Data Privacy Policy

The privacy policy published on handicap-international.de applies. Furthermore, we have compiled the following information specifically for this domain.

In order to fulfil our obligations under Article 13 of the GDPR, this privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as ‘data’) that is collected in the course of providing our services and within our online offering. This online service comprises, in particular, the web pages required for this purpose, as well as associated functions and content, and external online presences, such as social media profiles.

With regard to the terminology used, reference is made to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

We would like to point out at this stage that this privacy policy is based on pre-formulated text modules and uses the generic masculine form. Female and other gender identities are expressly included where necessary for the meaning of the text.

Data Controller

The data controller within the meaning of Article 13(1) of the GDPR is:

Handicap International e.V.
Lindwurmstr. 101
80337 Munich
info@deutschland.hi.org
Managing Director: Dr Inez Kipfer-Didavi
Legal notice

The data protection officer for the data controller is:

Dr Alexander Löw
Data-Warehouse GmbH
Beethovenstr. 33
85521 Ottobrunn
Tel.: +49 (0)89 660 393 – 0
Email:datenschutz@dwh.info
Website: www.datawh.de

Data subjects

The data processing carried out by us affects visitors and users of our online services.

Types of data processed

When simply accessing our online service – i.e. without registering or providing any other information – only the data transmitted to our server by the user’s browser (so-called ‘server log files’) is collected. This includes the following data:

  • Date and time of access
  • Amount of data sent in bytes
  • Source/link from which you accessed the page
  • IP address used (where applicable: in anonymised form)
  • Usage data (e.g. so-called cookies, web pages visited, interest in content, access times),
  • Meta/communication data (e.g. software information, IP/MAC addresses, operating system and browser used).

Should the user in question also complete a registration or provide other details, the following data will also be processed:

  • Master data (e.g. personal master data, names or addresses),
  • contact details (e.g. email addresses, telephone numbers),
  • Content data (e.g. text entries, photo and video material)

Purpose of processing

The data is processed

  • to provide the online service, including its functions and content,
  • to respond to enquiries and communicate with users,
  • to ensure security measures,
  • to measure reach, and
  • for marketing purposes

Terms used

‘Personal data’ means, in accordance with Article 4(1) of the GDPR, ‘any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

‘Processing’ means, pursuant to Article 4(2) of the GDPR, ‘any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution or any other form of making available, the comparison or linking, the restriction, erasure or destruction”.

According to Article 4(4) of the GDPR, ‘profiling’ means ‘any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person’.

‘Pseudonymisation’ means, in accordance with Article 4(5) of the GDPR, means “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”.

A ‘file system’ is, according to Article 4(6) of the GDPR, ‘any structured collection of personal data which is accessible according to specific criteria, whether that collection is centralised, decentralised or organised according to functional or geographical criteria’.

‘Controller’ means, in accordance with Article 4(7) of the GDPR, ‘the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States’.

‘Data processor’ means, pursuant to Article 4(8), ‘a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller’.

‘Recipient’ means, pursuant to Article 4(9) of the GDPR, ‘a natural or legal person, public authority, agency or other body to whom personal data are disclosed, irrespective of whether they are a third party or not. However, public authorities which may receive personal data in the course of a specific investigation mandate under Union law or the law of the Member States are not considered recipients; the processing of such data by the aforementioned authorities is carried out in accordance with the applicable data protection regulations and in line with the purposes of the processing”.

An IP address is a combination of numbers assigned to a device by an internet service provider to grant the device access to the internet.

Legal basis

In accordance with Article 13(1)(c) of the GDPR, we are obliged to inform you of the legal bases for our data processing activities. For users within the scope of the General Data Protection Regulation (GDPR), which covers the European Union (EU) and the European Economic Community (EEC), the following applies, provided that no other legal basis is specified in the privacy policy:

Article 6(1)(a) and Article 7 of the GDPR form the legal basis for the processing of data covered by consent.

Article 6(1)(b) of the GDPR is the legal basis for the processing of data for the purpose of fulfilling our contractual obligations, carrying out pre-contractual measures and responding to enquiries.

Article 6(1)(c) of the GDPR is the legal basis for processing carried out to fulfil our legal obligations.

