Data protection

Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter jointly referred to as the “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Data processing on this website is carried out by the website owner. You can find their contact details in the legal notice of this website.

Link to the legal notice
Contact for the data protection officer: info@dach-ukraine.de

Types of data processed:

• Inventory data (e.g. names, addresses).

• Contact data (e.g. e-mail, telephone numbers).

• Content data (e.g. text entries, photographs, videos).

• Usage data (e.g. websites visited, interest in content, access times).

• Meta and communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter we also refer to the data subjects collectively as “users”).

Purpose of processing

Provision of the online offering, its functions and content:

• Responding to contact enquiries and communicating with users.

• Security measures.

• Reach measurement/marketing

Data that you transmit to us:

On our website you have the opportunity to contact us (e.g. via the contact form). The personal data that you transmit to us in this context is used exclusively to process your respective enquiries.

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Where the legal basis is not stated in the privacy policy, the following applies: The legal basis for obtaining consent is Art. 6 (1) (a) and Art. 7 GDPR; the legal basis for processing in order to perform our services and carry out contractual measures as well as to respond to enquiries is Art. 6 (1) (b) GDPR; the legal basis for processing in order to fulfil our legal obligations is Art. 6 (1) (c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6 (1) (f) GDPR. In the event that the vital interests of the data subject or of another natural person make processing of personal data necessary, Art. 6 (1) (d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, input of, disclosure of and securing the availability and separation of the data. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the erasure of data and a response to threats to the data. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit data to them or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g. where a transmission of data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6 (1) (b) GDPR), where you have consented, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Where we commission third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the course of using third-party services or disclosing or transmitting data to third parties, this only takes place where it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process the data, or have it processed, in a third country only where the special requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special guarantees such as the officially recognised determination of a level of data protection corresponding to that of the EU (e.g. for the USA through the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

You have the right to request confirmation as to whether data concerning you is being processed, and to obtain information about that data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.

In accordance with Art. 17 GDPR, you have the right to request that data concerning you be erased without delay, or alternatively, in accordance with Art. 18 GDPR, to request a restriction of the processing of the data.

You have the right to request that the data concerning you which you have provided to us be received in accordance with Art. 20 GDPR and to request its transmission to other controllers.

You also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw consent you have given, with effect for the future, pursuant to Art. 7 (3) GDPR.

Right to object

You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR. The objection may in particular be made against processing for the purposes of direct marketing.

Cookies and the right to object to direct marketing

“Cookies” are small files stored on users' computers. Various information can be stored within cookies. A cookie primarily serves to store information about a user (or about the device on which the cookie is stored) during or after their visit within an online offering. Temporary cookies, also referred to as “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. Cookies are referred to as “permanent” or “persistent” if they remain stored even after the browser has been closed. In this way, for example, the login status can be stored if users visit the site after several days. Likewise, such a cookie may store users' interests, which are used for reach measurement or marketing purposes. A “third-party cookie” is a cookie offered by providers other than the controller operating the online offering (otherwise, if they are only the controller's cookies, they are referred to as “first-party cookies”).

We may use temporary and permanent cookies and provide information about this in our privacy policy.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may lead to functional restrictions of this online offering.

A general objection to the use of cookies employed for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be prevented by switching them off in the browser settings. Please note that in this case it may not be possible to use all functions of this online offering.

Erasure of data

The data we process is erased or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated within this privacy policy, the data stored by us is erased as soon as it is no longer required for its intended purpose and the erasure does not conflict with any statutory retention obligations. If the data is not erased because it is required for other and legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Under statutory requirements in Germany, data is retained in particular for 10 years pursuant to §§ 147 (1) of the German Fiscal Code, 257 (1) nos. 1 and 4, (4) of the German Commercial Code (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and for 6 years pursuant to § 257 (1) nos. 2 and 3, (4) of the German Commercial Code (commercial letters).

Under statutory requirements in Austria, data is retained in particular for 7 years pursuant to § 132 (1) of the Federal Fiscal Code (accounting documents, receipts/invoices, accounts, vouchers, business papers, statement of income and expenditure, etc.), for 22 years in connection with real property, and for 10 years in the case of documents relating to electronically supplied services, telecommunications, radio and television services provided to non-businesses in EU member states for which the Mini One Stop Shop (MOSS) is used.

