Data Protection

I. Name and Address of the Controller Pursuant to Article 4(7) of the GDPR

The controller within the meaning of the General Data Protection Regulation, other national data protection laws of the Member States, and other data protection regulations is:
Koblenz University of Applied Sciences
President
Konrad-Zuse-Strasse 1
56075 Koblenz
Germany

Tel.: +49 261 9528-0
E-mail: president
Website: www.hs-koblenz.de

Data Protection Officer of Koblenz University of Applied Sciences
N.N.
E-mail : data protection

II. General Information on Data Processing

1. Scope of the Processing of Personal Data
We generally only process personal data to the extent that this is necessary for the provision of a functional website as well as our content and services. Your personal data is only processed on a regular basis after we have obtained your consent. An exception applies in those cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.
2. Legal Basis for the Processing of Personal Data
Where we obtain the consent of the data subject for processing operations involving personal data, the legal basis for the processing is point (a) of Article 6(1) of the EU Data Protection Regulation (GDRP). Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, the legal basis is point
(b) of Article 6(1) of the GDPR. This also applies to processing activities necessary to take steps prior to entering into a contract. Where the processing of personal data is necessary for the compliance with a legal obligation to which Koblenz University of Applied Sciences is subject, the legal basis is point
(c) of Article 6(1) of the GDPR. If the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, the legal basis is point
(d) of Article 6(1) of the GDPR.
If the processing is necessary for the purposes of the legitimate interests pursued by our organisation or by a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis for the processing is point (f) of Article 6(1) of the GDPR.

3. Data Erasure and Storage Period
Your personal data will be erased or blocked as soon as the purpose of their storage no longer applies. The data may be stored for a longer period if this has been provided for by the European or national legislator in Union regulations, laws, or other provisions to which the University is subject. Data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract. III. Provision of the Website and Creation of Log Files
1. Description and Scope of the Data Processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. The following data are collected:
(1) Your IP address
(2) Date and time of access
(3) Information about the browser type and version used
(4) Your operating system
(5) Content of the request (specific page)
(6) Access status/HTTP status code
(7) Amount of data transferred with each access
The data are also stored in the log files of our system. These data will not be stored together with the user’s other personal data.

2. Legal Basis for the Data Processing
The legal basis for the temporary storage of the data and the log files is point (f) of Article 6(1) of the GDPR.

3. Purpose of the Data Processing
The IP address must be saved temporarily by the system so that it can deliver the website to your computer. For this purpose, your IP address must remain stored for the duration of the session. The data are stored in log files in order to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. The data are not analysed for marketing purposes in this respect. Our legitimate interest in the data processing according to point (f) of Article 6(1) of the GDPR is also based on these purposes.

4. Duration of Storage
The data are erased as soon as they are no longer required to achieve the purpose for which they were collected. Where data are collected for the purposes of providing the website, this is the case when the corresponding session has ended. Where data are stored in log files, this is the case after seven days at the latest. Data may be stored for a longer period. In this case, the IP addresses of the users are deleted or masked in way to ensure that the calling client can no longer be identified.

5. Possibility of Objection and Removal
The recording of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Therefore, there is no possibility of objection.

IV. Use of Cookies

1. Description and Scope of the Data Processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on your computer system. If you call up a website, a cookie may be stored on your operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after leaving a page.
The following data are stored and transmitted in the cookies:
(1) User browsing behaviour
The data transmitted to analyse your browsing behaviour are described in section VIII 1.
(2) Consent to our cookie policy
The data collected in this manner are pseudonymised by technical measures. Therefore, it is no longer possible to associate the data with the calling user. The data will not be stored together with your other personal data. When you access our website, you will be informed about the use of cookies for analysis purposes, and we will ask for your consent to the processing of personal data used in this context. This process also includes a reference to this data protection statement.

2. Legal Basis for the Data Processing
The legal basis for the processing of personal data using cookies is point (f) of Article 6(1) of the GDPR.

