Privacy Policy

Below, we provide information on the processing of personal data when using

• our website www.wilderness-international.org
• our social media profiles.

Personal data is any data that can be linked to a specific natural person, e.g. their name or IP address.

1.1. Contact details

The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is
Stiftung Wilderness International
, Grundstr. 1
, 01326 Dresden
Germany

Email: kontakt [at] wilderness-international.org

We are legally represented by Kai Andersch and Ronny Scholz.

Our Data Protection Officer can be contacted via
heyData GmbH
, Schützenstraße 5
, 10117 Berlin

www.heydata.eu
Email: datenschutz [at] heydata.eu

.

1.2. Scope of data processing, purposes of processing and legal bases

We set out the scope of data processing, the purposes of processing and the legal bases in detail below. The following are generally considered as legal bases for data processing:

• Article 6(1), first sentence, point (a) of the GDPR serves as the legal basis for processing operations for which we obtain consent.
• Article 6(1), first sentence, point (b) of the GDPR is the legal basis where the processing of personal data is necessary for the performance of a contract, e.g. when a website visitor purchases a product from us or we provide a service for them. This legal basis also applies to processing operations necessary for pre-contractual measures, such as enquiries regarding our products or services.
• Article 6(1), first sentence, point (c) of the GDPR applies where we process personal data to comply with a legal obligation, as may be the case under tax law, for example.
• Article 6(1), first sentence, point (f) of the GDPR serves as the legal basis where we can rely on legitimate interests for the processing of personal data, for example, for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions by the European Commission pursuant to Article 45( 3 of the GDPR guarantee the security of the data during transfer, where such decisions exist, as is the case, for example, with the United Kingdom, Canada and Israel.

When data is transferred to service providers in the USA, the legal basis for the transfer is an adequacy decision by the European Commission, provided that the service provider has also been certified under the EU–US Data Privacy Framework.

In other cases (e.g. where no adequacy decision exists), the legal basis for data transfers is, as a rule – unless we specify otherwise – the Standard Contractual Clauses. These constitute a set of rules adopted by the European Commission and form part of the contract with the relevant third party. In accordance with Article 46(2)(b) of the GDPR, they ensure the security of the data transfer. Many providers have provided contractual guarantees that go beyond the standard contractual clauses, thereby offering additional protection for the data. These include, for example, guarantees regarding the encryption of data or regarding the third party’s obligation to notify data subjects if law enforcement authorities seek to access data.

1.4. Retention period

Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its deletion. Where data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted; in other words, the data will be blocked and not processed for any other purposes. This applies, for example, to data that we are required to retain for commercial or tax law reasons.

1.5. Rights of data subjects

Data subjects have the following rights vis-à-vis us with regard to the personal data concerning them:

• Right of access,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to object to processing,
• Right to data portability,
• Right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. The contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6. Obligation to provide data

Donors, prospective clients or third parties are only required to provide us, within the context of a business relationship or other relationship, with those items of personal data that are necessary for the establishment, performance and termination of the business relationship or for the other relationship, or which we are legally obliged to collect. Without this data, we will generally have to refuse to enter into a contract or provide a service, or will no longer be able to fulfil an existing contract or other relationship.
Mandatory fields are marked as such.

1.7. No automated decision-making in individual cases

As a general rule, we do not use fully automated decision-making in accordance with Article 22 of the GDPR for the purpose of establishing and carrying out a business relationship or other relationship. Should we use such procedures in individual cases, we will provide separate information on this, where required by law.

1.8. Contact

When you contact us, e.g. by email or telephone, we will store the data provided to us (e.g. names and email addresses) in order to answer your enquiries. The legal basis for the processing is our legitimate interest (Article 6(1), first sentence, point (f) of the GDPR) in responding to enquiries addressed to us. We will delete the data collected in this context once storage is no longer necessary, or restrict its processing where statutory retention obligations apply.

