Privacy Policy
Foreword
We, the German Red Cross (DRK General Secretariat), hereinafter referred to as "the organisation," "we," or "us," take the protection of your personal data seriously and would like to inform you about data protection within our organisation.
As per the European Union General Data Protection Regulation (Regulation (EU) 2016/679; henceforth referred to as "GDPR"), there exist obligations to safeguard the personal data of individuals affected by processing (hereinafter addressed as the "customer," "user," "you," "yours," or "data subject").
Whether independently or in collaboration with others, where we determine the purposes and methods of data processing, our primary responsibility is to transparently communicate the nature, scope, purpose, duration, and legal basis of the processing (refer to Art. 13 and 14 GDPR). This statement, termed "privacy policy” serves to inform you about the manner in which we process your personal data.
Our privacy policy is organised into modules. It comprises a general section applicable to any processing of personal data and processing situations encountered with every website visit (Part A. General). Additionally, there is a specific section, the content of which pertains solely to the indicated processing situation, specifying the respective offer or product.
A. General
1. Definitions
Following the guidelines outlined in Article 4 of the General Data Protection Regulation (GDPR), the privacy policy provided herein is based on the following definitions:
“Personal Data” (Art. 4 No. 1 GDPR): All information pertaining to an identified or identifiable natural person, commonly referred to as the "data subject.”
“Processing” (Art. 4 No 2 GDPR):Any operation or set of operations carried out on personal data, encompassing collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
“Controller” (Art. 4 No. 7 GDPR): The individual, authority, or entity responsible for determining the purposes and means of processing personal data.
“Third Party” (Art. 4 No. 8 DDRP):Any person, authority, or entity excluding the data subject, the controller, and the processor.
“Consent” (Art. 4 No. 11 GDRP): voluntary, informed, and unambiguous expression of the data subject's will regarding the processing of their personal data.
2. Name and Address of the Controller Responsible for Processing
We, the German Red Cross, act as the entity responsible for processing your personal data in accordance with Article 4 No. 7 of the General Data Protection Regulation (GDPR). You can contact us at:
German Red Cross e.V.
Carstennstraße 58
12205 Berlin
Telefon: 030 / 85404 – 0
E-Mail: drk(at)drk.de
For additional information concerning our organization, please refer to the legal notice on our website.
3. contact details of the data protection officer
Our company data protection officer is available at all times to answer any questions you may have and to act as your contact person on the subject of data protection. His contact details are
advokIT Datenschutz
Weißmann Data Protection GmbH
Schirmerstraße 30
50823 Cologne
Postal address:
Riemenschneiderstraße 4
55543 Bad Kreuznach
Data protection[at]advokit.de
4. Legal Basis for Data Processing
By law, the general principle is that the processing of personal data is prohibited, and it is only permitted when the data processing falls under one of the following legal justifications:
Art. 6 Abs. 1 S. 1 lit. a GDPR (“Consent”): If the data subject has voluntarily, informed, and unequivocally indicated through a statement or another clear affirmative action that they consent to the processing of their personal data for one or more specific purposes.
Art. 6 Abs. 1 S. 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures requested by the data subject.
Art. 6 Abs. 1 S. 1 lit. c GDPR: If the processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., a legal retention obligation).
Art. 6 Abs. 1 S. 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exerciseof official authority vested in the controller
Art. 6 Abs. 1 S. 1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person.
Art. 6 Abs. 1 S. 1 lit. f GDPR (“Legitimate Interest”): If the processing is necessary for the protection of legitimate (especially legal or economic) interests of the controller or a third party, unless the overriding interests or rights of the data subject prevail, particularly if the data subject is a minor.
For the processing operations we carry out, we indicate the applicable legal basis in each case below. Processing can also be based on several legal bases.
General Information on the Legal Basis for Data Processing on this Website
If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special categories of data are processed in accordance with Art. 9 para. 1 GDPR. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR.
If you have consented to the storage of cookies or access to information in your end device (e.g. via device fingerprinting), the data processing is also carried out on the basis of Section 25 (1) TTDSG.
Consent can be revoked at any time. If your data is required to fulfill the contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR.
Furthermore, we process your data if this is necessary to fulfill a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR.
Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.
5. Data Erasure and Storage Duration
For the processing operations carried out by us, we indicate below how long the data will be stored by us and when it will be deleted or blocked. Unless an explicit storage period is specified below, your personal data will be erased or blocked as soon as the purpose or legal basis for storage no longer applies. Your data will generally only be stored on our servers in the European Economic Area (EEA), subject to any disclosure in accordance with the provisions in A. (7) and A. (8).
