data processing is necessary to carry out pre-contractual measures based on your request and to subsequently fulfil the contract concluded between you and us. The legal basis for this processing is Art. 6 para. 1 p. 1 letter b) GDPR.

3. Submitting research datasets
If you submit a research dataset for archiving or publication, its documentation and assignment to a person are required. A submission can therefore only be made after a user account has been created for allocation. We process the following additional data categories upon submission:

• Title of the dataset and data collection
• Name, first name of the submitting responsible person, role in the project, ORCID-ID
• Kinds of data / resource type
• Language

We process the following optional dataset information if provided:

• Formal information on the dataset (e.g. project title, temporal coverage of the project, funding information, etc.).
• Content-related methodological descriptions of the dataset (e.g. dataset description, survey method, research design, geographical information, time period, etc.).
• Persons involved (first name, last name, ORCID-ID, institution, role, etc.) and institutions

After submission, we check your dataset for compliance with our PubData Collection Policy Research Data and, if necessary, supplement your submitted metadata in such a way that the findability of the datasets is guaranteed in accordance with good scientific practice.

The legal basis for this processing is Art. 6 para. 1 sentence 1 letter b) GDPR.

Insofar as you have submitted research datasets and these are sufficiently described and legally, technically and formally suitable for inclusion in PubData, we will publish the metadata specified above for the dataset submitted on our website.

The legal basis for this processing is Section 3 S. 1 No. 1 NDSG, Art. 6 para. 1 S. 1 letter e), para. 2 and 3 GDPR iVm. Section 3 para. 1 S. 1 No. 1 Niedersächsisches Hochschulgesetz (NHG) i.V.m.. Section 3 para. 1 s. 2 of the “Richtlinie der Leuphana Universität Lüneburg zur Sicherung guter wissenschaftlicher Praxis und zum Verfahren zum Umgang mit wissenschaftlichem Fehlverhalten“.

Please note that you must be able to prove that you have an appropriate legal basis for the publication of submitted personal (meta) data of the researchers involved in the research project. Data without a suitable legal basis may be rejected by us.

In the course of the publication of the metadata, the aforementioned metadata will also be delivered to the provider DataCite - International Data Citation Initiative e.V., Welfengarten 1 B, 30167 Hannover, Germany, for the purpose of the registration of the data. In addition, the metadata are specifically disseminated to selected scientific search engine networks, reference systems and metacatalogues for the purpose of increased visibility and findability via metadata interfaces including the metadata publication. The processing is carried out under the data protection responsibility of the respective providers. A list of the platforms and systems concerned is available on request.

The legal basis for this contractual disclosure is also Art. 6 para. 1 s. 1 letter b) GDPR.

4. Archiving
Datasets that you have transferred to us after the conclusion of the archiving agreement are stored in accordance with our official Leuphana Archiving Directive for Research Data (“Leuphana Archivierungsrichtlinie Forschungsdaten") together with the assigned metadata under linkage to your user account for preservation. The archiving infrastructure is primarily used for the digital archiving of research results to enable reproducibility of research results. Data transfer is carried out with transport encryption, data storage with the integration of fully comprehensive directory and file protection.

For files requiring protection (especially datasets with personal data), additional encryption procedures are used. The MIZ uses a standardized procedure for encryption including the separate, secure storage and administration of the corresponding key.

Access to Leuphana's digital archiving and storage system is only granted in direct access to MIZ staff explicitly entrusted with digital archiving. Therefore, the archive is protected from unauthorized access from outside. Any other access and, if necessary, the decryption of certain data only takes place in exceptional cases, and only after examination by the MIZ, with existing legal permission and authorization by the respective submitters. Data is stored in accordance with the Guidelines for Safeguarding Good Scientific Practice that means for 10 years from the date of submission. Longer preservation must be agreed and determined separately. The processing is necessary to fulfil our contractual obligations under the archiving agreement. The legal basis for this processing is Art. 6 para. 1 s. 1 letter b) GDPR.

5. Publication
If commissioned and in accordance with our PubData Collection Policy Research Data, we publish datasets submitted by you. This means that the data cannot only be viewed by a limited group of users after registration and verification but can be publicly accessed on the internet by anyone. Due to the purpose limitation under data protection law, this is not possible if your dataset contains personal data. Access to such datasets is only granted to third parties via a data request (clause 6.).

