Source: https://knodelfoundation.org/en/privacy/
Timestamp: 2019-04-21 10:33:45+00:00

Document:
The recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, regardless of whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.
You can ask the controller to confirm whether personal data concerning you are being processed by us.
the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing on the data subject.
You have the right to request information as to whether the personal data concerning you are transmitted to a third country or to an international organisation. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.
You have the right to rectification and/or completion towards the controller if the personal data processed concerning you are incorrect or incomplete. The controller must make the correction without delay.
if you have filed an objection to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate reasons of the controller outweigh your reasons.
If the processing of personal data concerning you has been restricted, such data may only be processed, except for being stored, with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State.
You withdraw your consent on which the processing was based in accordance with Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR and there is no other legal basis for processing.
You object to processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate reasons for processing, or you object to processing in accordance with Art. 21 (2) GDPR.
The erasure of your personal data is necessary to fulfil a legal obligation under Union or Member State law which the controller is subject to.
If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that you as the data subject have requested the erasure of all links to these personal data or of copies or replications of these personal data.
If you have exercised your right to have the controller correct or erase the data or restrict the processing, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this correction or erasure of the data or the restriction on processing, unless this proves impossible or involves a disproportionate effort.
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you under Art. 6 (1) lit. e or f GDPR; this also applies to any profiling based on these provisions.
The controller will no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is required for the establishment, exercise or defence of legal claims.
If you object to processing for direct marketing purposes towards our company, we shall no longer process the personal data concerning you for such purposes.
Further, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means using technical specifications.
You have the right to withdraw your data protection consent at any time. The withdrawal of consent shall not affect the legality of the processing carried out on the basis of the consent until the withdrawal.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you are staying, working or suspected of infringing, if you believe that the processing of personal data concerning you is in breach of the GDPR.
We categorically only process personal data of our users if this is necessary to provide a functional website and our contents and services.
Our users’ personal data is therefore generally only processed with their consent. An exception applies in those cases where prior consent cannot be obtained for justified reasons and if processing of the data is permitted by law.
If processing is necessary for compliance with a legal obligation to which our foundation is subject, Art. 6 (1) lit. c GDPR serves as the legal basis.
If processing is necessary for the purposes of the legitimate interests pursued by our foundation or by a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 (1) lit. f GDPR serves as the legal basis for processing.
We will erase or block the personal data of the data subject as soon as the purpose of storage ceases to apply. Data may be stored beyond this point in time if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless further storage of the data is required for the conclusion or fulfilment of a contract.
We take technical and organisational security measures to ensure a level of protection of our users’ personal data and other confidential contents appropriate to the risk (e.g. inquiries to the controller). We continually adapt these measures to the current state of the art. In addition to the (e.g.) means of access control, we therefore use an encryption procedure in all relevant areas of our webpages. In this case, the information provided by our users is transmitted in encrypted form, i.e. using the SSL protocol (Secure Socket Layer). Encrypted connections are indicated by the character string “https://” and the padlock symbol in the browser line.
The data are also stored in the log files of our system. However, these data are not stored together with other personal data of the user.
The legal basis for the temporary storage of data and log files is Art. 6 (1) lit. f GDPR.
The temporary storage of the IP address by the system is necessary to enable the webpages to be delivered to the user’s computer. For this purpose, the IP address of the user must remain stored for the duration of the session.
The data are stored in log files to ensure the functionality of our webpages. In addition, the data help to optimise our webpages and to ensure the security of our IT systems. An evaluation of the data for marketing purposes does not take place in this context.
Our legitimate interest in data processing pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes.
The data will be erased as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the webpages, this is the case when the respective session has ended.
If the data are stored in log files, these are deleted after seven days at the latest. Further storage is possible. In this case however, the IP addresses of the users are deleted or anonymised, so that an assignment of the accessing client is no longer possible.
The collection of the data for the provision of the webpages and the storage of the data in log files are absolutely necessary for the operation of the website. There is thus no possibility of objection on the part of the user.
Technical measures are used to pseudonymise user data collected in this way. It is therefore no longer possible to assign the data to the accessing user. The data are not being stored together with other personal data of the users.
The legal basis for the processing of personal data using cookies for analysis purposes, if corresponding consent by the user has been provided, is Art. 6 (1) lit. a GDPR.
The analysis cookies are used to improve the quality of our website and its content. Analysis cookies tell us how the website is used, allowing us to continuously optimise our offer.
Our legitimate interest in the processing of personal data pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes.
On our website you have the option to support our projects through online donations. We use a donation form for this purpose. Donations can be made via PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) or by bank transfer.