Article 6(1)(d) of the GDPR is the legal basis for the processing of personal data where this is necessary to protect the vital interests of the data subject or of another natural person.

Article 6(1)(e) of the GDPR is the legal basis for processing carried out in the public interest or in the exercise of official authority vested in the controller, insofar as this is necessary for that purpose.

Article 6(1)(f) of the GDPR is the legal basis for processing carried out to safeguard our legitimate interests.

Article 6(4) of the GDPR concerns the processing of data for purposes other than those for which it was collected. Such processing is only permitted under the conditions set out here.

Article 9(2) of the GDPR sets out specific requirements for the processing of special categories of data (in accordance with Article 9(1) of the GDPR).

Security measures

To ensure a level of protection appropriate to the risk, we take measures in accordance with

  • the statutory requirements, taking into account the state of the art,
  • the implementation costs, the nature, scope, context and purposes of the processing, and
  • the varying likelihood and severity of the risk to the rights and freedoms of natural persons

.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by

  • controlling physical access to the data,
  • controlling access to the data,
  • controlling data entry, data disclosure and data backup, as well as ensuring data segregation.

Furthermore, we have established procedures that guarantee the exercise of data subjects’ rights, the erasure of data and a response to any data breaches.

Cooperation with data processors, joint controllers and third parties

For certain services, it is necessary, as part of our data processing, to disclose data to other parties (usually companies), i.e. to transfer data to them or otherwise grant them access to the data. These companies are either data processors or joint controllers, or third parties such as payment service providers. Such disclosure takes place only on the basis of a statutory authorisation or obligation, the user’s consent, or on the basis of our legitimate interests, which exist, for example, when using agents or web hosts. Such a legitimate interest also applies in particular to the processing of data for administrative purposes.

In the event that we make data available to other companies within our group (through disclosure, transfer or granting of access in any other form), this is done in particular for administrative purposes. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Furthermore, the provision of access may also be based on a legal requirement.

Transfers of data to third countries

Any disclosure, transfer or other provision of data to a person (including a company) in a third country (i.e. outside the EU, the EEA or the Swiss Confederation) takes place where the legal requirements are met. This applies in particular where processing is carried out to fulfil our contractual or pre-contractual obligations. Otherwise, the processing must be based on your consent, a legal obligation or our legitimate interests. Furthermore, when personal data is transferred to a third country, the conditions set out in Articles 44 et seq. of the GDPR must be met. This may, in particular, be done on the basis of an adequacy decision pursuant to Article 45 of the GDPR. For the USA, the adequacy decision relating to the EU-US Data Privacy Framework applies only to transfers covered by the certification of the respective US recipient. Otherwise, appropriate safeguards under Article 46 of the GDPR, such as the European Commission’s standard contractual clauses, including the necessary assessment of the level of protection and, where applicable, supplementary measures, are required; statutory exceptions under Article 49 of the GDPR remain unaffected.

Rights of data subjects

Upon making a request to that effect, you have the right to be informed as to whether data relating to you is being processed. Furthermore, in accordance with the statutory requirements, you are entitled to further information and to receive a copy of the data.

You have the right to have your personal data completed and to have any inaccurate personal data concerning you rectified.

You have the right, in accordance with the statutory provisions, to have data relating to you erased without delay. Alternatively, you have the right, within the framework of the statutory provisions, to restrict the processing of the data. (see also right to object)

In accordance with the statutory provisions, you have the right to receive the data concerning you that you have provided to us, and you may also request that it be transferred to other data controllers.

You have the right to lodge a complaint with the relevant supervisory authority.

Right to withdraw consent

You may withdraw any consent you have given at any time with effect for the future.

Right to object

You have the right to object to the future processing of your personal data in accordance with the statutory provisions. In particular, the objection may also relate to processing for the purposes of direct marketing.

Cookies

We use both temporary and permanent cookies. Information will only be stored on your device, or accessed from there, with your prior consent in accordance with Section 25(1) of the TDDDG, unless an exception under Section 25(2) of the TDDDG applies. Such an exception applies, in particular, where this is strictly necessary to provide a digital service you have expressly requested. Where personal data is processed for analytical or marketing purposes requiring consent, the legal basis is Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with effect for the future. The mere possibility of subsequently disabling cookies in your browser does not replace the requirement for prior consent. Stored cookies can be deleted in your browser’s system settings. Disabling cookies may result in functional limitations of this online service.

