Privacy Policy

Privacy Policy ifo Institute

Information to be provided pursuant to Art. 12, 13 et seq. of the GDPR

1. Name and Address of Controller

Your contact and the controller within the meaning of the General Data Protection Regulation of the European Union ("GDPR"), national data protection laws of the member states, and other data protection regulations is:

ifo Institute – Leibniz Institute for Economic Research at the University of Munich
Poschingerstr. 5
81679 München

(hereinafter referred to as "we", "us", "our" or "ifo Institute").

2. Name and Address of Data Protection Officer

The protection of your personal data is of great importance to the ifo Institute – Leibniz Institute for Economic Research at the University of Munich. To demonstrate our commitment to protecting your personal data, we have commissioned a consulting firm specialising in data protection and security to handle these important issues. Our data protection officer is part of a team of highly experienced professionals at our consulting firm. The firm that provides us with consulting services is:

Legaltech GmbH
Augustaanlage 32
68165 Mannheim
https://www.schutz-von-daten.de/

If you have any questions concerning data protection and data security at the ifo Institute, please contact our data protection officer Dr. Thomas Wirth directly:

Email: datenschutz@ifo.de
Tel.: +49 621 43179339

3. General Information on Data Processing

3a. Scope of Personal Data Processing

As a matter of principle, we will only process your personal data to the extent that is necessary to provide our services. Any processing of your personal data is, as a rule, subject to your prior consent, except in cases where prior consent cannot be obtained for factual reasons or the processing of your personal data is permitted by law.

3b. Legal Basis for Processing Personal Data

In cases where we seek your consent to process personal data, the legal basis for doing so is set out in Art. 6(1)(a) of the GDPR.

In cases where we process personal data in the execution of a contract between you and us, the legal basis for doing so is set out in Art. 6(1)(b) of the GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures.

In cases where personal data must be processed to comply with a legal obligation that we are subject to, the legal basis for doing so is set out in Art. 6(1)(c) of the GDPR.

If the processing of personal data is necessary for the performance of a task carried out in the public interest, the legal basis for this is Art. 6(1)(e) GDPR.

In cases where the processing of personal data is necessary for the purposes of the legitimate interests pursued by us or a third party and those interests are not overridden by your interests, fundamental rights and freedoms, the legal basis for doing so is set out in Art. 6(1)(f) of the GDPR.

3c. Deletion and Storage Period

Your personal data will be deleted or blocked if they are no longer required for the purposes for which they were stored or otherwise processed. In addition, data may be stored to meet the legal obligations stipulated by the European or national legislator in EU regulations, laws or other standards that we are subject to. Data will also be blocked or deleted if the storage period stipulated in the above-mentioned regulations, laws or standards expires unless longer storage is necessary for the purpose of entering into or performing a contract.

3d. Converia
We use Converia, operated by Lombego Systems GmbH, for the registration for our events. If you register for an event via our links, your personal data will be transmitted directly to Converia. This data typically includes your name, your contact details, and possibly other event-specific information required for registration. Your data will be processed solely for the purpose of organizing and conducting the respective event.
Converia processes the data on our behalf and in accordance with our instructions as well as applicable data protection regulations.
Further information on data processing by Converia can be found in their privacy policy available at: https://www.converia.de/de/datenschutz.html.

4. Website Provision and Creation of Log Files

4a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of website provision and the creation of log files is set out in Art. 6(1)(f) of the GDPR.

4b. Purpose of Data Processing

The temporary storage of your personal data is necessary to enable us to deliver the website to your computer. To this end, your personal data need to be stored for the duration of the session.

Your personal data are stored in log files to ensure the operability of the website. We also use your personal data to optimise our website and safeguard the security of our information technology systems. In this context we will not analyse your personal data for marketing purposes.

The above is necessary for the purposes of the legitimate interests pursued by us referred to in Art. 6(1)(f) of the GDPR.

4c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed. In cases where your personal data are collected for the purpose of providing the website, they will be deleted each time a session ends.

If personal data are stored in log files, they will be deleted after fourteen days at the latest. In some cases data may be stored for a longer period of time, in which case your personal data will be deleted or masked, thus making identification of the requesting client impossible.