1.9. Prize draws

From time to time, we run competitions via our website or by other means. We process the data collected in this context in order to identify and notify the winners. We then delete the data. We may also run prize draws exclusively for regular donors. In such cases, we process only the name to identify the winners and the contact details to notify them. It is in our legitimate interest to run prize draws to attract new donors or to engage with our existing donors. The legal basis for data processing is Article 6(1)(f) of the GDPR.

1.10. Donor surveys

 From time to time, we carry out donor surveys to get to know our donors and their preferences better. In doing so, we collect the data requested in each survey. It is in our legitimate interest to get to know our donors and their preferences better; therefore, the legal basis for the associated data processing is Article 6(1), first sentence, point (f) of the GDPR. We delete the data once the results of the surveys have been analysed.

We reserve the right to inform donors who have previously used our services or purchased goods from us about our offers from time to time by email or other means, provided they have not objected to this. The legal basis for this data processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in direct marketing (Recital 47 of the GDPR). Donors may object to the use of their email address for marketing purposes at any time, free of charge, for example via the link at the end of each email or by emailing us at the address given above.

Prospective donors have the option to subscribe to a free newsletter. We process the data provided during registration solely for the purpose of sending the newsletter. Registration takes place by selecting the relevant box on our website, by ticking the relevant box on a paper document, or by any other unambiguous action through which interested parties give their consent to the processing of their data; the legal basis for this is therefore Article 6(1), first sentence, point (a) of the GDPR. Consent may be withdrawn at any time, e.g. by clicking the relevant link in the newsletter or by notifying us at the email address provided above. The processing of data up to the point of withdrawal remains lawful even in the event of withdrawal.

On the basis of the recipients’ consent (Article 6(1), first sentence, point (a) of the GDPR), we also measure the open and click-through rates of our newsletters in order to understand which content is relevant to our recipients.

We send out newsletters using the Brevo tool provided by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin (Privacy Policy: https://de.sendinblue.com/legal/privacypolicy/). In doing so, the provider processes content, usage, meta/communication and contact data within the EU.

We send mailings to partners using the Pipedrive tool provided by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia (Privacy Policy: https://www.pipedrive.com/en/privacy). The provider processes content data, usage data, meta/communication data and contact data within the EU.

3.1. Notice for website visitors from Germany

Our website stores information on website visitors’ devices (e.g. cookies) or accesses information already stored on those devices (e.g. IP addresses). The specific details of this information are set out in the following sections.
This storage and access are carried out on the basis of the following provisions:

• Insofar as this storage or access is strictly necessary for us to provide the service on our website expressly requested by website visitors (e.g. to operate a chatbot used by the website visitor or to ensure the IT security of our website), it is carried out on the basis of Section 25(2)(2) of the TDDDG.
• In all other cases, this storage or access is based on the consent of website visitors (Section 25(1) of the TDDDG).

Subsequent data processing is carried out in accordance with the following sections and on the basis of the provisions of the GDPR.

3.2. Informational use of the website

When the website is used for information purposes – that is, when visitors do not specifically provide us with information – we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This constitutes our legitimate interest, and the legal basis is therefore Article 6(1), first sentence, point (f) of the GDPR.

This data comprises:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each instance
• Website from which the request originates
• Browser
• Operating system and its user interface
• Language and version of the browser software.

This data is also stored in log files. It is deleted when its storage is no longer required, at the latest after 14 days.

3.3. Web hosting and provision of the website

Our website is hosted by Amazon AWS. The provider is Amazon Web Services EMEA Sàrl, Avenue John F. Kennedy 38, 1855 Luxembourg. The data is processed on servers located in Frankfurt am Main (Germany). The provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication data or contact details. Further information can be found in the provider’s privacy policy at https://aws.amazon.com/de/privacy/?nc1=f_pr.

We also use the Amazon CloudFront Content Delivery Network (CDN). This is a service provided by Amazon Web Services EMEA SARL. A CDN is a network of regionally distributed servers connected via the internet, which enables content (such as graphics or scripts on our website) to be delivered more quickly. This processing is carried out for the purpose of speeding up our website’s loading times and thereby improving our online service.