Cookies are small files that are stored on your computer. These files contain various types of information. Primarily, cookies serve to store information about a user of an online service. In particular, they store, for example, login details, the contents of a shopping basket and items viewed in an online shop, or generally the websites visited.

A distinction must first be made between temporary and permanent cookies. Temporary cookies are also known as ‘session cookies’ or ‘transient cookies’. These are cookies that are deleted once you leave the online service. This usually happens when you close your browser.

Permanent cookies (or ‘persistent cookies’) are files that remain stored even after the browser has been closed. This means that the information mentioned above may persist beyond the respective browser session.

This is particularly relevant in the case of cookies that contain information about users’ interests. This data is frequently used for audience measurement or marketing purposes.

A distinction must also be made between so-called ‘third-party cookies’, which are provided by providers other than the data controller operating the online service, and so-called ‘first-party cookies’, which are used in all other cases.

It is possible to object in general to the use of cookies employed for online marketing purposes. There are a number of providers offering this service. In the case of tracking, this service is provided by the US website ‘http://www.aboutads.info/choices/’ or the EU website ‘http://www.youronlinechoices.com/’. These opt-out options merely supplement your rights; they do not replace the required prior consent nor its withdrawal from us.

Furthermore, the storage of cookies can also be prevented by disabling them in your browser settings. However, selecting this option may mean that not all features of this website can be used.

Deletion of data

In accordance with legal requirements, we delete the data we have collected or restrict its processing.

We delete the data we have stored as soon as the purpose for which it was retained no longer applies, provided that there are no statutory retention obligations that prevent this and no differing provisions have been set out in this privacy policy.

Should the data not be deleted due to the need to retain it for other, legally permissible purposes (e.g. retention for commercial or tax law reasons), its processing will be restricted. In this case, the data will be processed exclusively for this purpose and will otherwise be blocked.

Changes to the Privacy Policy

Legal developments or changes to the data processing activities we carry out may necessitate an amendment to this privacy policy. For this reason, we ask you to check the content of our privacy policy regularly. Should a change require action on your part (e.g. consent) or any other individual notification, we will inform you in an appropriate manner.

Processing for business purposes

In addition, we process contractual data (e.g. subject matter of the contract, term, date of conclusion) and payment details (e.g. account number) relating to our customers, prospective customers and business partners in order to provide contractual and other services. These include, in particular, customer service, customer care, marketing, advertising and market research.

Other contractual services

In order to fulfil our contractual and pre-contractual obligations, we process the data of our ‘contractual partners’, which specifically includes prospective customers as well as other clients, customers or clients, in accordance with Article 6(1)(b) of the GDPR.

The data processed is determined by the underlying contractual relationship. This also applies to the nature, scope and purpose of the processing, as well as its necessity.

The data processed primarily consists of

  • contractual partners’ master and reference data (e.g. name, address, etc.),
  • contact details (e.g. email address, telephone number, etc.),
  • contract data (e.g. services used, products purchased, costs, names of contact persons).

As a general rule, we do not process special categories of personal data, unless these form part of commissioned or contractual processing.

Furthermore, we process data that is necessary for the establishment and fulfilment of contractual obligations. In doing so, we draw attention to the necessity of providing the data if this is not obvious to the contracting parties.

We only disclose the processed data to external individuals or organisations where this is required under a contract.

When processing data entrusted to us under a contract, we act strictly in accordance with the client’s instructions and the statutory requirements.

We store the IP address you use when registering, during subsequent logins and when using our online services, as well as the time of each user action. This storage is carried out on the basis of our legitimate interests, namely to protect users from misuse and other unauthorised use. This data is not, as a matter of principle, passed on to third parties. This does not apply if such disclosure is necessary to pursue our legal claims as a legitimate interest or if there is a legal obligation to do so.

When you use our online services, we generally store the IP address and the time of the respective user action. This storage is carried out on the basis of our legitimate interests, as well as the users’ interests in protection against misuse and other unauthorised use. This data is generally not disclosed to third parties, unless such disclosure is necessary for the pursuit of our claims in accordance with Article 6(1)(f) of the GDPR or there is a legal obligation to do so in accordance with Article 6(1)(c) of the GDPR.

