Data protection and privacy information for Charité Facebook and Instagram channels

Charité relies on the technical platforms and services of Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland (“Meta” or “Facebook/Instagram”) for the information services offered. This text was prepared by Charité to provide you with information in accordance with Article 13 of the EU General Data Protection Regulation (GDPR) on the nature of processing of your personal data and the background for this processing via the fan page and Instagram channel and on your rights in this regard.

The controller responsible for the processing of your personal data as defined in Article 4(7) GDPR is:

Charité – Universitätsmedizin Berlin, represented by Prof. Heyo K. Kroemer, Chief Executive Officer of Charité,
Charitéplatz 1, 10117 Berlin, Germany
Tel.: +49 (0) 30 450 50 (also referred to in this text as “we” or “us”).

In addition, Meta is a joint controller together with Charité for certain data processing when you visit the fan page/Instagram channel. The latter pertains to processing of data within the scope of the “Page Insights” functions, which are described below.

In this regard, Charité has entered into an agreement with Meta in accordance with Article 26 GDPR regarding these two entities’ status as joint controllers. This agreement stipulates, among other things, that Meta is required to fulfill your rights as a data subject within the scope of this data processing. You can access the full content of the agreement here.

You can reach our data protection officer by e-mail at datenschutzbeauftragte(at)charite.de or by postal mail at the above address, adding “An die Datenschutzbeauftragte” (“Attn.: Data Protection Officer").

When you visit the fan page/Instagram channel, Meta collects information within the scope of the Page Insights function, including your IP address and further information, which is stored on your computer in the form of cookies (text files stored in or by your Internet browser).

Meta also stores other information, such as information on its users’ devices (e.g., within the scope of the “login alert” function); Meta may be able to associate IP addresses with individual users in this case.

If you also like the Charité fan page by clicking the “Like” button or follow our Instagram channel, this information is processed as well.

This information may be used to identify you and track your user behavior on the Internet. Meta processes this information for various reasons, including to prepare page statistics regarding the Charité fan page/Instagram channel. It provides insight into visitor groups and visitor activities on the fan page/Instagram channel, such as the total number of page impressions, the reach of individual posts, and the average age of visitors. Meta provides these page statistics to Charité in anonymized form as the operator of the fan page/Instagram channel, regardless of whether Charité orders them or actually uses them. Meta provides further information on this via the following links as well as on other pages: http://de-de.facebook.com/help/pages/insights and https://www.facebook.com/help/instagram/788388387972460/?helpref=uf_share.

Charité and Meta are jointly the controllers responsible for this processing of personal data. The legal basis for this data processing with regard to Charité is point (f) of Article 6(1) GDPR. The particular interest in processing pursued by Charité consists in enhancing the visibility of the fan page/Instagram channel for the benefit of targeted and balanced public relations work.

According to information provided by Meta, Meta stores these data until they are no longer needed to provide its services and Meta products or until the relevant account of the user is deleted, whichever occurs first. This depends on the circumstances of the individual case, particularly the nature of the data, why they are collected and processed, and the relevant legal or operational storage and retention requirements. Further information on the storage of your data can be found at the following sites as well as in other places: https://de-de.facebook.com/about/privacy and https://privacycenter.instagram.com/policy.

Charité is not certain whether it has a comprehensive overview of the data that Meta processes when people visit fan pages/Instagram channels. The same applies to the period for which Meta stores your data. Furthermore, there is uncertainty regarding the extent to which Meta uses the data collected to link this information with your Facebook and/or Instagram account(s) or other profiles.

The data collected regarding you in this context are processed by Meta and may be transferred to countries outside the European Economic Area (EEA) in the course of these activities. According to information provided by Meta, Meta uses what are known as the EU standard contractual clauses (accessible at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN) when transferring data to countries outside the EEA and, where necessary, takes additional measures to ensure that the level of data protection is equivalent to that found within the EEA.

In cases in which Meta transfers personal data to recipients based in the United States, it cannot be guaranteed, in light of the decisions rendered by the Court of Justice of the European Union (CJEU), that this data processing is subject to the same level of protection as applies within the EEA. In this regard, there is a certain risk that you might have difficulty enforcing your rights with respect to the personal data concerning you. Moreover, there is no data protection supervision in the United States that is comparable to that which exists in the EEA. Furthermore, there is a risk of disproportionate access to your data by government security agencies, and there is generally no effective legal protection available against this. Please take note of these points.

