PRIVACY POLICY
COLDEMAR Website
Dear visitors,
Welcome to the COLDEMAR website. This Privacy Policy explains how personal data may be processed when you visit or use the website, including when you contact us, subscribe to the COLDEMAR newsletter, or use other forms available on the website.
The website is operated in the context of the Colombian-German Knowledge Platform for Tropical Marine Biodiversity and Climate Change (COLDEMAR). Because COLDEMAR is run from Germany and Colombia and addresses audiences in both countries, this Policy is written to meet both European and Colombian data protection law. Some statements in this Policy apply only to people located in one of the two countries, and this is indicated where it is the case.
1. Data Controller
The processing of personal data through this website is carried out under the responsibility of:
- In Germany: Leibniz Centre for Tropical Marine Research (ZMT) GmbH
Fahrenheitstrasse 6, 28359 Bremen, Germany. Telephone: +49 (0)421 23800-0.
Email: contact@leibniz-zmt.de. sonia.bejarano@leibniz-zmt.de
- In Colombia: Universidad del Valle, Instituto de Investigaciones y Ciencias del Mar y Limnología (INCIMAR), in Cali, Colombia:
Calle 13 # 100-00, Cali, Colombia. Telephone: +(57) 602-3212100 Ext 2900.
Email: protecciondatos.sec.general@correounivalle.edu.co. fernando.zapata@correounivalle.edu.co
For questions concerning data protection, to exercise your rights, please use the contact details provided in Section 12 below.
2. Personal Data We Process
Depending on how you use the website, the following categories of personal data may be processed:
- Technical and usage data generated when accessing the website, such as the requested page, date and time of access, browser, operating system and IP address, where applicable.
- Contact details and other information that you voluntarily provide through website forms, such as your name, email address, institution or organization, and the content of your message.
- Information provided when subscribing to the COLDEMAR newsletter or registering for an activity or event through a website form.
- Information required to manage your communication preferences, such as newsletter subscription or unsubscribe status.
Please provide only the information that is necessary for the relevant purpose. We do not intend to collect personal data through the website beyond what is necessary for the stated purposes and we do not expect any kind of sensitive information.
We collect this personal data directly from you when you fill in a form on the website, or it is generated automatically by your browser and by our technical infrastructure when you access the website.
3. Purposes, Legal Bases and Your Authorization
We process personal data only for specified and legitimate purposes, including:
- operating, maintaining and securing the website;
- responding to enquiries and contact requests;
- managing newsletter subscriptions and sending COLDEMAR communications;
- managing registrations for COLDEMAR events or activities where a corresponding form is provided;
- administering and maintaining website content and functionality; and
- preventing, detecting and responding to technical or security incidents.
Where the GDPR applies, the legal basis depends on the specific processing activity, they may include:
- Article 6(1)(a) GDPR – consent, where you have given consent for a specific purpose, such as receiving the newsletter. You may withdraw your consent at any time.
- Article 6(1)(f) GDPR – legitimate interests, in particular for the secure and reliable operation of the website and the prevention of technical attacks; or
In Colombia, we process the personal data you give us on the basis of your prior and informed authorization, including by unequivocal conduct.
4. Server Logs and Technical Operation
When you access the website, technical information may be processed temporarily to ensure system stability, security and reliable delivery of website content. This may include the requested page and time of access, browser and operating system information, and the IP address from which the request originated.
IP addresses are retained for a maximum period of seven days for the purpose of detecting and defending against possible technical attacks, after which they are deleted or anonymized, subject to any longer retention required by law or necessary for the establishment, exercise or defence of legal claims.
The website uses Vercel for web hosting/infrastructure. Depending on the technical configuration, Vercel may process technical information contained in server requests and logs. Don Dominio is used in connection with domain-related services.
Where European law applies, we process this technical data on the basis of our legitimate interest in providing a secure and reliable website. This data is generated automatically by the connection between your device and our hosting infrastructure.
