Privacy

Privacy Policy

Name and Contact of the Responsible Party in Accordance with Article 4 (7) GDPR

Zukunftsraum Weilersbach e.V.
c/o Freispiel Akademie
Bernhard Hanel
Weilersbachstraße 26
79254 Oberried, Germany

Phone: +49 177 2220483

Email: info@freispiel-akademie.com

Security and Protection of Your Personal Data

We consider it our primary responsibility to maintain the confidentiality of the personal data you provide and to protect it from unauthorized access. Therefore, we apply the utmost care and modern security standards to ensure maximum protection for your personal data.

As a private company, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). We have implemented technical and organizational measures to ensure that both we and our external service providers comply with data protection regulations.

Definitions of Terms

The law requires personal data to be processed in a lawful, fair, and transparent manner (“lawfulness, fairness, transparency”). To ensure this, we provide you with explanations of the legal terms used in this Privacy Policy:

1. Personal Data

“Personal data” refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that are expressions of the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2. Processing

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.

3. Restriction of Processing

“Restriction of processing” refers to marking stored personal data with the aim of limiting its future processing.

4. Profiling

“Profiling” means any form of automated processing of personal data involving the use of personal data to evaluate certain personal aspects related to a natural person, particularly to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

5. Pseudonymization

“Pseudonymization” refers to the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is stored separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

6. Filing System

“Filing system” means any structured set of personal data accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.

7. Controller

“Controller” refers to a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law.

8. Processor

“Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

9. Recipient

“Recipient” means a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a particular inquiry under Union or Member State law shall not be regarded as recipients; the processing of such data by those public authorities shall comply with applicable data protection rules according to the purposes of the processing.

10. Third Party

“Third party” means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons authorized to process personal data under the direct authority of the controller or processor.

11. Consent

“Consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by which they, through a statement or clear affirmative action, signify agreement to the processing of personal data relating to them.

Lawfulness of Processing

The processing of personal data is lawful only if there is a legal basis for the processing. According to Article 6 (1) (a–f) GDPR, legal bases for processing can include:

a. The data subject has given consent to the processing of personal data for one or more specific purposes.

b. Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.

c. Processing is necessary for compliance with a legal obligation to which the controller is subject.

d. Processing is necessary to protect the vital interests of the data subject or another natural person.

e. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

f. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, particularly where the data subject is a child.

Information on the Collection of Personal Data

1. General Information

When you use our website, we collect certain personal data (e.g., name, address, email addresses, user behavior).

2. Contacting Us

When you contact us via email or contact form, the data you provide (e.g., email address, name, phone number) will be stored to answer your questions. We delete this data once storage is no longer necessary or limit processing if there are legal retention obligations.

Collection of Personal Data When Visiting Our Website

When you access our website, we collect data transmitted by your browser, including:

• IP address
• Date and time of request
• Time zone difference from GMT
• Specific page accessed
• HTTP status code
• Amount of data transferred
• Referring website
• Browser type
• Operating system
• Language and version of browser software

Use of Cookies

1. General Information

In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive by the browser you use and through which specific information flows to the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer. Their purpose is to make the website more user-friendly and effective overall.

2. Types of Cookies

This website uses the following types of cookies, which are explained below in terms of their scope and functionality:

• Transient Cookies (see a)

• Persistent Cookies (see b)

a. Transient Cookies

Transient cookies are automatically deleted when you close your browser. These include session cookies, which store a session ID that allows various requests from your browser to be assigned to the same session. This enables your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

b. Persistent Cookies

Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete these cookies at any time in your browser’s security settings.

c. Cookie Configuration Options

You can configure your browser settings according to your preferences, for example, by refusing to accept third-party cookies or all cookies. “Third-party cookies” are cookies set by a party other than the website you are currently visiting. Note that if you disable cookies, you may not be able to use all features of this website.

d. Cookies for Account Identification

We use cookies to identify you on subsequent visits if you have an account with us. Otherwise, you would need to log in again for each visit.

e. Flash Cookies and HTML5 Storage

Flash cookies are not captured by your browser but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your device. These objects store the required data independently of your browser and have no automatic expiration date. If you do not want Flash cookies to be processed, you must install a corresponding add-on, such as “Better Privacy” for Mozilla Firefox (available at Better Privacy Add-on) or the Adobe Flash Killer Cookie for Google Chrome. You can prevent the use of HTML5 storage objects by using your browser in private mode. Additionally, we recommend regularly deleting your cookies and browser history manually.