3. Purpose of the Data Processing
The purpose of using cookies that are necessary for technical reasons is to simplify the use of web pages for users. Some functions of our website cannot be offered without the use of cookies. For these functions, the browser has to be recognised even after leaving a page. We need cookies for the following applications:
(1) Analysis of your browsing behaviour
(2) Storage of the consent to our cookie policy
The user data collected by cookies that are necessary for technical reasons are not used to create user profiles. Analysis cookies are used for the purpose of improving the quality of our website and its content. Analysis cookies allow us to learn how the website is used and therefore to continuously optimise our offer. Our legitimate interest in the processing of personal data in accordance with point (f) of Article 6(1) of the GDPR is also based on these purposes.

4. Duration of Storage, Possibility of Objection and Removal
Cookies are stored on your computer and transmitted from it to our site. That is why you as a user have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transfer of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you might not be able to fully use all functions of our website.

V. Newsletter

1. Description and Scope of the Data Processing
Our website offers the possibility to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask are transmitted to us.
These are:
(1) E-mail address
In addition, the following data are collected when registering:
(1) Date and time of registration
In the registration process, your consent is obtained, and reference is made to this data protection statement. No data are passed on to third parties in connection with the processing of data for the purposes of sending out the newsletters. The data will be used exclusively for sending the newsletter.

2. Legal Basis for the Data Processing
Where the user has given his or her consent, the legal basis for the processing of data after registering for the newsletter is point (a) of Article 6(1) of the GDPR.

3. Purpose of Data Processing
The purpose of collecting your e-mail address is to deliver the newsletter. The other personal data collected during the registration process is used to prevent any misuse of the services or the e-mail address used.

4. Duration of Storage
The data are erased as soon as they are no longer required to achieve the purpose for which they were collected. Accordingly, your e-mail address will be stored as long as the subscription to the newsletter is active.
The other personal data collected during the registration process are usually erased after a period of seven days.

5. Possibility of Objection and Removal
You can cancel the subscription to the newsletter at any time. Every newsletter contains a link for this purpose, under which it is also possible to withdraw the consent to the storage of the personal data collected during the registration process.

VIa. Online Registrations (Continuing Education, Events, etc.)

1. Description and Scope of the Data Processing
On our website, we offer you the possibility to register by providing personal data. The data are entered in an input mask and transmitted to us and stored. The data are not shared with any third parties. The following data are also stored at the time of registration:
(1) Date and time of registration
In the registration process, we obtain your consent to the processing of these data.
2. Legal Basis for the Data Processing
If you have given your consent, the legal basis for the processing of the data is point (a) of Article 6(1) of the GDPR.
3. Purpose of the Data Processing
Your registration is required for the provision of certain content and services on our website.

4. Duration of Storage
The data are erased as soon as they are no longer required to achieve the purpose for which they were collected. This is the case for the data collected during the registration process if the registration on our website is cancelled or modified.

5. Possibility of Objection and Removal
As a user, you have the option to cancel the registration at any time. You can have the data stored about you changed at any time. You can have your account deleted or the data changed by e-mail at the place where you register.

VIb. Career Fair Praxis@Campus

1. Description and Scope of the Data Processing
On our website, we offer users the possibility to register for the participation in our Praxis@Campus career fair by providing personal data. The data are entered in an input mask and transmitted to us and stored. Companies participating in Praxis@Campus appear with a standardised company profile in the job brochure. The information required for this is also recorded via an input mask on the Internet.
These data are:
(1) Company name
(2) Street/PO box
(3) Postcode and city
(4) First name
(5) Last name
(6) Role
(7) Telephone number
(8) E-mail address

Voluntary data:
(1) Department
(2) Title
(3) Role
(4) Mobile phone number

The following data are also stored when the message is sent:
(1) Date and time of registration
When you enter the company profile for the job brochure, we store the following data necessary for the creation of the brochure:
(1) Company name
(2) Department
(3) Street/PO box
(4) Postcode and city
(5) Internet address
(6) First name
(7) Last name
(8) Role
(9) Telephone number
(10) E-mail address

Voluntary data
(1) Title
(2) Mobile phone number
(3) Industry
(4) Location
(5) Number of employees
(6) Other information

The following data are also stored when the message is sent:
(1) Date and time of registration
During the submission process, we obtain your consent to the data processing and make reference to this data protection statement Your personal data will not be transferred to any third parties unless we have explicitly indicated this and you have given your express consent in accordance with sentence 1 of point (a) of Article 6(1) of the GDPR.