However, data may be stored beyond the specified period in the event of an (impending) legal dispute with you or other legal proceedings or if storage is provided for by statutory provisions to which we are subject as the controller (e.g. Section 257 HGB, Section 147 AO). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.
6. Data Security
We use suitable technical and organisational measures to protect your data from manipulation, loss, destruction or unauthorised access by third parties. For example, we use TSL encryption for our website. The measures take into account the current state of the art, the implementation costs as well as the type, scope, context and purpose of the processing and the risks of a data breach for you as the data subject (including the probability and impact). We continuously improve our security measures in line with technological progress.
7. Cooperation with Contract Processors
We use external domestic and foreign service providers to process our business transactions (e.g. for IT, logistics, telecommunications and marketing). These service providers only act in accordance with our instructions and are contractually obliged to comply with data protection regulations in accordance with Art. 28 GDPR.
If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is done on the basis of existing commissioned processing agreements.
8. Requirements for the Transfer of Personal Data to Third Countries
As part of our business relationships, your personal data may be transferred or disclosed to third party companies. These may also be located outside the EEA, i.e. in third countries. Such processing takes place exclusively to fulfil contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer at the relevant points below.
The European Commission certifies that some third countries have data protection standards comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Other third countries to which personal data may be transferred may not have a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognised codes of conduct.
9. No Automated Decision-Making (including profiling)
We do not intend to use personal data collected from you for automated decision-making (including profiling).
10. No Obligation to Provide Personal Data
We do not make the conclusion of contracts with us dependent on you providing us with personal data beforehand. As a customer, you are under no legal or contractual obligation to provide us with your personal data; however, we may only be able to provide certain services to a limited extent or not at all if you do not provide the necessary data. If this should exceptionally be the case in the context of the products presented below and offered by us, you will be informed separately.
11. Legal Obligation to Transmit Certain Data
Under certain circumstances, we may be subject to a specific legal or statutory obligation to provide the lawfully processed personal data to third parties, in particular public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).
12. Your Rights
You can assert your rights as a data subject with regard to your processed personal data at any time by contacting us using the contact details provided at the beginning under A. (2). As the data subject, you have the right
in accordance with Art. 15 GDPR, to request information about your data processed by us. In particular, you can request information about the purposes of processing, the category of data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
in accordance with Art. 16 GDPR, to immediately request the correction of incorrect data or the completion of your data stored by us;
in accordance with Art. 17 GDPR, to demand the erasure of your data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
in accordance with Art. 18 GDPR, to demand the restriction of the processing of your data if the accuracy of the data is disputed by you or the processing is unlawful;
in accordance with Art. 20 GDPR, to receive your data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller ("data portability");
in accordance with Art. 21 GDPR, the right to object to the collection of data in special cases and to direct marketing (Art. 21 GDPR), provided that the processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. If it is not an objection to direct advertising, we ask you to explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and either discontinue or adapt the data processing or point out to you our compelling reasons worthy of protection on the basis of which we will continue the processing;
in accordance with Art. 7 (3) GDPR, to withdraw your consent once given - i.e. your voluntary, informed and unequivocal expression of your consent to the processing of the personal data concerned for one or more specific purposes by means of a statement or other unequivocal affirmative act - at any time, if you have given such consent. As a result, we may no longer continue the data processing that was based on this consent in the future and
in accordance with Art. 77 GDPR, to complain to a data protection supervisory authority about the processing of your personal data in our organization.
13. Changes to the Privacy Policy
In the context of the further development of data protection law as well as technological or organisational changes, our privacy policy is regularly reviewed to determine whether it needs to be adapted or supplemented. You will be informed of any changes, in particular on our website. This data protection notice was last updated in January 2024.
B. Visiting the Website
When you visit our website, your personal data may be processed. When you use the website, the following categories of personal data may be collected, stored and processed by us:
1. Data Processing, Purpose and Legal Basis
Server Log Files ("log data")
When you visit our website, a so-called log data record (of server log files) is temporarily and anonymously stored on our web server. This consists of:
the page from which the page was requested (so-called referrer URL)
the name and URL of the requested page
the date and time of the request
the description of the type, language and version of the web browser used
the IP address of the requesting computer, which is shortened so that a personal reference can no longer be established
the amount of data transferred
the operating system
the message as to whether the request was successful (access status/Http status code)
the GMT time zone difference
The log data is processed for statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR). The stored information is deleted after seven days, unless there is a legitimate suspicion of unlawful use, which requires further verification. It is not possible for us to identify you from the stored information. Therefore, Articles 15 to 22 GDPR do not apply pursuant to Article 11(2) GDPR, unless you provide further information that enables your identification.