We delete the data once it is no longer required to fulfil contractual or statutory duties of care, or to deal with any warranty claims and similar obligations. We review the necessity of retaining the data every three years. Otherwise, the statutory retention obligations apply.

Provision of our services in accordance with our Articles of Association and business practices

The processing of data relating to our members, supporters, prospective clients, customers or other individuals for the purpose of offering or fulfilling contractual services is carried out in accordance with Article 6(1)(b) of the GDPR. The same applies when acting within the framework of an existing business relationship or when receiving services and donations.

Otherwise, the data of data subjects is processed in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interests. This is particularly the case where administrative tasks or public relations work are involved.

The nature, scope and purpose of the data processed, as well as the necessity of its processing, are determined by the underlying contractual relationship.

The data generally includes

  • personal records and master data (e.g. name, address, etc.),
  • contact details (e.g. email address, telephone number, etc.),
  • contractual data (e.g. services used, content and information provided, names of contact persons).

We will delete any data that is no longer required for the fulfilment of our statutory and business purposes.

The relevant tasks and contractual relationships are decisive in this regard.

We retain data that is relevant to our business for as long as is necessary for the comprehensive conduct of our business. Any warranty or liability obligations are also relevant in this regard. We review the necessity of retaining the data every three years. Otherwise, the statutory retention obligations apply.

Administration, financial accounting, office organisation, contact management

We process data in the course of carrying out administrative tasks, organising our operations, managing our financial accounts and complying with legal obligations, such as archiving.

This data is the same data that we process to provide our contractual services. This processing is carried out in accordance with Article 6(1)(c) and Article 6(1)(f) of the GDPR.

This processing affects customers, prospective customers, business partners and website visitors. The purpose and our legitimate interest in the processing lie in administration, financial accounting, office organisation and the archiving of data – in other words, tasks that serve to maintain our business activities, fulfil our duties and provide our services. The erasure of data relating to contractual services and contractual communication is in accordance with the information provided in relation to these processing activities.

In this context, we disclose or transfer data to the tax authorities, advisers such as tax advisers or auditors, as well as other fee-charging bodies and payment service providers.

Furthermore, based on our business interests, we store information on suppliers, event organisers and other business partners, e.g. for the purpose of contacting them at a later date. We generally store this data, the majority of which is company-related, on a permanent basis.

Microsoft Cloud Services

We use the cloud provided by Microsoft, as well as its cloud software services (known as ‘Software as a Service’), to

  • exchange, store and manage documents,
  • send emails,
  • organise calendars,
  • create spreadsheets and presentations,
  • share content, information and forms with specific recipients
  • publish websites,
  • holding conversations via ‘chats’ or
  • To hold audio and video conferences.

The Microsoft Cloud Services are provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Where personal data is transferred to Microsoft Corporation in the USA and the transfer is covered by its certification under the EU-US Data Privacy Framework, it is carried out on the basis of the European Commission’s adequacy decision pursuant to Article 45 of the GDPR. Information on the certification: https://www.microsoft.com/de-de/privacy/microsoft-data-privacy-framework-covered-entities.

When using the service, users’ personal data is processed. This applies to all data that forms part of the documents and content processed within the scope of the listed services. Furthermore, the processing also covers all data that forms part of communication processes.

In particular, users’ master and contact data, as well as data relating to transactions, contracts, other processes and their contents, are processed.

Furthermore, Microsoft processes usage and metadata for the purposes of security and to improve the service.

When using publicly accessible documents, websites or other content, Microsoft stores cookies on users’ devices for the purposes of web analytics or to ensure that settings made by the user are retained for the next session. Insofar as information is stored on or read from your device for this purpose, Section 25 of the TDDDG applies. Web analytics that are not strictly necessary are carried out only with prior consent; the associated processing of personal data is based on Article 6(1)(a) of the GDPR.

We use Microsoft Cloud Services on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR in efficient and secure administrative and collaborative processes. Furthermore, the processing is carried out on the basis of a data processing agreement which we have concluded with Microsoft.

Further information can be found in Microsoft’s Privacy Statement (https://privacy.microsoft.com/de-de/privacystatement) and the security information on Microsoft cloud services (https://www.microsoft.com/de-de/trustcenter).

