Privacy Policy - help heritage international e.V.

Status 15.01.2024

With the publication of this privacy policy, all previous privacy policies lose their validity.

1. privacy information

We take the protection of your personal data very seriously. In the following, we would like to inform you comprehensively and in detail about what we collect your personal data for, what we do with it, to whom we may pass on this data and where and how long we store your data. In addition, you have numerous rights as a data subject, which we would also like to inform you about. We provide this information to you on the basis of Regulation (EU) 679/2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC, hereinafter referred to as the GDPR.

2. who processes your personal data?

We, that is the bodies listed below. We operate the data processing jointly and, in accordance with Art. 26 DS-GVO, are your contact persons in all matters of data protection as jointly responsible persons.

help heritage international e.V., Gestütsweg 4, 73733 Esslingen am Neckar
Vertreten durch Jacqueline Geh, Tel. +49 (0)15209198651

3. principles of data processing

3.1 Legal basis

3.1.1 General

We process your personal data based on the legal requirements of the DSGVO as well as the Federal Data Protection Act in its current version. In detail, we process your personal data:

within the scope of legal obligations,
insofar as we need them to fulfill contracts we have concluded with you, insofar as they are required for pre-contractual measures (e.g. offers),
as far as you have given your consent,
within the scope of our legitimate interests, which include marketing and direct advertising, as well as for the purpose of
Safeguarding our legal rights.

3.1.2 Special types of personal data

We would like to point out that, in accordance with Art. 9 para. 2 lit. d) DPA as a religiously oriented organization. Therefore, we are also permitted to process special categories of personal data, such as religious or ideological beliefs, to the extent that they relate to our members or persons who are in regular contact with us in the course of our activities. We treat this data as particularly confidential and do not disclose it to the outside world without your explicit consent.

3.2 Passing on data

In principle, we do not pass on data to third parties unless,

You have consented to the disclosure,
we are required to do so by law,
it is necessary for the performance of a contract with you or
we commission external service providers to perform tasks. In this case, we ensure that our service providers provide sufficient guarantees that appropriate technical and organizational measures are in place and that processing operations comply with the GDPR (Art. 28 GDPR). For this reason, we select such service providers very carefully.

3.3 Consents

3.3.1 Obtaining consent

We obtain your consent to the processing of personal data – if required – electronically or in writing. We secure electronic consents by means of an appropriate double opt-in procedure and log your consent.

3.3.2 Revocation

You can revoke your consent once given at any time with effect for the future. The legality of the data processing carried out on the basis of the consent until revocation is not affected by this. You can address your revocation to one of the offices mentioned under 2.

3.3.3 Legal consequences of revocation

Insofar as any processing of your personal data is based on your consent, we will terminate this as a result of your revocation. This may also mean that services obtained from you (e.g. newsletters) can no longer be provided.

3.3.4 Consents of children and adolescents

With our offers, we also address children and young people, among others. We therefore ensure, within the scope of technical and organizational possibilities, that consents given for the processing of a child’s personal data are in compliance with Art. 8 GDPR.

3.4 Processing in third countries

We generally process your data within the EU or the European Economic Area. An exception is the use of IT systems of partners and service providers that are operated in the USA or other third countries. In such cases, we will ensure that appropriate safeguards are in place to protect your personal data before it is transferred. The processing of your data in the USA is carried out in accordance with Art. 46 para. 2 lit. c and d GDPR on the basis of corresponding contracts using approved standard contractual clauses of the EU Commission or using the EU-US Privacy Shield. We will be happy to provide you with more detailed information on request.

3.5 Online forms

If you use the online form on our website to contact us, your personal data will be forwarded to us by e-mail. We ask you not to transmit confidential information in this way, as we cannot ensure the protection of this information during the transmission of unencrypted e-mails.

3.6 Storage and deletion periods

We only store your personal data for as long as is necessary to fulfill its processing purpose or due to legal retention obligations. After that, the personal data will be deleted. Notwithstanding the foregoing, we will delete your contact information only after three (3) years in which you have neither contacted us, subscribed to our newsletter, participated in any of our events, nor taken advantage of any of our other offers. Of course, your rights to erasure, blocking, restriction of processing or the right to be forgotten remain unaffected.