4d. Objection, Removal

Recording your personal data for the purpose of providing the website and storing your personal data in log files are essential for the operation of the website. You therefore have no right to raise any objection to these activities.

5. Use of Cookies

When you visit our website, we inform you via our cookie banner that we use cookies. Below, we would like to provide you with information about the cookies we use and how you can consent to the use of non-essential cookies.

In order to expand the range of functions of our web offering and to make its use more convenient for you, we use so-called “cookies” on some of our pages, which primarily serve to identify the site visitors or contain information about user activity on the web pages. Cookies are small text files that are stored on your computer. Some of these cookies are deleted after the browser session ends (so-called session cookies). Other cookies remain on your computer and enable us or our partner companies (third-party cookies) to recognize your browser the next time you visit us (so-called persistent cookies). If cookies are set, they collect and process certain user information to an individual extent, such as browser and location data and IP address values.

5a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of using cookies required for technical purposes is set out in Art. 6(1)(f) GDPR.

The legal basis for data processing in the context of the use of technically unnecessary cookies is Art. 6(1)(a) GDPR.

5b. Purpose of Data Processing

The use of cookies required for technical purposes is designed to simplify your use of our website. Some features of our website cannot be offered without the use of cookies. For these features it is necessary that your web browser is recognized even after a page change. The user data collected through cookies required for technical purposes will not be used to create user profiles.

Such processing is therefore necessary for the purposes of the legitimate interests pursued by us as referred to in Art. 6(1)(f) GDPR.
The use of technically not necessary cookies serves to further simplify the use of our website and to make it more convenient for you, as well as for the statistical recording and analysis of general usage behaviour based on access data. These cookies are set only with your express consent, which you give by selecting the checkboxes in our cookie banner.

5c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected; this is particularly the case when non-essential cookies that are not necessary for the operation of the website are deactivated. The specific lifetime of each individual cookie can be found in the list under section 5e.

5d. Objection, Removal

Cookies are stored on your computer and transmitted from it to our website. Since the cookies are stored on your computer, you have full control over their use. You can deactivate or restrict the transmission of cookies by changing the settings in your web browser. You can delete cookies that have already been saved at any time. This can also be done automatically. If you deactivate cookies in your browser settings for our website, you may not be able to fully use all of the website’s features.

5e. List of Cookies Used

Cookie	Purpose	Duration
Cookie accepted (ifoclCy46qXZu)	Technically required to record the approval decision	365 days
Only for logged-in users
Session Cookie	Technically required: enables actions and rights assigned to the user	4 weeks or end of the session
Only after approval (click-to-play)
youtube.com	Various cookies of the external provider
tv1.com	Various cookies of the external provider
matomo.org	Various cookies of the external provider

6. Newsletter

6a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of distributing the newsletter is obtaining your prior consent, as set out in Art. 6(1)(a) of the GDPR, or, as a result of the sale of goods or supply of services, provided by the legal permission pursuant to § 7 (3) of the German Act Against Unfair Competition (§ 7 Abs. 3 UWG).

6b. Purpose of Data Processing

Your personal data are collected for the purpose of distributing the newsletter to you.

6c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed, i.e. your personal data are stored while the subscription to the newsletter is active.

6d. Objection, Removal

You can cancel your newsletter subscription at any time. To do so, a corresponding link is provided in every newsletter. Canceling the subscription also constitutes a withdrawal of your consent.

7. Registration

7a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of your registration is set out in Art. 6(1)(b) of the DGPR.

7b. Purpose of Data Processing

Your registration facilitates entry into contracts between you and us. Hence the processing of your personal data in the context of the registration is required to fulfil the contract between you and us or to implement pre-contractual measures.

7c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed. This is the case during the registration process when your personal data are no longer required to fulfil a contract or to implement pre-contractual measures Even after entering into the contract, it may be necessary for us to store personal data of a party to the contract in order to comply with contractual or legal requirements.

7d. Objection, Removal

You may cancel your registration at any time. You can also request modification of your stored personal data at any time. In cases where your personal data are necessary to execute a contract or implement pre-contractual measures, early deletion of your personal data will only be possible if there are no contractual or legal requirements that conflict with their deletion.

