Privacy Policy

Thank you for visiting our website and for your interest in our services. Below we would like to inform you about the purposes for which your data is collected and used and how you can exercise your rights. You can access and print out this Privacy Policy at any time by clicking on "Privacy Policy" at the bottom of each page of our website.

This Privacy Policy applies to the use of the digital services of Einstein Foundation Berlin accessible via PC, smartphones, tablets and all other internet-enabled devices at www.doctoral-programs.de.

The digital services may contain links to third-party websites. This Privacy Policy does not apply to those external websites.

The body responsible for processing your personal data pursuant to Art. 4(7) GDPR is:

Einstein Foundation Berlin 
Jägerstraße 22/23 
10117 Berlin
Germany 
Email: contact(at)einsteinfoundation.de

The GDPR requires that personal data be processed lawfully, fairly, and in a transparent manner. To ensure this, we provide you with the following key definitions used throughout this Privacy Policy:

3.1 Personal data "Personal data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3.2 Processing "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.3 Restriction of processing "Restriction of processing" means the marking of stored personal data with the aim of limiting its future processing.

3.4 Profiling "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

3.5 Pseudonymisation "Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

3.6 Filing system "Filing system" means any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

3.7 Controller "Controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

3.8 Processor "Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3.9 Recipient "Recipient" means a natural or legal person, public authority, agency or another body to which personal data is disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

3.10 Third party "Third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

3.11 Consent "Consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

We consider it our primary responsibility to protect the confidentiality of the personal data you provide and to safeguard it from unauthorised access. We therefore apply the utmost care and state-of-the-art security standards to ensure maximum protection of your personal data.

All data transmitted to and from our website is encrypted using TLS (Transport Layer Security). We have implemented appropriate technical and organisational measures in accordance with Art. 32 GDPR to ensure a level of security appropriate to the risk.

As a foundation under German civil law, we are subject to the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Telemedia Data Protection Act (TDDDG). These measures apply equally to our external service providers.

Personal data may only be processed where a legal basis exists. Under Art. 6(1) GDPR, the applicable legal bases are:

(a) The data subject has given consent to the processing of their personal data for one or more specific purposes;

(b) Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;

(c) Processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) Processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.

The following section describes how we collect personal data when you use our website. Personal data includes, for example, your name, address, email address, and usage behaviour.

Providing personal data on this website (e.g. email addresses, names) is always voluntary. We use personal data only for internal purposes and process it in compliance with applicable data protection law. We will only disclose data to public authorities where required by law. Our staff are bound by confidentiality obligations.

If you contact us by e-mail or via a contact form, the data you provide (your email address, and where applicable your name and telephone number) will be stored solely for the purpose of responding to your enquiry. We delete this data once it is no longer required, unless statutory retention obligations apply.

When you use our website for purely informational purposes — without registering or submitting any data — we do not actively collect personal data. However, your browser automatically transmits certain technical data to our server. For further details, please see Section 8 (Server Log Files).

Our web server automatically collects and stores information in server log files, which your browser transmits to us automatically. This includes:

- Operating system used
- Browser type and version
- Hostname of the accessing device
- Referrer URL (previously visited page)
- Date and time of the server request
- IP address (anonymised)

This data cannot, as a rule, be attributed to specific individuals and is not combined with other data sources. It is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free operation of our website). We reserve the right to review this data retrospectively if there are concrete indications of unlawful use. 

This website does not use cookies for tracking or marketing purposes.

Where technically necessary cookies are used solely to ensure the proper functioning of the website (e.g. for session management), these are based on Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG and do not require your prior consent.

If you use our contact form, the data you provide (such as your name, email address and message) will be stored and processed solely for the purpose of handling your enquiry. 

The legal basis is Art. 6(1)(b) GDPR (pre-contractual or contractual measures) or, where no contractual relationship exists, Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry). Data will be deleted once your enquiry has been fully resolved, unless statutory retention obligations require continued storage.

In addition to purely informational use, we may offer further services on our website. Where you make use of these services, you may be required to provide additional personal data, which will be processed in accordance with the principles set out in this Privacy Policy.

In some cases, we engage external service providers to process your data on our behalf. These providers are carefully selected, are contractually bound via Data Processing Agreements (DPA) pursuant to Art. 28 GDPR, and are subject to our instructions.

Where our service providers or partners are located outside the European Economic Area (EEA), we will ensure an adequate level of data protection through appropriate safeguards (e.g. EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR) and will inform you accordingly.

Our website is primarily intended for adults. Persons under the age of 18 should not submit personal data to us without the consent of a parent or legal guardian. If we become aware that we have inadvertently collected personal data from a minor, we will delete it promptly.

You have the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details provided in Section 2.