The legal basis for this processing is Art. 6 para. 1 s. 1 letter b) GDPR.

6. Data request
If you grant access protection or if it is legally necessary, datasets can only be released to requesting users after a check. This is particularly the case if the datasets contain personal data of data subjects of the requested dataset, as they are subject to purpose limitation under data protection law. You can apply the request to grant access to such protected datasets via a created user account. In order to check the legitimate purpose and the compatibility with the legal basis underlying the dataset, we process not only your e-mail address and your user data but also the information on the purpose of your request. When granting a data release, we store the information together with the time of the releases in order to be able to track data recipients and to be able to fulfil our obligations to provide information. This data processing is necessary to meet our obligations towards the data providers and the data subjects and to ensure a level of protection appropriate to the risk.

The legal basis for this processing is Section 3 s. 1 no. 1 NDSG, Art. 6 para. 1 s. 1 letter c) GDPR in conjunction with Art. 32 para. 1 GDPR and Art. 12 para. 3 s. 1 GDPR.

General information:
If we did not receive your data directly from you, it was transmitted to us by Leuphana Accounting.
Even if you do not exercise your rights below, the data associated with research datasets will be stored by us for a period of 10 years in accordance with the Guidelines for Safeguarding Good Scientific Practice and otherwise only for as long as is necessary for the above purposes. This does not apply if, in derogation thereof, a longer storage or preservation period is required by law or is necessary for legal enforcement within the statutory limitation periods. If data is only retained for the aforementioned purposes, data access is limited to the extent necessary for this purpose.

As a matter of principle, we keep your data to ourselves and only make it available to those employees who need it for their work within the scope of fulfilling their tasks. This does not apply if we are legally obliged to disclose it or if we publish data for an undefined group of persons by way of contract performance.

We would like to inform you that the provision of your data is necessary for the conclusion and performance of the publication and/or archiving contract. If you do not provide your data, you will be prevented from fulfilling the contract, which may result in further legal and contractual claims, or the contract cannot be concluded.

For the sake of completeness, we would like to inform you that further consequences under civil law may arise from a contractual relationship that has been concluded but cannot be implemented.

Automated decision-making including profiling within the meaning of Art. 22 para. 1 and 4 GDPR does not take place.

Your right to object according to Art. 21 GDPR:
With regard to the publication of metadata (see point 3), you have the right to object to the processing of personal data concerning you at any time on grounds relating to your particular situation.

In this case, we will no longer process this data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Your other rights:
You have the right to request information from us about the processing of data concerning you. In addition to a copy of the data, this right to information also includes the purposes of the data processing, the data recipients and the storage period.

If incorrect data is processed, you can demand that we correct this data without delay. If the legal requirements according to Art. 17 or 18 GDPR are met, you also have the right to immediate deletion or restriction of the processing of the data. Please note that restricted processing of the data may not be possible.

Furthermore, you can make use of your right to data portability under the conditions of Art. 20 GDPR.

To exercise your above rights, please contact:

Leuphana Universität Lüneburg
Martin Bilz
Universitätsallee 1
21335 Lüneburg
E-Mail: martin.bilz@leuphana.de

If you have any further questions, our data protection officer will be happy to advise you.

If you have a data protection complaint, please contact the data protection authority of your choice. Directly responsible for Leuphana University of Lüneburg:

Die Landesbeauftragte für den
Datenschutz Niedersachen
Prinzenstraße 5
30159 Hannover

E-Mail: poststelle@lfd.niedersachsen.de

Only the German version of this privacy notice shall be legally binding. The English translation serves information purposes only.

The Leuphana guidelines, policies and agreements referenced in this document can be found at the PubData Guidelines Overview for Research Data.

2. Create an account
If you submit publications to Leuphana’s repository (PubData), you need a user account for identification and allocation to your publication.

To create an account, we store your contact details (surname, first name, email address, institutional address, academic institution) for the purpose of concluding and executing the publication agreement. If you notify us of changes to your contact details during the term of the contract, we will also store these for the duration of the contractual relationship. If you have a Leuphana account, you can also use it to log in to PubData. In this case, we will use your contact details (surname, first name, Leuphana email address, institutional address, affiliated unit at Leuphana) stored with the accounting department to conclude and execute the necessary publication agreement.