The legal basis for the use of AWS and CloudFront is our legitimate interest in ensuring the technically flawless, fast and secure provision of our website (Article 6(1)(f) of the GDPR).

As AWS is a subsidiary of Amazon.com, Inc. (USA), the transfer of data to the USA cannot be entirely ruled out. The security of data transfers is guaranteed by the EU-US Data Privacy Framework (adequacy decision) and by additional agreed standard contractual clauses, which ensure an adequate level of data protection (Article 46(2)(c) of the GDPR).

3.4. Contact form

When you contact us via the contact form on our website, we store the data requested there and the content of your message.

The legal basis for the processing is our legitimate interest in responding to enquiries addressed to us. The legal basis for the processing is therefore Article 6(1), first sentence, point (f) of the GDPR.
We will delete the data collected in this context once storage is no longer necessary, or restrict the processing where statutory retention obligations apply.

3.5. Job Advertisements

We publish vacancies within our company on our website, on pages linked to our website, or on third-party websites.

The data provided as part of the application is processed for the purpose of conducting the application process. Insofar as this data is necessary for our decision to enter into an employment relationship, the legal basis is Article 88(1) of the GDPR in conjunction with Section 26(1) of the Federal Data Protection Act (BDSG). We have marked the data required to carry out the application process accordingly or have drawn attention to it. If applicants do not provide this data, we cannot process their application.

Any further data is provided on a voluntary basis and is not required for an application. Should applicants provide further information, the legal basis is their consent (Article 6(1), first sentence, point (a) of the GDPR).

We ask applicants to refrain from including information on political opinions, religious beliefs and similar sensitive data in their CVs and cover letters. Such information is not required for an application. If applicants nevertheless provide such information, we cannot prevent its processing as part of the processing of the CV or cover letter. In such cases, the processing is also based on the applicants’ consent (Article 9(2)(a) of the GDPR).

Finally, we process applicants’ data for further recruitment procedures if they have given us their consent to do so. In this case, the legal basis is Article 6(1), first sentence, point (a) of the GDPR.
We pass on applicants’ data to the relevant staff in the Human Resources department, to our data processors in the recruitment sector, and to other staff involved in the recruitment process.

If, following the recruitment process, we enter into an employment relationship with the applicant, we will only delete the data once the employment relationship has ended. Otherwise, we will delete the data no later than six months after rejecting an applicant.
If applicants have given us their consent to use their data for future recruitment processes as well, we will not delete their data until one year after receiving the application.

3.6. Provision of services

We collect donations via our website. In doing so, we process the following data as part of the donation process:

• First name
• Surname
• Email address
• Address for the donation receipt
• Reason for and name on the receipt (optional)

The data is processed for the purpose of fulfilling the contract concluded with the respective website visitor (Article 6(1)(b) of the GDPR).

3.7. Payment service providers

To process payments, we use payment service providers who are themselves data controllers within the meaning of Article 4(7) of the GDPR. Insofar as these providers receive the data and payment details entered by us during the ordering process, we thereby fulfil the contract concluded with our donors (Article 6(1), first sentence, point (b) of the GDPR).

These payment service providers are:

• Stripe Payments Europe, Ltd., Ireland

3.8. Technically necessary cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser on a visitor’s device. Cookies help to make the website more user-friendly, effective and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter “technically necessary cookies”), the legal basis for the associated data processing is Article 6(1), first sentence, point (f) of the GDPR. We have a legitimate interest in providing donors and other visitors with a fully functional website.

Specifically, we use technically necessary cookies for the following purpose or purposes:

• Cookies that store language settings
• Cookies set by payment providers for payment processing which do not analyse user behaviour

3.9. Third-party providers

3.9.1. Pipedrive

We use Pipedrive for lead management. The provider is Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. The provider processes contact data (e.g. email addresses, telephone numbers), meta/communication data (e.g. device information, IP addresses) and master data (e.g. names, addresses) within the EU.