8. Contact Form and Contact by Email

8a. Legal Basis for Data Processing

The legal basis for processing your personal data transmitted by using the contact form or sending an email is set out in Art. 6(1)(f) of the GDPR. In cases where you use the contact form or send an email with a view to entering into a contract, Art. 6(1)(b) of the GDPR provides an additional legal basis for processing.

8b. Purpose of Data Processing

In the context of you contacting us via the contact form or by email, your personal data is processed for the sole purpose of handling your contact request.

8c. Storage Period

Your personal data will be deleted once they are no longer required for the purpose for which they were collected or otherwise processed. Personal data transmitted via the contact form or by email will be deleted each time a dialogue with you is over. A dialogue is deemed over when it can be inferred from the circumstances that the facts in question have finally been clarified between you and us.

8d. Objection, Removal

You may at any time object to the processing of your personal data in the future in the context of contacting us via the contact form or email. In this we cannot continue a dialogue with you. All personal data stored in the process of your contacting us will be erased.

9. Web Tracking and Web Analysis by Matomo (formerly PIWIK)

9a. Legal Basis for Data Processing

The legal basis for processing your personal data is set out in Art. 6(1)(f) of the GDPR.

9b. Purpose of Data Processing

Processing your personal data enables us to analyse your surfing patterns. By evaluating the collected data, we are able to compile information on your use of specific components of our website. This helps us to continuously improve our website and its user-friendliness. Such processing is therefore necessary for the purposes of the legitimate interests pursued by us, as referred to in Art. 6(1)(f) of the GDPR. By anonymizing your IP address, your interest in protecting your personal data is sufficiently taken into account.

9c. Storage Period

Your personal data will be deleted once they are no longer required for the above-mentioned purposes. In our case, this will be after 14 days.

9d. Objection, Removal

Cookies are stored on your computer and transmitted to our website from your computer. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies that have already been saved at any time. This can also be done automatically. If you deactivate cookies in your browser settings for our website, you may not be able to fully use all features of our website.

More detailed information on the privacy settings of the Matomo software may be found at:
https://matomo.org/docs/privacy/

10. Direct Marketing

10a. Legal Basis for Data Processing

The legal basis for processing your personal data for the purpose of direct mail marketing is set out in Art. 6(1)(f) of the GDPR.

10b. Purpose of Data Processing

The purpose of processing your personal data for the purposes of direct mail marketing is to promote the sale of goods or supply of services. This is a legitimate interest pursued by us as referred to in Art. 6(1)(f) of the GDPR.

10c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed; this will particularly be the case if we receive your objection.

10d. Objection, Removal

You may at any time object, with future effect, to the processing of your personal data in the context of direct mail marketing.

11. Social Media

We use links on our website to the social networks Twitter, YouTube, Flickr, XING, and LinkedIn. The responsibility for data-protection-compliant operation must be ensured by their respective providers. Direct contact between the networks and users is established only when the user actively clicks on one of these links. There is no automatic transfer of user data to the operators of these platforms.

11a. X (Twitter)

This website integrates features of the service X (formerly Twitter). These features are provided by the parent company X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. For the processing of personal data of individuals living outside the United States, the responsible entity is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

When the social media element is activated, a direct connection is established between your device and the X server. As a result, X (formerly Twitter) receives information that you have visited this website. By using X (formerly Twitter) and its "Re-Tweet" or "Repost" function, the websites you visit are linked to your X (formerly Twitter) account and disclosed to other users.
We would like to point out that, as the provider of this site, we have no knowledge of the content of the transmitted data or its use by X (formerly Twitter). Further information can be found in the privacy policy of X (formerly Twitter) at: https://twitter.com/en/privacy.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.

X Corp. is certified under the "EU-U.S. Data Privacy Framework" (DPF). More information about this can be found at the following link: https://www.dataprivacyframework.gov/list.

You can adjust your privacy settings for X (formerly Twitter) in your account settings at: https://twitter.com/account/settings.

