Data Privacy Policy

Preface

We, the German Red Cross e.V. (German Red Cross General Secretariat) (hereinafter jointly referred to as "the organisation", "we" or "us") take the protection of your personal data seriously and would like to inform you here about data protection within our organisation. 

According to the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: "GDPR"), there are obligations to ensure the protection of personal data of the person affected by the processing (we also refer to you, the person affected, as “client", "user", "you", or "data subject").  

Insofar as we decide either alone or jointly with others on the purposes and means of data processing, this includes above all the obligation to inform you transparently about the type, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and 14 GDPR).  

With this declaration (hereinafter: "privacy policy") we inform you about the way in which your personal data is processed by us. 

A. General information 

1. Definitions

Following the example of Art. 4 GDPR, this privacy policy is based on the following definitions: 

“Personal data” (Art. 4(1) GDPR) means any information that relates to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by reference to information about the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiability can also be achieved by linking such information or other additional knowledge. The origin, form or type of information is irrelevant (photos, video or audio recordings may also contain personal data).

“Processing” (Art. 4(2) GDPR) means any operation or set of operations which is performed on personal data, whether or not by automated (i.e. technology-based) means. This includes in particular the collection (i.e. procurement), recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction of personal data, or alteration of the purposes for which they were originally processed.

“Controller” (Art.4(7) GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. 

“Third party” (Art.4(10) GDPR) means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; this also includes other legal entities belonging to the group. 

“Processor” (Art.4(8) GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; in particular in accordance with the controller's instructions (e.g. IT service providers). In particular, a processor is not a third party in terms of data protection law. 

“Consent” (Art.4(11) GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and address of the controller 

We are the controller responsible for the processing of your personal data as defined in Art. 4(7) GDPR: 

Deutsches Rotes Kreuz e.V. 
Carstennstraße 58 
12205 Berlin 

Further information about our organisation can be found in the legal notice on our website. 

3. Contact details of the data protection officer 

Our company data protection officer is available at all times to answer any questions you may have and to act as your contact person on the subject of data protection. Their contact details are: 

advokIT Datenschutz 
part of 
Weißmann Datenschutz GmbH 
Kopernikusstraße 24 
10245 Berlin 

Web: https://www.advokit.de/ 
Email: Datenschutz[at]advokit.de 

4. Legal basis for data processing 

In principle, any processing of personal data is prohibited by law and is only permitted if the data processing falls under one of the following justifications: 

• Art. 6(1)(1)(a) GDPR (“consent”): If the data subject has voluntarily, in an informed and unambiguous manner, by means of a statement or other unambiguous confirmatory act, indicated that they consent to the processing of their personal data for one or more specific purposes;
• Art. 6(1)(1)(a) GDPR (“consent”): If the data subject has voluntarily, in an informed and unambiguous manner, by means of a statement or other unambiguous confirmatory act, indicated that they consent to the processing of their personal data for one or more specific purposes;
• Art. 6(1)(1)(b) GDPR: If the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Art. 6(1)(1)(d) GDPR: If processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• Art. 6(1)(1)(e) GDPR: If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or
• Art. 6 (1)(1)(f) GDPR (“legitimate interest”): if processing is necessary for the purposes of the legitimate interests (in particular legal or economic) pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights of the data subject which require protection of personal data (in particular where the data subject is a child).  

For the processing operations we carry out, we indicate the applicable legal basis in each case below. Processing can also be based on several legal bases. 

General information on the legal basis for data processing on this website 

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR, insofar as special categories of data are processed in accordance with Art. 9(1) GDPR. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 (1)(a) GDPR. 

If you have consented to the storage of cookies or access to information in your end device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25(1) TDDDG. Consent can be revoked at any time. If your data is required to fulfil a contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR.

Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy. 

5. Data deletion and storage

For the processing operations carried out by us, we indicate below how long the data is stored by us and when it will be deleted or blocked. Unless an explicit storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. Your data will only be stored on our servers in the European Economic Area (EEA), subject to any transfer in accordance with the regulations on "Cooperation with data processors" and "Requirements for the transfer of personal data to third countries" set out below. 

However, data may be stored beyond the specified period in the event of an (impending) legal dispute with you or other legal proceedings, or if storage is provided for by statutory provisions to which we are subject as the controller (e.g. Section 257 HGB, Section 147 AO). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this. 

6. Data security 

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties (e.g. TSL encryption for our website), taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and impact) for the data subject. Our security measures are continuously improved in line with technological developments. 