Users may object to the processing of their data in the Microsoft Cloud in accordance with the statutory requirements, which will result in the deletion of their data. In other cases, the deletion of data within the cloud services is determined by the other processing operations within the scope of which the data is processed. For example, data that is no longer required for contractual purposes is deleted, provided that it is also no longer required for other purposes, such as taxation.

Contacting Us

When you contact us – which can be done via the contact form, email, telephone, fax or social media – the user’s details are processed for the purpose of handling and processing the contact enquiry. The legal basis regarding contractual and pre-contractual relationships is set out in Article 6(1)(b) of the GDPR. With regard to other enquiries, Article 6(1)(f) of the GDPR applies. Users’ details are generally stored in a Customer Relationship Management system (‘CRM system’) or a comparable enquiry management system.

We delete the data collected in connection with the enquiry once it is no longer required. The necessity of retaining the data is reviewed every two years. Otherwise, the statutory retention obligations apply.

Newsletter – Newsletter2Go/Sendinblue

Newsletters are sent via the mailing service provider Newsletter2Go GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. You can view the mailing service provider’s privacy policy here: https://www.newsletter2go.de/datenschutz/. The mailing service provider is engaged on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR and a data processing agreement pursuant to Article 28(3), first sentence, of the GDPR.

The mailing service provider Newsletter2Go may use recipients’ data in pseudonymised form – i.e. without the possibility of linking it to a specific user – to improve its own services. Examples of this include using the data for the technical optimisation of the dispatch and presentation of newsletters, or for statistical purposes.

However, Newsletter2Go does not use the data of our newsletter recipients to contact them directly or to pass the data on to third parties.

Newsletters – Performance Measurement

Our newsletters contain a so-called ‘web beacon’. This refers to a pixel-sized file that is loaded from our server – or, if we use a mailing service provider, from their server – when the newsletter is opened. The personalised performance measurement described below is carried out only with your separate prior consent in accordance with Article 6(1)(a) of the GDPR and, insofar as information is stored on or read from your device, in accordance with Section 25(1) of the TDDDG.

When the newsletter is accessed, technical information is collected, such as details of the user’s browser and operating system, as well as their IP address and the time of access.

This information is used to improve the technical aspects of the services. In doing so, the technical data may be analysed with regard to the respective target groups and their reading behaviour, the respective locations from which the pages are accessed (as determined by the IP address), and the times of access.

The statistical analyses also include determining whether newsletters are opened, when they are opened and which links are clicked.

For technical reasons, it is possible that this information may be linked to individual newsletter recipients. However, we assure you that it is neither our intention nor that of any mailing service providers we may use to spy on individual users.

Rather, the analyses are used to identify our users’ reading habits and to tailor our content to them, or to distribute different content in line with our users’ interests.

You may withdraw your consent to performance measurement at any time with future effect, irrespective of your newsletter subscription, for example by sending a message to the contact details provided above. Your newsletter subscription remains unaffected by this. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Hosting and email distribution

We use external hosting services to operate our online platform. This applies to:

  • Infrastructure and platform services
  • Computing capacity, storage space and database services,
  • Email dispatch services, and
  • security and technical maintenance services.

In pursuit of our legitimate interests in the efficient and secure provision of this online service in accordance with Article 6(1)(f) of the GDPR in conjunction with Article 28 of the GDPR (conclusion of a data processing agreement), the following data in particular is processed by us or our hosting provider:

  • Personal and contact details,
  • Content data and contractual data, as well as
  • usage, meta and communication data.

This data processing applies to our customers as well as prospective customers and visitors to our online service.

Collection of access data and log files

On the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR, we or our hosting provider collect data on every access to the server on which this service is hosted (so-called server log files). This data includes

  • the name of the webpage accessed and, where applicable, specific files,
  • the date and time of the access,
  • the amount of data transferred,
  • Confirmation of successful retrieval,
  • browser type and version, the user’s operating system,
  • referrer URL (the page visited previously),
  • IP address and
  • the requesting provider.

For security reasons, log file information is stored for up to seven days and then deleted. This is primarily to investigate cases of misuse or fraud. Where data is suitable as evidence for investigating a matter, it is exempt from deletion until the incident in question has been fully resolved.