11b. YouTube

A link to the YouTube site, operated by Google, is integrated into our website. The operator of the site is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. According to Google, data may also be transferred to the USA, specifically to YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. By clicking on the "YouTube" button, a direct connection is established between you and YouTube. In doing so, the YouTube server is informed about which of our pages you have visited.

If you are logged into your YouTube account, YouTube can directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account before interacting with the YouTube elements.

After activating a YouTube video, further data processing operations may be triggered over which we have no control. The use of YouTube is based on our interest in providing an attractive presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If and insofar as user consent has been requested, processing will be carried out exclusively based on Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Further information on data protection at YouTube can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?hl=en.

YouTube is certified under the "EU-U.S. Data Privacy Framework" (DPF). More information about this certification can be found here: https://www.dataprivacyframework.gov/list.

11c. Xing

Our website contains a link to the social network XING. As soon as you click on the "XING" button, the link establishes direct contact between you and the servers of New Work SE, located at Strandkai 1, 20457 Hamburg, Germany.

The integration of XING enables you to directly access XING profiles and to maintain and expand professional contacts.
For more information on how your data is used by XING, as well as their privacy policy, please visit: https://privacy.xing.com/en/privacy-policy.

11d. LinkedIn

Our website uses features of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
A direct connection between you and LinkedIn will only be established when you click the LinkedIn button. When you do so, a connection to LinkedIn's server is made, and information such as your computer’s IP address and the specific webpage you visited is transmitted to LinkedIn.
If you are logged into your LinkedIn account, LinkedIn can associate your visit to our website with your user account.
We would like to point out that, as the provider of this website, we have no knowledge of the content of the transmitted data or its use by LinkedIn.

LinkedIn's parent company, LinkedIn Corporation, located in Sunnyvale, CA, USA, is certified under the EU-U.S. Data Privacy Framework (DPF).
Further information on how your data is protected when using LinkedIn services can be found here:
Privacy Policy: https://www.linkedin.com/legal/privacy-policy;
Standard Contractual Clauses (ensuring data protection standards for processing in third countries): https://legal.linkedin.com/dpa;
Opt-Out Options: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out;
Data Processing Agreement: https://legal.linkedin.com/dpa.

11e. TV1.eu

Our website contains a link to TV1.eu, a streaming service provider. When you click on the video button, a direct connection is established between you and TV1.eu. In doing so, your IP address is transmitted to the TV1.eu server. This transfer of your IP address is technically necessary in order for you to view the video. The IP address is also used for access evaluation and technical analysis purposes. No user profiles are created.

The transmission of your IP address constitutes the processing of personal data within the meaning of Art. 4 No. 2 GDPR.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.
Dienstanbieter: TV1 GmbH, Beta-Str. 9a, 85774 Unterföhring, Germany; Privacy policy: https://tv1.eu/en/data-protection/

11f. Legal Basis for the Processing of Personal Data

The legal basis for the processing of users’ personal data is Art. 6(1)(f) GDPR.

11g. Purpose of Data Processing

On our website, we use links to the social networks Twitter, Youtube, Flickr, Xing, and LinkedIn on the basis of Art. 6(1)(f) GDPR in order to make the ifo Institute better known. The advertising purpose behind these links is to be regarded as a legitimate interest within the meaning of GDPR.

11h. Objection, Removal

If you do not want the social media provider to be able to associate visits to our pages with you, please log out of your respective user accounts.

12. Legal Defence and Enforcement of Rights

12a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of legal defence and the enforcement of rights is set out in Art. 6(1)(f) of the GDPR.

12b. Purpose of Data Processing

The purpose of processing your personal data in the context of legal defence and the enforcement of rights is the defence against unfounded claims and the legal enforcement of claims and rights. This is a legitimate interest pursued by us as referred to in Art. 6(1)(f) of the GDPR.

12c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed.

12d. Objection, Removal

The processing of your personal data in the context of legal defence and enforcement of rights is essential for legal defence and the enforcement of rights. You therefore have no right to raise any objection.

13. Categories of Recipients

Within our institute, only those entities and departments that need personal data to fulfil the purposes set out above obtain such data. In addition, we work with various service providers and transmit your personal data to other trustworthy recipients such as, for example:

- Banks
- Scan service providers
- Print shops
- Letter shops
- IT service providers
- Lawyers and courts.