Provision of our statutory and business services

We process the data of our members, supporters, interested parties, customers or other persons in accordance with Art. 6 (1) (b) GDPR where we offer them contractual services or act within the framework of an existing business relationship, e.g. towards members, or are ourselves recipients of services and contributions. Otherwise, we process the data of data subjects pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interests, e.g. where administrative tasks or public relations work are concerned.

The data processed in this context, the nature, scope and purpose of the processing and its necessity are determined by the underlying contractual relationship. This generally includes inventory and master data of the persons (e.g. name, address, etc.) as well as contact data (e.g. e-mail address, telephone, etc.), contract data (e.g. services used, content and information communicated, names of contact persons) and, where we offer chargeable services or products, payment data (e.g. bank details, payment history, etc.).

We erase data that is no longer required for the provision of our statutory and business purposes. This is determined according to the respective tasks and contractual relationships. In the case of business processing, we retain the data for as long as it may be relevant for the conduct of business as well as with regard to any warranty or liability obligations. The necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply.

Participation in affiliate partner programmes

Within our online offering, on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering) pursuant to Art. 6 (1) (f) GDPR, we use industry-standard tracking measures insofar as these are necessary for the operation of the affiliate system. Below we inform users about the technical background.

The services offered by our contractual partners may also be advertised and linked on other websites (so-called affiliate links or after-buy systems, where, for example, links or third-party services are offered after a contract has been concluded). The operators of the respective websites receive a commission if users follow the affiliate links and subsequently take up the offers.

In summary, it is necessary for our online offering that we can track whether users who are interested in affiliate links and/or the offers available from us subsequently take up the offers as a result of the affiliate links or our online platform. For this purpose, the affiliate links and our offers are supplemented with certain values that may form part of the link or be set in another way, e.g. in a cookie. These values include in particular the originating website (referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as advertising medium ID, partner ID and categorisations.

The online identifiers of users that we use are pseudonymous values. This means that the online identifiers themselves do not contain any personal data such as names or e-mail addresses. They only help us to determine whether the same user who clicked on an affiliate link or became interested in an offer through our online offering took up the offer, i.e. for example concluded a contract with the provider. However, the online identifier is personal insofar as the partner company and we ourselves have the online identifier together with other user data. Only in this way can the partner company inform us whether that user took up the offer and we can, for example, pay out the bonus.

Registration function

Users can create a user account. During registration, the required mandatory information is communicated to users and processed on the basis of Art. 6 (1) (b) GDPR for the purposes of providing the user account. The data processed includes in particular the login information (name, password and an e-mail address). The data entered during registration is used for the purposes of using the user account and its purpose.

Users may be informed by e-mail about information relevant to their user account, such as technical changes. If users have terminated their user account, their data relating to the user account is erased, subject to any statutory retention obligation. It is the responsibility of users to secure their data before the end of the contract once notice of termination has been given. We are entitled to irretrievably erase all of the user's data stored during the term of the contract.

When our registration and login functions are used and the user account is used, we store the IP address and the time of the respective user action. This storage takes place on the basis of our legitimate interests as well as those of users in protection against misuse and other unauthorised use. This data is generally not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6 (1) (c) GDPR. The IP addresses are anonymised or erased after no more than 7 days.

Contacting us

When you contact us (e.g. by contact form, e-mail, telephone or via social media), the user's details are processed in order to handle the contact enquiry and its processing pursuant to Art. 6 (1) (b) GDPR. Users' details may be stored in a customer relationship management system (“CRM system”) or a comparable enquiry management system.

We erase enquiries once they are no longer required. We review the necessity every two years; furthermore, the statutory archiving obligations apply.

Newsletter

With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedures and your rights of objection.

Content of the newsletter: We send newsletters, e-mails and other electronic notifications to our members.

Cancellation/withdrawal – You can cancel receipt of our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the end of every newsletter, or you can send an informal e-mail to info@dach-ukraine.de. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before erasing them, in order to be able to demonstrate consent previously given. The processing of this data is restricted to the purpose of a possible defence against claims.

