Privacy Notice for Our Social Media Channels

We are pleased about your interest in our social media presence. We operate profiles on various social networks (hereinafter referred to as "social media channels") to present the German-American Fulbright Commission, our programs, and our activities, and to connect with you. The following explanations provide you with information about what type of personal data we process, to what extent, and for what purpose.

These privacy notices apply exclusively to our social media channels listed below. To read the general privacy notice for our website, please click here.

You can access our imprint, which also applies to our social media channels, at https://fulbright.de/impressum.

1.1   The entity responsible in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) is: German-American Fulbright Commission, Lützowufer 26, 10787 Berlin, Germany, Tel.: +49 (0)30-284443-0, Email: info@fulbright.de

1.2   Our Data Protection Officer, Attorney Susanne Klein, Beiten Burkhardt Services GmbH, Ganghoferstraße 33, 80339 Munich, can be reached by phone at +49 (0)69-756095-585 or by email at Susanne.Klein@bbservices.gmbh

2.1   We maintain publicly accessible profiles on various social networks. Visiting these profiles triggers a series of data processing activities. Below, we provide an overview of the personal data we collect, use, and store when you visit our profiles on social networks. Personal data refers to information that can be associated with you as a specific individual (e.g., name, age, address, photos, email addresses, and possibly IP addresses). We also inform you of the rights you have regarding the processing of your personal data. You are not required to provide us with your personal data. However, this may be necessary for certain functionalities of our profiles on social networks. These functionalities may not be available to you or only to a limited extent if you do not provide your personal data.

2.2   When you visit our profiles, your personal data is not only collected, used, and stored by us, but also by the operators of the respective social network. This happens even if you do not have a profile on the respective social network. We have no influence over and are not fully aware of how the operators process the data from your visit to our social media profiles and your interactions with our posts for their own purposes, how long the data is stored, or whether the data is passed on to third parties. Data processing may vary depending on whether you are registered and logged in to the social network or visit the page as a non-registered and/or non-logged-in user. When accessing the fan page or a post, the IP address assigned to your device is transmitted to the operator of the respective social network. When you visit the social network, cookies and similar technologies such as pixels, web beacons, and local storage may be used to collect information about your use of the service and to provide you with features. If you are currently logged in to the social network, a cookie on your device can be used to track how you navigate the web. The platforms can use buttons embedded in websites to track your visits to these websites and associate them with your respective profile. Based on this data, content or advertisements can be tailored to you. If you wish to avoid this, you should log out or disable the "stay logged in" function, delete the cookies on your device, and restart your browser.

2.3   For details on the collection and storage of your personal data, as well as the type, scope, and purpose of its use by the operator of the respective social network, please refer to the privacy policies of the respective operator and the following explanations.

3.1   You have the right, in accordance with Article 15 of the GDPR, to obtain information free of charge about the personal data we have stored about you.

3.2   Additionally, if the legal requirements are met, you have the right to request the correction (Article 16 GDPR), deletion (Article 17 GDPR), and restriction of processing (Article 18 GDPR) of your personal data.

3.3   If the data processing is based on Article 6(1)(e) or (f) of the GDPR, you have the right to object to the processing of your personal data for reasons arising from your particular situation, in accordance with Article 21 GDPR. If you object to the data processing, it will no longer take place in the future unless we can demonstrate compelling legitimate grounds for the processing that override your interests, or if the processing serves the assertion, exercise, or defense of legal claims. Of course, you can object to the processing of your personal data for direct marketing purposes and related data analysis at any time without providing reasons.

3.4   If you have provided us with the processed data, you have the right to data portability in accordance with Article 20 GDPR. However, in the case of social media profiles, you can usually only assert this right with the operator of the respective social network, as they have sole access to your profile data.

3.5   If the data processing is based on consent under Article 6(1)(a) or Article 9(2)(a) of the GDPR, you can withdraw your consent at any time with future effect, without affecting the legality of the processing carried out prior to the withdrawal.

3.6   Additionally, in accordance with Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the data processing carried out by us violates legal provisions.

3.7   If you wish to exercise your data subject rights regarding a specific data processing activity over which we have influence, or if you have any other questions, please contact us in writing or by email, or reach out to our Data Protection Officer mentioned in section 1.2. We will review your request (e.g., request for information or objection) ourselves or forward it to the relevant social network operator if your request pertains to data processing by the social network operator.