14. Rights of the Data Subject

If your personal data are processed by us, you are a data subject within the meaning of the GDPR and have the following rights:

14a. Right of Access

You shall have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed by us.

Where that is the case, you have the right to request the following information from us:

(1) The purposes for which your personal data are being processed;
(2) The categories of personal data concerned;
(3) The recipients or categories of recipient to whom your personal data have been, or will be, disclosed;
(4) The envisaged period for which your personal data will be stored, or, if precise information is not possible, the criteria used to determine that period;
(5) The existence of the right to request rectification or deletion of your personal data, the right to request a restriction on personal data processing, or the right to object to such processing;
(6) The right to lodge a complaint with a supervisory authority;
(7) Any available information as to the source of the data where the personal data are not collected from you;
(8) The existence of automated decision-making, including profiling, referred to in Art.22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

You have the right to obtain access to your personal data and to request information as to whether your personal information will be disclosed to recipients in third countries or international organisations. If so, you shall have the right to be informed of the appropriate safeguards relating to the transfer pursuant to Art. 46 of the GDPR.

14b. Right to Rectification

Where your personal data processed by us are inaccurate or incomplete, you have the right to obtain the rectification and/or the right to have incomplete personal data completed. We are obliged to perform the rectification without undue delay.

14c. Right to Restriction of Processing

You have the right to obtain restriction of processing of your personal data where one of the following applies:

(1) You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data;
(2) Our processing is unlawful and you oppose the deletion of personal data and request the restriction of their use instead;
(3) We no longer need your personal data for processing purposes, but you require them for the establishment, exercise or defence of legal claims, or
(4) You have objected to processing pursuant to Art. 21(1) of the GDPR and the verification as to whether our legitimate grounds override yours is still pending.

In cases where processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.

If you have obtained restriction of processing in accordance with the above requirements, we will inform you before the restriction of processing is lifted.

14d. Right to Deletion

14d i. Obligation to Delete

You have the right to obtain from us the deletion of your personal data without undue delay and we are obliged to delete you’re your personal data without undue delay in cases where one of the following applies:

(1) Your personal data are no longer required for the purposes for which they were collected or otherwise processed;
(2) You withdraw your consent on which the processing is based according to Art. 6(1)(a), or Art. 9(2)(a) of the GDPR, and there is no other legal ground for the processing;
(3) You object to data processing pursuant to Art. 21(1) of the GDPR and there are no overriding legitimate grounds for processing, or you object to processing pursuant to Art. 21(2) of the GDPR;
(4) Your personal data have been unlawfully processed;
(5) Your personal data have to be deleted to comply with a legal obligation under Union or Member State law to which we are subject;
(6) Your personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) of the GDPR.

14d ii. Informing Third Parties

In cases where we have made the personal data public and are obliged to delete them pursuant to Art. 17(1) of the GDPR, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform the controllers processing your personal data that you, the data subject, have requested the data deletion by such controllers of any links to, or copy or replication of those personal data.

14d iii. Exceptions

The right to deletion does not apply if the processing of data is necessary

(1) To exercise the right of freedom of expression and information;
(2) To comply with a legal obligation, which requires processing by Union or Member State law to which we are subject; or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
(3) For reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) as well as Art. 9(3) of the GDPR;
(4) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) of the GDPR in so far as the right referred to in section d. above is likely to render impossible, or seriously impair, the achievement of the objectives of that processing, or
(5) To establish, exercise or defend legal claims.

14e. Notification Obligation

In cases where you have exercised your right to rectification, deletion or restriction of processing, we are obliged to inform all recipients to whom we have disclosed your personal data of such rectification, deletion or restriction of processing unless this proves to be impossible or would involve a disproportionate effort.

You have the right to obtain information on those recipients.

14f. Right to Data Portability

You have the right to receive the personal data, which you have provided us with, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit those data to another controller without hindrance from us, where

(1) The processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6(1)(b); and
(2) The processing is carried out by automated means.