Desired method of payment; if payment is made via PayPal, the user is forwarded to the website of the payment service. PayPal is responsible for further data processing, the information specified by PayPal therefore must be provided (PayPal’s current data protection regulations can be found at www.paypal.com/de/webapps/mpp/ua/privacy-full).
For the transmission of data in connection with the online donation we use a secure SSL connection (recognisable by the padlock symbol in the address line of the browser). The data transmitted to us therefore cannot be read by third parties.
For the purpose of payment processing, the data entered in the donation form are automatically transmitted to the online payment service provider PayPal. The data are not passed on to any other third parties.
By clicking the button “Spenden” (“Donate”) the donation process is completed.
The legal basis for data processing is Art. 6 (1) lit. a GDPR (consent) and Art. 6 (1) lit. b GDPR (processing for the fulfilment of a contract).
The sole purpose of processing the data is to fulfil and process the donation.
The data will be deleted or blocked as soon as the purpose of storage ceases to apply and there are no longer any legal regulations on the obligation to store data.
Consent to the processing of personal data can be withdrawn at any time. The data will be deleted in this case, provided that there are no legal regulations on the obligation to store data. If such obligations exist, the data will initially be blocked for further use and deleted after expiry of the retention periods.
The legality of the data processing that takes place until the withdrawal remains unaffected by the withdrawal.
are transmitted to a Google server in the USA and stored there. These collected data may also be transferred by Google to third parties if required by law or if third parties are commissioned to process these data.
We only use Google Analytics with activated IP anonymisation (so-called IP masking). This means that the IP address of the users will be truncated by Google within Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. The IP address transmitted by the user’s browser is not connected with any other Google data.
Art. 6 (1) sentence 1 lit. f GDPR.
On our order, Google uses this information to assess the use of the website, to compile online reports on website activities and to provide us with further services related to the use of the website and the internet. The processed data may be used to create pseudonymous usage profiles. This processing helps us to continuously improve our website and its user-friendliness.
Our legitimate interest in the processing of the data pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes. By anonymising the IP address, users’ interest in protecting their personal data is sufficiently taken into account.
Users’ personal data is automatically deleted or anonymised after 14 months.
Users can prevent the storage of cookies by setting their browser software accordingly and thereby objecting to the setting of cookies permanently. Additionally, a cookie already set by Google can be deleted at any time via the internet browser or other software programs.
The opt-out cookie only prevents web analysis as long as it is not deleted.
To promote our website we use “Google Adwords” and in this context the “Conversion-Tracking” of the provider Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA). As a result, if a user accesses our website via a Google ad, a so-called “conversion cookie” is stored on the user’s computer (the term “cookie” is already explained in section VI.). Conversion cookies have a limited validity and do not serve to identify the data subject.
The conversion cookie collects information about the activities of the user on our website (e.g. surfing behaviour or visited sub-pages of our web presence). All usage data is stored using a pseudonym, so that personal identification is generally excluded.
Google also uses the information collected via the conversion cookie to generate visit statistics about our websites. This tells us the total number of users who have been referred to us via AdWords ads. The information collected and the IP address of the user are transmitted to Google in the USA and stored there. Google may share these data with third parties.
The processing of personal data within the framework of Google AdWords is carried out on the basis of Art. 6 (1) lit. f GDPR on the basis of legitimate interest in targeted advertising and the analysis of the effect and efficiency of this advertising.
The purpose of Google AdWords is the targeted advertising of our website. The visit statistics serve the analysis of the effect and efficiency and therefore the optimisation of our AdWords ads.
Our legitimate interest in the processing of these data pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes.
On our website we have integrated YouTube Videos of the Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The integration of such contents requires that the third-party providers have access to the IP address of the user, otherwise the contents cannot be transmitted to the user’s browser.
In addition, some third-party providers also use web beacons, which make it possible to statistically evaluate the number of visitors and surfing behaviour. The data collected in this way can be stored together with further technical information (in particular browser type, operating system and referring website) in cookies (as already described under section VI.), on the user’s computer. Usage data is stored using a pseudonym, so that personal identification is generally not possible.
However, if the user has his or her own account with the third-party provider and is logged in there while visiting our webpages, the information can be assigned to the user’s account.
For better data control, we also use the so-called “extended data protection mode” for the integration of YouTube videos, i.e. no data about the user is transmitted to YouTube until the video is played. A transmission of the aforementioned data occurs only when a video is actively clicked.
The legal basis for the integration of third-party content is Art. 6 (1) lit. f GDPR.
The integration takes place in order to be able to provide our users with a needs-oriented website and in the interest of continuously optimising the content and operation of our pages.
Our legitimate interest pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes.
Data processing in connection with the integration of YouTube videos on our pages is deactivated by default. Processing therefore only takes place when a video is actively clicked on by the user. The user therefore has control over whether he or she wishes to allow the data to be transmitted to the relevant providers and processed by them.
Should you have any further queries regarding data protection with regard to our website or our foundation, you can contact us at any time at the contact address provided above.

References: Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 17
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6

Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6