Newsletter – dispatch service provider

The newsletter is sent using the dispatch service provider Elastic Email, Unit 107, 1208 Wharf Street, Victoria, BC V8W 3B9, Canada. You can view the dispatch service provider's data protection provisions here: https://elasticemail.com/resources/usage-policies/privacy-policy/. The dispatch service provider is used on the basis of our legitimate interests pursuant to Art. 6 (1) (f) GDPR and a data processing agreement pursuant to Art. 28 (3) sentence 1 GDPR.

The dispatch service provider may use the recipients' data in pseudonymous form, i.e. without attribution to a user, to optimise or improve its own services, e.g. for the technical optimisation of dispatch and the presentation of the newsletter, or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.

Hosting and e-mail dispatch

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services which we use for the purpose of operating this online offering.

In this context, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering pursuant to Art. 6 (1) (f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Collection of access data and log files

We, or our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6 (1) (f) GDPR. The access data includes the name of the website accessed, the file, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g. to investigate acts of misuse or fraud), log file information is stored for a maximum of 7 days and then erased. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the respective incident has been finally clarified.

This usage data is used to make the website accessible to you, to identify and remedy any technical problems that may arise, and to prevent and, if necessary, prosecute misuse of the offering. In addition, the usage data is used in anonymised form, i.e. without the possibility of identifying you as a user, for statistical purposes and to improve our website.

Online presences in social media

We maintain online presences within social networks and platforms in order to be able to communicate with the customers, interested parties and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.

Unless otherwise stated in our privacy policy, we process users' data where they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages.

Integration of third-party services and content

Within our online offering, on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 (1) (f) GDPR), we use content or service offerings from third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always presupposes that the third-party providers of this content are aware of users' IP addresses, since without the IP address they could not send the content to their browsers. The IP address is therefore necessary for the presentation of this content. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further details about the use of our online offering, and may also be combined with such information from other sources.

Youtube

We integrate videos from the “YouTube” platform of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.

OpenStreetMap

We integrate the maps of the “OpenStreetMap” service (https://www.openstreetmap.de), which are offered on the basis of the Open Data Commons Open Database Licence (ODbL) by the OpenStreetMap Foundation (OSMF). Privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy.

To our knowledge, users' data is used by OpenStreetMap exclusively for the purposes of displaying the map functions and caching the selected settings. This data may include in particular users' IP addresses and location data, which is, however, not collected without their consent (as a rule given within the settings of their mobile devices).

The data may be processed in the USA. Further information can be found in OpenStreetMap's privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy.

Use of Facebook social plugins

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 (1) (f) GDPR), we use social plugins (“plugins”) of the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins may display interaction elements or content (e.g. videos, graphics or text contributions) and can be recognised by one of the Facebook logos (a white “f” on a blue tile, the terms “Like”, “Gefällt mir” or a “thumbs up” sign) or are marked with the addition “Facebook Social Plugin”. The list and appearance of the Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/.

Facebook is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

When a user accesses a function of this online offering that contains such a plugin, their device establishes a direct connection with Facebook's servers. The content of the plugin is transmitted by Facebook directly to the user's device and integrated by it into the online offering. In doing so, usage profiles of users may be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and inform users accordingly to the best of our knowledge.

Through the integration of the plugins, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged in to Facebook, Facebook can attribute the visit to their Facebook account. When users interact with the plugins, for example by pressing the Like button or leaving a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a member of Facebook, it is nevertheless possible for Facebook to learn and store their IP address. According to Facebook, only an anonymised IP address is stored in Germany.

The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the related rights and setting options for protecting users' privacy, can be found in Facebook's data protection information: https://www.facebook.com/about/privacy/.

If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and link it to their membership data stored on Facebook, they must log out of Facebook before using our online offering and delete their cookies. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

X / Twitter

Functions and content of the Twitter service, offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, may be integrated within our online offering. This may include, for example, content such as images, videos or texts and buttons with which users can express their liking for the content or subscribe to the authors of the content or to our posts. Where users are members of the Twitter platform, Twitter can attribute access to the above-mentioned content and functions to their profiles there. Twitter is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active). Privacy policy: https://twitter.com/de/privacy, opt-out: https://twitter.com/personalization.

Adapted by the website owner
Created with Datenschutz-Generator.de by RA Dr. Thomas Schwenke

This English text is a translation provided for convenience. The German version of this privacy policy is the legally binding one.