This data processing is necessary to carry out pre-contractual measures based on your enquiry and to subsequently fulfil the contract concluded between you and us. The legal basis for this processing is Art. 6 para. 1 sentence 1 letter b) GDPR.

3. Submitting publications
If you submit a publication for publishing, it is necessary that this publication can be documented and assigned to a person. A submission can therefore only be made after a user account has been created for allocation. We process the following additional data categories upon submission:

• Title of the submitted publication (so-called resource)
• Surname, first name of the submitting and responsible person
• Information on the type and context of the publication (e.g. context of creation, description, resource type)
• Depending on the selected resource type: patent number, trademark registration number, design number
• Language

If provided, we process the following optional information about the publication:

• Formal publication details (e.g. project title, funding information)
• Content and contextual descriptions of the publication (e.g. subject classification, location, time period, degree programme, institute and event details)
• Persons involved (surname, first name, ORCID-iD, GND, institution) and institutions (name, ROR, affiliation) and, if applicable depending on the selected resource type, editor information (surname, first name, ORCID iD, GND, institution).

After submission, we check your submitted publication for compliance with our “PubData Collection-Policy Publications” and, if necessary, we will complete or adjust your submitted metadata in such a way that the findability of the publications is guaranteed in accordance with good scientific practice.

The legal basis for this processing is Art. 6 para. 1 sentence 1 letter b) GDPR.

If you have submitted publications and these are sufficiently described and legally, technically and formally suitable for inclusion in PubData, we will publish the metadata specified above for the submitted publication on our website. The legal basis for the publication of the metadata is Section 3 sentence 1 no. 1 of the NDSG, Art. 6 para. 1 sentence 1 letter e), para. 2 and 3 GDPR in conjunction with Section 3 para. 1 sentence 1 no. 1 NDSG. § Section 3 (1) sentence 1 no. 1 NHG in conjunction with Section 4 (1) and Section 5 (1) of Leuphana University of Lüneburg “Richtlinie der Leuphana Universität Lüneburg zur Sicherung guter wissenschaftlicher Praxis und zum Verfahren zum Umgang mit wissenschaftlichem Fehlverhalten“.

Please note that you must be able to provide evidence of a valid legal basis for the publication of personal (meta)data on the individuals involved in the creation and use of the resource that you submit to us. Data without proof of a valid legal basis may be rejected by us.

In the process of publishing the metadata, the aforementioned metadata will also be deposited with the provider DataCite - International Data Citation Initiative e.V., Welfengarten 1 B, 30167 Hannover for the purpose of registration there. In addition, the metadata is transmitted and published via metadata interfaces to selected scientific search engine networks, discovery systems and meta catalogues for the purpose of better visibility and findability. The processing is carried out under the respective providers' own responsibility under data protection law. You can obtain a corresponding list of the platforms and systems concerned on request. In addition, the Leuphana Media and Information Centre undertakes the legally prescribed mandatory delivery of the work to the German National Library, Bundesunmittelbare Anstalt des Öffentlichen Rechts, Adickesallee 1, 60322 Frankfurt am Main.

The legal basis for this contractual transfer is Art. 6 para. 1 sentence 1 letter b) GDPR.

4. Publication
If commissioned and in accordance with our “PubData Collection-Policy Publications”, we publish the publications submitted by you along with your personal data. This means that this data, together with the publication, is publicly accessible to everyone on the Internet.

• a) Dissertations and Habilitations
  
  If you submit your dissertation or habilitation thesis for publication in accordance with the respective valid doctoral or habilitation regulations of Leuphana University Lüneburg, your name and identification data (date of birth, place of birth) as well as information on faculty affiliation will be published together with the date of submission and the date of the defence. These data are required to fulfil the publication obligations in accordance with the applicable regulations and thus to fulfil the publication agreement concluded with you for dissertations and habilitation theses.
  
  In addition, the metadata described in section 3 will be linked to the publication and made publicly accessible.