3.7 Data subject rights

3.7.1 Right of access (Art. 15 GDPR)

Data subjects have the right to request information on whether or not personal data relating to them is being processed. If personal data is processed by our company, there is a right to information about:

the purposes of processing;
the categories of personal data (type of data) that are processed;
the recipients or categories of recipients to whom their data have been or will be disclosed; this applies in particular if data have been or will be disclosed to recipients in third countries outside the scope of the GDPR;
the planned storage period, insofar as this is possible; if it is not possible to specify the storage period, the criteria for determining the storage period (e.g. statutory retention periods or similar) must be provided in any case;
Your right to rectification and deletion of the data concerning you, including the right to restrict processing and/or the possibility to object (see also the following paragraphs);
the existence of a right of appeal to a supervisory authority;
the origin of the data, if personal data were not collected directly from the data subject. You also have the right to be informed whether your personal data is the subject of automated decision-making within the meaning of Article 22 of the GDPR and, if this is the case, which decision-making criteria form the basis of such automated decision-making (logic) and what effects and scope the automated decision may have for you. If personal data is transferred to a third country outside the scope of the GDPR, you have the right to be informed whether and, if so, on the basis of which guarantees an adequate level of protection within the meaning of Art. 45, 46 GDPR is ensured at the data recipient in the third country. You have the right to request a copy of your personal data. We generally provide copies of data in electronic form unless you have specified otherwise. The first copy is free of charge; a reasonable fee may be charged for additional copies. The provision is subject to the rights and freedoms of other persons who may be affected by the transmission of the data copy.

3.7.2 Right of rectification (Art. 16 GDPR)

You have the right to ask us to correct your data if it is incorrect, inaccurate and/or incomplete; the right to rectification includes the right to complete it by means of supplementary declarations or notifications. A correction and/or addition must be made immediately – i.e. without culpable hesitation.

3.7.3 Right to erasure (Art. 17 GDPR)

You have the right to request that we delete your personal data insofar as

the personal data are no longer necessary for the purposes for which they were collected and processed;
the data processing is based on your consent and you have revoked your consent, unless there is another legal basis for the data processing;
you object to data processing pursuant to. Art. 21 DSGVO and there are no overriding legitimate grounds for further processing,
you object to data processing for the purpose of direct marketing pursuant to. Art. 21 par. 2 DSGVO have objected;
your personal data have been processed unlawfully;
it is data of a child relating to information society services pursuant to. Art. 8 par. 1 DSGVO have been collected. A right to the deletion of personal data does not exist insofar as
the right to freedom of expression and information precludes the request for deletion;
the processing of personal data (i) to comply with a legal obligation (e.g. statutory retention obligations), (ii) for the exercise of public functions and interests under Union law and/or Member State law (this includes public health interests); or (iii) is necessary for archiving and/or research purposes;
the personal data is necessary for the assertion, exercise or defense of legal claims. The deletion must take place immediately – i.e. without culpable hesitation. If personal data has been made public by us (e.g. on the Internet), we must ensure, as far as is technically possible and reasonable, that third party data processors are also informed of the deletion request, including the deletion of links, copies and/or replications.

3.7.4 Right to restrict processing (Art. 18 GDPR)

You have the right to have the processing of your personal data restricted in the following cases:

If you have disputed the accuracy of your personal data, you can demand that your data not be used for other purposes for the duration of the accuracy check and be restricted in this respect.
In case of unlawful data processing, instead of data deletion according to Art. 17 para. 1 lit. d DSGVO demand the restriction of data use according to Art. 18 DSGVO;
If you need your personal data for the assertion, exercise or defense of legal claims, but your personal data is otherwise no longer required, you may request us to restrict processing to the aforementioned legal pursuit purposes;
If you have objected to data processing pursuant to Art. 21 para. 1 DSGVO and it is not yet clear whether our interests in processing outweigh your interests, you may request that your data not be used for other purposes for the duration of the review and be restricted to this extent. Personal data, the processing of which has been restricted at your request, may – subject to storage – only be (i) with your consent, (ii) for the assertion, exercise or defense of legal claims, (iii) to protect the rights of other natural or legal persons; or (iv) processed for reasons of substantial public interest. If a processing restriction is lifted, you will be informed of this in advance.