4.1   The purpose of data processing by us on our social media platforms is to inform our scholarship recipients, alumni, or other interested individuals about our programs, services, activities, topics, news, and to interact with visitors to our social media platforms on these topics, as well as to respond to corresponding inquiries, praise, or criticism.

4.2   The processing of your personal data during your visit to our social media channels is based on our legitimate interest in effectively informing users and communicating with them in accordance with Article 6(1)(f) GDPR. No overriding conflicting interests of yours are apparent if you use the social networks voluntarily and with knowledge of the respective terms of use and privacy notices, especially since we also provide the content through alternative communication channels, such as our website, whenever possible. If you are registered with the social networks yourself, the processing is also carried out in accordance with Article 6(1)(b) GDPR, in compliance with the terms of use that apply between you and the social network. Insofar as cookies or similar technologies are stored on your device by the social network providers, the legal basis for technically necessary cookies or similar technologies is Section 25(2) No. 2 TDDDG, and otherwise your consent in accordance with Section 25(1) TDDDG.

4.3   We reserve the right to delete content if necessary. We may also share your content on our page if this is a function of the social media platform and communicate with you via the platform.

5.1   A transfer of your data to third parties generally only takes place if you have given us your consent in accordance with Article 6(1)(a) GDPR, which you can revoke at any time with effect for the future. This may be the case, for example, if we run joint competitions with third-party providers on our social media channels, where you are asked to accept the terms of participation and agree to the associated data processing if you choose to participate. Disclosure to entitled state institutions and authorities will only take place within the framework of statutory information obligations or if we are obliged to provide information by a court decision. In this case, the transfer of your data is necessary according to Article 6(1)(c) GDPR to fulfill a legal obligation to which we are subject.

5.2   External service providers who process data on our behalf are carefully selected and contractually bound by strict obligations. These service providers work according to our instructions, which is ensured by strict contractual regulations, technical and organizational measures, and additional controls.

5.3   We point out that when data is processed by the operators of social networks, your personal data may be processed in so-called third countries outside the EU or the European Economic Area. In these cases, the level of data protection in the third country may not have been determined by the EU Commission in accordance with Article 45 GDPR, and there may also be no appropriate safeguards within the meaning of Article 46 GDPR. Therefore, it is possible that the level of data protection in the third country may not be equivalent to that of the GDPR. Data may be used, for example, for commercial interests to display specific advertisements to users. Users may also face risks because, for instance, it could become more difficult to enforce their rights. For details, please refer to the following explanations.

6.1   We store your personal data for as long as necessary to fulfill the intended purpose or as required by legitimate reasons in accordance with Article 17(3) GDPR, such as statutory retention periods. As long as legal retention obligations, such as those under tax and commercial law, prevent the deletion of your personal data, we will restrict the processing of your data; subsequently, your data will be deleted in accordance with legal provisions.

6.2   All public posts made by you on our social media channels will remain on the timeline indefinitely unless we delete them due to an update to the underlying topic or a legal violation, or unless you delete the post yourself. We have no influence over the deletion of your data by the social network operator. Therefore, the privacy policies of the respective operator apply in addition.

6.3   If you contact us, the data will be deleted once it is no longer necessary to achieve the purpose for which it was collected. This is the case when the respective conversation with you is concluded. The conversation is considered concluded when it can be inferred from the circumstances that the relevant matter has been fully resolved. If the data provided is subject to tax and commercial law retention obligations, it will be stored for the duration of the legal retention obligations and then deleted, unless you have consented to storage beyond this period or further processing of the data is necessary for the assertion, exercise, or defense of legal claims.

Our Facebook and Instagram pages are accessible through Meta's platform, which is operated in the European Union by Meta Platforms Ireland Ltd., Merrion Road Dublin 4, D04 X2K5, Ireland ("Meta").

When you visit our Facebook/Instagram page, Meta collects usage data. Meta is generally solely responsible for these data processing activities from a data protection perspective. Meta provides information about this in its privacy policy and cookie policy. Additional, more specific information can also be found in Facebook's help section and Instagram's privacy information.

The data collected about you in this context is processed by Meta and may be transferred to countries outside the EU. Meta describes the information it receives and how it is used in its aforementioned privacy policy. There, you will also find information on how to contact Meta and the settings for advertisements.