2. Legal Basis for the Data Processing
Where the user has given his or her consent, the legal basis for the processing of data is point (a) of Article 6(1) of the GDPR. The legal basis for the processing of data transmitted when an e-mail is sent is point (f) of Article 6(1) of the GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is point (b) of Article 6(1) of the GDPR.

3. Purpose of the Data Processing
Your registration provides us with the possibility to compile all information and thus ensure an efficient organisation of the career fair for us and you.

4. Duration of Storage
Your data will be stored to fulfil our contractual obligations, to inform you about our future career fairs, and to send you invitations.

5. Possibility of Objection and Removal
As a user, you have the possibility of cancelling the registration at any time. You can have the data stored about you changed at any time. You can have your account deleted or the data changed by e-mail at the place where you register.

VII. Job Board

1. Description and Scope of the Data Processing
Our website includes a job board, which can be used to submit job offers electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored.

These data are:
(1) Company address
(2) E-mail address
(3) Contact person
(4) Job title
(5) Type of job offer
(6) Category/discipline
(7) Brief description
(8) Job description
(9) Link to the application form (external)
(10) Country/location
(11) Time frame
(12) Release for publication on www.wissenschaftsregion-bonn.de

The following data are also stored when the message is sent:
(1) Date and time
During the submission process, we ask for your consent to the data processing and make reference to this data protection statement. In this context, the data will not be shared with any third parties. The data will be used exclusively to process the job offer.

2. Legal Basis for the Data Processing
Where the user has given his or her consent, the legal basis for the processing of data is point (a) of Article 6(1) of the GDPR. The legal basis for the processing of data transmitted when an e-mail is sent is point (f) of Article 6(1) of the GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for the processing is point (b) of Article 6(1) of the GDPR.

3. Purpose of Data Processing
The personal data from the input mask is processed solely for the purposes of processing the job offer. The other personal data processed during the submission process are used to prevent any misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of Storage
The data are erased as soon as they are no longer required to achieve the purpose for which they were collected. The additional personal data collected during the submission process will be erased after a period of seven days at the latest.

5. Possibility of Objection and Removal
You have the possibility to withdraw your consent to the processing of personal data at any time. You can object to the storage of your personal data at any time by contacting us by e-mail.

VIII. Web Analysis by Matomo (formerly PIWIK)

1. Scope of the Processing of Personal Data
We use the open-source software tool Matomo (formerly PIWIK) on our website to improve our website based on the analysis of the browsing behaviour of our users. The software places a cookie on your computer (for information on cookies, see above). The following data are stored when individual pages of our website are accessed:
(1) Two bytes of the IP address of your calling system
(2) The accessed web page
(3) The web page from which you reached the accessed web page (referrer)
(4) The subpages accessed from the accessed web page
(5) The time spent on the web page
(6) The frequency of accessing the web page

The software runs exclusively on the servers of our website at the University. Personal data of users are only stored on these servers. The data are not shared with any third parties.
The software is set to not completely save your IP address and to mask 2 bytes of the IP address (e.g.: 192.168.xxx.xxx). This way it is no longer possible to associate the shortened IP address with the calling computer.

2. Legal Basis for the Processing of Personal Data
The legal basis for the processing of the user's personal data is point (f) of Article 6(1) of the GDPR.

