Privacy Policy
WEBSITE PRIVACY NOTICE
Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
1. Controller
The controller responsible for the processing of personal data in connection with this website within the meaning of Article 4(7) GDPR is:
Life Sciences Acceleration Alliance e.V.
St.-Martin-Str. 102
81669 Munich, Germany
Contact: Rainer Westermann, Chairman
In this Privacy Notice, the controller is referred to as “the Association”, “we”, “us” or “our”.
2. Contact for Data Protection Matters
The Association is not required to appoint a data protection officer under Article 37 GDPR in conjunction with § 38 German Federal Data Protection Act (BDSG). If you have questions or requests relating to the processing of your personal data or to the exercise of your rights under the GDPR, please contact:
Email: info@lsaa.eu
Postal: [same as under Section 1, to the attention of: “Data Protection”]
3. Processing Activities in Connection with this Website
When you visit and interact with our website, we process personal data only to the extent described below. We do not use web analytics services, advertising cookies, or cross-site tracking technologies.
3.1 Access to the Website (Server Log Files)
Purpose: Enabling the delivery of the website, ensuring the stability and technical security of our systems, and detecting and defending against attacks.
Categories of personal data: IP address (in full during the session; [truncated / anonymized for storage]); date and time of the request; requested URL; HTTP status code; transmitted data volume; referrer URL; browser type and version; operating system.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and effective operation of our website.
Retention: Log data are automatically deleted after 7 days, unless retention is required in a specific case to investigate a security incident.
3.2 Contact by Email or Contact Form
Purpose: Responding to inquiries submitted through the contact details published on this website or through the contact form.
Categories of personal data: Name; email address; [subject / organization affiliation, where provided]; message content; any further information you voluntarily include.
Legal basis: Article 6(1)(b) GDPR where the inquiry is made with a view to entering into or performing a contractual or pre-contractual relationship; otherwise Article 6(1)(f) GDPR, our legitimate interest being to respond to inquiries addressed to us.
Retention: Inquiries and related correspondence are deleted once the matter has been fully processed and no statutory retention obligations apply. Where the correspondence gives rise to obligations under commercial or tax law, the applicable statutory retention periods (generally six or ten years under §§ 147 AO, 257 HGB) apply.
3.3 Website Search
Purpose: Returning results relevant to queries entered into the on-site search function.
Categories of personal data: Search query; date and time; IP address (for rate-limiting and abuse prevention).
Legal basis: Article 6(1)(f) GDPR; our legitimate interest is to provide a usable and secure search function.
Retention: Search queries are not stored in identifiable form.
3.4 Embedded Videos
Purpose: Displaying videos relevant to the Association’s activities (e.g. recorded webinars and statements) from third-party video platforms, only after the user has actively consented to loading the respective embed.
Categories of personal data: Before consent: no personal data are transmitted to the video platform. After consent: IP address; browser and device information; interaction data with the player; and, where the user is logged in to the platform, account identifiers.
Legal basis: Article 6(1)(a) GDPR (and, where the platform accesses or stores information on the user’s device, § 25(1) of the German Telecommunications Digital Services Data Protection Act – TDDDG – based on the same consent). The consent is voluntary and may be withdrawn at any time with effect for the future.
Retention: Retention is governed by the respective platform’s privacy policy. The Association itself does not store data generated by the embedded player.
Further information: Where the video platform is based outside the European Economic Area (in particular in the United States), please see Section 5 on international data transfers below.
3.5 Links to Social Media Channels
Purpose: Providing links to the Association’s profiles on [e.g. LinkedIn, YouTube]. The links are implemented as static hyperlinks; no content is loaded from these platforms until the user actively clicks the link.
Categories of personal data: Until the user actively clicks the link, no personal data are transferred to the platform. Upon clicking, the user is redirected to the third-party site, where the platform’s own privacy policy applies.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest lies in making the Association’s public presence easily accessible.
Retention: Not applicable on our side. Please refer to the privacy policies of the respective platforms.
4. Recipients of Personal Data
We disclose personal data only where necessary for the purposes described in this Privacy Notice and only to the following categories of recipients:
- IT service providers acting as processors on our behalf, in particular our [web hosting / email / content management / newsletter] providers;
- professional advisors bound by confidentiality (in particular legal counsel and auditors), where necessary for the establishment, exercise or defense of legal claims;
- public authorities and courts, where disclosure is required by law or ordered by a competent authority;
- third-party video and social media platforms, only to the extent described in Section 3 above and, where applicable, subject to your prior consent.
We do not sell personal data and do not disclose personal data for the direct marketing purposes of third parties.
5. Transfers to Third Countries
Personal data are primarily processed within the European Economic Area (EEA). Transfers to third countries (i.e. countries outside the EEA) may occur in particular where we use providers whose servers or sub-processors are located in such countries, or where you actively consent to loading content embedded from such providers (see Section 3.4).
Where personal data are transferred to a third country, we ensure an adequate level of protection in accordance with Chapter V GDPR by one of the following instruments:
- an adequacy decision of the European Commission pursuant to Article 45 GDPR (e.g. for the United Kingdom, Switzerland, or transfers to certified recipients in the United States under the EU-U.S. Data Privacy Framework);
- Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR, supplemented by additional technical and organizational measures where necessary following a transfer impact assessment; or
- your explicit consent pursuant to Article 49(1)(a) GDPR, after you have been informed of the possible risks associated with the transfer.
A copy of the safeguards relied upon is available on request to the contact details set out in Section 2.
6. No Automated Decision-Making
We do not use the personal data collected through this website for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
7. Your Rights as a Data Subject
Subject to the conditions set out in the GDPR, you have the following rights with respect to personal data concerning you:
- Right of access (Article 15 GDPR) — to obtain confirmation as to whether personal data concerning you are being processed and, where that is the case, access to those data and related information;
- Right to rectification (Article 16 GDPR) — to have inaccurate data corrected and incomplete data completed;
- Right to erasure (Article 17 GDPR) — to have your data deleted in the cases specified therein;
- Right to restriction of processing (Article 18 GDPR);
- Right to data portability (Article 20 GDPR), where applicable;
- Right to withdraw consent (Article 7(3) GDPR) at any time with effect for the future, where processing is based on your consent.
To exercise these rights, please contact us using the contact details set out in Section 2. We will respond without undue delay and in any event within the statutory deadlines.
8. Right to Object — Article 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will no longer process your personal data in those circumstances unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
Where we process personal data for direct marketing purposes, you have the right to object at any time without giving any reason. Following your objection, we will cease processing the relevant data for such purposes.
9. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR (Article 77 GDPR).
The supervisory authority competent for the Association is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — www.lda.bayern.de]
10. Changes to this Privacy Notice
We may amend this Privacy Notice from time to time to reflect changes in our processing activities or in the legal framework. The current version is identified by the version number and date set out below. We recommend that you review this Privacy Notice periodically.
Version 1.0 — Effective date: October 1, 2026