Source: https://verein.datenanfragen.de/en/privacy/
Timestamp: 2019-04-20 14:24:21+00:00

Document:
We are committed to privacy, so we have designed our services from the ground up to collect as little data as possible. We also try our best to keep data processing at a minimum.
Most features on our websites will be executed entirely on your own computer, so the data you enter will never even reach our servers. Furthermore, our websites can only be accessed via a TLS-encrypted connection to ensure that your connection to our server cannot be compromised by third parties.
To exercise your privacy rights, we of course recommend using our generator which will help you generate the appropriate requests for free.
This includes the data we collect and process from our member but also the data that is incurred from donations and the like.
In addition, this includes the websites Datenanfragen.de and datarequests.org, as well as verein.datenanfragen.de.
The association’s purpose is to support the general public in excercising their right to privacy (“right to informational self-determination”) by informing and advising them with all questions regarding personal data protection. We are bound by our constitution in all our activities.
With our websites Datenanfragen.de and datarequests.org, we want to help you exercise your right to privacy. In order to do so, we offer a generator that helps you automatically generate requests, a company database with contact data for privacy-related requests to many companies and educational material on subjects related to privacy and data protection.
Finally, the website verein.datenanfragen.de has information on the association and allows you to join or donate among other things.
We respect the Do Not Track (DNT) option that you can set in your browser. If you have enabled it, we will deactivate all telemetry (currently there is none but we may implement privacy-friendly telemetry in the future).
To fulfill our association’s purpose, to operate our website and to provide our services, we have to collect and process some personal data. Our top priority is to minimise data collection and processing: We only collect personal data where it is necessary and only to the extent that it is necessary. In addition, data is always collected for a specific purpose and storage is limited to the necessary period of time.
In order to give you the greatest possible control over your privacy, you can set whether you want to activate many functions of our websites at any time via our privacy controls. A cookie is stored in your browser for each option. It only contains an indication as to whether you have activated or deactivated the respective option, but no personal data.
In this section we would like to explain to you exactly under which circumstances we collect and process which data. Not listed here are the processings that take place exclusively on your own computer and for which no data is transferred to us. You can find further information about these in the above mentioned privacy controls.
In addition to that, some of the files on our website are requested from servers run by Amazon Web Services EMEA SARL, 5 rue Plaetis, L-2338 Luxembourg, Luxembourg (the authorized representative of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA in the European economic area). These servers may collect aggregated statistics on how the services are used. While have have access to these statistics, we cannot influence whether or how they are collected.
Amazon Web Services, Inc. is certified under the US-European “Privacy Shield” framework, which ensures that the EU data protection level is maintained, through Amazon.com, Inc.. For more information on how Amazon Web Services processes your data, please refer to their data privacy FAQ.
Lawful basis: The data is stored on the basis of our (and our hosting partners’) legitimate interest in improving the stability and functionality of the servers in use in accordance with Art. 6(1) lit. f GDPR.
If you post content on datarequests.org (like comments or contributions to our company database), it may contain personal data. The disclosure of this data is entirely voluntary for you. Not providing it has no influence on your use of our website.
Lawful basis: The basis of the storage is our legitimate interest to display the user contributions on our website in accordance with Art. 6(1) lit. f GDPR.
Data disclosure: User content is publicly accessible via our website.
If you report an error to us, your report may contain personal data. The disclosure of this data is entirely voluntary for you. Not providing it has no influence on your use of our website.
We will always display all the information included in the report to you before you send it and give you the ability to alter or remove information from it.
Lawful basis: The basis of the storage is our legitimate interest to improve the stability and functionality of our website in accordance with Art. 6(1) lit. f GDPR.
Data disclosure: The content of error reports may be publicly accessible via our GitHub issue tracker.
If you want to become a member of the association, you need to provide some data through the membership application form. This data is necessary for our records and for us to be able to contact you with important information regarding your membership (like invitations to the general assembly, donation receipts or payment reminders).
Providing this data is necessary for us to fulfill our obligations laid down in our constitution and the law. Thus, you can unfortunately not become a member of Datenanfragen.de e. V. without providing said data.
