This privacy policy describes how we, the Hans Thomann Foundation (controller within the meaning of the GDPR), process the data you provide us with when using our websites and protect it in accordance with the General Data Protection Regulation (GDPR) and the relevant German data protection laws, in particular the BDSG.

The security of personal data such as name, address, telephone number, or email address is a serious and important business concern for us. That is why we conduct our web activities in accordance with the respective laws on data protection and data security. Below you will find information about what data we process.

Responsible party, contact person for questions or exercising your rights as a data subject, contact

The responsible party within the meaning of data protection regulations for all data processing carried out via our websites is:

Hans Thomann Foundation

Professor-Arneth-Straße 11

96224 Burgkunstadt

Germany

If you have any questions, comments, complaints, or wish to exercise your rights as a data subject in connection with this privacy policy and the processing of your personal data via our websites, you can contact our data protection officer directly by email (privacy@hansthomannstiftung.de). They will be happy to address your data protection concerns.

Personal data/types of use

As a matter of principle, the protection of your personal data is of the utmost importance to us. You decide whether or not you want to disclose this data to us, for example in the context of a registration, survey, or similar. This information is relevant to your request, but is provided to us on a voluntary basis. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) lit. a GDPR serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which we are subject, Art. 6 (1) lit. c GDPR serves as the legal basis.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which we are subject, Art. 6 (1) lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) lit. d GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) lit. f GDPR serves as the legal basis for processing.

If we access your end device and the information stored there, or if we store information on your end device ourselves through our processing (e.g. by using cookies), the primary legal basis is Section 25 (1) sentence 1 TDDDG, if we need to obtain your consent for this access, or Section 25 (2) No. 2 TDDDG, if the access concerns processing that is technically absolutely necessary.

Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

Data collected automatically on our website / usage data

We welcome everyone to visit our site free of charge, use it, and view the products offered there. When you visit our website, we log the following general usage data in order to assess which parts of our website you visit and how long you stay there:

(1)    Information about the browser type and version used

(2)    The user’s operating system

(3)    The user’s IP address

(4)    Date and time of access

(5)    Websites from which the user’s system accesses our website

(6)    The services and functions used on our websites

This data is combined with the usage data of all visitors to our website in order to measure the number of visitors, the average time spent on our website, the pages accessed, etc. The data we collect is combined and used for internal purposes only.

The legal basis for the temporary storage of data and log files is Art. 6 (1) lit. f GDPR.

We use this aggregated data to evaluate our products and services, including the news we make available on our website, to measure the use of our website, and to improve its content overall.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 (1) lit. f GDPR.

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data storage in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymized so that it is no longer possible to assign them to the accessing client.

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no possibility for the user to object.

Third-party advertisements or links to other websites displayed on our website may collect user data if you “click” on them or otherwise follow their instructions. We have no control over the data that is collected voluntarily or involuntarily via advertisements or third-party websites. We recommend that you review the privacy policies of the advertised websites if you have concerns about the collection and use of your data.

Purposes and legal basis for the use of cookies and other identifiers

The legal basis for the processing of personal data using technically necessary cookies is Section 25 (2) No. 2 TDDDG for setting such cookies on your end device, as well as Art. 6 (1) sentence 1 lit. f GDPR, e.g. for any subsequent processing that may be necessary on our systems.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our websites cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

The right to object is excluded for technically necessary cookies, as these are absolutely necessary in order to display our website and its content to you and to provide you with the functionalities of the website.

The user data collected by technically necessary cookies is not used to create user profiles.

Analytics cookies are used to improve the quality of our websites and their content. Analytics cookies tell us how the website is used, enabling us to continuously optimize our offering. Processing on your device that is based on cookies or other identifiers (e.g., browser fingerprints, pixels) and is not technically necessary for the functioning of our websites is only carried out with your consent, which you can give via the cookie layer that appears when you visit our websites. The legal basis for this cookie-based processing is Section 25 (1) sentence 1 TDDDG for the setting of cookies on your end device and Article 6 (1) lit. a GDPR for any subsequent processing outside your end device on our systems or the systems of our technology partners. Cookies that are not necessary for the functioning of our websites will not be set until you have given your consent.

Revocation of consent for the use of cookies and other identifiers/tags

You can revoke your consent to data collection through cookies at any time by deactivating cookies in our cookie policy.

You can revoke your consent to data collection via cookies at any time by deactivating cookies in our cookie policy.

If you do not want your browser to accept cookies, you also have the option of deactivating or restricting cookies. Cookies that have already been stored can be deleted or deactivated at any time via your internet browser. Disabling the cookie function may prevent this website from functioning properly. You may not be able to access all the features and information on this website. Please also note that you must disable cookies for each browser you use.

For more information on how to delete or manage cookies via your browser settings, please visit the help pages of the respective browser.

Email contact

You can contact us via the “Contact/Request” button. In this case, the user’s personal data transmitted with the email will be stored.

In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.

The legal basis for processing the data transmitted when sending an email is Art. 6 (1) lit. f GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR.

The processing of personal data transmitted with the email serves solely to process the contact request. This also constitutes the necessary legitimate interest in the processing of the data.

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our websites. Google Analytics uses “cookies,” which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us, as the website operator, with other services related to website and internet usage. Google will not merge the IP address transmitted by your browser within the scope of Google Analytics with other Google data. We would also like to point out that Google Analytics is used on our websites with the anonymizeIP extension and therefore IP addresses are only processed in truncated form in order to exclude any personal reference.

You can prevent the storage of cookies by adjusting your browser software settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection and transmission of data generated by the cookie and related to your use of the website at https://www.hansthomannstiftung.de to Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout/eula.html?hl=de.

Right of revocation

You can find out how to revoke the consent you have given via our cookie layer in the section “Revocation of consent for the use of cookies and other identifiers/tags”.

For more information on how Google Analytics works and the terms of use and privacy policy applicable to this service, please visit http://www.google.com/analytics/terms/de.html or http://www.google.de/intl/de/policies/privacy/.

Google Ireland Ltd. is a subsidiary of Google LLC, based in the USA. It cannot be ruled out that your data collected by Google may also be transferred to the USA.

Google Tag Manager

We use Google Tag Manager to manage so-called website tags. Tags are small code elements on our websites that are executed during certain interactions with the website and send measured data to the third-party programs used (e.g., Google Analytics). Tag Manager itself does not use cookies and does not collect any personal data. Tag Manager triggers other tags, which in turn may collect data and set cookies (e.g., the third-party programs used). Tag Manager does not access this data.

Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Information, correction, restriction, and deletion

You have the right to obtain information free of charge at any time about the data we have stored about you, its origin and recipients, and the purpose of data processing via our websites. In addition, you have the right to correct, delete, and restrict the processing of your personal data, provided that the legal requirements for this are met.

Details can be found in the relevant legal provisions in Articles 15 to 19 of the GDPR.

2. Right to data portability

You have the right to receive the personal data concerning you that you have provided to us as the controller in a structured, commonly used, and machine-readable format. We can fulfill this right by providing a CSV export of the customer data processed about you.

3. Right to notification

If you have asserted your right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

4. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR; This also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of automated procedures using technical specifications.

5. Revocability of data protection consent declarations

In addition, you can revoke your consent at any time with future effect by contacting us at the contact details provided below.

6. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

The supervisory authority to which the complaint was submitted shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

Updating the Privacy Policy

We may update this Privacy Policy from time to time. Such changes will be posted on the website. If you have any comments or questions about this Privacy Policy or other policies on this website, please contact us in writing.