Privacy Policy

 

This privacy statement explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online offering and the related websites, functions and content, as well as external online presence, such as our Social Media Profile. (collectively referred to as "online offer"). With regard to the terms used, such as “processing" or “responsible”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Responsible

pro filia e.V.
Marientalstraße 78
48149 Münster
Geschäftsführerin: Dr. Johanne Feldkamp
kontakt@profilia.eu
https://www.profilia.eu

Types of processed data:

  • Inventory data (eg, names, addresses).
  • Contact details (eg, e-mail, telephone numbers).
  • Content data (eg, text input, photographs, videos).
  • Usage data (eg, visited websites, interest in content, access times).
  • Meta / communication data (eg, device information, IP addresses).

Categories of data subjects:

  • Visitors and users of the online offer.

In the following, we also refer to the persons concerned as "users".

Purpose of processing:

  • Providing the online offer, its contents and functions.
  • Answering contact requests and communication with users.
  • Safety measures.
  • Range measurement/marketing.

Definitions used

personal data’ means any information relating to an identified or identifiable natural person hereinafter referred to as ‚concerned person‘); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is comprehensive and covers practically all handling of data.

pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

responsible’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the responsible

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you about the legal basis of our data processing. Unless the legal basis in the data protection declaration is mentioned, the following applies: The legal basis for obtaining consent is Article 6 (1) lit. a and Art. 7 GDPR, the legal basis for the processing for the performance of our services and the execution of contractual measures as well as the response to inquiries is Art. 6 (1) lit. b GDPR, the legal basis for processing in order to fulfill our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Article 6 (1) lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 section 1 lit. d GDPR is classified as legal basis.

Safety measures

We take appropriate technical measures in accordance with Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and freedoms of individuals and organizational measures to ensure a level of protection appropriate to the risk.

Measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as their access, input, disclosure, availability and separation. In addition, we have established procedures that ensure the exercise of data subject rights, data erasure and reaction to data being compromised. Furthermore, we consider the protection of personal data already in the development, or selection of hardware, software and procedures, according to the principle of data protection by technology design and by privacy-friendly default settings considered (Article 25 DSGVO).

Collaboration with processors and third parties

If, in the context of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them to them or otherwise grant access to the data, this will only be done on the basis of a legal permission (eg if a transmission of the data to third parties, as to payment service providers, in accordance with Art. 6 section 1 lit. b DSGVO is required to fulfill the contract), you have consented to a legal obligation or on the basis of our legitimate interests (eg the use of agents, webhosters, etc.).

If we commission third parties to process data on the basis of a so-called "order processing contract", this is done on the basis of Art. 28 DSGVO.

Transfers to third countries

If we process data in a third country (ie outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. DSGVO. This means, for example, that the processing takes place on the basis of special guarantees, such as the officially recognized level of data protection (eg for the USA through the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

Rights of data subjects

You have the right to request a confirmation as to whether the data in question are being processed and to provide information about this data as well as further information and a copy of the data in accordance with Art. 15 DSGVO.

You have accordingly. Art. 16 DSGVO the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you.

In accordance with Art. 17 DSGVO, you have the right to demand that the relevant data be deleted immediately, or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 DSGVO.

You have the right to demand that the data relating to you provided to us be obtained in accordance with Art. 20 DSGVO and to be transmitted to other persons responsible.

You have gem. Art. 77 DSGVO the right to file a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw consent in accordance with. Art. 7 section 3 DSGVO with effect for the future.

Right of objection

You may at any time object to the future processing of your data in accordance with Art. 21 GDPR. The objection may in particular be made against processing for direct marketing purposes.

Cookies and right to object in direct mail

"Cookies" are small files that are stored on users' computers. Different information can be stored within the cookies. A cookie is primarily used to store the information about a user (or the device on which the cookie is stored) during or after his visit to an online offer. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes his browser. In such a cookie, e.g. the contents of a shopping cart are stored in an online store or a login status. The term "permanent" or "persistent" refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status will be saved if users visit it after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for range measurement or marketing purposes. A "third-party cookie" refers to cookies that are offered by providers other than the person who manages the online offer (otherwise, if it is only their cookies, this is called "first-party cookies").

We can use temporary and permanent cookies and clarify this in the context of our privacy policy.

If users do not want cookies stored on their computer, they will be asked to disable the option in their browser's system settings. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.

A general contradiction to the use of cookies used for online marketing purposes can be found in a variety of services, especially in the case of tracking, via the US website
http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/ be explained. Furthermore, the storage of cookies can be achieved by switching them off in the settings of the browser. Please note that not all features of this online offer may be used.