Lawful basis: Collecting and processing this data is necessary for becoming a member, it is based on Art. 6(1) lit. b GDPR.
Duration of storage: If your request is not accepted, we will delete the data immediately. If your application is accepted and you become a member of the association, we will store the data for the duration of your membership. After your withdrawal from the association, we will delete all data that we no longer need within 30 days. For some data (including letters and receipts), however, there are legal storage obligations of currently up to ten years (see in particular § 147(3) of German AO).
Data disclosure: Only the board has access to this data. Under certain circumstances we may be legally obliged (e.g. on the basis of § 37 of German BGB) to pass on your contact data to other members of the association for internal communication.
As a member you are likely required to pay membership fees in accordance with our membership fee regulation. After your membership application has been accepted, we will ask for your payment details and the desired payment method. We need this data for billing purposes and for issuing donation receipts.
Lawful basis: The collection and processing is necessary for the settlement of membership fees and is based on Art. 6(1) lit. b GDPR. In addition, we are subject to certain legal accounting obligations, for which we have to store and process the data pursuant to Art. 6(1) lit. c GDPR.
Data disclosure: Only the board has access to this data. We may have to pass it on to the tax office responsible for us as part of tax statements or similar.
If you decide to pay through one of the external payment gateways we offer, these gateways will receive personal data on you and your payment and will provide some of that data to us. For more details on those third parties and the affected data, have a look at the “External services” section below.
If you send us donations, we will receive data that we have to store and process for accounting purposes.
We are happy to accept anonymous donations, so providing this information is completely voluntary for you.
Lawful basis: We are subject to certain legal accounting obligations, therefore the storage and processing is based on Art. 6(1) lit. c GDPR.
We offer a newsletter with information about the activities of the association and for which you can register e.g. in the membership application form. If you decide to do so, we will send you the relevant information via the contact option you have provided (by e-mail or post).
The subscription is entirely voluntary for you. It is currently only available to members of the association.
Lawful basis: By subscribing, you consent to the sending of the newsletter in accordance with Art. 6(1) lit. a GDPR. You can revoke this consent at any time; you can find out how to do this in the section “Right to revoke given consent”.
Data disclosure: The newsletter is sent by the board.
In order to make our servives more interesting and efficient, we work with some external services.
We allow you to make payments to the association (especially donations and membership fees) through the payment gateway CoinGate. CoinGate is run by UAB Virtualios valiutos, A. Goštauto g. 8, LT-01108 Vilnius, Lithuania.
We use CoinGate for crypto currency transactions. We will display a note in the payment form if your payment is made through CoinGate.
If you make a payment through CoinGate, UAB Virtualios valiutos receives all data incurred in the payment process, especially including: the payment amount, the cryto currency you are using, your payment details (like your Bitcoin wallet address), potentially your name, potentially your email address.
We allow you to make payments to the association (especially donations and membership fees) through the payment gateway CoinGate. Mollie is run by Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands.
We use CoinGate for example for credit card transactions. In any case, we will display a note in the payment form if your payment is made through Mollie.
If you make a payment through Mollie, Mollie B.V. receives all data incurred in the payment process, especially including: your payment details (for example your bank account or credit card details) including the amount, your IP address, your browser and device type, potentially your name, potentially your address, potentially information on the kind of paynebt your are making to us, potentially all other data you actively provide (like when interacting with Mollie’s support).
We allow you to make payments to the association (especially donations and membership fees) through the payment gateway PayPal. PayPal is run by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal L-2449, Luxembourg.
We will display a note in the payment form if your payment is made through PayPal.
If you make a payment through PayPal, PayPal (Europe) S.à.r.l., S.C.A. receives all data incurred in the payment process, especially including: the amount, data on the payment source for the transaction (for example your bank account or credit card details), device details, technical usage details, location details, your name, your address, your phone number, your email address.
We of course invite you to use our generator which will assist you with writing requests.

References: Art. 6
 Art. 6
 Art. 6
 V. 
 Art. 6
 § 147
 § 37
 Art. 6
 Art. 6
 Art. 6
 Art. 6