Additional Features and Offerings on Our Website

1. Additional Services

In addition to the purely informational use of our website, we offer various services that you can use if you are interested. In doing so, you will typically need to provide additional personal data that we use to deliver the respective service. The aforementioned principles of data processing apply to these cases.

2. Use of External Service Providers

In some cases, we engage external service providers to process your data. These providers are carefully selected and commissioned by us, bound by our instructions, and regularly monitored.

3. Sharing Data with Third Parties

We may also share your personal data with third parties when participation in promotions, sweepstakes, contract conclusions, or similar services are offered in collaboration with partners. You will receive more detailed information about this when providing your personal data or in the description of the offering below.

4. Data Processing Outside the EEA

If our service providers or partners are located in a country outside the European Economic Area (EEA), we will inform you about the implications of this circumstance in the description of the offering.

Use of Your Data for Direct Marketing

Subscribing to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offerings. The only mandatory information required for sending the newsletter is your email address. Providing additional information is voluntary and helps us address you personally.

We use the so-called double opt-in procedure for newsletter subscription. This means we will only send you an email newsletter after you have explicitly confirmed your consent to receiving the newsletter. After registering, you will receive a confirmation email asking you to confirm your subscription by clicking a link.

By activating the confirmation link, you consent to the use of your personal data in accordance with Article 6(1)(a) GDPR. When subscribing to the newsletter, we store the IP address entered by your internet service provider (ISP), as well as the date and time of registration, to trace any potential misuse of your email address later.

The data we collect when you register for the newsletter is used exclusively for promotional purposes through the newsletter. You can unsubscribe from the newsletter at any time using the designated link provided in the newsletter or by notifying the controller mentioned at the beginning. Once you unsubscribe, your email address will be promptly removed from our newsletter distribution list unless you have expressly consented to the further use of your data or we reserve the right to use your data beyond this, as permitted by law and as explained in this notice.

Newsletter Delivery via MailChimp

Our email newsletters are sent via the technical service provider The Rocket Science Group, LLC d/b/a MailChimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA (https://mailchimp.com), to whom we transmit the data you provided during newsletter registration. This transfer is carried out pursuant to Article 6(1)(f) GDPR and serves our legitimate interest in using a secure, user-friendly, and effective newsletter system.

Please note that your data is typically transmitted to and stored on a MailChimp server in the USA. MailChimp uses this data to send and statistically evaluate newsletters on our behalf. The emails sent by MailChimp contain so-called web beacons or tracking pixels—small image files stored on our website. These enable us to determine whether a newsletter message has been opened and which links were clicked.

Using the web beacons, MailChimp automatically generates non-personal, aggregated statistics about recipients’ behavior in response to newsletter campaigns. Additionally, based on our legitimate interest in statistical analysis to optimize communication, data from individual newsletter recipients (such as email address, retrieval time, IP address, browser type, and operating system) is collected and processed by MailChimp to create automated statistics showing whether a specific recipient opened a newsletter message.

If you wish to deactivate data analysis for statistical purposes, you must unsubscribe from the newsletter.

MailChimp may use this data based on its own legitimate interest (Article 6(1)(f) GDPR) to optimize and design its services and conduct market research. However, MailChimp does not use the data of our newsletter recipients to contact them directly or share it with third parties.

To protect your data in the USA, we have signed a data processing agreement (DPA) with MailChimp based on the EU’s standard contractual clauses, ensuring your data is handled according to GDPR standards. You can review this DPA at: MailChimp Data Processing Agreement.

Additionally, MailChimp is certified under the EU-US Privacy Shield Framework, committing to comply with EU data protection regulations.

You can view MailChimp’s privacy policy here: MailChimp Privacy Policy.

Children

Our offerings are primarily aimed at adults. Persons under the age of 18 should not submit any personal data to us without the consent of their parents or legal guardians.