When accessing a Facebook/Instagram page, the IP address assigned to your device is transmitted to Meta. According to Meta, this IP address is anonymized. Meta also stores information about its users' devices (e.g., as part of the "login notification" function); Meta may thus be able to associate IP addresses with individual users.

If you are currently logged in to Facebook/Instagram as a user, a cookie with your Facebook/Instagram ID is stored on your device. This allows Meta to track that you visited this page and how you used it. This also applies to all other Facebook/Instagram pages. Through Facebook/Instagram buttons embedded in websites, Meta can track your visits to these websites and associate them with your Facebook/Instagram profile. Based on this data, content or advertisements may be tailored to you.

If you wish to avoid this, you should log out of Facebook/Instagram or deactivate the "stay logged in" function, delete the cookies on your device, and close and restart your browser. This will remove information that directly identifies you. This way, you can use the Facebook/Instagram fan page without revealing your Facebook/Instagram ID. If you access interactive functions of the page (like, comment, share, messages, etc.), a login screen will appear. Once logged in, you will again be recognizable to Facebook/Instagram as a user.

According to its own information, Meta stores data until it is no longer needed to provide the services and Facebook/Instagram products or until the respective user account is deleted, whichever occurs first. This depends on the specifics of the individual case, particularly the type of data, why it was collected and processed, and the relevant legal or operational storage needs.

In connection with the aforementioned functions, Meta may also transfer the processed data to servers outside the EU, particularly to Meta Platforms Inc. in the USA, as necessary to provide these services. For the USA, the EU-U.S. Data Privacy Framework provides an adequacy decision by the EU Commission, certifying an adequate level of data protection under GDPR for certified companies. Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework and is also listed in the Data Privacy Framework List maintained by the U.S. Department of Commerce. Therefore, a consistently high level of data protection is ensured when data is transferred to servers of Meta Platforms Inc. in the USA. If data is transferred to the USA, such a third-country transfer is based on Article 45(1) sentence 1 GDPR.

When you visit our Facebook/Instagram page, Meta also uses certain usage data (e.g., whether you liked or commented on certain posts) to provide us with aggregated usage statistics (so-called "Page Insights"). Usage statistics do not allow any conclusions about the behavior of individual users but only provide us with an overview of the use of the Facebook/Instagram page (e.g., which posts were clicked on particularly frequently). We do not have access to the personal data processed to create the statistics. The specific usage actions recorded by Facebook/Instagram are determined solely by Meta and cannot be set, changed, or otherwise influenced by us.

We receive usage statistics from Facebook/Instagram to improve the posts published there and to make them as interesting as possible for users.

In the processing of personal data for the creation of these usage statistics, Meta and we are joint controllers in accordance with Article 26 GDPR.

Facebook's information on Page Insights describes which data are processed within the framework of joint responsibility and includes the "Page Insights Supplement," in which Meta and we have contractually determined who fulfills which obligations under the GDPR.

When you contact us through our Facebook/Instagram page, such as by commenting on a post or sending us a message via Facebook/Instagram Messenger, we process your related personal data (e.g., your name and communication contents) to handle your request.

Our LinkedIn page is accessible via the LinkedIn platform, which is operated in the European Union by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn").

When you visit our LinkedIn page, LinkedIn collects usage data. LinkedIn is primarily responsible for these data processing activities under data protection laws. LinkedIn provides information about this in its Privacy Policy and Cookie Policy.

LinkedIn processes data that you voluntarily provide during registration, such as your name, email address, phone number, and payment and billing information if you have registered for a premium service, or your address book contacts if you have uploaded or synchronized it. LinkedIn also processes personal information you publish on your profile, such as education, work experience, skills, photo, or other demographic data if you provide, post, or upload them on the network’s services.

Additionally, LinkedIn analyzes the content you share to determine your interests, stores and processes confidential messages you send directly to other users, and may determine your location based on geolocation data such as GPS, wireless network information, or your IP address to deliver ads or other content to you.

Finally, LinkedIn also receives information when you view content, even if you do not have an account. These so-called “log data” may include IP address, browser type, operating system, information about previously visited websites and the pages you visited, your location, your mobile provider, the device you used (including device ID and application ID), the search terms you used, and cookie information.

Through LinkedIn buttons or widgets embedded in websites and the use of cookies, LinkedIn can track your visits to these websites and associate them with your LinkedIn profile. Based on this data, LinkedIn can offer content or ads tailored to you.

