The Federal Ministry for Digital Transformation and Government Modernisation (BMDS) gives a high priority to the responsible use of personal data. We want users of our website to know which data the BMDS collects and uses and when.
1. Fundamentals
1.1 Controller and data protection officer
The controller responsible for processing personal data is the
Federal Ministry for Digital Transformation and Government Modernisation (BMDS)
Alt-Moabit 140
10557 Berlin, Germany
Email: info@bmds.bund.de
For all general enquiries, please use our contact form.
If you have specific questions about how your data are protected, please contact the BMDS data protection officer:
Data Protection Officer at the Federal Ministry for Digital Transformation and Government Modernisation
Alt-Moabit 140
10557 Berlin, Germany
Email: bds@bmds.bund.de
1.2 Personal data
Personal data means any information relating to an identified or identifiable natural person. Natural persons are considered identifiable if they can be identified directly or indirectly, in particular by linking them to an identifier such as a name, identification number, location data or an online reference number.
1.3 Protection of minors
Anyone younger than 16 should not send us their personal data without the consent of their parents or guardians.
1.4 Legal basis for processing personal data
The BMDS processes personal data in carrying out its assigned tasks in the public interest. Its public responsibilities include in particular informing the public and making information available to the public through its website. The legal basis for processing in this case is Article 6 (1) (e) of the EU’s General Data Protection Regulation (GDPR) in conjunction with the relevant national or European law and with section 3 of Germany’s Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). If, in a specific case, it is necessary to process personal data to fulfil a legal obligation, then the legal basis for processing is in addition Article 6 (1) (c) of the GDPR in conjunction with the relevant legal provision from which that legal obligation derives.
When processing personal data is necessary to fulfil a contract with the data subject, Article 6 (1) (b) of the GDPR serves in addition as the legal basis in the individual case. This also applies to processing which is necessary to implement pre-contractual measures. The BMDS acts as a contracting party under civil law in particular with regard to staff recruitment and procurement. If vital interests of the data subject or of another natural person make it necessary to process personal data, Article 6 (1) (d) of the GDPR serves as the legal basis.
On the basis of Article 6 (1) (e) of the GDPR in conjunction with section 5 of the Act on the Federal Office for Information Security (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, BSIG), the BMDS is required to store data beyond the time of your visit to the website in order to protect against attacks on the internet infrastructure of the BMDS and on federal communications technology. These data are analysed and, in the event of attacks on communications technology, used to initiate legal and criminal proceedings. These data are deleted as soon as they are no longer needed for official purposes. Data logged when you access the BMDS website are only shared with third parties if we are required by law to do so, or if the data are needed for legal or criminal proceedings in the case of attacks on federal communications technology. Otherwise, these data are not shared with third parties. The BMDS does not combine these data with other data sources, for example to create user profiles.
2. Data processing related to visiting this website
2.1 Data collection
Every time someone accesses our website and retrieves a file, data are temporarily saved in a log file.
Specifically, the following data are saved:
- date and time of retrieval (time stamp) and the IP address of the device or server requesting access
- details of the request and destination (log version, HTTP method, referrer, user agent string);
- name of the file retrieved and volume of data transferred (requested URL and query string, size in bytes)
- whether the request was successful (HTTP status code)
According to Article 6 (1) (e) of the GDPR in conjunction with section 5 of the Act on the Federal Office for Information Security, we are required to store data beyond the time of your visit to the website in order to protect against attacks on the internet infrastructure of the BMDS and on federal communications technology. These data are analysed and, in the event of attacks on the communications technology, needed to initiate legal and criminal proceedings. These data are deleted as soon as they are no longer needed for official purposes.
Data logged when you access the BMDS website are only shared with third parties if we are required by law to do so, or if the data are needed for legal or criminal proceedings in the case of attacks on federal communications technology. Otherwise these data are not shared with third parties. The BMDS does not combine these data with other data sources.
2.2 Overview of cookies used by the BMDS
Technically necessary
JSESSIONID (value: string/hash)
- Cookie for session management on the application server
- Does not contain any personal data
- Not based on the user’s IP address or any other information that can be traced back to the actual user
- Only valid for the duration of the current session
- Session ID is only valid on the respective server and is not synchronised via different server instances
2.3 Processing personal data related to web analysis
We use the etracker tool provided by etracker GmbH, based in Hamburg, Germany, for the purpose of web analytics and to improve this website. Among other things, information about visitor behaviour on this website and technical data are collected and analysed. In the process, no cookies are stored on your device.