In exercising your right to data portability, you also have the right to have your personal data transmitted directly from us to another controller, where technically feasible. Your rights may not adversely affect the rights and freedoms of others.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

14g. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, at any time to any processing of your personal data, which is based on Art. 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, or freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

In cases where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

In cases where you object to processing for direct marketing purposes, your personal data will no longer be processed to such an end.

In the context of the use of information society services you may, notwithstanding Directive 2002/58/EC, exercise your right to object by automated means based on technical specifications.

14h. Right to Withdraw Consent

You have the right to withdraw your consent to the processing of personal data at any time. This withdrawal of consent will not affect the lawfulness of processing based on consent before your withdrawal.

14i. Automated Individual Decision-Making, including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

(1) Is necessary for enter into, or execute a contract between you and us;
(2) Is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) Is based on your explicit consent.

However, those decisions must not be based on the special categories of personal data referred to in Art. 9(1) of the GDPR, unless Art. 9(2)(a) or (g) of the GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

With regard to the cases referred to in (1) and (3), we will implement suitable measures to safeguard your rights, freedoms and justified interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

14j. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State in which you are ordinarily resident, your place of work or the place where the alleged infringement took place, if you consider that processing of your personal data infringes the GDPR.

The competent supervisory authority for the ifo Institute is:

Bayerisches Landesamt für Datenschutzaufsicht
Postfach 1349
91504 Ansbach
Deutschland

The supervisory authority with which the complaint has been lodged will inform you of its progress and the outcome of your complaint, including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.

If you have any questions, please do not hesitate to contact our data protection officer.

Date of last update: June 3rd, 2025

Privacy Policy CESifo GmbH

Information to be provided pursuant to Art. 12, 13 et seq. of the GDPR

1. Name and Address of Controller

Munich Society for the Promotion of Economic Research – CESifo GmbH
Poschingerstr. 5
81679 Munich
Germany

(hereinafter referred to as "we", "us", "our" or "CESifo")

The protection of your personal data is of great importance to Munich Society for the Promotion of Economic Research – CESifo GmbH. If you have any questions regarding data protection and data security, you may contact us at:

Email: privacy@cesifo.de

Tel.: +49(0)89/9224-0

2. General Information on Data Processing

2a. Scope of Personal Data Processing

2b. Legal Basis for Processing Personal Data

In cases where we seek your consent to process personal data, the legal basis for doing so is set out in Art. 6(1)(a) of the GDPR.

In cases where personal data must be processed to comply with a legal obligation that we are subject to, the legal basis for doing so is set out in Art. 6(1)(c) of the GDPR.

If the processing of personal data is necessary for the performance of a task carried out in the public interest, the legal basis for this is Art. 6(1)(e) GDPR.

2c. Deletion and Storage Period

2d. Converia

We use Converia, operated by Lombego Systems GmbH, for the registration for our events. If you register for an event via our links, your personal data will be transmitted directly to Converia. This data typically includes your name, your contact details, and possibly other event-specific information required for registration. Your data will be processed solely for the purpose of organizing and conducting the respective event.
Converia processes the data on our behalf and in accordance with our instructions as well as applicable data protection regulations.
Further information on data processing by Converia can be found in their privacy policy available at: https://www.converia.de/de/datenschutz.html.

2e. Oxford Abstracts

To manage registrations for our events, we use Oxford Abstracts, operated by Oxford Abstracts Limited. When you register for an event via our links, your personal data is transmitted directly to Oxford Abstracts Limited. This data typically includes your name, contact information, and other event-specific details necessary for the registration process. Your data is processed solely for the organization and execution of the respective event.

Oxford Abstracts Limited processes the data on our behalf and in accordance with our instructions and the applicable data protection regulations. For more information on how Oxford Abstracts Limited handles your personal data, please refer to their privacy policy available at: https://oxfordabstracts.com/privacy-policy/.

3. Website Provision and Creation of Log Files

3a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of website provision and the creation of log files is set out in Art. 6(1)(f) of the GDPR.

3b. Purpose of Data Processing

The temporary storage of your personal data is necessary to enable us to deliver the website to your computer. To this end, your personal data need to be stored for the duration of the session.

The above is necessary for the purposes of the legitimate interests pursued by us referred to in Art. 6(1)(f) of the GDPR.