In connection with the functions mentioned above, LinkedIn may also transfer the processed data to servers outside the EU, particularly to LinkedIn Corp. in the USA, if necessary to provide these services. For the USA, the EU-U.S. Data Privacy Framework provides an adequacy decision by the EU Commission, certifying that companies meeting the framework adhere to an adequate level of data protection in accordance with the GDPR.

However, LinkedIn Corp. is not yet certified under the EU-U.S. Data Privacy Framework. For EU citizens, this means an increased risk, as U.S. security agencies could access and process their data. Moreover, legal remedies against U.S. security agencies’ actions are limited. According to LinkedIn, however, standard contractual clauses for data transfers between LinkedIn Ireland Unlimited Company and LinkedIn Corp. have been agreed upon. This ensures LinkedIn’s commitment to maintaining European data protection standards even when transferring data to third countries like the USA. Any such transfer of data to the USA is based on Article 46(2)(c) of the GDPR.

When visiting, following, or engaging with our LinkedIn page, LinkedIn processes personal data to provide us with anonymized statistics and insights through analysis tools. This gives us insights into the types of actions people take on our page (so-called Page Insights). The data processed includes information you provided during LinkedIn registration or use. We have no influence over LinkedIn’s use of such tools and have not been informed about their potential use. We only receive anonymized, non-personal information about posting activity, such as the number of company page or link clicks through a specific post. Therefore, we cannot draw conclusions about individual users from the Page Insights data.

We use the usage statistics to improve the content published on LinkedIn and make it as interesting as possible for users.

For the processing of personal data for the creation of these usage statistics, LinkedIn and we are joint controllers under Article 26 of the GDPR. In the Page Insights Joint Controller Addendum, LinkedIn and we have contractually defined which of us fulfills which obligations under the GDPR. It also describes which data is processed within the framework of joint responsibility.

When you contact us through our LinkedIn page, such as by commenting on a post or sending a message via LinkedIn messages, we process your data (e.g., your name and communication contents) to handle your request.

Please note that we can see the names of registered LinkedIn users who have visited our LinkedIn page. If you do not wish to share this information, you can activate the so-called "private mode" in your LinkedIn profile settings.

Our X profile is accessible via the X or Twitter platform, which is operated in the European Union by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland ("Twitter").

When you view our X profile or the profile of a third party on X and the posts there, Twitter collects information about your interactions with these profiles and content and processes this information independently for its own purposes in accordance with X’s privacy policies.

To our knowledge, Twitter uses this information to determine topics you may be interested in and uses this data to personalize the posts and ads you see on X. For these purposes, Twitter generally also uses cookies on your device and similar technologies to recognize you. Twitter may also link this data with your X account. Twitter performs these processing activities independently and without our influence, and we cannot deactivate or restrict these processing activities.

You can limit the processing of your data in the general settings of your X account, as well as under "Privacy and Security." Additionally, on mobile devices (smartphones, tablets), you can restrict Twitter’s access to contact and calendar data, photos, location data, etc., depending on the operating system used. Further information on these settings is available on X’s support page.

In connection with the above functions, Twitter may also transfer the processed data to servers outside the EU, particularly to X Corp. in the USA, if necessary to provide these services. For the USA, the EU-U.S. Data Privacy Framework provides an adequacy decision by the EU Commission, certifying that companies meeting the framework adhere to an adequate level of data protection in accordance with the GDPR. However, X Corp. is not yet certified under the EU-U.S. Data Privacy Framework. For EU citizens, this implies an increased risk as U.S. security agencies might access and process their data. Furthermore, legal remedies against U.S. security agencies’ actions are limited. According to Twitter, standard contractual clauses of the EU Commission apply to data transfers to the USA or other third countries. This commits Twitter to maintaining European data protection standards even when transferring data to third countries like the USA. Any such transfer of data to the USA or another third country is based on Article 46(2)(c) of the GDPR.

In connection with our X profile, we receive detailed reports from Twitter about how users interact with our X profile and individual posts. However, these reports do not include any personal data but only general statistics and summaries, such as the total number of views of our profile and individual posts. We cannot filter the reports by users or user groups or set such criteria for creating the reports. Therefore, we cannot determine from the reports and data provided by Twitter whether a specific user has performed a certain interaction. We also do not create profiles of individual users. We do not have access to personal data processed by Twitter. Only Twitter determines how data for statistics and summaries are processed. We have no legal or actual influence on the processing by Twitter.

