Privacy Policy

1) Introduction and controller contact details

1.1  Thank you for visiting our website and for your interest. This policy explains how we handle your personal data when you use the website. Personal data is any information that can identify you directly or indirectly.

2) Data collected when you visit our website

2.1  When you use the website only to obtain information and do not register or otherwise submit information, we collect only the data your browser sends to the server. The following server log data is technically necessary to display the website:

• Page visited
• Date and time of access
• Amount of data transferred
• Referring source or page
• Browser used
• Operating system used
• IP address, where applicable in anonymised form

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in improving the stability and functionality of the website. We do not otherwise use or disclose this data. We may subsequently review server logs where there are specific indications of unlawful use.

2.2  This website uses SSL/TLS encryption to secure personal data and other confidential content in transit. You can recognise an encrypted connection by “https://” and the lock symbol in your browser.

3) Hosting and content delivery network

3.1  We use a provider to host the website and display its content. The provider supplies these services itself or through selected subcontractors using servers located exclusively within the European Union.

All data collected through this website is processed on those servers. We have concluded a data processing agreement requiring the provider to protect visitor data and prohibiting unauthorised disclosure.

3.2 Cloudflare

We use the content delivery network operated by Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA. It delivers media, content, and scripts through regionally distributed servers to improve website speed, stability, and functionality.

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in a reliable website. We have concluded a data processing agreement with Cloudflare. Cloudflare participates in the EU-US Data Privacy Framework for relevant transfers to the United States.

4) Cookies

We use cookies—small text files stored on your device—to provide functions and make the website easier to use. Session cookies are deleted when the browser closes. Persistent cookies remain for a defined period and can remember site settings; your browser shows their storage duration.

Where cookies process personal data, processing is based on Article 6(1)(b) GDPR when required for a contract, Article 6(1)(a) GDPR when you have consented, or Article 6(1)(f) GDPR for our legitimate interest in an effective and user-friendly website.

You can configure your browser to notify you about cookies, decide on individual cookies, or reject cookies in some or all cases. Rejecting cookies may restrict website functionality.

5) Contacting us

If you contact us through a form or by email, we collect the data shown in the form or included in your message. We use it only to answer your request, contact you, and administer the communication.

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in responding to you. If your message concerns a contract, Article 6(1)(b) GDPR also applies. We delete the data when the matter is conclusively resolved unless a statutory retention obligation requires continued storage.

6) Website registration

You can register by supplying the personal data shown in the registration form. We use a double opt-in process: registration is completed only after you confirm it through the link sent by email. If confirmation is not received within 24 hours, the registration is automatically deleted. Required fields are mandatory; other portal information is voluntary.

While you use the portal, we retain the data required to provide it, including payment-method details where applicable, until you permanently delete your access. Voluntary information is retained while you use the portal unless you delete it earlier. You can manage this information in the protected account area. Processing is based on Article 6(1)(f) GDPR.

We also retain content you publish, such as public posts or guestbook entries, to operate the website with complete user-generated content. This is based on Article 6(1)(f) GDPR. After account deletion, public statements may remain visible but will no longer link to an accessible account; other account data is deleted.

7) Data processing for donations

7.1  To process donations, we generally use your first and last name, address, and email address. We store these details together with the amount, frequency, and purpose of the donation for ten years.

Depending on the payment method selected, the data required for the donation is sent to the chosen payment provider and processed only as necessary to complete the payment. Processing is based on Article 6(1)(b) GDPR. Ten-year retention is based on Article 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code.

7.2 PayPal

Donation payments may be processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When you pay through PayPal, the payment data you provide—including your name, address, bank or card details, currency, and transaction number—is sent to PayPal under Article 6(1)(b) GDPR solely as necessary to process the payment.

8) Comment function

When you comment, we store and publish the comment, its creation time, and your chosen display name. We also log and store your IP address for security and in case a comment infringes third-party rights or contains unlawful material. We need your email address so we can contact you if someone challenges your published content.

Processing is based on Article 6(1)(b) and (f) GDPR. We may delete comments reported as unlawful.

9) Online marketing

Google AdSense

This website uses Google AdSense, an advertising service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. AdSense uses cookies and web beacons to record, collect, and evaluate website traffic. Information generated through them, including your IP address, is normally sent to and stored on a Google server and may also be sent to Google LLC servers in the United States.

Google uses this information to analyse usage in relation to AdSense advertisements. The IP address sent by your browser for AdSense is not combined with other Google data. Google may disclose the information where legally required or to processors acting on its behalf.

