The protection of your personal data is of particular concern to us. This privacy policy describes how Zeugen der Zeitzeugen e. V. ("Witnesses of the Witnesses", "we" or "us") as the responsible party within the meaning of the EU General Data Protection Regulation ("GDPR"), the German Federal Data Protection Act ("BDSG") and other applicable data protection laws ("Applicable Data Protection Laws") processes personal data of users ("Users" or "you") of our website www.zeugen-der-zeitzeugen.de/de ("Website").

1 PROCESSING PURPOSES, LEGAL BASIS AND SOURCE

1.1 Informational use of the website

When you access our website and use it purely for informational purposes, we do not collect any personal data from you. We only collect and process personal data when you use one of the functions on our website described below in this privacy policy.

1.2 Subscription to our newsletter

If you would like to receive the newsletter offered on the website under Communication by e-mail or by post, we collect and store the personal data provided by you in the newsletter registration form (in the case of subscription by e-mail: Name, e-mail address; when receiving by mail: Name, address). Your IP address and the time of registration are also stored. We process the personal data you provide in order to manage your newsletter subscription and to send the newsletter. For this purpose, this data is transmitted to and processed by the MailChimp service of Rocket Science Group LLC, based in Atlanta, USA, which we use to send e-mail newsletters.

The legal basis for this data processing is your consent in the case of receiving the newsletter by e-mail (Art. 6 para. 1 lit. a) DSGVO) and our legitimate interest (Art. 6 para. 1 lit. f) DSGVO) in direct advertising in the case of receiving the newsletter by mail. The storage of IP address and time of registration is based on our legitimate interest (Art. 6 para. 1 lit. f) DSGVO) to ensure the security of our information technology systems and to demonstrate compliance with legal requirements.

We process your data provided during newsletter registration until you cancel your newsletter subscription and then delete it. You are not obliged to provide this personal data. However, without providing it, you cannot subscribe to our newsletter.

1.3 Contact form

If you send us inquiries via the contact form integrated on our website under Contact, we store the mandatory data in the contact form (name, e-mail address, subject) as well as the communication contents communicated by you in the message field. We process this data to process your request and any follow-up questions and to prevent misuse of the contact form.

We base this data processing on our legitimate interest (Art. 6 para. 1 lit. f DSGVO) to process your request. We base the storage of the time stamp of the request on our legitimate interest (Art. 6 para. 1 lit. f DSGVO) to ensure the security of our information technology systems. The personal data you provide will be stored for as long as is necessary to respond to your inquiry and then deleted after one month at the latest. You are not obliged to provide this personal data. However, without providing it, you will not be able to contact us via the contact form.

1.4 Donation form

If you would like to make a donation to us via the website, we will collect the following data from you:

• Contact information (first name, last name if you do not wish to make an anonymous donation; company name if applicable; email address if you wish to receive a confirmation; and address if you wish to receive a donation receipt),
• Payment information (e.g. IBAN, credit card information, PayPal, etc.),
• donation amount and donation frequency (e.g., one-time, annual, etc.),
• and donation-related data (e.g. purpose of donation/project name, donation receipt request).

This data is collected via an electronic donation form of the service "Givio", which is provided by Givio gGmbH, Hirschstr. 8, 70173 Stuttgart, Germany, and transmitted to us via a secure connection. The payment data is transmitted directly to the respective payment service provider via an encrypted connection (SSL).

The data processing is carried out for the execution of the donation. The legal basis for this is the contract on the respective donation (Art. 6 para. 1 lit. b) DSGVO) with you as well as our legitimate interests (Art. 6 para. 1 lit. b) DSGVO) to receive donations intended by you. For more information on data protection at Givio, please click here: https://www.gooding.de/givio/datenschutz (German).

1.5 Plugins and tools

1.5.1 YouTube

Our website embeds videos from the YouTube platform. The operator of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

We use YouTube in extended data protection mode. According to YouTube, this mode has the effect that YouTube does not store any information about visitors to this website before they watch the video. However, the disclosure of data to YouTube partners is not necessarily excluded by the extended data protection mode. For example, YouTube sets cookies from the Google DoubleClick network - regardless of whether you watch a video.

As soon as you start a YouTube video on our website, a connection to the YouTube servers is established. This tells the YouTube server which pages of our website you have visited. This data is transferred to Google servers in the USA and stored there. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, YouTube can save various cookies on your end device after starting a video. With the help of these cookies, YouTube can obtain information about visitors to our website. This information is used, among other things, to collect video statistics, improve the user experience and prevent fraud attempts. Cookies remain on your terminal device until you delete them. If necessary, further data processing operations may be triggered after the start of a YouTube video, over which we have no control.

The use of YouTube is based on our legitimate interests (Art. 6 para. 1 lit. f) DSGVO) in an appealing presentation of our website. For more information about data protection at YouTube, please see their privacy policy at: https://policies.google.com/privacy?hl=de (German).

