I.    Information about the responsible official

The Physikalisch-Technische Bundesanstalt (PTB) operates an online portal (E-Service Portal) to fulfill the requirements of the Online Access Act (OZG). PTB collects personal data when citizens and companies submit applications for the services offered by PTB via this E-Service Portal. In the following, we would like to inform you about the processing of your personal data and the respective rights to which you are entitled in this context.
The responsibility of processing these data lies with PTB Braunschweig and Berlin, Bundesallee 100, 38116 Braunschweig, Germany, phone: +49 531 592-0, email: info@ptb.de. 
Contact details of the Data Protection Officer: phone: +49 531 592-8463, email: datenschutz@ptb.de. For further information on data protection, please visit: https://www.ptb.de/cms/en/service-seiten/data-protection.html.

II.    Purposes and legal basis for data processing 

Data processing is carried out for the purpose of setting up administrative accounts (accounts for customers to manage a company or organization’s orders) as well as for the registration of user accounts for employees to apply for the respective services via the E-Service Portal. In addition, the E-Service Portal is used for the central acceptance of applications for administrative services according to the OZG as well as for other services offered by PTB.

When PTB processes personal data in the performance of its delegated powers and/or statutory tasks, data processing is carried out in accordance with Art. 6 (1) e and Art. 3 of the EU General Data Protection Regulation (GDPR) in conjunction with Art. 3 of the German Federal Data Protection Act (BDSG) and the relevant provisions. In the event that consent has been obtained, the legal basis is Art. 6 (1) a of the GDPR. 

III.   Data processing 

1. Processed data
   1. Registration and activation of an administrative account 
      The registration of an administrative account includes, as a first step, registering a user account to be able to use the E-Service Portal. In this procedure, the following personal data will be processed.
      • User account
        After registering, an email with a verification code will be sent to the email address provided during registration. This verification code will activate the administrative account for your organization. In this context, the following personal data will be processed:
        • MASTER DATA (business/professional email address, language, prefix (optional), first name and last name, additional given name (optional))
        • USER DATA (password chosen, response to the selected security question (password reminder))
           
      • Administrative account
        • MASTER DATA (name and address of the company/organization which establishes the link to a company/organization, form of address and title (optional), business/professional contact data (phone and email address), function within the company/organization, language)
           
   2. Assignment of a user account to the administrative account of an organization
      To be able to use the functions of the E-Service Portal, a user account must be linked to the administrative account of the associated organization. For this purpose, the person responsible for the administrative account will assign the user account to the organization’s administrative account. In this context, the following personal data will be processed:
      • Business/professional email address, first name and last name
   3.     Log data 
      During your visit to the E-Service Portal, PTB will automatically process the following data:
      • Log data (IP address, date and time, notification stating whether access/retrieval has been successful or not, retrieved URL, volume of data transmitted)
   4. Processing application data
      The master data stored in the relevant user account are processed as part of the application for using administrative and other services offered by PTB. 
      In addition, the attachments added to an application may contain personal data (content data). These data depend on the service requested.
       
2. Recipient of data 
   Personal data will be transferred to the bodies of PTB that are entrusted with account administration and with processing the application, respectively. 
   The use of the account data for purposes other than those stated above and the disclosure of such data to third parties by PTB shall only be allowed in cases permitted by law and for the purpose of prosecution of criminal offenses conducted by the authorities or for adverting dangers. 
   Possible recipients of content data are listed in the specific data protection information for administrative and other services.
    