When saving user data, your IP address is only stored briefly (milliseconds), so that it is not possible to identify individual users. The IP address is automatically truncated (anonymised) at the earliest possible point in time.
The web analytics data generated are processed exclusively in Germany. They are not used for any other purpose and are not combined with other data, nor are they shared with third parties.
Please note that, up until it is anonymised, your IP address will be processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).
You can find more information about the anonymised analysis of data on the etracker website. Please note that the following link leads to an external website: etracker, Cookie-less etracking.
2.4 Social media feeds on our website
On our website, we use the plug-in Stage of Jaimo Solutions GmbH, Friedrichstr. 52, 76669 Bad Schönborn, Germany (the processor as referred to in Article 28 of the GDPR) to integrate aggregated content from our social media accounts into social media feeds. This content is temporarily stored on German servers operated by Jaimo Solutions GmbH, aggregated and delivered to our website. This content may contain external links to social media platforms. The data protection provisions of the provider concerned apply when you click on these links. You can find more information from the provider (in German). Please note that the following link leads to an external website: https://about.stage.bio/datenschutz.
3. Processing personal data when you contact us
Personal data are processed in different ways depending on how you contact us: whether via email, online contact form, post or telephone (hotline).
3.1 Contacting the BMDS via email
You can contact the BMDS using the official email address of individual staff members, one of the ministry’s topic-related mailboxes or the ministry’s central email address: info@bmds.bund.de. For more information on contacting the ministry’s public information service, please see number 3.4.
The data you send the BMDS (such as first and last name, address) and at least your email address and the information contained in your message (including any personal data you provide) will be saved by the relevant organisational unit for the purpose of contacting you and responding to your message in accordance with the time limits for record retention given in the Registry Directive, supplemental to the Joint Rules of Procedure of the Federal Ministries (Gemeinsame Geschäftsordnung der Bundesministerien, GGO).
If you contact us at the central email address info@bmds.bund.de, your enquiry will be processed by the BMDS’s authorised service provider, Telemark Rostock Kommunikations- und Marketinggesellschaft mbH, in the framework of processing under Article 28 of the GDPR. If your enquiry cannot be processed by staff of Telemark Rostock Kommunikations- und Marketinggesellschaft mbH, it will be forwarded to the BMDS or, with your consent, to the responsible authority at state or federal level.
Please note that the data will be processed in compliance with Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). It is necessary to process the personal data you provide in order to respond to your enquiry.
3.2 Contacting the BMDS via the email address of the internet editorial team
If you wish to contact the internet editorial team, you will need to provide your preferred form of address, your first and last name, and your email address. Without this information, your enquiry cannot be processed. A postal address is optional and enables us to respond by post, if requested. In addition, the date and time your message was sent will be transmitted to us.
If you send us a message via email, we will assume that we are authorised to reply via email. The information and content you send (which may also include personal data you provide) will be processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act for the purpose of responding to your enquiry.
Correspondence between you and the BMDS is stored in accordance with the time limits for record retention given in the Registry Directive, supplemental to the Joint Rules of Procedure of the Federal Ministries (Gemeinsame Geschäftsordnung der Bundesministerien, GGO).
3.3 Contacting the BMDS using the online contact form of the public information service
If you use the online contact form of the public information service to contact the BMDS, you will need to provide your first and last name and your email address. Without this information, your enquiry cannot be processed. Providing your telephone number and postal address is optional and enables us to respond by telephone or post, if requested. In addition, the date and time your message was sent will be transmitted to us. If you send us a message via email or the online contact form, we will assume that we are authorised to reply via email.
The information you provide on the BMDS contact form is transmitted via an encrypted https connection. The information and content you send using the online contact form (which may also include personal data you provide) is processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act for the purpose of responding to your enquiry. Information submitted using the online contact form is transmitted to the BMDS public information service.
The data you provide will be processed in order to respond to your enquiry.
If you contact us using the online contact form, your enquiry will be processed by the BMDS’s authorised service provider, Telemark Rostock Kommunikations- und Marketinggesellschaft mbH, in the framework of processing under Article 28 of the GDPR. If your enquiry cannot be processed by staff of Telemark Rostock Kommunikations- und Marketinggesellschaft mbH, it will be forwarded to the BMDS or, with your consent, to the responsible authority at state or local level.