3c. Storage Period

3d. Objection, Removal

4. Use of Cookies

4a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of using cookies required for technical purposes is set out in Art. 6(1)(f) GDPR.

The legal basis for data processing in the context of the use of technically unnecessary cookies is Art. 6(1)(a) GDPR.

4b. Purpose of Data Processing

4c. Storage Period

4d. Objection, Removal

4e. List of Cookies Used

Cookie	Purpose	Duration
Cookie accepted (ifoclCy46qXZu)	Technically required to record the approval decision	365 days
Only for logged-in users
Session Cookie	Technically required: enables actions and rights assigned to the user	4 weeks or end of the session
Only after approval (click-to-play)
youtube.com	Various cookies of the external provider
tv1.com	Various cookies of the external provider
matomo.org	Various cookies of the external provider

5. Newsletter

5a. Legal Basis for Data Processing

5b. Purpose of Data Processing

Your personal data are collected for the purpose of distributing the newsletter to you.

5c. Storage Period

5d. Objection, Removal

You can cancel your newsletter subscription at any time. To do so, a corresponding link is provided in every newsletter. Canceling the subscription also constitutes a withdrawal of your consent.

6. Registration

6a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of your registration is set out in Art. 6(1)(b) of the DGPR.

6b. Purpose of Data Processing

6c. Storage Period

6d. Objection, Removal

7. Contact Form and Contact by Email

7.a. Legal Basis for Data Processing

7.b. Purpose of Data Processing

In the context of you contacting us via the contact form or by email, your personal data is processed for the sole purpose of handling your contact request.

7.c. Storage Period

7.d. Objection, Removal

8. Web Tracking and Web Analysis by Matomo (formerly PIWIK)

8a. Legal Basis for Data Processing

The legal basis for processing your personal data is set out in Art. 6(1)(f) of the GDPR.

8b. Purpose of Data Processing

8c. Storage Period

Your personal data will be deleted once they are no longer required for the above-mentioned purposes. In our case, this will be after 14 days.

8d. Objection, Removal

More detailed information on the privacy settings of the Matomo software may be found at:
https://matomo.org/docs/privacy/

9. Direct Marketing

9a. Legal Basis for Data Processing

The legal basis for processing your personal data for the purpose of direct mail marketing is set out in Art. 6(1)(f) of the GDPR.

9b. Purpose of Data Processing

9c. Storage Period

9d. Objection, Removal

You may at any time object, with future effect, to the processing of your personal data in the context of direct mail marketing.

10. Social Media

10a. X (Twitter)

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.

X Corp. is certified under the "EU-U.S. Data Privacy Framework" (DPF). More information about this can be found at the following link: https://www.dataprivacyframework.gov/list.

You can adjust your privacy settings for X (formerly Twitter) in your account settings at: https://twitter.com/account/settings.

10b. YouTube

Further information on data protection at YouTube can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?hl=en.

YouTube is certified under the "EU-U.S. Data Privacy Framework" (DPF). More information about this certification can be found here: https://www.dataprivacyframework.gov/list.

10c. Xing

10d. LinkedIn

10e. Bluesky

If you use the ifo Institute's services via the platform operated by Bluesky Social, PBC, Bluesky processes the interactions you perform there. In this context, your IP address, user settings, cookie identifiers, mobile carrier, browser and device information, internet service provider, viewed posts, clicked links, and the frequency/duration of your activities on Bluesky may be automatically collected. The data collected in this context may also be transferred to countries outside the European Union. Please make use of the privacy settings provided by Bluesky. You can find information on your available options under section “7. Your Privacy Choices and Rights” in Bluesky’s privacy policy, available at: https://bsky.social/about/support/privacy-policy#privacy-choices
(as of April 30, 2025).

We would like to point out that, as the provider of this page, we have no knowledge of the content of the data transmitted to Bluesky or of how it is used by Bluesky. Use of this service is based on your consent in accordance with Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. Consent can be withdrawn at any time.