3.7.5 Right to data portability (Art. 20 GDPR)

You have the right – subject to the following provisions – to demand the return of the data relating to you in a standard electronic, machine-readable data format. The right to data transfer includes the right to transfer the data to another controller; therefore, upon request, we will – as far as technically possible – transfer data directly to a controller designated by you or yet to be designated. The right to data transfer exists only for data provided by you and requires that the processing is based on consent or for the performance of a contract and is carried out with the help of automated processes. The right to data transfer according to Art. 20 DSGVO does not affect the right to data deletion according to Art. 17 DSGVO. The data transfer is subject to the rights and freedoms of other persons whose rights may be affected by the data transfer.

3.7.6 Right of objection (Art. 21 DSGVO)

In case of processing of personal data for the performance of tasks in the public interest (Art. 6 para. 1 lit e DSGVO) or for the performance of legitimate interests (Art. 6 para. 1 lit f DSGVO), you may object to the processing of the personal data concerning you at any time with effect for the future. In the event of an objection, we shall refrain from any further processing of your data for the aforementioned purposes unless,

there are compelling legitimate grounds for processing which override your interests, rights and freedoms, or
the processing is necessary for the establishment, exercise or defense of legal claims. You can object to the use of your data for the purpose of direct advertising at any time with effect for the future; this also applies to profiling insofar as it is connected with direct advertising. In the event of an objection, we must refrain from any further processing of your data for the purpose of direct marketing.

3.7.7 Prohibition of automated decisions

Profiling (Art. 22 GDPR) [soweit relevant] Decisions that produce legal effects concerning you or significantly affect you must not be based solely on automated processing of personal data – including profiling. This does not apply insofar as the automated decision

is necessary for the conclusion or fulfillment of a contract with you,
is permitted by Union or Member State legislation, provided that such legislation contains adequate measures to safeguard the rights and freedoms and legitimate interests of your person, or
is done with your express consent. Decisions based exclusively on automated processing of special categories of personal data are in principle inadmissible, unless Art. 22 para. 4 in conjunction with Art. 9 para. 2 lit a or lit. g DSGVO applies and appropriate measures have been taken to protect the rights and freedoms as well as the legitimate interests of your person.

3.7.8 Legal protection options / right of complaint to a supervisory authority

In case of complaints, you may at any time contact the competent supervisory authority of the Union or the member states. The supervisory authority named in Section II is responsible for our company.

4. detailed information on individual processing operations

Below, we have detailed the various purposes for which we collect and process personal data, what data we process, and how we handle personal data or to whom we may disclose it.

4.1 Processing for the purpose of communication with interested parties, general advertising to interested parties, marketing and public relations, solicitation of donors.

4.1.1 Purpose and legal basis

Our legitimate interest is that as many people as possible learn about us and support us and our projects. Therefore, we process your contact information if you have either already contacted us in some way or we believe you may be interested in us and our work. Our work is financed mainly by donations. Therefore, it is equally important for us to keep in touch with existing and potential donors and to inform them regularly about our work.

4.1.2 Scope of data processing

In order to contact you and inform you according to your interests, we process the following data: Name, address, e-mail address, telephone number, date of birth, interests, event attendance, donations, denomination, faith information/stories.

4.1.3 Origin of the data

We have received this data from you personally or from persons in your personal environment.

4.1.4 Retention and deletion periods According to the basic rules in 3.6

4.1.5 Special notes

Any additional personal data that you have entrusted to the arche altenbuch employee with whom you are in personal contact will remain confidential and will not be stored or processed by us.

4.2 Processing for the purpose of donation management

4.2.1 Purpose and legal basis

If you donate to us or a project, we need to process your data due to legal requirements (AO) and to fulfill your donation request.

4.2.2 Scope of data processing

If you have given us a specific donation order, we store the following personal data: Name, address, marital status, denomination, nationality, date of birth, e-mail address, telephone number, bank details, donation information.

4.2.3 Origin of the data

We have received this data from you.

4.2.4 Transfer of data, processing in third countries

Insofar as you have made a donation for a specific project, your personal data will also be passed on to our project partners in the respective recipient country of your donation. If you give us a note to that effect when you make your donation, we will not forward your information. In addition, we also disclose donor information to the relevant tax authorities as part of our legal obligations.