The legal basis for the processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in managing data relating to leads for the purposes of direct marketing.
We will delete the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://www.pipedrive.com/en/privacy.

3.9.2. LinkedIn Insight Tag

We use the LinkedIn Insight Tag for conversion tracking. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The provider processes usage data (e.g. webpages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) within the EU.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information is available in the provider’s privacy policy at https://www.linkedin.com/legal/privacy-policy.

3.9.3. Cookiebot

We use Cookiebot to manage consents. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich. The provider processes metadata and communication data (e.g. device information, IP addresses) within the EU.

The legal basis for the processing is Article 6(1)(c) of the GDPR. The processing is necessary for compliance with a legal obligation to which we are subject.

The data will be deleted once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information is available in the provider’s privacy policy at https://www.cookiebot.com/de/privacy-policy/.

3.9.4. Jotform

We use Jotform for questionnaires and forms. The provider is Jotform Inc., 4 Embarcadero Centre, Suite 780, San Francisco CA 94111, USA. The provider processes content data (e.g. entries in online forms), contact details (e.g. email addresses, telephone numbers) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Article 6(1), first sentence, point (f) of the GDPR. We have a legitimate interest in collecting information from donors and other individuals in a simple and user-friendly manner.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the assessment procedure under Article 93(2) of the GDPR (Article 46(2)(c) of the GDPR), which we have agreed with the provider.

The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information is available in the provider’s privacy policy at https://www.jotform.com/privacy/.

3.9.5. Stripe

We use Stripe for payments. The provider is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The provider processes payment data (e.g. bank details, invoices, payment history) and master data (e.g. names, addresses) in the USA.

The legal basis for the processing is Article 6(1), first sentence, point (b) of the GDPR. The legal basis is Article 6(1), first sentence, point (b) of the GDPR, as the processing is necessary for the performance of a contract to which the data subject is a party, or as it is necessary for the implementation of pre-contractual measures taken at the data subject’s request.

The legal basis for the transfer to a country outside the EEA is an adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://stripe.com/de/privacy#translation.

3.9.6. Meta Pixel

We use Meta Pixel for analysis. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g. webpages visited, interest in content, access times) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.

The legal basis for the transfer to a country outside the EEA is an adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country offers an adequate level of protection.
The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information can be found in the provider’s privacy policy at https://www.facebook.com/policy.phpabrufbar.

3.9.7. Google Maps

We use Google Maps to display maps on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. The provider processes usage data (e.g. webpages visited, interest in content, access times), location data and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.
The legal basis for the transfer to a country outside the EEA is consent.
We will erase the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://policies.google.com/privacy?hl=de.

3.9.8. YouTube videos

We use YouTube videos on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.

The legal basis for the transfer to a country outside the EEA is consent.

Further information is available in the provider’s privacy policy at https://policies.google.com/privacy.

3.9.9. Google Tag Manager

We use Google Tag Manager for analytics and advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.

The legal basis for the transfer to a country outside the EEA is an adequacy decision. The security of data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country offers an adequate level of protection.

We will erase the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://policies.google.com/privacy?hl=de.

3.9.10. Help Scout

We use Help Scout to communicate with donors, for knowledge management and for donor support. The provider is Help Scout PBC, 177 Huntington Ave, Ste 1703, PMB 78505, Boston, MA 02115-3153. The provider processes contact details (e.g. email addresses, telephone numbers), meta/communication data (e.g. device information, IP addresses) and master data (e.g. names, addresses) in the USA.

The legal basis for the processing is Article 6(1), first sentence, point (f) of the GDPR. We have a legitimate interest in responding to enquiries from our donors in a straightforward manner.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the assessment procedure under Article 93(2) of the GDPR (Article 46(2)(c) of the GDPR), which we have agreed with the provider.

The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information is available in the provider’s privacy policy at https://www.helpscout.com/company/legal/privacy/.

3.9.11. Google Analytics

We use Google Analytics for analysis. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the assessment procedure under Article 93(2) of the GDPR (Article 46(2)(c) of the GDPR), which we have agreed with the provider.