5. Content Management System – Sanity
The content of the website is managed using Sanity CMS (Sanity, Inc). Sanity provides content-management and related technical services required to publish and deliver website content.
Personal data may be processed through Sanity only to the extent necessary for the administration and technical provision of the website. Website visitors do not create a Sanity account merely by browsing the public website.
Where European law applies, the processing necessary for website administration and secure technical operation is based on our legitimate interest in operating and maintaining the website.
6. Contact Forms, Newsletter and Brevo
If you submit a contact form, subscribe to the COLDEMAR newsletter, or provide information through another website form, the personal data you enter will be processed for the purpose for which you provide it.
COLDEMAR uses Brevo (Sendinblue GmbH) for newsletter distribution and related form and communication functions. Depending on the form and its configuration, this may include your name, email address, institution or organization, and the information contained in your request.
Newsletter subscriptions are based on consent where consent is required. You may withdraw your consent at any time by contacting us or by using the unsubscribe link included in our emails.
Information submitted through a contact form will be used to process and respond to your request. Automated forwarding of the submitted forms can be handled by Make (Celonis Inc.). The applicable legal basis is our legitimate interest in responding to enquiries addressed to us.
Brevo processes personal data on our behalf in accordance with applicable contractual data-protection arrangements. Further information concerning the provider's data protection practices can be found in the provider's own privacy documentation.
Personal data submitted through forms will be retained only for as long as necessary for the relevant purpose, unless a longer retention period is required by law or is necessary for the establishment, exercise or defence of legal claims.
7. Cookies
The COLDEMAR website uses technical session cookies that are necessary for navigation and for providing localized content, including language switching between English, Spanish and German.
These cookies are not used to track users across external websites.
Because these cookies are required for core website functions, disabling them in your browser may limit certain features.
The website does not use advertising cookies or cross-site tracking cookies unless this Policy and/or the website's cookie information is updated accordingly.
Where additional cookies or similar technologies are introduced in the future, COLDEMAR will provide the information and obtain consent where required by applicable law.
8. Third-Party Services and International Processing
The website relies on external technical service providers for hosting, content management, domain services, newsletter and form functions, and other technical services. Current providers include:
- Vercel – web hosting/infrastructure;
- Sanity – content management;
- Brevo – newsletter and forms;
- Don Dominio – domain-related services;
- DeepL – automated translation, where used for website content.
Not every provider necessarily receives or processes personal data of website visitors. The extent of processing depends on the technical configuration and the service concerned.
Where a service provider processes personal data on behalf of the controller, appropriate contractual and technical safeguards will be used as required by applicable law.
Personal data collected through this website may be transferred outside the country in which you are located. In particular, personal data may be shared between Colombia and Germany and may be processed by the service providers listed above in the countries in which they operate.
Where personal data is transferred out of the European Economic Area, we carry out the transfer on the basis of appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission, together with any additional measures needed in the individual case. You may ask us for information about those safeguards, or for a copy of them, using the contact details in Section 12.
Where personal data is transferred from Colombia, we make the transfer only to a country recognised by the Superintendencia de Industria y Comercio (SIC) as offering an adequate level of protection, or with your authorization, or where another of the cases permitted by Colombian law applies. Germany, where ZMT is established, is recognised by the SIC as offering an adequate level of protection.
DeepL is used for automated translation of website content. Where only COLDEMAR's own institutional content is submitted for translation and no visitor-provided personal data is involved, DeepL is not intended to receive personal data collected from website visitors.
9. Data Security
We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.
These measures include, as appropriate, access controls, secure communications and measures for the secure operation and maintenance of the website and its supporting services. Website communications are protected using HTTPS/TLS where applicable.
Access to personal data is limited to persons and service providers who require it for the relevant purpose and are subject to appropriate confidentiality and data-protection obligations.
10. Data Retention
Wir speichern personenbezogene Daten nur so lange, wie es zur Erfüllung des Zwecks, für den sie erhoben wurden, erforderlich ist, es sei denn, eine längere Aufbewahrungsfrist ist gesetzlich vorgeschrieben oder für die Geltendmachung, Ausübung oder Abwehr von Rechtsansprüchen erforderlich.