4.2.5 Retention and deletion periods according to the general rules in 3.6

4.3 Processing for the performance of contracts and the enforcement of legal claims

4.3.1 Purpose and legal basis

We offer numerous services. These services include: Consulting, events, organization of group trips, accommodation, coaching, therapy. We offer these services as part of a contractual relationship with you. We process your personal data insofar as

this is necessary for the fulfillment of the contract,
we are required to do so by law,
it is necessary to safeguard our legitimate interests.
you have declared your consent to the processing. We pursue legitimate interests in particular in connection with the enforcement of legal claims, e.g. for payment of agreed fees for the provision of services.

4.3.2 Scope of data processing

We may process the following categories of data: Name, address, contract data, performance data on the service provided (e.g. location, date, expenses), costs for the provision of services, religious affiliation, marital status, data on living situation, religious belief, bank details, dunning and payment data, collection data, passport and visa data, vaccination data, pictures and videos (only with consent).

4.3.3 Origin of the data

We have received the data from you, from our partners or from public authorities.

4.3.4 Transfer of data, processing in third countries

As a matter of principle, we only process your data within the framework of the principles listed under 3.2 and 3.4. In the context of travel events, additional data transfers to authorities in third countries (e.g. USA) may be necessary. You will be informed separately about this in connection with travel events.

4.3.5 Storage and deletion periods in accordance with the bases according to 3.6

4.4 Processing of applicant data

4.4.1 Purpose and legal basis

If you would like to join us, either as a permanent employee or as a volunteer, we look forward to receiving your application. In doing so, we process the personal data that you have provided to us as part of the application, as well as the data that accrues in the course of the application process. These are pre-contractual measures. We assume that by sending us your data, you have given us consent to process it as part of the application process. If we accept your application, we will continue to store your data as part of your cooperation pursuant to Art 6 para. 1 lit b DSGVO in conjunction with §26 BDSG 2018. If we reject your application, we store the records of the application process for a maximum of a further 6 months to safeguard our legitimate interests.

4.4.2 Scope of data processing

We process the following data in the application process: Name, address, marital status, religious denomination, qualifications, professional history, economic information (e.g. salary requirements), individual information that you have provided to us as part of the application.

4.4.3 Storage and deletion periods

We will delete this data 6 months after rejecting your application, with the exception of your contact data, unless legal retention requirements stipulate longer storage periods. We also store your contact data beyond this period within the scope of the purposes according to 4.1.

4.5 Processing to optimize and secure our online offering

4.5.1 Purpose and legal basis

We offer numerous online services for our partners and interested parties. In addition to our Internet pages, this also includes an online store. In order to ensure and further optimize the security, functionality and user-friendliness of our online offers, we collect personal data as soon as you use one of our online offers, incl. our website. of mobile apps.

4.5.2 Scope of data processing

We regularly collect the following data: Your IP address, date and time of access, access status/http status code, browser software used and its language and version operating system used, URLs from which you came and to which you go next, the amount of data transferred and the information whether the retrieval was successful.

4.5.3 Passing on data

For the provision of our online offers incl. mobile apps, we also use external service providers. They may also come into contact with your personal data. We select these service providers carefully and ensure that your data is protected by appropriate guarantees and technical-organizational measures. For more details see 3.2

4.5.4 Storage and deletion periods

This data is deleted within 7 days, unless it is exceptionally required for a longer period to protect legitimate interests. This may be necessary, for example, in the context of troubleshooting or for the prosecution of criminal acts.

4.5.5 Notes on the use of cookies on our Internet pages

Whenever you visit our website, so-called “cookies” are also stored on your terminal device. Cookies are information files. As soon as you visit our website, your Internet browser automatically saves it on your computer or data carrier. Cookies are used to make your visit to our site easier and more pleasant and to develop our site in a meaningful way. If you have already visited our site and made settings there, for example, a cookie with corresponding information is stored. When you visit our website again, this information is recognized by our system so that you do not have to make the corresponding entries each time you visit. In addition, the information obtained is used exclusively to compile statistics on the use of our website in order to be able to adapt it to your wishes and to make the use of our online offer as convenient as possible. No personal data, such as your name or address, is generated or passed on through this. Therefore, you cannot be personally identified from this information. Cookies also cannot run programs or damage your computer’s hard drive. Most of the cookies we use are so-called “session cookies”. They are automatically deleted after the end of your visit. Some so-called long-term cookies remain on your computer and are recognized the next time you visit our site. This will allow us to provide you with better access to our site. Specifically, this website uses the following types of cookies:

Transient cookies (temporary use),
Persistent cookies (time-limited use),
Third-party cookies (from third-party providers).

Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to the website. The session cookies are deleted when you log out or close the browser. Persistent cookies are automatically deleted after a predefined duration, which may differ depending on the cookie. You can delete the cookies in the security settings of your browser at any time. Third-party cookies come from third-party providers, for example. in the context of the use of the web analytics service Google Analytics. The information stored through the use of cookies is stored separately from any further data provided to us. In particular, the data of the cookies are not linked with your other data.

4.6 Use of web analytics services, social network plugins and third-party services

4.6.1 Google Analytics web analytics service

4.6.1.1 General

Our website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies, i.e. information files that are stored on your computer or terminal device and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. Google Analytics is used in accordance with the conditions agreed with Google by the German data protection supervisory authorities. We would like to point out that the Google Analytics extension “_anonymizeIp()” has been activated on this website to ensure anonymized collection of IP addresses. This means that IP addresses are processed in abbreviated form, thus excluding the possibility of direct personal references (see: support.google.com/analytics/answer/2763052 ). The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google.

4.6.1.2 Opposition options:

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing the browser plugin available at the link below: Link for browser plugin: https://tools.google.com/dlpage/gaoptout?hl=de As an alternative to the browser plugin or if you access our website via a mobile device, you can prevent the aforementioned collection and processing of data by Google Analytics on our website in the future by clicking on the following link. This sets an opt-out cookie on your terminal device that prevents future collection of your data when visiting this website. If you delete your cookies, you must click the link again:

Deactivate Google Analytics

4.6.1.3 Information from the third-party provider

Google: Google Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Email: support-de@google.com Terms of Use:http://www.google.com/analytics/terms/de.html Privacy Information:https://www.google.de/intl/de/policies/ www.google.de/intl/de/policies/privacy/ Building Blocks for Additional Plugins:

4.6.2 YouTube video integration

4.6.2.1 General

We have integrated YouTube videos into our online offer, which are stored on www.youtube.com and can be played directly from our website. The video platform is operated by YouTube, LLC, a Google Inc. company. (see above under “Google Analytics”). These are all integrated in the so-called extended data protection mode, which means that no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos, the data mentioned below will be transferred. We have no influence on this data transmission. When you play the videos, the third-party provider receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned in section 2.1 of this declaration will be transmitted. This takes place regardless of whether you are logged in to YouTube via a user account or whether no user account exists. If you are logged in to YouTube, this data is directly assigned to your user account. If you do not want such an assignment to your YouTube user account, you must log out before playing the video. The third party provider may store this data as a usage profile and use it for the purposes of advertising, market research and/or tailoring its website to meet user needs. Such an evaluation may also be carried out (also for users who are not logged in) for the purpose of providing tailored advertising and to inform other users of the platform about your activities on our website. You have a right to object to the creation of such user profiles, and you must contact the third-party provider to exercise this right to object. Further information on the purpose and scope of the data collection and its processing by the third-party provider, as well as your rights in this regard and setting options for protecting your privacy, can be obtained via the following

4.6.2.2 Information from the third-party provider YouTube:

YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA Tel: +1 / 650 253 0000 Fax: +1 / 650 253 0001 Email: support-de@google.com Terms of Use: www.youtube.com/t/terms

Privacy overview: www.google.com/intl/de/policies Technologies and principles incl.

Cookies: www.google.de/intl/de/policies/technologies/ Privacy policy: www.google.de/intl/de/policies/privacy

4.6.6 Using a font via MyFonts

The font used on this website uses a page view counter to ensure that the font is used correctly. After 30 days this log data is deleted, personal data is not processed. You can find the detailed privacy policy of the webfont provider here:

www.monotype.com/de/rechtshinweise/datenschutzrichtlinie/datenschutzrichtlinie-zum-tracking-von-webschriften