7. Recipients of personal data 

As part of our business activities, we work together with various external bodies. In some cases, it is also necessary to transfer personal data to these external bodies. We only pass on personal data to external parties if this is necessary in the context of fulfilling a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in passing on the data in accordance with Art. 6(1)(f) GDPR or if another legal basis allows the data to be passed on. When using data processors, we only pass on our customers' personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded. 

8. Cooperation with data processors 

We use external domestic and foreign service providers to process our business transactions (e.g. for IT, logistics, telecommunications and marketing). They will only act in accordance with our instructions and have been contractually obliged to comply with data protection regulations within the meaning of Art. 28 GDPR. 

If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is done on the basis of existing data processing arrangements. 

9. Requirements for the transfer of personal data to third countries 

As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the EEA, i.e. in third countries. Such processing takes place exclusively to fulfil contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer in the following sections relevant to this matter. 

The European Commission certifies that some third countries have data protection standards comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found on the European Commission's website). However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. Where this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding company regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognised codes of conduct. 

10. No automated decision-making (including profiling) 

We do not intend to use personal data collected from you for automated decision-making (including profiling). 

11. No obligation to provide personal data 

We do not make the conclusion of contracts with us conditional on the prior provision of personal data. For you as a client, there is in principle no legal nor contractual obligation to provide us with your personal data; however, when you do not provide us with the necessary data, we may not be able to provide certain services or provide them only in a limited capacity. If, as an exception, this should be the case in the context of the products presented below and offered by us, you will be advised of this specifically. 

12. Your rights 

You can assert your rights as a data subject with regard to your processed personal data at any time by contacting us using the contact details given at the beginning under A.(2). As the data subject, you have the right: 

• in accordance with Art. 15 GDPR, to request information about your data processed by us. In particular, you can demand information about the purposes for processing, the categories of data, the categories of recipient to whom your personal data has been or will be disclosed, the planned retention period, the existence of the right to rectification, deletion, restriction of processing or objection, the right to lodge a complaint, the origin of your data if it was not directly provided by you as well as information about the existence of automated decision-making, including profiling and, where applicable, meaningful information about the details;
• in accordance with Art. 16 GDPR, to demand the rectification without undue delay of inaccurate, stored personal data or demand the completion of your stored personal data;
• in accordance with Art. 17 GDPR, to demand the deletion of your stored personal data so long as the processing is not required for the exercise of freedom of expression and information, the fulfilment of a legal obligation, on grounds of public interest or enforcement, or the exercise or defence of legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your data if the accuracy of the data is disputed by you or the processing is unlawful;
• in accordance with Art. 20 GDPR, to receive the personal data that you have provided us with in a structured, commonly used and machine-readable format, or demand that the data be transmitted to another data controller (“data portability”).
• in accordance with Art. 21 GDPR, to object to the collection of data in special cases and to direct marketing (Art. 21 GDPR), provided that the processing is carried out on the basis of Art. 6(1)(1)(e) or (f) GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. Unless it concerns an objection to direct marketing, we ask that you explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and either cease or adapt the data processing or explain our compelling legitimate grounds on which we continue the processing.
• in accordance with Art. 7 (3) GDPR, to withdraw your consent once given – i.e. your voluntary, informed and unambiguous declaration, made clear by means of a statement or other unambiguous confirmatory act that you consent to the processing of the personal data concerned for one or more specific purposes – at any time, if you have given such consent. This means that from then on we may no longer continue processing data to the extent this was based on this consent.
• in accordance with Art. 77 GDPR, to complain to a data protection supervisory authority about the processing of your personal data in our organisation and
• in accordance with Art. 79 GDPR, to obtain legal protection before the ordinary courts and the labour courts, in particular if we refuse to take action on the basis of the data subject's request in accordance with Art. 12(5) GDPR. 

13. Objection to unsolicited emails 

The use of contact details published within the scope of the legal notice obligation for the purpose of sending unsolicited advertising and information material by third parties is hereby expressly prohibited. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited sending of advertising or promotional information, such as spam emails. 

14. Amendments to the privacy policy 

As part of the ongoing development of data protection law and technological or organisational changes, our privacy policy is regularly reviewed to determine whether it needs to be adapted or supplemented. You will be informed of any changes, in particular on our website. This privacy policy is valid as of December 2024. 