13.1 Right to withdraw consent (Art. 7(3) GDPR) Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

13.2 Right of access (Art. 15 GDPR) You have the right to obtain confirmation as to whether we are processing personal data about you and, if so, to receive a copy of that data together with information on the purposes, categories, recipients, retention periods, and other relevant details of the processing.

If personal data is transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards in place pursuant to Art. 46 GDPR. We will provide one copy of the data free of charge; for any further copies, we may charge a reasonable fee based on administrative costs.

13.3 Right to rectification (Art. 16 GDPR) You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data without undue delay.

13.4 Right to erasure / "Right to be forgotten" (Art. 17 GDPR) You have the right to request the deletion of your personal data without undue delay where one of the following grounds applies:

- The data is no longer necessary for the purposes for which it was collected or processed;
- You withdraw consent and there is no other legal basis for processing;
- You object under Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object under Art. 21(2) GDPR;
- The data has been processed unlawfully;
- Deletion is required to comply with a legal obligation under Union or Member State law;
- The data was collected in relation to information society services offered to a child pursuant to Art. 8(1) GDPR.

This right does not apply where processing is necessary for:

- The exercise of the right of freedom of expression and information;
- Compliance with a legal obligation or the performance of a task in the public interest;
- Reasons of public interest in the area of public health (Art. 9(2)(h) and (i) and Art. 9(3) GDPR);
- Archiving, scientific or historical research, or statistical purposes pursuant to Art. 89(1) GDPR, where erasure would render such processing impossible or seriously impair it;
- The establishment, exercise or defence of legal claims.

13.5 Right to restriction of processing (Art. 18 GDPR) You have the right to request that we restrict the processing of your personal data where:

- You contest the accuracy of the data, for a period enabling us to verify accuracy;
- The processing is unlawful and you request restriction rather than erasure;
- We no longer need the data, but you require it for the establishment, exercise or defence of legal claims; or
- You have objected to processing pursuant to Art. 21(1) GDPR, pending verification of whether our legitimate grounds override yours.

Where processing has been restricted, such data may only be processed — apart from storage — with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest.

13.6 Right to data portability (Art. 20 GDPR) Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller. Where technically feasible, you may request that the data be transmitted directly from one controller to another. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

13.7 Right to object (Art. 21 GDPR) You have the right to object at any time to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR, on grounds relating to your particular situation, including profiling based on those provisions. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time; this includes profiling to the extent it is related to direct marketing. Upon objection, your data will no longer be processed for such purposes.

You also have the right to object to processing for scientific or historical research or statistical purposes pursuant to Art. 89(1) GDPR on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out in the public interest.

13.8 Rights related to automated decision-making and profiling (Art. 22 GDPR) You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision:

- Is necessary for entering into or performing a contract;
- Is authorised by Union or Member State law with appropriate safeguards; or
- Is based on your explicit consent.

In cases where automated decision-making applies, we will implement appropriate measures to safeguard your rights, including the right to obtain human intervention, to express your point of view, and to contest the decision.

13.9 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for Einstein Foundation Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit 
(Berlin Commissioner for Data Protection and Freedom of Information) 
Alt-Moabit 59–61 
10555 Berlin
Germany 
Phone: +49 30 13889-0 
Email: mailbox@datenschutz-berlin.de 
Website: www.datenschutz-berlin.de

13.10 Right to an effective judicial remedy (Art. 79 GDPR) Without prejudice to any available administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority under Art. 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in breach of the GDPR.

This website uses Matomo, an open-source web analytics service, to analyse website usage and continuously improve our services.

Configuration: Matomo is operated without cookies and with IP anonymisation enabled. IP addresses are truncated immediately upon collection, making direct identification of individual users impossible. Data generated about the use of this website is not shared with third parties. Personal data submitted via the contact form is not processed by Matomo.

Legal basis: Under § 25(1) TDDDG, the use of analytics tools in Germany generally requires the prior consent of users. The legal basis for processing is Art. 6(1)(a) GDPR (consent).

Opt-out: You may choose to prevent this website from aggregating and analysing your actions at any time. Doing so will protect your privacy, but will also prevent us from learning from your interactions and improving the website experience for you and other users. You can withdraw your consent using the checkbox below — your opt-out preference will be saved in your browser.

For further information on Matomo's privacy practices, please visit: https://matomo.org/privacy-policy

We engage external service providers (processors) to support the operation of our website and services. All processors are carefully selected, contractually bound via Data Processing Agreements pursuant to Art. 28 GDPR, and are subject to our instructions. They may only process your personal data on our behalf and in accordance with our documented instructions.

This Privacy Policy is reviewed and updated periodically to reflect changes in our data processing practices or applicable law. We recommend checking this page regularly. The current version is always available at www.doctoral-programs.de/privacy-policy.

Last updated: May 2026