• b) Student publications: Examination and Qualification Theses
  
  If you as a student submit a publication to Leuphana’s repository (PubData), we will use your degree programme and information on the grade range and scientific relevance of your publication along with information on the reviewer or lecturer to check and document the suitability of your publication for publishing in PubData. We use your name, identification and contact details (postal address, private e-mail address) to attribute your publication and to communicate with you during the publication process. In addition, the metadata described in section 3 will be linked to the publication and made publicly accessible.

This data processing is necessary for the implementation of pre-contractual measures resulting from your request to submit your publication and for the subsequent fulfilment of the contract concluded between you and us. The legal basis for this processing is Art. 6 para. 1 sentence 1 letter b) GDPR.

5. Documentation of scientific relevance for student publications
If you provide information on a student paper as a reviewer or lecturer, we will use your name and function together with your information in the "publication recommendation for a student publication" for the purpose of assessing and documenting the scientific relevance of the student publications to be published in Leuphana’s repository (PubData). Your information will be stored separately from the publication for internal verification purposes, but not made public. The processing is carried out to fulfil the public interest task of promoting early-career researchers and artists. This data processing is necessary for the fulfilment of this task. The legal basis for this processing is Section 3 sentence 1 no. 1 NDSG, Art. 6 para. 1 sentence 1 letter e, para. 2 and 3 GDPR in conjunction with Section 3 para. 1 sentence 1 NDSG. § Section 3 para. 1 sentence 1 no. 3 NHG.

General information:
If we have not received your data directly from you, it was transmitted to us by the Accounting Department of Leuphana University. In the case described in section 5, the data was provided to us by the submitting person.

Even if you do not make use of your rights outlined below, the data associated with the publications will be stored by us for the duration of the publication agreement concluded and subsequently for up to 10 years after its termination. The data will be archived after the end of the publication. In order to protect against data loss, we also store the publications that you have submitted to us under the "PubData Publication Agreement for Publications" along with the associated metadata linked to your user account for at least ten years in accordance with good scientific practice. Otherwise, we will retain your data only as long as necessary to fulfil the purposes stated above.

This does not apply if a longer storage or retention period is required by law or is necessary for legal enforcement within the statutory limitation periods. If data is retained solely for the aforementioned purposes, access to the data is restricted to the extent necessary.

We generally keep your data confidential and make it accessible only to employees who need it for their work as part of the fulfilment of their duties. This does not apply if we are legally obliged to disclose the data or if we publish data for an undefined group of people in the context of contract fulfilment.

Please note that providing your data is necessary for the conclusion and fulfilment of the publication agreement. If you do not provide your data, this will prevent the fulfilment of the contract, which may result in further legal and contractual claims, or it may prevent the contract from being concluded.

For the purpose of completeness, we would like to inform you that a contract that has been concluded but cannot be executed may lead to further civil law consequences.

Automated decision-making including profiling within the meaning of Art. 22 (1) and (4) GDPR does not take place.

Your right to object according to Art. 21 GDPR:
With regard to the provision of the platform (see section 1.), the publication of metadata (see section 3.) and your involvement as a reviewer or lecturer (see section 5.), you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

In this case, we will no longer process this data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Your further rights:
You have the right to request information from us about the processing of data concerning you. This right of access includes a copy of the data as well as details about the purposes of processing, the recipients of the data, and the storage period.

If incorrect data is processed, you can demand that we correct this data immediately. Provided the legal requirements under Articles 17 or 18 GDPR are met, you also have the right to request the erasure of your data or the restriction of its processing. Please note that it may not be possible to restrict the processing of data.

Furthermore, under the conditions of Article 20 GDPR, you have the right to data portability.

To exercise your above-mentioned rights, please contact:

Leuphana Universität Lüneburg
Martin Bilz
Universitätsallee 1
21335 Lüneburg
E-Mail: martin.bilz@leuphana.de

If you have any further questions, our data protection officer will be pleased to assist you.

If you have any data protection complaints, please contact a data protection authority of your choice. The authority directly responsible for Leuphana University of Lüneburg is:

Die Landesbeauftragte für den
Datenschutz Niedersachen
Prinzenstraße 5
30159 Hannover

E-Mail: poststelle@lfd.niedersachsen.de


The regulations, policies, forms and legal agreements referenced in the document can be found on the PubData guidelines page for publications.