Meta describes which information it processes in its data use guidelines. You can also consult these guidelines for information on ways to contact Meta. The data use guidelines are available at http://de-de.facebook.com/about/privacy and https://privacycenter.instagram.com/policy.

If you comment on, share, or otherwise respond to a post on the fan page/Instagram channel, Charité processes further personal data. These include but are not limited to your username, the content of the comments you submit, the metadata concerning these (particularly the time at which you posted the relevant comment), and the information that you have shared the post in your timeline. The legal basis in this regard is point (f) of Article 6(1) GDPR. Charité processes these data for the purpose of being able to assess and, where applicable, improve the effectiveness of its posts based on your activity, for the benefit of functional public relations work.

We use the Facelift tool from processor Facelift brandbuilding technologies GmbH, Gerhofstr. 19, 20354 Hamburg, Germany, to be able to manage our social media channels more easily. You can find the Facelift data privacy policy here: https://facelift-bbt.com/en/data-protection.

Facelift serves primarily to make it easier to manage all the social media channels we maintain. If a user uses the comments function on our social media page to ask a question specified in further detail in Facelift, then the text and the user’s username flow into the tool together and are displayed to us. The text that has been transmitted and the username are deleted once the inquiry has been answered.

The legal basis for the data processing is point (f) of Article 6(1) GDPR. We use Facelift because we have a legitimate interest in managing the content on our Twitter profile in a way that saves both time and costs but is equally effective, which includes collecting and responding to comments by visitors to our profile. In this regard, it is also in the interest of visitors for their comments to be acknowledged centrally and promptly and – depending on the content – recognized or answered by Charité. This gives us a better overview of user comments, which facilitates communication with the users of our social media presence.

Charité uses Talkwalker for the purposes of brand monitoring on our social media websites and to optimize our campaigns. The brand monitoring encompasses monitoring, collection, and analysis of mentions, statements, and perceptions relating to Charité on the various social media websites. Primary goals here include monitoring the reputation and acceptance of Charité in the public and among consumers and assessing these factors on a targeted basis in terms of demographics.

This Web analytics service is provided by Talkwalker Sàrl, 12-16 Avenue Monterey, 2163 Luxembourg, Luxembourg. The service includes extensive data analysis and provision of all information and opinions mentioned regarding Charité on social media platforms, a search engine option for brand and trend checks and for comparison with competitors, and tracking of campaigns placed by Charité.

We process your personal data on the basis of our legitimate interest pursuant to point (f) of Article 6(1) GDPR. Our interest consists in keeping abreast of what is being published and said about Charité and having this information in order to be able to respond to issues such as fake news or security problems. The data collected in this context are deleted after this purpose ceases to apply and after we stop using Talkwalker.

Where personal data concerning you are processed, you have, pursuant to the GDPR, the rights of access to and rectification or erasure of personal data, the right to data portability, and the right to restriction of processing.

If Charité processes your personal data to safeguard legitimate interests of its own, you can object to the processing thereof. The cases in which Charité bases its processing of data on this are set out in this data protection and privacy policy.

Where Charité is the sole controller responsible for the processing of your data, you can assert your right to object and your other rights as a data subject by contacting Charité or the Charité data protection officer (which you can do by e‑mail, among other methods; see the contact details provided above). In cases in which Charité and Meta are jointly the controllers responsible for the processing of your personal data, you can also contact Meta to assert your rights as a data subject. Pursuant to Charité’s agreement with Meta in accordance with Article 26 GDPR, Meta assumes all obligations in the event that you assert your rights as a data subject with regard to the processing of the personal data for which Charité and Meta are jointly responsible as controllers (accessible at https://www.facebook.com/legal/terms/page_controller_addendum, for example). Therefore, Charité kindly asks that you contact Meta in this regard. Of course, you can also assert your rights toward Charité. If you do so, Charité will forward your inquiries concerning data processing to Meta.

If you are exercising your right to object, please specify the reasons that your personal data should not be processed. In case of a justified objection, the facts of the matter will be reviewed and the data processing will either be discontinued or adjusted to fit the circumstances, or you will be informed of the compelling legitimate grounds on which the processing is being continued.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.