We request usage statistics to improve the posts published on X and make them as interesting as possible for users.

Furthermore, we process your data, which you may send us via X, solely for managing our X profile, especially to respond to questions or to react to your posts, comments, and messages on X.

Our YouTube channel is accessible via the YouTube platform, which is operated in the European Union by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

When you visit our YouTube channel, Google collects usage data. Google is solely responsible for these data processing activities. Information about this is provided in Google’s Privacy Policy.

We have no influence over the nature and scope of the data processed by Google, how the data is processed and used, or the sharing of this data with third parties. We also do not have effective control over this.

When using YouTube, your personal data is collected, transmitted, stored, disclosed, and used by Google, regardless of your residence, and transferred and stored in the USA, Ireland, and any other country where Google operates. Data may be transferred to affiliated companies of Google as well as other companies or individuals who process the data on Google’s behalf.

Google processes your voluntarily provided data such as your name and username, email address, and phone number. Google also processes content you create, upload, or receive from others using its services. This includes, for example, photos and videos you save, documents and spreadsheets you create, and comments you write on YouTube videos.

Additionally, Google analyzes the content you share to determine your interests, stores and processes confidential messages you send directly to other users, and may determine your location based on GPS data, wireless network information, or your IP address to provide you with ads or other content.

Finally, Google also receives information when you, for example, view content, even if you do not have an account. These so-called “log data” may include IP address, browser type, operating system, information about previously visited websites and the pages you viewed, your location, your mobile provider, the device you used (including device ID and application ID), search terms used, and cookie information. You can limit the processing of your data in the general settings of your Google/YouTube account. In addition to these tools, Google offers specific privacy settings for YouTube. More information is available in Google’s Privacy Guide for Google Products.

In connection with the above functions, YouTube may also transfer the processed data to servers outside the EU, particularly to Google LLC in the USA, if necessary to provide these services. For the USA, the EU-U.S. Data Privacy Framework provides an adequacy decision by the EU Commission, certifying that certified companies adhere to an adequate level of data protection according to the GDPR. Google LLC is certified under the EU-U.S. Data Privacy Framework and is also listed on the U.S. Department of Commerce’s Data Privacy Framework List. Therefore, a high level of data protection is ensured for data transferred to Google LLC’s servers in the USA. Any such transfer of data to the USA is based on Article 45(1) sentence 1 of the GDPR.

Google uses certain data collected from YouTube platform users (e.g., which videos users watch) to create aggregated usage statistics and provide them to the operators of the YouTube channel (so-called “YouTube Insights”). We also receive such aggregated usage statistics. The information we receive through YouTube Insights does not allow us to identify individual users. We do not have access to personal data processed by Google for YouTube Insights. Only Google determines which data is processed for YouTube Insights and how. We have no legal or actual influence on Google's processing.

We request usage statistics to improve the posts published on our YouTube channel and make them as interesting as possible for users.

When you contact us via our YouTube channel, such as by commenting on a video, we process your data (e.g., your name and the communication contents) to handle your request.

We are interested in occasionally publishing images of you that were taken in connection with our scholarship programs or during your participation in one of our own Fulbright events on the internet, particularly on our aforementioned social media channels. Generally, we obtain your explicit consent for this purpose. This is especially true for images where your likeness is prominently displayed; in such cases, we will inform you separately before publishing such images and seek your consent.

If we publish images that may also include you to protect our legitimate interests—such as to provide an impression of the events we conduct—you have the right to object under Article 21(1) GDPR (see the rights of the data subjects in section 3 for details).

Please note that, according to currently available information, photos posted on social networks may not be completely deletable but can only be made non-public. There is insufficient information about the internal use of recordings and data by social networks—for example, for the creation of personal profiles (see also section 2.2 above). Additionally, the providers of social networks may be based in the USA or process personal data in the USA, where an equivalent level of data protection comparable to the GDPR is only ensured under certain conditions. This could, among other things, make it more difficult to enforce your rights regarding the images. Details about the respective social networks can be found above in sections 7 to 10.

Please note that we are only responsible for the publication of images that were created within our area of responsibility, particularly during Fulbright events conducted by us, and that are published on our dissemination channels (e.g., the website and social media channels of the German-American Fulbright Commission).