Request by E-Mail, telephone or fax
If you contact us by email, telephone or fax, we will store and process your request, including all resulting personal data (name, request) for the purpose of processing your request.
This data is processed on the basis of Art. 6 para. 1 lit. b GDPR, provided that your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass on this data without your consent.
Contact Form data
This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
2. Duration of Data Processing
Your data will only be processed until you ask us to delete it, revoke your consent to storage or as long as this is necessary to achieve the above-mentioned processing purposes; the legal bases stated in the context of the processing purposes apply. With regard to the use and storage duration of cookies, please note the points mentioned there as well as the cookie declaration.
Third parties used by us will store your data on their system for as long as is necessary in connection with the provision of the services for us in accordance with the respective order.
3. Transfer of Personal Data to Third Parties; Legal Basis
The following categories of recipients, which are usually processors, may receive access to your personal data:
Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g. for data centre services, payment processing, IT security). The legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR, unless they are processors;
Government bodies/authorities, insofar as this is necessary to fulfil a legal obligation. The legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. c GDPR;
Persons employed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors or supervisory authorities). The legal basis for the disclosure is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR.
In addition, we only pass on your personal data to third parties if you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or if this is necessary on the basis of the contract with you in accordance with Art. 6 para. 1 lit. b GDPR.
4. Hosting and Content Delivery Networks (CDN)
We host the content of our website with the following provider:
storytile GmbH
The provider is storytile GmbH, Gollierstr. 70, 80339 Munich (hereinafter "storytile").
When you visit our website, your personal data is processed on the servers of Microsoft Ireland Operations Limited, server location Europe West. Personal data may also be transferred to the parent company of Microsoft Ireland Operations Limited in the USA. The data transfer to the USA is based on the EU standard contractual clauses. Details can be found here: https://learn.microsoft.com/de-de/compliance/regulatory/offering-EU-Model-Clauses
Further information can be found in storytile's privacy policy: https://www.storytile.net/datenschutzerklaerung
The use of Microsoft Ireland Operations is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
Contract processing
Our provider storytile has concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which guarantees that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
C. Use of Cookies, Plugins and Other Services on our Website
1. General: Cookies and comparable technologies
So-called "cookies" and comparable recognition technologies may be used on our website. Cookies are small text files that are assigned and stored on your hard disk to the browser you are using by means of a characteristic string of characters and through which certain information flows to the body that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer and therefore cannot cause any damage. They serve to make the Internet offer more user-friendly and effective overall, i.e. more pleasant for you.
Cookies may contain data that makes it possible to recognize the device used. In some cases, however, cookies only contain information on certain settings that are not personally identifiable. However, cookies cannot directly identify a user.
A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. In terms of their function, a distinction is made between cookies:
Necessary or essential cookies (technical cookies): These are absolutely necessary in order to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they store which websites you have visited;
Functional cookies: Cookies that collect user data to provide convenient website functions, e.g. for displaying a video;
Analytical cookies (performance cookies): These collect information about how you use our website, which pages you visit and, for example, whether errors occur during website use; they do not collect any information that could identify you - all information collected is anonymous and is only used to improve our website and find out what interests our users;
Marketing cookies (advertising cookies, targeting cookies): These are used to offer the website user needs-based advertising on the website or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;
If consent to the storage of cookies and comparable technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG); the consent can be revoked at any time. If no consent is requested or another legal basis is specified, the processing is based on our legitimate interest in the storage of cookies for the technically error-free and optimized provision of our services.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this privacy policy and, if necessary, request your consent.
2. Cookie Consent Tool
Consent with Usercentrics
This website uses the consent technology of Usercentrics to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies and to document this in compliance with data protection regulations. The provider of this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, website: usercentrics.com/en/ (hereinafter "Usercentrics").
When you enter our website, the following personal data is transferred to Usercentrics:
Your consent(s) or the withdrawal of your consent(s)
your IP address
Information about your browser
Information about your end device
Time of your visit to the website
Furthermore, Usercentrics stores a cookie in your browser in order to be able to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to delete it, delete the Usercentrics cookie yourself or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected.