3. Purpose of Data Processing
The processing of personal data enables us to analyse the browsing behaviour of our users. The analysis of the data obtained enables us to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. Our legitimate interest in the processing of personal data according to point (f) of Article 6(1) of the GDPR is also based on these purposes. The users' interest in the protection of their personal data is duly taken into account through the anonymisation of the IP address.

4. Duration of Storage
These anonymised data will be erased as soon as they are no longer needed for our capturing purposes. In our case, this occurs after 210 days.

5. Possibility of Objection and Removal
Cookies are stored on your computer and transmitted from it to our site. That is why you as a user have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transfer of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you might not be able to fully use all functions of our website. On our website, we offer the possibility of opting out of the analysis procedure. The function is located on the page www.hs-koblenz.de/rechtliche-informationen/datenschutz/. This places another cookie in your system that signals your system to not save your data. If you delete the corresponding cookie from your own system at some point, you will have to reinstall the opt out cookie. For more information about the privacy settings of the Matomo software, please follow the link: matomo.org/docs/privacy/

IX. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights in relation to the University:

1. Right of Access
You may obtain from the University confirmation as to whether or not personal data concerning you are being processed. Where such processing takes place, you may request from the University access to the personal data and the following information:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the envisaged period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine that period;
(5) the existence of the right to request from the University rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing
(6) the right to lodge a complaint with a supervisory authority;
You have the right to request information on whether personal data concerning you is transferred to a third country or to an international organisation. In this respect, you may request to be informed about the appropriate safeguards pursuant to Article 46 of the GDRP in connection with the transfer. This right of access may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfilment of the research or statistical purposes.

2. Right to Rectification
You have a right to rectification and/or completion vis-à-vis the University, insofar as the personal data processed concerning you are inaccurate or incomplete. The University will make the correction without undue delay.
Your right to rectification may be limited to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the limitation is necessary for the fulfilment of the research or statistical purposes.

3. Right to Restriction of Processing
You may request the restriction of the processing of personal data concerning you where the following applies:
(1) if you contest the accuracy of the personal data concerning you for a period enabling the University to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) the University no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
(4) if you have objected to the processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the University override your grounds.
Where the processing of personal data concerning you has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.
If the restriction of processing has been obtained in accordance with the above conditions, you will be informed by the University before the restriction is lifted. Your right to restriction of processing may be limited to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the limitation is necessary for the fulfilment of the research or statistical purposes.

4. Right to Erasure
a) Obligation to Erase
You may obtain from the University the erasure of the personal data concerning you without undue delay. The University shall have the obligation to erase these data without undue delay where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2) You withdraw consent on which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.
(3) You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
(4) The personal data concerning you have been unlawfully processed.
(5) The personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the University is subject.
(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

b) Information to Third Parties
Where the University has made the personal data concerning you public and is obliged pursuant to Article 17(1) of the GDPR to erase the personal data, the University, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) Exceptions
The right to erasure does not exist to the extent that processing is necessary:
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the University is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University;
(3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the GDPR in so far as the right referred to in paragraph (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.

5. Right to Be Informed
If you have asserted the right to rectification, erasure or restriction of processing against the University, the University shall have the obligation to communicate this rectification or erasure of the data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves a disproportionate effort.
You have a right vis-à-vis the University to be informed about these recipients.

6. Right to Data Portability
You have the right to receive the personal data concerning you that you have provided to the University in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller, where:
(1) the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR or on a contract pursuant to point (b) of Article 6(1) of the GDPR; and

(2) the processing is carried out by automated means.
In exercising this right, you shall also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms and rights of others.

7. Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) of the GDPR. In that case the University shall no longer process the personal data concerning you unless the University demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, you, on grounds relating your particular situation, shall also have the right to object to processing of personal data concerning you. Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfilment of the research or statistical purposes.

8. Right to Withdraw the Declaration of Consent under Data Protection Law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of the processing carried out based on consent before its withdrawal.

9. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint to the supervisory authority. The right to lodge a complaint must be asserted with the competent supervisory authority responsible for Koblenz University of Applied Sciences:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
LfDI
Postfach 3040
55020 Mainz
Germany

X. Google Maps
We use Google Maps on our website to display our location and to create directions. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter referred to as "Google". Google guarantees that the data protection requirements of the EU are also complied with when data is processed in the USA through the certification under the EU-US Privacy Shield www.privacyshield.gov/participant.

To enable certain fonts to be displayed on our website, a connection to the Google server in the USA is established when our website is accessed. If you call up the Google Maps component integrated into our website, Google stores a cookie on your end device via your Internet browser. In order to display our location and provide directions, your user settings and data are processed. We cannot exclude the possibility that Google uses servers in the USA in this process. The legal basis for this is point (f) of Article 6(1) of the GDPR. Our legitimate interest lies in optimising the functionality of our website. Through the connection to Google established in this way, Google can determine from which website your request was sent and to which IP address the directions should be sent.
If you do not agree to this processing, you have the possibility of preventing the installation of cookies by making the appropriate settings in your Internet browser. For details about this, please see the item "Cookies” above.
In addition, the use of Google Maps and the information obtained via Google Maps is subject to Google’s Terms of Service
policies.google.com/terms
and the terms and conditions for Google Maps
www.google.com/intl/en_en/help/terms_maps.html
Furthermore, Google provides more information at
adssettings.google.com/authenticated
policies.google.com/privacy.

XI. YouTube
We use YouTube on our website. This is a video portal of YouTube LLC, 901 Cherry Ave, 94066 San Bruno, CA, USA, hereinafter referred to as "YouTube". YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter referred to only as "Google". Google, and thus also its subsidiary YouTube, guarantees that the data protection requirements of the EU are also complied with when data is processed in the USA through the certification under the EU-US Privacy Shield www.privacyshield.gov/participant.

We use YouTube in connection with the "Privacy Enhanced Mode" function to show you videos. The legal basis for this is point (f) of Article 6(1) of the GDPR. Our legitimate interest lies in improving the quality of our website. According to YouTube, the "Privacy Enhanced Mode" function means that the data described in more detail below will only be transmitted to YouTube's server when you actually start a video. Without this "Enhanced Privacy", a connection to the YouTube server in the USA is established as soon as you call up one of our Internet pages containing an embedded YouTube video.
This connection is necessary in order to be able to display the respective video on our website via your Internet browser. With this connection, YouTube will at least record and process your IP address, the date and time, and the website you visited. In addition, a connection to Google's advertising network "DoubleClick" is established. If you are logged into YouTube at the same time, YouTube will associate the connection information with your YouTube account. If you want to prevent this, you have to either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.
YouTube permanently stores cookies on your end device via your Internet browser for functionality purposes and for the analysis of user behaviour,. If you do not agree to this processing, you have the possibility of preventing the storage of cookies through a setting in your Internet browser. You can find more information about this above under "Cookies".
Google provides further information on the collection and use of data as well as your rights and protection options in this regard in the Privacy Policy available at policies.google.com/privacy.

XII. Social Media
Our websites contain links to our external social networks Facebook, Twitter, Google+, YouTube, Instagram, XING, and LinkedIn. The references are identified by the corresponding logos on our website. Social plugins are not used. Therefore, no data are transmitted to any third parties when you visit one of our webpages that includes a reference to the social networks. The data are only transferred when you call up the external website of the social media service and have registered with this service. Koblenz University of Applied Sciences has no declared goal of storing or using data from our social media channels. Nevertheless, you can visit our open university channels, read, like and comment on the content. Data protection concerns may be affected when third parties comment on or create posts. The legal bases for data protection are derived from the EU General Data Protection Regulation, the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”) and the German Telemedia Act (Telemediengesetz, “TMG”).

Here you can find the data use policies of Facebook, Twitter, Google+ and YouTube, Instagram, XING, and LinkedIn, which always become effective when you visit these external pages. We are not responsible for whether or not the owners of the social media platforms comply with the statutory data protection regulations.