Deletion of data

The data processed by us are deleted or restricted in accordance with Art. 17 and 18 DSGVO. Unless explicitly stated in this privacy policy, the data stored by us are deleted as soon as they are no longer required for their purpose and the deletion does not conflict with any statutory storage requirements. Unless the data is deleted because it is required for other and legitimate purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax reasons.

According to German legal requirements, the storage is effected in particular for 10 years according to §§ 147 section 1 AO (books, records, management reports , accounting documents, commercial and business letters, documents relevant to taxation, etc.) and for 6 years according to § 257 sections 1 numbers 2 and 3, section 4 HGB (trade letters).

According to Austrian legal requirements, the storage is effected in particular for 7 years according to §132 section 1 BAO (accounting documents, relevant documents/invoices, accounts, business papers, income and expenditure figures etc), for 22 years in context with property plots and for 10 years for documents in in context with electronically supplied services, telecommunication, broadcast and television services that are provided to non-business individuals in EU member states and for which the Mini-One-Stop-Shop (MOSS) is used.

 

We process the data of our members, supporters, interested parties, and other persons according to Art. 6 Abs. 1 lit. b. DSGVO, insofar as we are offering them contractual services or are active in the context of existing business relationships, for example in relation to members, or when we are ourselves the recipients of services and contributions. We moreover process data of persons according to Art. 6 Abs. 1 lit. f. DSGVO on the basis of our legitimate interests, for example in relation to our administrative tasks or public outreach.

The data processed in these cases and the manner, scope, purpose, and necessity of their processing are determined by the underlying contractual relationship. This includes basic inventory and reference data of persons (e.g. name, address, etc.) as well as contact details (e.g. email address, phone number, etc.), contractual data (e.g. services used, content and information shared, or names of contacts), and payment details in cases where we offer fee-based services or products (e.g. bank details, payment history, etc.).

We delete data that is no longer necessary for the fulfillment of our purposes according to our statutes and business. This is determined according to the respective tasks and contractual relationship. In the case of business processing, we keep data as long as necessary for the completion of the business and as long as any guarantees or liabilities remain relevant. The necessity of storage of these data is reviewed every three years; otherwise, the legal responsibilities concerning data storage apply. 

Newsletter

With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedures as well as your right of objection. By subscribing to our newsletter, you agree to the receipt and the procedures described.

Content of the newsletter: We send newsletters, e-mails and other electronic notifications with advertising information (hereinafter "newsletter") only with the consent of the recipient or a legal permission. Insofar as the contents of a newsletter are concretely described, they are authoritative for the consent of the users. Incidentally, our newsletters contain information about our achievements and us.

Double opt-in and logging: Registration for our newsletter is done in a so-called double-opt-in procedure. This means you will receive an e-mail after logging in to ask for confirmation of your registration. This confirmation is necessary so that nobody can register with external e-mail addresses. The registration for the newsletter will be logged in order to prove the registration process according to the legal requirements. This includes the storage of the login and the confirmation time, as well as the IP address. Likewise, changes to your data stored with the shipping service provider will be logged.

Subscription data: Your email address is sufficient to subscribe to the newsletter. We also give you the option to provide us with your name so that we can address you personally in the newsletter. 
The sending of the newsletter and the performance assessment connected to this occurs with the consent of the recipient in accordance with art. 6 par. 1 lit. a, art. 7 DSGVO i.V.m § 7 par. 2 no. 3 UWG and in accordance with the legal permission outlined in § 7 par. 3 UWG. 
The subscription process is recorded based on our entitled interests in accordance with art. 6 par. 1 lit. f DSGVO. We are interested in providing a user-friendly and secure newsletter system which not only serves our commercial interests and meets users’ expectations, but also allows us to verify consent. 

Unsubscribing / withdrawing consent – You can unsubscribe from our newsletter at any time, i.e. withdraw your consent. A link to unsubscribe from the newsletter can be found at the bottom of every newsletter. We can save the provided email address for up to three years on the basis of our entitled interests before deleting it for the purpose of newsletter distribution in order to verify previously given consent. The processing of this data is restricted to the possible defense against any arising claims. An individual request to delete this data can be made at any time, if the previous giving of consent is confirmed.

Hosting
The hosting services we utilise are intended for the provision of the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services that we employ to operate the website. 

We and/or our hosting provider hereby process inventory data, contact data, content data, contract data, usage data, metadata and communication data from customers, interested parties and visitors to this website on the basis of our legitimate interests in an efficient and secure provision of our website in accordance with Article 6 § 1 S. 1 f) GDPR in connection with Article 28 GDPR.