Audience measurement with Matomo/PIWIK

We use Matomo’s web analytics service, which utilises cookies as described below, only with your prior consent. The legal bases are Section 25(1) of the TDDDG for the storage and retrieval of information on your device, and Article 6(1)(a) of the GDPR for the associated processing of personal data.

The following user data is processed in this context:

  • browser type and version used,
  • operating system used,
  • country of origin,
  • date and time of the server request,
  • number of visits,
  • time spent on the website, and the external links clicked.

Users’ IP addresses are anonymised before being stored, so that they can no longer be linked to a specific individual. Matomo is an open-source project for which, according to the information provided on its website, Matthieu Aubry is legally responsible. There is currently no known official registered office.

The Matomo service uses cookies, which are stored on the user’s device and enable an analysis of the use of our online service. In doing so, it is possible that pseudonymous user profiles may be created from the processed data.

These cookies are stored for approximately one week. The information contained in the cookie regarding the use of our websites is stored exclusively on our server and is not passed on to third parties.

You may withdraw your consent to data collection by Matomo at any time with future effect, for example by sending a message to the contact details provided above or via the function below. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

In this case, a so-called opt-out cookie is stored in the user’s browser. As a result, Matomo will not collect any further session data.

If the user deletes their cookies, the opt-out cookie will also be deleted. This does not constitute the granting of new consent. Tracking requiring consent may only resume once consent has been given again.

[matomo_opt_out font_color=004F71 font_size=20px font_family=Arial width=100%]

The logs containing user data are deleted after 6 months at the latest.

Integration of third-party services and content

As part of our online offering, we use content or services provided by third parties to integrate their content and services, based on the pursuit of our legitimate interests, which primarily consist of the interest in analysing, optimising and the commercial operation of our online offering in accordance with Article 6(1)(f) of the GDPR. This applies, for example, to the integration of videos or fonts. Where such integration requires consent, it will only take place once consent has been given. This applies in particular to the storage of, or access to, information on the end-user’s device that is not strictly necessary, in accordance with Section 25(1) of the TDDDG. The legal basis for any associated processing of personal data requiring consent is Article 6(1)(a) of the GDPR.

In order to integrate content and services from third-party providers, these providers must be aware of the user’s IP address, as otherwise no data can be transmitted to their browser. The IP address is therefore essential for the display of this content and the integration of these services.

We endeavour to integrate only such content and services whose respective providers use the IP address exclusively for the purpose of making the content and services available. Third-party providers may also use so-called pixel tags for statistical or marketing purposes. A pixel tag, also known as a ‘web beacon’, refers to invisible graphics the size of a pixel. These enable visitor traffic on the individual web pages of an online service to be tracked. The pseudonymised information may also be stored on users’ devices in the form of so-called cookies. These contain, in particular, technical information about the browser and operating system, referring websites, the time of the visit, and further details regarding the use of our online service. Furthermore, this information may also be linked to similar information from other sources. This is particularly the case when users, as members of the respective platforms, are logged in to them on different devices.

YouTube

We embed videos from the “YouTube” platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.

Google Fonts:

We use Google Fonts. These are fonts which are downloaded by Google Ireland Limited upon your prior consent when you access the website. During this process, data such as your IP address is transmitted to Google. The use of externally integrated Google Fonts is based on your consent in accordance with Article 6(1)(a) of the GDPR. Insofar as information is stored on or read from your device and no exception under Section 25(2) of the TDDDG applies, Section 25(1) of the TDDDG also applies. You may withdraw your consent at any time with future effect.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy; EU-US Data Privacy Framework: Google LLC is certified. Insofar as the transfer of personal data to the USA is covered by this certification, it takes place on the basis of the adequacy decision pursuant to Article 45 of the GDPR. Information: https://policies.google.com/privacy/frameworks?hl=de

OpenStreetMap

We integrate maps from the “OpenStreetMap” service (https://www.openstreetmap.de), which are provided by the OpenStreetMap Foundation (OSMF) under the Open Data Commons Open Database Licence (ODbL). Privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy.

To the best of our knowledge, OpenStreetMap uses users’ data exclusively for the purposes of displaying map functions and temporarily storing the selected settings. This data may include, in particular, users’ IP addresses and location data; however, this data is not collected without their consent (which is usually given via the settings on their mobile devices).

