Introduction

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as "data" for short) that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both as part of the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "Online Offer").
The terms used are not gender-specific.

Responsible

Dr. Annina H. Michel
University of Zurich, Department of Geography
Winterthurerstrasse 190
8057 Zurich

Authorized representative:
Prof. Norman Backhaus

E-mail address:
This email address is being protected from spambots. You need JavaScript enabled to view it.

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR, on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

• Contract performance and pre-contractual requests (Art. 6 (1) p. 1 lit. b) GDPR) - The processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures which are carried out at the request of the data subject.
• Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR) - Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Switzerland. These include, in particular, the Federal Data Protection Act (FADP). The GDP applies in particular if no EU/EEC citizens are affected and, for example, only data of Swiss citizens is processed.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not required for the purpose). If the data are not deleted because they are required for other and legally permissible purposes, their processing will be limited to these purposes. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

Our data protection notices may also contain further information on the retention and deletion of data, which shall have priority for the respective processing operations.

Provision of online service

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.

• Types of data processed: Usage data (e.g. web pages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses). 
• Data subjects: Users (e.g. website visitors). 
• Purposes of processing: provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).); security measures.
• Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

Further notes on processing, procedures and service provider:

• Provision of online offer on rented storage space: for the provision of our online offer, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called "web hoster"); Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).
• Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files". The server log files may include the address and name of the web pages and files accessed, the date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g., to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR); Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data whose further storage is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident.
• Domain hosting/Webhosting/Websites: hosteurope: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany; Website: https://www.hosteurope.de/en; Privacy Policy: https://www.hosteurope.de/en/terms-and-conditions/privacy.

Registration, Login and User Account

Users can create a user account. Within the scope of registration, the required mandatory information is communicated to the users and processed for the purposes of providing the user account on the basis of contractual fulfilment of obligations. The processed data includes in particular the login information (name, password and an e-mail address).

Within the scope of using our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by e-mail or via in-app messages of information relevant to their user account, such as technical changes.

Registration with pseudonyms: Users may use pseudonyms as user names instead of real names.

Users' profiles are public: Users' profiles are publicly visible and accessible.

Deletion of data after termination: If users have terminated their user account, their data relating to the user account will be deleted, subject to any legal permission, obligation or consent of the users.

It is the responsibility of the users to secure their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all user data stored during the term of the contract.

• Processed data types: Inventory data (e.g. names, user names), Contact data (e.g. e-mail, telephone numbers), Content data (e.g. text input, photographs, videos), Meta/communication data (e.g. device information, IP addresses).

• Data subjects: Users (e.g. app users, website visitors, users of online services).

• Purposes of Processing: Provision of contractual services and customer support, Security measures, Managing and responding to inquiries.

• Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter "publication medium") in our websites. Readers' data will only be processed for the purposes of the publication medium to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this privacy policy.

Comment subscriptions: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is done for our safety, if someone leaves illegal contents (insults, forbidden political propaganda, etc.) in comments and contributions. In this case, we ourselves can be prosecuted for the comment or contribution and are therefore interested in the author's identity.

Furthermore, we reserve the right to process user data for the purpose of spam detection on the basis of our legitimate interests.

On the same legal basis, in the case of surveys, we reserve the right to store the IP addresses of users for the duration of the surveys and to use cookies in order to avoid multiple votes.

The personal information provided in the course of comments and contributions, any contact and website information as well as the content information will be stored permanently by us until the user objects.

Comment subscriptions: Follow-up comments can be subscribed to by users with their consent. Users will receive a confirmation email to verify that they are the owner of the email address entered. Users can unsubscribe from current comment subscriptions at any time. The confirmation email will contain information on the cancellation options. For the purposes of proving the users' consent, we store the time of registration along with the users' IP address and delete this information when users unsubscribe from the subscription.

You can cancel the receipt of our subscription at any time, i.e. revoke your consent. We may store the unsubscribed email addresses for up to three years based on our legitimate interests before deleting them to provide evidence of prior consent. The processing of these data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of a consent is confirmed at the same time.

Users are welcome to use pseudonyms, or to refrain from entering their name or email address. You can completely prevent the transmission of data by not using our comment system. That is a pity, but unfortunately we do not see any alternatives that work just as effectively.

• Processed data types: Inventory data (e.g. names, addresses), Contact data (e.g. e-mail, telephone numbers), Content data (e.g. text input, photographs, videos), Usage data (e.g. websites visited, interest in content, access times), Meta/communication data (e.g. device information, IP addresses).

• Data subjects: Users (e.g. website visitors, users of online services).

• Purposes of Processing: Provision of contractual services and customer support, Feedback (e.g. collecting feedback via online form), Security measures, Managing and responding to inquiries, Contact requests and communication.

• Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR), Consent (Article 6 (1) (a) GDPR).