The following retention principles apply:
- Server IP addresses: maximum seven days, after which they are deleted or anonymized, subject to legal exceptions.
- Newsletter data: retained while you remain subscribed or until the data is no longer required for the relevant communication purpose, subject to applicable legal obligations.
- Contact-form data: retained for as long as necessary to process and document the request, subject to applicable legal obligations.
- Event-registration data: retained for as long as necessary to administer the relevant activity and meet applicable documentation or legal requirements.
Where specific retention periods cannot reasonably be stated in advance, we use the criteria described above to determine the appropriate retention period.
11. Your Rights
You have the following rights in relation to your personal data. Not every right applies in every country, and the exercise of each of them may be subject to the conditions and exceptions laid down by the law applicable to you.
- Right of access: you may ask whether we process personal data about you, obtain a copy of that data and be told how it is used.
- Right to rectification: you may ask us to correct or update personal data that is inaccurate, incomplete or out of date.
- Right to erasure: you may ask us to delete your personal data, subject to the conditions and exceptions laid down by the law applicable to you.
- Right to restriction of processing: you may ask us to restrict the processing of your personal data in the cases provided for by the law applicable to you.
- Right to data portability: you may ask to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.
- Right to object: you may object to processing that is based on our legitimate interests, and you may object at any time and without giving reasons to the use of your personal data for direct marketing, including the newsletter.
- Right to withdraw your consent or to revoke authorization: where processing is based on your consent or authorization, you may withdraw or revoke it at any time, in whole or for a single purpose. For newsletter subscriptions, you may also use the unsubscribe link provided in each newsletter.
- Right to complain to the supervisory authority competent for the country in which you are located. In Germany this is Die Landesbeauftragte fuer Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen. In Colombia it is the Delegatura para la Protección de Datos Personales of the SIC.
We may request appropriate information to verify your identity before processing a request concerning your personal data. The exercise of these rights may be subject to legal conditions and exceptions.
12. How to Exercise Your Rights / Data Protection Contact
If you have questions about the processing of your personal data or wish to exercise your rights, please contact:
Data Protection Officer of ZMT, for Germany and for European data protection law:
Mr. Oliver Stutz
Data Protection Officer
datenschutz nord GmbH
Konsul-Smidt-Straße 88
28217 Bremen, Germany
Email: office@datenschutz-nord.de
Phone: +49 (0)421 69 66 32 0
Website: www.datenschutz-nord-gruppe.de
If you are in Colombia, you may exercise your rights through the Citizen Services Program, by completing the form under the ‘data protection’ section on the website http://atencionalciudadano.univalle.edu.co/, or by email to: quejasyreclamos@correounivalle.edu.co, or by calling the phone number: 018000 22 00 21. A request to consult your personal data, or to correct, update or delete it or to report a possible breach of Colombian data protection law, should identify you and describe what you are asking for, together with any documents you want us to consider. An inquiry will be answered within ten working days and a complaint within fifteen working days, and we will tell you if we need the additional time that Colombian law allows.
Colombian law requires you to raise an inquiry or a complaint with us before escalating the case to the SIC.
13. Photographs, Videos and Other Published Content
The COLDEMAR website may publish photographs, videos, names, professional affiliations and other information relating to COLDEMAR researchers, partners, events and activities.
Where an identifiable person is depicted or personal information is published, the publication and further use will be carried out on an appropriate legal basis and in accordance with applicable data-protection and other legal requirements.
Photographic copyright and personal-data protection are separate legal matters. The rights of photographers or other copyright holders do not replace the requirements applicable to the processing of personal data.
14. Updates to this Privacy Policy
We may update this Privacy Policy when the website, its services, processing activities or applicable legal requirements change.
The current version will be made available on the COLDEMAR website. The date of the latest update will be indicated below.
Last updated: October 7th, 2026