Bluesky is not certified under the EU-U.S. Data Privacy Framework (DPF). According to the European Court of Justice, companies without such certification are considered unsuitable recipients of personal data. However, it is not entirely clear whether Bluesky’s services are operated by a single company or constitute a social media service supported by a broader community. Nevertheless, by using this service, there is a risk that your data may be accessed by U.S. authorities for surveillance and monitoring purposes without adequate legal remedies being available to you.

10f. TV1.eu

The transmission of your IP address constitutes the processing of personal data within the meaning of Art. 4 No. 2 GDPR.

10g. Slido

As part of our events, we use the service Slido to enable interactive polls, Q&A sessions, and discussions. Slido is operated by Slido s.r.o., a company owned by Cisco Systems, Inc. In the course of using this service, personal data such as your IP address, any questions or answers you submit, and, where applicable, your name may be processed. This data is used exclusively for the execution and evaluation of the event and is subject to Slido’s data protection regulations, which you can view at: https://www.sli.do/terms.

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) of the TDDDG. You may withdraw your consent at any time.

Cisco Systems, Inc. is certified under the "EU-U.S. Data Privacy Framework" (DPF). More information is available from the provider at: https://www.dataprivacyframework.gov/list.

10h. Legal Basis for the Processing of Personal Data

The legal basis for the processing of users’ personal data is Art. 6(1)(f) GDPR.

10i. Purpose of Data Processing

On our website, we use links to the social networks X, Youtube, Flickr, Xing, Bluesky and LinkedIn on the basis of Art. 6(1)(f) GDPR in order to make the ifo Institute better known. The advertising purpose behind these links is to be regarded as a legitimate interest within the meaning of GDPR.

10k. Objection, Removal

If you do not want the social media provider to be able to associate visits to our pages with you, please log out of your respective user accounts.

11. Legal Defence and Enforcement of Rights

11a. Legal Basis for Data Processing

The legal basis for processing your personal data in the context of legal defence and the enforcement of rights is set out in Art. 6(1)(f) of the GDPR.

11b. Purpose of Data Processing

11c. Storage Period

Your personal data will be deleted once they are no longer required for the purposes for which they were collected or otherwise processed.

11d. Objection, Removal

12. Categories of Recipients

- Banks
- Scan service providers
- Print shops
- Letter shops
- IT service providers
- Lawyers and courts.

13. Rights of the Data Subject

If your personal data are processed by us, you are a data subject within the meaning of the GDPR and have the following rights:

13a. Right of Access

You shall have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed by us.

Where that is the case, you have the right to request the following information from us:

13b. Right to Rectification

13c. Right to Restriction of Processing

You have the right to obtain restriction of processing of your personal data where one of the following applies:

If you have obtained restriction of processing in accordance with the above requirements, we will inform you before the restriction of processing is lifted.

13d. Right to Deletion

13d i. Obligation to Delete

13d ii. Informing Third Parties

13d iii. Exceptions

The right to deletion does not apply if the processing of data is necessary

13e. Notification Obligation

You have the right to obtain information on those recipients.

13f. Right to Data Portability

(1) The processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6(1)(b); and
(2) The processing is carried out by automated means.

13g. Right to Object

In cases where you object to processing for direct marketing purposes, your personal data will no longer be processed to such an end.

In the context of the use of information society services you may, notwithstanding Directive 2002/58/EC, exercise your right to object by automated means based on technical specifications.

13h. Right to Withdraw Consent

13i. Automated Individual Decision-Making, including Profiling

13j. Right to Lodge a Complaint with a Supervisory Authority

The competent supervisory authority for the ifo Institute is:

Bayerisches Landesamt für Datenschutzaufsicht
Postfach 1349
91504 Ansbach
Deutschland

If you have any questions, please do not hesitate to contact us via the contact details provided in section 1.

Date of last update: June 11, 2026.

You Might Also be Interested in

Information for Participants in ifo Online, E-Mail, Paper and Fax Surveys

Information for Participants in Online, Paper, and Fax Surveys of the Company Monitor (in German)

Data Protection Information for Online Meetings, Telephone Conferences, and Webinars of the ifo Institute

Researchers

Privacy Policy

Privacy Policy ifo Institute

Privacy Policy CESifo GmbH

You Might Also be Interested in