3.4 Contacting the BMDS by post
We kindly ask you to refrain from sending letters via post and to use electronic communication channels instead. If you do write a letter to the BMDS, please use the following address:
Federal Ministry for Digital Transformation and Government Modernisation (BMDS)
Alt-Moabit 140
10557 Berlin, Germany
The data you send (such as first and last name, address) will be stored and the information contained in your letter (including any personal data you provide) will be saved in accordance with the time limits for record retention given in the Registry Directive, supplemental to the Joint Rules of Procedure of the Federal Ministries.
The data you provide will be processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). This processing is necessary to respond to your enquiry.
3.5 Contacting the BMDS by telephone
If you contact a ministry staff member by telephone, your personal data will be processed as far as necessary to respond to your enquiry. Your data will be processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act.
4. Accreditation for the media
Personal data collected in the context of accreditation for members of the media are collected and processed for the accreditation procedure. Which data are requested for accreditation depends on the particular event. Information submitted using the online registration form is transmitted to the BMDS.
Please note that the data transmitted with the online form and its content (which may also include personal information you provide) will be processed on the basis of Article 6 (1) (e) of the GDPR in conjunction with section 3 of the Federal Data Protection Act for the purpose of processing your request. The accreditation is processed by the staff of the BMDS press relations division, who will store your data to respond to your request and in compliance with the legal and contractual requirements. Information collected for accreditation will be provided to the Federal Criminal Police Office (BKA), for the purpose of security checks. After this check the BKA will delete the data. If you do not consent to the processing of your data, we cannot issue you a press credential. The information provided through the BMDS registration form is transmitted via an encrypted connection.
5.Deletion of data
Your personal data will be deleted as soon as they are no longer needed as evidence or for revision purposes. In addition, the retention period according to the Registry Directive (ten years) applies to the BMDS, after which an examination is required to determine whether the data are to be transferred to the interim archive or deleted. Documents from court proceedings can be retained for up to 30 years.
6. Your rights
You have the following rights which must be respected by the BMDS with regard to personal data concerning you:
Right of access, Article 15 of the GDPR
This right gives data subjects comprehensive access to data concerning them and to a few other key criteria, such as purpose of processing or duration of storage. Exceptions to this right are governed by section 34 of the Federal Data Protection Act.
Right to rectification, Article 16 of the GDPR
The right to rectification includes the option of having inaccurate personal data concerning the data subject corrected.
Right to erasure, Article 17 of the GDPR
This right enables data subjects to have the controller delete data concerning them. However, such data may only be deleted if they are no longer needed, if they were processed unlawfully or if consent covering their processing has been withdrawn. Exceptions to this right are governed by section 35 of the Federal Data Protection Act.
Right to restriction of processing, Article 18 of the GDPR
This right enables data subjects to temporarily prevent further processing of personal data concerning them. Such a restriction is used above all when data subjects are examining whether to claim other rights.
Right to object (to collection, processing and/or use), Article 21 of the GDPR
This right enables data subjects to object, on grounds relating to their particular situation, to the further processing of their personal data when the justification for this processing is based on the need to perform public tasks or to exercise public and private interests. Exceptions to this right are governed by section 36 of the Federal Data Protection Act.
Right to data portability, Article 20 of the GDPR
This right enables data subjects to receive from the controller the personal data concerning them in a commonly used and machine-readable format in order to transmit this data to another controller if needed. According to Article 20 (3) sentence 2 of the GDPR, this right does not apply if the data processing is necessary in order to perform tasks in the public interest.
Right to withdraw consent, Article 7 (3) of the GDPR.
If their personal data are processed on the basis of consent, data subjects can at any time withdraw their consent to these data being processed for the purpose in question. The lawfulness of processing on the basis of consent remains unaffected until notification has been received that consent has been withdrawn.
You can claim these rights using the contact information provided in section 1.1 above.
You also have the right according to Article 77 of the GDPR to submit a complaint to the supervisory authority under data protection law: the Federal Commissioner for Data Protection and Freedom of Information.
You may also address your questions and complaints to the BMDS at bds@bmds.bund.de.