1.5.2 Google reCAPTCHA

We use the reCAPTCHA service offered by Google on our website. reCAPTCHA checks whether the data entry on our website (e.g. when using our contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website user based on various characteristics. This analysis begins automatically as soon as the website user enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the website user on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google servers in the USA.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified separately that an analysis is taking place. This data is transferred to Google servers in the USA and stored there.

The data processing is based on our legitimate interests (Art. 6 para. 1 lit. f) DSG-VO) to protect our website from abusive automated spying and SPAM. For more information about Google reCAPTCHA and Google's privacy policy, please see the following links: https://policies.google.com/privacy?hl=de and https://www.google.com/recaptcha/intro/android.html (files are in German).

2 RECIPIENTS OF THE DATA

2.1 External service providers

We engage external service providers who act as our processors to provide certain services to us, such as email marketing, hosting, website, IT or other service providers. In providing these services, the external service providers may have access to or process your personal data.

On the basis of the order processing contracts concluded with them, external service providers used are obliged to take appropriate technical and organizational security measures to protect the personal data processed and to process it only in accordance with our instructions.

2.2 Other recipients

We may also disclose your personal data to law enforcement and other authorities, legal advisors and other external consultants in accordance with applicable data protection law. The legal basis for this processing is compliance with legal obligations (Art. 6(1)(c) DSGVO) to which we are subject or our legitimate interests (Art. 6(1)(f) DSGVO), such as the exercise or defense of legal claims.

3 TRANSFER OF DATA TO THIRD COUNTRIES.

We may transfer your personal data to recipients in third countries outside the European Union (EU) or the European Economic Area (EEA) that do not ensure an adequate level of data protection, such as the United States.

To the extent that we transfer your personal data to third countries that do not provide an adequate level of data protection from the perspective of EU data protection law, we base the transfer on appropriate safeguards, such as the EU standard contractual clauses adopted by the European Commission. You may request a copy of the relevant appropriate safeguards by contacting us using the contact details set out in Section 6.

4 STORAGE PERIOD OF YOUR DATA, CRITERIA OF THE STORAGE PERIOD.

We will retain your personal data for as long as is necessary for the respective purposes of the data processing operations described in section 1 above. As soon as we no longer process your personal data for these purposes, we will delete it from our systems and records or completely anonymize it so that you can no longer be identified. Deletion or complete anonymization will not take place as long as we need to retain your data to fulfill legal or regulatory obligations. This applies in particular to statutory retention obligations under the German Commercial Code (HGB) or the German Fiscal Code (AO), which provide for retention periods of 6 to 10 years, or if we need the data to preserve evidence in connection with legal disputes within the statute of limitations, which is usually three years, but in individual cases can be up to 30 years.

5 YOUR RIGHTS AS A DATA SUBJECT AND HOW TO EXERCISE THEM

If you have declared your consent to the processing of your personal data, you may revoke it at any time with effect for the future. Such revocation will not affect the lawfulness of the processing prior to the revocation of consent. If you declare the revocation, we will no longer process your personal data unless another (legal) basis allows this. However, if a revocation is made and there is no other legal basis for permission, we must delete the personal data without delay (Article 17 (2) (b) DSGVO).

According to applicable data protection law, you as the data subject have the right to information (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR). The right to information as well as the right to erasure may be restricted under certain circumstances (cf. Sections 34, 35 BDSG). In addition, you have the right to lodge a complaint with a data protection authority (Art. 77 DSGVO). For more information on these rights, please see the attachment: Your rights (German).

In certain circumstances, you also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of our legitimate interests (Article 6(1)(f) DSGVO); this also applies to profiling based on this legal basis (Article 21(1) DSGVO). In addition, you have the right to object at any time to the processing of your personal data for these purposes if your personal data is processed for the purpose of direct marketing; the right to object also exists with regard to the creation of profiles, insofar as this is related to such direct marketing (Art. 21 (2) DSGVO). If you object, we will no longer process your personal data for these purposes.

To exercise your rights, please contact us using the contact details set out in section 6 above.

6 CONTACT

If you have any questions about this privacy policy or the processing of your personal data, please contact us at:

Zeugen der Zeitzeugen e.V.

P.O. Box 1207, 82180 Puchheim, Germany

Phone: +49 (0)89 20 18 47 33

E-mail: datenschutz(at)zeugen-der-zeitzeugen.de

Website: www.zeugen-der-zeitzeugen.de

7 CHANGES TO THIS PRIVACY STATEMENT

This privacy policy needs to be adapted from time to time - e.g. due to new functions or technologies on our website. In these cases, we will change or supplement this privacy policy. We will publish the changes on this page and/or inform you accordingly (e.g. by e-mail).

Status: October 2020