Usercentrics is used to obtain the legally required consent for the use of certain technologies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.
Contract processing:
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that the service provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
3. Cookies, Plugins and Other Third-Party Services
Pusher Ltd.
This service is used as a real-time service at the event (e.g. chat function)
Website: https://messagebird.com/en/legal/privacy
Mailjet GmbH and Mailjet SAS
This service is used to send access codes
Website: https://www.mailjet.com/de/rechtliches/datenschutzerklaerung/
8x8 Inc
This service is used to connect to a stream
Website: https://www.8x8.com/terms-and-conditions/privacy-policy
Mentimeter
This service is used for surveys
Website: https://www.8x8.com/terms-and-conditions/privacy-policy
Padlet
This service is used for surveys
Website: https://legal.padlet.com/privacy
Webex
This service is used as a video conferencing tool
Website: http://www.cisco.com/c/de_de/about/legal/privacy-full.html
Zoom
This service is used as a video conferencing tool
Website: https://explore.zoom.us/en/privacy/
Zammad
This service is used for support requests
Website: zammad.com/de/unternehmen/datenschutz
D. Our social media presences
This privacy policy applies to the following social media sites:
Data processing by social networks
We maintain publicly accessible profiles in social networks. The individual social networks we use are listed below.
Social networks such as Facebook, X etc. can generally analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail:
When you are logged into your social media account and visit our social media presence, the operator of the social media platform may associate this visit with your user account. However, your personal data may also be collected even if you are not logged in or do not have an account on the respective social media platform. In this case, data collection can occur, for example, through cookies stored on your device or by capturing your IP address.
The data collected in this manner allows the operators of the social media platforms to create user profiles, storing your preferences and interests. This information enables the display of targeted advertising within and outside the respective social media presence. If you have an account on the particular social network, interest-based advertising may be displayed on all devices where you are logged in or have been logged in.
Please note that we may not be able to trace all processing activities on social media platforms. Depending on the provider, additional processing activities may be carried out by the operators of the social media platforms. For more details, refer to the terms of use and privacy policies of the respective social media platforms.
Legal Basis
Our social media presence aims to ensure comprehensive visibility on the internet. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the General Data Protection Regulation (GDPR). The analysis processes initiated by social networks may be based on different legal grounds, as specified by the operators of the social networks (e.g., consent under Article 6(1)(a) GDPR).
Controller and Assertion of Rights
When you visit one of our social media profiles (e.g., Facebook), we, along with the operator of the social media platform, are jointly responsible for the data processing activities triggered during your visit. You can assert your rights (information, correction, deletion, restriction of processing, data portability, and complaint) both against us and the operator of the respective social media portal (e.g., Facebook).
Please note that despite our shared responsibility with the social media platform operators, we do not have full control over the data processing activities of the social media portals. Our capabilities depend significantly on the corporate policies of the respective provider.
Storage Duration
The data directly collected by us through the social media presence is deleted from our systems when you request deletion, revoke your consent for storage, or when the purpose for data storage no longer exists. Stored cookies remain on your device until you delete them. Mandatory legal provisions, especially retention periods, remain unaffected.
We do not have influence over the storage duration of your data, which is stored by the operators of social networks for their own purposes. For details, please refer directly to the operators of the social networks (e.g., in their privacy policy, see below).
Your Rights
You have the right to receive information at any time about the origin, recipients, and purpose of your stored personal data free of charge. Additionally, you have the right to object, the right to data portability, and the right to lodge a complaint with the relevant supervisory authority. Furthermore, you can request correction, blocking, deletion, and under certain circumstances, restriction of the processing of your personal data.
Social Networks Individually
We maintain a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter Meta). According to Meta, the collected data is also transferred to the USA and other third countries.
We have entered into an agreement on joint processing (Controller Addendum) with Meta. This agreement specifies the data processing operations for which we or Meta is responsible when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum
You can adjust your advertising settings independently in your user account. To do this, click on the following link and log in:https://www.facebook.com/settings?tab=ads
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381
For further details, please refer to Facebook's privacy policy: https://www.facebook.com/about/privacy/
X (formerly Twitter)
We use the short messaging service X, formerly Twitter. The provider is X Corp., Suite 900, 1355 Market Street, San Francisco, California, 94103
You can adjust your X privacy settings independently in your user account. To do this, click on the following link and log in:https://twitter.com/personalization
The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html
For further details, please refer to X's privacy policy: https://twitter.com/de/privacy
We maintain a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Last updated: 24 January 2024