Rights of the Data Subject

(1) Right to Withdraw Consent

If the processing of your personal data is based on your consent, you have the right to withdraw this consent at any time. The withdrawal of consent does not affect the legality of processing carried out based on the consent before its withdrawal.

You may exercise your right of withdrawal at any time by contacting us.

(2) Right to Confirmation

You have the right to request confirmation from the data controller regarding whether personal data concerning you is being processed. You can request this confirmation at any time via the contact information provided above.

(3) Right of Access

If personal data is being processed, you have the right to request information regarding:

a. the purposes of processing;

b. the categories of personal data being processed;

c. the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly in the case of recipients in third countries or international organizations;

d. if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria used to determine this duration;

e. the existence of a right to rectification or erasure of personal data concerning you, or to restrict the processing by the data controller, or to object to such processing;

f. the existence of a right to lodge a complaint with a supervisory authority;

g. if the personal data was not collected from you, all available information about its source;

h. the existence of automated decision-making, including profiling, per Article 22(1) and (4) GDPR, and meaningful information about the logic involved, as well as the significance and intended consequences of such processing for you.

If personal data is transferred to a third country or an international organization, you have the right to be informed about the appropriate safeguards pursuant to Article 46 GDPR related to the transfer.

We will provide a copy of the personal data being processed. For additional copies requested, we may charge a reasonable fee based on administrative costs. If you make the request electronically, the information will be provided in a commonly used electronic format, unless otherwise requested. The right to receive a copy must not adversely affect the rights and freedoms of others.

(4) Right to Rectification

You have the right to request the immediate rectification of incorrect personal data concerning you. Considering the purposes of the processing, you also have the right to request the completion of incomplete personal data, including through a supplementary statement.

(5) Right to Erasure (“Right to be Forgotten”)

You have the right to request the immediate erasure of personal data concerning you, and we are obligated to delete such data without delay if one of the following reasons applies:

a. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

b. You withdraw your consent, and there is no other legal basis for the processing.

c. You object to the processing under Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing under Article 21(2) GDPR.

d. The personal data has been unlawfully processed.

e. The deletion of personal data is required to comply with a legal obligation under Union or Member State law to which the data controller is subject.

f. The personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If the data controller has made the personal data public and is obligated to erase it, they must, considering available technology and implementation costs, take reasonable steps, including technical measures, to inform other data controllers processing the data that you have requested the deletion of any links to, or copies or replications of, such personal data.

The right to erasure does not apply where processing is necessary:

•for exercising the right of freedom of expression and information;

•to comply with a legal obligation that requires processing under Union or Member State law, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;

•for reasons of public interest in the area of public health as per Article 9(2)(h) and (i), as well as Article 9(3) GDPR;

•for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

•for the establishment, exercise, or defense of legal claims.

(6) Right to Restriction of Processing

You have the right to request the restriction of processing of your personal data if one of the following conditions applies:

a. You contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the data;

b. The processing is unlawful, and you oppose the erasure of the personal data, requesting instead the restriction of its use;

c. The controller no longer needs the personal data for processing, but you require it for the establishment, exercise, or defense of legal claims; or

d. You have objected to processing under Article 21(1) GDPR pending verification of whether the legitimate grounds of the controller override yours.

When processing has been restricted, such data shall, with the exception of storage, only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

You may exercise your right to restriction of processing by contacting us using the provided contact details.

(7) Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. Additionally, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that:

a. the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR; and

b. the processing is carried out by automated means.

When exercising the right to data portability as per paragraph 1, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. Exercising the right to data portability does not affect the right to erasure (“Right to be Forgotten”). This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(8) Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions. The controller will no longer process the personal data unless compelling legitimate grounds for the processing are demonstrated, which override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You also have the right to object to the processing of your personal data for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You may exercise your right to object at any time by contacting the relevant controller.

(9) Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

a. is necessary for entering into, or performance of, a contract between you and the controller;

b. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests; or

c. is based on your explicit consent.

The controller shall implement suitable measures to safeguard your rights, freedoms, and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

You may exercise this right at any time by contacting the relevant controller.

(10) Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates this Regulation.

(11) Right to an Effective Judicial Remedy

Without prejudice to any available administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority under Article 77 of the GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of the processing of your personal data not in compliance with this Regulation.