B. Visiting the website

When you visit our website, your personal data may be processed. When using the website, the following categories of personal data may be collected, stored and processed by us: 

1. Data processing, purpose and legal basis 

Server log files ("log data") 

When you visit our website, a so-called log data record (so-called server log files) is temporarily and anonymously stored on our web server. This consists of:  

• "the page from which the website was requested (so-called referrer URL)
• the name and URL of the requesting page
• the date and time of the request
• the description of the type, language and version of the web browser used
• the IP address of the requesting computer, which is shortened so that a personal reference can no longer be established
• the amount of data transferred
• the operating system
• a report on whether the request was successful (access status/Http status code)
• the GMT time zone difference 

The processing of log data serves statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6(1)(1)(f) GDPR). The stored information is deleted after seven days, unless there is a legitimate suspicion of illegal use, which requires further verification. It is not possible for us to identify you from the information stored. Therefore, Articles 15 to 22 GDPR do not apply in accordance with Article 11(2) GDPR, unless you provide further information that enables your identification. 

Inquiries by email, telephone or fax 

If you contact us by email, telephone or fax, we will store and process your inquiry, including all personal data (name, inquiry), for the purpose of processing your request. 

This data is processed on the basis of Art. 6(1)(b) GDPR, provided that your inquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested. 

Contact form data 

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We do not pass on this data without your consent. 

This data is processed on the basis of Art. 6(1)(b) GDPR, provided that your inquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested. 

2. Data processing term 

Your data will only be processed until you ask us to delete it, revoke your consent to its storage or as long as this is necessary to achieve the above-mentioned processing purposes; the legal bases stated in the context of the processing purposes apply. With regard to the use and storage duration of cookies, please note the points mentioned here as well as the cookie declaration. 

Third parties engaged by us will store your data on their system for as long as is necessary in connection with the provision of the services for us in accordance with the respective inquiry. 

3. Transfer of personal data to third parties; legal basis 

The following categories of recipients, which are usually processors, may have access to your personal data: 

• Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g. for data centre services, payment processing, IT security). The legal basis for the transfer is then Art. 6(1)(1)(b) or (f) GDPR, insofar as it does not concern processors;
• Government agencies/authorities, insofar as this is necessary to fulfil a legal obligation. The legal basis for the transfer is then Art. 6(1)(1)(c) GDPR;
• Persons appointed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors or supervisory authorities). The legal basis for the transfer is then Art. 6(1)(1)(b) or (f) GDPR. 

In addition, we only pass on your personal data to third parties if you have given your express consent in accordance with Art. 6(1)(1)(a) GDPR or if this is necessary on the basis of the contract with you in accordance with Art. 6(1)(b) GDPR. 

4. Hosting and Content Delivery Networks (CDN)

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website. 

External hosting is carried out for the purpose of fulfilling the contract with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6(1)(f) GDPR). If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time. 

Our host(s) will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data. 

We use the following host(s): 

D&T Internet GmbH
Fliederweg 127
51143 Cologne

Data processing 

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that the data controller processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR. 

C. Use of cookies, plugins and other services on our website 

1. General information: Cookies and similar technologies 

So-called "cookies" and comparable recognition technologies may be used on our website. Cookies are small text files that are assigned to the browser you are using and stored on your hard disk by means of a string of characters, and through which certain information flows to the site that sets the cookie.

Cookies cannot run programs or transfer viruses to your computer, and therefore cannot cause any damage. They serve to make the website more user-friendly and effective overall, i.e. more pleasant for you. 

Cookies may contain data that make it possible to recognise the device used. In some cases, cookies only contain information on certain settings that are not personally identifiable. However, cookies cannot directly identify a user.  

A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. With regard to their function, a distinction is made between cookies: 

• Necessary or essential cookies (technical cookies): These are strictly necessary to navigate the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they store which websites you have visited;
• Functional cookies: Cookies that collect user data to provide convenient website functions, e.g. for displaying a video
• Analysis cookies (performance cookies): They collect information about how you use our website, which pages you visit and, for example, if you experience any errors while using the website; they do not collect any information that could identify you – all information collected is anonymous and is only used to improve our website and to find out what interests our users;
• Marketing cookies (advertising cookies, targeting cookies): These are used to offer the website user needs-based advertising on the website or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months; 

If consent to the storage of cookies and comparable technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); the consent can be revoked at any time. If no consent is requested or no other legal basis is specified, the processing is based on our legitimate interest in the storage of cookies for the technically error-free and optimised provision of our services. 

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted. 

If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this privacy policy and, if necessary, request your consent.