This processing, including access to information on your device, occurs only with your express consent under Article 6(1)(a) GDPR. Without consent, Google AdSense is not used during your visit. You can withdraw consent with future effect through the cookie consent tool.

Google participates in the EU-US Data Privacy Framework for relevant transfers to the United States. Further information is available from Google Business Safety & Privacy and the Google Privacy Policy.

10) Site functionality

10.1 YouTube

We use plugins from Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland, to display and play YouTube videos. Data may also be sent to Google LLC in the United States.

When you open a page containing a plugin, your browser connects directly to Google’s servers no later than when playback begins. This sends information including your IP address. Starting a video may set cookies for usage information, playback statistics, and abuse prevention. If you are signed in to Google, playback activity can be associated with your account; sign out before playing a video to avoid that association.

This processing occurs only with consent under Article 6(1)(a) GDPR. You can withdraw consent with future effect through the cookie consent tool. Google participates in the EU-US Data Privacy Framework.

10.2 Unsplash

Some pages load images from Unsplash Inc., 400 Rue McGill, Suite 500, Montreal, Quebec H2Y 2G1, Canada. Loading an image establishes a connection to Unsplash and transmits your IP address so the content can be delivered. No other personal data is sent, and Unsplash deletes the IP address after loading according to the provider information.

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in an efficient and attractive website. Canada is recognised by the European Commission as providing an adequate level of protection for relevant transfers.

10.3 Font Awesome

We may use web fonts and icons from Fonticons, Inc., 710 Blackhorn Drive, Carl Junction, MO 64834, USA. When provider-hosted assets are loaded, your browser connects directly to its servers and transmits browser information including your IP address.

This occurs only with consent under Article 6(1)(a) GDPR. You can withdraw consent through the cookie consent tool. If the font cannot be loaded, a system font is used. Transfers to the United States may rely on European Commission standard contractual clauses.

10.4 Google Web Fonts

We may use web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Your browser connects to Google to load the required fonts and sends browser information including your IP address; data may also be sent to Google LLC in the United States.

This occurs only with consent under Article 6(1)(a) GDPR, which can be withdrawn through the cookie consent tool. A system font is used if the web font cannot be loaded. Google participates in the EU-US Data Privacy Framework. More information is available from Google Business Safety & Privacy.

10.5 Google Photos

We use Google Photos from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to embed and display images. Google Photos does not itself store information on your device or independently analyse it, but loading images sends your IP address to Google and may involve Google LLC servers in the United States.

Images from Google Photos load only with consent under Article 6(1)(a) GDPR. You can withdraw consent through the cookie consent tool. We have concluded a data processing agreement with Google. Google participates in the EU-US Data Privacy Framework.

11) Tools and other services

Cookie consent tool

We use a cookie consent tool to obtain valid choices for cookies and applications that require consent. When you open the website, it presents an interface where you can select the relevant services. Consent-dependent cookies and services load only after you make the corresponding selection.

The tool uses technically necessary cookies to remember your preferences and generally does not process personal data. If it processes data such as an IP address to store, assign, or document settings, this is based on Article 6(1)(f) GDPR and our legitimate interest in lawful, user-specific, and user-friendly consent management. Article 6(1)(c) GDPR also applies to our legal obligation to make non-essential cookies dependent on consent.

Where required, we have concluded a data processing agreement with the provider. Details about the operator and available settings are shown in the cookie consent interface.

12) Your data protection rights

12.1  Subject to the applicable conditions, data protection law gives you the following rights regarding our processing of your personal data:

• Access under Article 15 GDPR;
• Rectification under Article 16 GDPR;
• Erasure under Article 17 GDPR;
• Restriction under Article 18 GDPR;
• Notification under Article 19 GDPR;
• Data portability under Article 20 GDPR;
• Withdrawal of consent under Article 7(3) GDPR;
• A complaint to a supervisory authority under Article 77 GDPR.

12.2 Right to object

13) How long we retain personal data

Retention depends on the legal basis, the processing purpose, and any applicable statutory retention period, including commercial and tax-law requirements.

Data processed with consent under Article 6(1)(a) GDPR is retained until you withdraw consent. Data processed for contractual or similar obligations under Article 6(1)(b) GDPR is routinely deleted after statutory retention periods expire, unless it remains necessary for a contract or we have a legitimate interest in continued storage.

Data processed under Article 6(1)(f) GDPR is retained until you exercise your right to object under Article 21(1), unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for legal claims. Data processed for direct marketing is retained until you object under Article 21(2).

Unless another part of this policy specifies otherwise, we delete stored personal data when it is no longer needed for the purpose for which it was collected or otherwise processed.