The data may be processed in the USA. Further information can be found in OpenStreetMap’s privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy

Event registration

On our website, you can register for various events using registration forms created with Microsoft Forms. To process your application, we require your name, email address, place of residence, etc. The data is used solely for the purpose of processing your registration. The data you enter is processed on our behalf by Microsoft on the basis of a data processing agreement. The legal basis is Article 6(1)(b) of the GDPR.

Further information on Microsoft Forms can be found at https://support.office.com/de-de/forms and further information on the processing of personal data by Microsoft at https://privacy.microsoft.com/de-DE/privacystatement.

Use of the Zoom video conferencing software

We use the ‘Zoom’ tool to conduct online meetings, video conferences and webinars (hereinafter: ‘online meetings’).

Depending on the nature and extent of the use of ‘Zoom’, various types of data are collected or processed. These include, in particular:

Personal details (e.g. first name and surname, email address, profile picture), meeting metadata (e.g. date, time and duration of the communication, name of the meeting, participants’ IP addresses), device/hardware data, text, audio and video data, connection data (e.g. telephone numbers, country names, start and end times, IP addresses).

If you are joining an online meeting as an external participant, the host will send you an access link by email. When registering for the online meeting, you will then need to provide your name and, where applicable, your email address. In addition, the tool collects user data necessary for the provision of the service. This includes, in particular, technical data relating to your devices, your network and your internet connection, such as your IP address, device type, operating system type and version, client version, camera type, microphone or speakers, and connection type.

You may provide further personal details, but you are not obliged to do so. You are also free to use the chat function during the online meeting. You can also switch your camera and microphone on, off or mute them yourself. By default, the camera and microphone are disabled at the start of a meeting.

If you use the chat function, the text you enter will be processed in order to display it in the ‘online meeting’. The chat is not logged. If you switch on your camera or microphone, data from your device’s microphone and any video camera on your device will be processed for the duration of the meeting.

Please note that all information which you or others upload, provide or create during an online meeting will be processed at least for the duration of the meeting. This includes, in particular, chat/instant messages, files, whiteboards and other information shared whilst using the service. No recordings are made.

Further information on the processing of your data when using ‘Zoom’, a detailed list of the data collected and processed by ‘Zoom’, and the ‘Zoom’ privacy policy can be found at: https://zoom.us/de-de/privacy.html.

If you participate in an online meeting as an external participant, your data will be processed on the basis of Article 6(1)(b) of the GDPR, provided that your participation in the online meeting is necessary for the performance of a contract concluded with you. The same applies if the online meeting is necessary for the implementation of pre-contractual measures taken in response to your enquiry. Where data processing in connection with the use of ‘Zoom’ is not necessary for the performance of a contract concluded with you or for the implementation of pre-contractual measures, it is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest in this regard lies in maintaining location-independent communication, fostering business contacts and providing the services owed by . If, whilst using the tool, you also voluntarily provide personal information or voluntarily use functions that are not strictly necessary, the associated data processing is carried out on the basis of your revocable consent in accordance with Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with effect for the future. Please note that any processing carried out prior to the withdrawal of consent is not affected by this.

As a general rule, we do not transfer your data to third parties. Data will only be disclosed if it is specifically intended for disclosure, if you have expressly consented to the transfer in advance, or if we are obliged or authorised to do so by law.

Zoom Video Communications Inc. supports us in the processing of your data as an external service provider and data processor within the meaning of Article 28 of the GDPR. As a data processor, Zoom Video Communications Inc. processes your data strictly in accordance with our instructions and on the basis of a separately concluded data processing agreement. Data processing may also take place outside the EU or the EEA. With regard to Zoom Video Communications Inc., an adequate level of data protection in accordance with Article 46(2)(c) of the GDPR is deemed to be ensured through the use of EU Standard Contractual Clauses and other appropriate measures (the implementation of end-to-end encryption and the use of the data routing function; This refers to the ability to determine for yourself through which data centres the data should flow during meetings and webinars.) It is assumed that an adequate level of data protection is ensured. We will be happy to provide the agreed EU Standard Contractual Clauses on request.

As a general rule, we process your data only for as long as is necessary for the purposes for which it was collected. We do not record anything. Your data is therefore not stored.

Photos and participant lists

The privacy policy for photos and participant lists can be viewed here.