The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information can be found in the provider’s privacy policy at https://policies.google.com/privacy?hl=deabrufbar.

3.9.12. Google Remarketing

 This website uses the functions of Google Analytics Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Remarketing analyses your user behaviour on our website (e.g. clicking on specific products) in order to categorise you into specific advertising target groups and subsequently display relevant advertising messages to you when you visit other online services (remarketing or retargeting).

Furthermore, the advertising target groups created using Google Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalised advertising messages – which have been tailored to you based on your previous usage and browsing behaviour on one device (e.g. a mobile phone) – can also be displayed on another of your devices (e.g. a tablet or PC).

If you have a Google account, you can opt out of personalised advertising via the following link: https://www.google.com/settings/ads/onweb/.

The use of Google Remarketing is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in marketing its products as effectively as possible. Where consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

Further information and the data protection provisions can be found in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.

3.9.13. Typeform

We use Typeform for questionnaires and forms. The provider is Typeform S.L., 163 Carrer de Bac de Roda, Barcelona, Spain. The provider processes content data (e.g. entries in online forms) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is carried out on the basis of consent. Data subjects may withdraw their consent at any time, for example by contacting us using the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal.

The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses adopted in accordance with the assessment procedure under Article 93(2) of the GDPR (Article 46(2)(c) of the GDPR), which we have agreed with the provider.

The data will be erased once the purpose for which it was collected no longer applies and there is no conflicting obligation to retain it. Further information is available in the provider’s privacy policy at https://admin.typeform.com/to/dwk6gt.

3.9.14. heyData

We have integrated a data protection seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes metadata and communication data (e.g. IP addresses) within the EU.

The legal basis for the processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in providing website visitors with confirmation of our compliance with data protection regulations. At the same time, the provider has a legitimate interest in ensuring that only donors with existing contracts use its seals; therefore, a mere image copy of the certificate does not constitute a viable alternative to the confirmation.

The data is anonymised after collection so that it can no longer be linked to any individual. Further information is available in the provider’s privacy policy at https://heydata.eu/datenschutzerklaerung.

We are active on social media platforms to showcase our organisation and our services. The operators of these platforms regularly process their users’ data for advertising purposes. Among other things, they create user profiles based on users’ online behaviour, which are used, for example, to display adverts on the networks’ pages and elsewhere on the internet that match users’ interests. To this end, the network operators store information on usage behaviour in cookies on users’ computers. It cannot be ruled out, moreover, that the operators may combine this information with other data. Users can find further information, as well as details on how to object to the processing carried out by the site operators, in the privacy policies of the respective operators listed below. It may also be the case that the operators or their servers are based in non-EU countries, meaning that they process data there. This may give rise to risks for users, for example because it becomes more difficult to enforce their rights or because government authorities may access the data.

When users of these networks contact us via our profiles, we process the data provided to us in order to respond to their enquiries. This constitutes our legitimate interest, and the legal basis is therefore Article 6(1), first sentence, point (f) of the GDPR.

4.1. Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://www.facebook.com/policy.php. One way to object to data processing is via the ad settings: https://www.facebook.com/settings?tab=ads.

On the basis of an agreement, we are jointly responsible with Facebook for the processing of data relating to visitors to our profile, in accordance with Article 26 of the GDPR. Facebook explains exactly which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects may exercise their rights with both us and Facebook. However, under our agreement with Facebook, we are obliged to forward enquiries to Facebook. Data subjects will therefore receive a quicker response if they contact Facebook directly.

4.2. Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://help.instagram.com/519522125107875.

4.3. TikTok

We maintain a profile on TikTok. The operator is TikTok Technology Limited, whose registered office is at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The privacy policy is available here: https://www.tiktok.com/de/privacy-policy.

4.4. YouTube

We maintain a profile on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The privacy policy is available here: https://policies.google.com/privacy?hl=de.

4.5. LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available here: https://www.linkedin.com/legal/privacy-policy?_l=de_DE. One way to object to data processing is via the advertising settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.