3. Duration of retention
   The following principles apply to the retention time of processed personal data:
   • Personal data will only be stored for as long as is necessary to achieve the purpose for which it is stored, provided that it is prescribed by the European body responsible for issuing directives and regulations or by another legislator in laws and regulations to which PTB is subject or that contractual retention periods exist.
   • The criterion determining the retention period is primarily the necessity of knowing the data for documentation purposes and to secure results or for other purposes for which the data were collected.
   • If the purpose of retention no longer applies or if a retention period prescribed by the European body responsible for issuing directives and regulations or by another competent legislator has expired, personal data will be blocked or deleted in accordance with the legal provisions.
   Deleting the assignment of a user account to an administrative account is performed by the person responsible for an organization’s administrative account. The complete deletion of administrative accounts and user accounts is performed at the request of the respective user.
   Data which is provided to the E-Service Portal for an application can be retrieved via the Portal for a period determined by the PTB office responsible for the processing of the application (usually 30 days) and will then be deleted. 
   For information on storing application documents outside of the E-Service Portal, please refer to the specific privacy notices for each administration and service. Log data are temporarily stored for a maximum of 7 days and evaluated solely for statistical purposes, to improve the service and to ensure data protection and information security at PTB. If there are concrete indications of criminal acts or cyber attacks, PTB reserves the right to forward log data to the competent law enforcement authorities or to the Federal Office for Information Security (BSI). The data will not be used for other purposes or passed on to third parties.
4. Legal requirements for the provision of personal data; obligation of the data subject to provide personal data; possible consequences of failure to provide personal data
   It is necessary to provide personal data when using the E-Service Portal in order to use the administrative and other services offered through the portal. Failure to provide personal data would mean that the E¬Service Portal cannot be used. 

IV.    Ergänzende Angaben zu einzelnen Datenverarbeitungen

1. Auskunft nach Informationsfreiheitsgesetz
   Im Formular zur Auskunft nach Informationsfreiheitsgesetz wird zwischen Pflichtangaben, d.h. solchen Angaben, ohne die die Bearbeitung Ihres Antrages nicht möglich wäre, und der freiwilligen Angabe weiterer Daten unterschieden. Um einen Antrag stellen zu können, müssen Sie mindestens die für die Antragstellung erforderlichen Daten in das Formular eintragen. 
   
   Ihre Daten werden ausschließlich zur Bearbeitung Ihres Antrags auf Grundlage von Art. 6 Abs. 1 lit. c, Abs. 2, 3 lit. b DSGVO in Verbindung mit §§ 1, 7 IFG verarbeitet. Soweit Sie freiwillige Angaben machen, ist Ihre Einwilligung nach Art. 6 Abs. 1 lit. a DSGVO die Rechtsgrundlage für die Verarbeitung dieser Daten. Ihre Einwilligung können Sie jederzeit mit Wirkung für die Zukunft widerrufen. Die Rechtmäßigkeit der Verarbeitung Ihrer Daten bis zum Zeitpunkt des Widerrufs wird durch den Widerruf nicht berührt. Ihren formlosen Widerruf können Sie u.a. an die im Impressum dieser Webseite genannte E-Mail-Adresse richten.
   
   Folgende Angaben sind für eine Antragstellung erforderlich: 
   
   Anrede, Vorname, Nachname, E-Mail-Adresse, Betreff und Inhalt Ihrer Anfrage 
   
   Eine Registrierung im Portal ist für die Antragstellung nicht erforderlich. Bei Aufrufen der Webseite werden jedoch die unter Ziff. III.1.c genannten Protokolldaten verarbeitet und für die unter Ziff. III.3 genannte Dauer gespeichert. 
   
   Ihre Antragsdaten werden an die mit der Bearbeitung Ihres Antrages betrauten Stellen der PTB übermittelt und im Portal nach einem Tag gelöscht. Ihre Antragsdaten werden anschließend nach Registraturrichtlinie behandelt und 3 Jahre nach Verfahrensabschluss gelöscht.

V. Rights of data subjects

Data subjects have the following legal rights, in particular with regard to the processing of their personal data:
RIGHT OF ACCESS according to Art. 15 GDPR 
RIGHT TO RECTIFICATION according to Art. 16 GDPR 
RIGHT TO ERASURE according to Art. 17 GDPR 
RIGHT TO RESTRICTION OF PROCESSING according to Art. 18 GDPR
RIGHT TO WITHDRAW CONSENT AT ANY TIME according to Art. 7 (3) GDPR 
RIGHT TO DATA PORTABILITY according to Art. 20 (1) GDPR 
RIGHT TO OBJECT according to Art. 21 (1) GDPR
RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY according to Art. 77 GDPR.
The responsible supervisory authority for PTB is the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Graurheindorfer Str. 153, 53117 Bonn, Germany, poststelle@bfdi.bund.de, +49 228997799-0.