Privacy

This privacy policy applies to the processing of personal data in connection with offerings by the Heidelberg Vis Arbitration Moot Alumni e.V. to the general public. This includes data processing

• when visiting the website heidelberg-vis-alumni.de,
• when contacting us by email at addresses with the suffix “@heidelberg-vis-alumni.de” and
• when contacting us via the contact form on the website heidelberg-vis-alumni.de.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

I. Data Controller and Data Protection Officer

The data controller, i.e. the person responsible for processing your personal data under data protection law within the meaning of the GDPR and other national data protection laws, is the

represented by the executive board: Niels Elsner, Stella Elmentaler, Dominik Stefer.

The Association is not currently required to appoint a data protection officer, as the Association does not constantly employ as a rule at least 20 persons dealing with the automated processing of personal data and no other grounds for a mandatory appointment apply.

II. Website

1. What Data Is Processed and for What Purpose?

Each time the content of the website (heidelberg-vis-alumni.de) is accessed, data that may permit identification is temporarily stored. The following data is collected in this process:

• date and time of access,
• page visited on our website,
• message indicating whether the retrieval was successful,
• IP address,
• information about the browser type and version used,
• operating system,
• device type.

The temporary storage of this data is necessary for the website visit to proceed and to enable the website to be displayed. Data is also stored in log files to ensure the functionality of the website and the security of our IT systems. These purposes also constitute our legitimate interest in processing the data.

2. On What Legal Basis Is This Data Processed?

The legal basis for processing this data is Art. 6(1)(f) GDPR.

3. Are There Any Recipients of the Personal Data Other Than the Data Controller?

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). All data collected when visiting the website is stored by Cloudflare. The data is stored on various servers located in various data centres. A list of these data centres is available on Cloudflare’s website ↗. It cannot be ruled out that personal data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework. Therefore, an adequacy decision pursuant to Art. 45 GDPR exists, so that the transfer can take place without the need for further transfer instruments or additional measures. Further information about the EU-US Data Privacy Framework can be found here ↗. In addition, we have entered into a data processing agreement with Cloudflare. This ensures that personal data is only processed in accordance with our instructions and in compliance with the GDPR. You can obtain further information from Cloudflare regarding data protection from their website here ↗ and here ↗.

4. How Long Is the Data Stored?

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of the website, this occurs when the respective session ends. The log files are stored in a manner accessible only to administrators. After 30 days, they are permanently deleted.

5. Cookies

We do not use cookies on our website.

6. Web Analytics

We do not use Cloudflare Web Analytics or any other web analytics software.

III. Email

1. What Data Is Processed and for What Purpose?

When you contact the Association by email (“…@heidelberg-vis-alumni.de”), only the personal data you provide in the email is collected.

The data is processed to handle your request.

2. On What Legal Basis Is This Data Processed?

The legal basis for processing this data is Art. 6(1)(b) GDPR, provided that the email contact is related to the performance of a contract or is necessary for pre-contractual measures. If you have given us your consent—which you may withdraw at any time—the legal basis for processing this data is Art. 6(1)(a) GDPR. In all other cases, the legal basis for processing this data is Art. 6(1)(f) GDPR because we have a legitimate interest in the effective processing of enquiries addressed to us.

3. Are There Any Recipients of the Personal Data Other Than the Data Controller?

The Association uses Google Workspace for email correspondence, which means that all data collected in this context is stored by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data is stored on various servers located in various data centres. A list of these data centres is available on Google’s website ↗. It cannot be ruled out that personal data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework. Therefore, an adequacy decision pursuant to Art. 45 GDPR exists, so that the transfer can take place without the need for further transfer instruments or additional measures. Further information about the EU-US Data Privacy Framework can be found here ↗. In addition, we have entered into a data processing agreement with Google. This ensures that personal data is only processed in accordance with our instructions and in compliance with the GDPR. You can obtain further information from Google regarding data protection from their website here ↗ and here ↗.

4. How Long Is the Data Stored?

The data will be deleted as soon as you request us to delete it, object to its processing, withdraw your consent or the purpose of processing the data has been fulfilled (e.g. when your request has been conclusively processed). The request for deletion, objection to processing or revocation of consent is made by email to YkLwzVPTjyTCd8gnbxP0FqSJBsMoTl4hYa6CxcjfSsJQT4Ag8eN8u5XiWMfFwUWgREL9zi5_zYn8.

IV. Contact Form

1. What Data Is Processed and for What Purpose?

When you contact the Association via the contact form on the website (heidelberg-vis-alumni.de), the following data, which you enter into the form, is collected:

• name,
• email address,
• subject,
• message,
• your consent to the processing of this data.

The data is processed in order to handle your request. For this purpose, the data is transmitted to the Association by email. The provision of this data is required neither by law nor by contract. However, the contact form cannot be used without this data. Alternatively, you can contact the Association by email (see III.).

In addition, when the contact form is submitted, the following data is collected:

• date and time of submission,
• message indicating whether the submission was successful,
• volume of data transferred,
• IP address,
• information about the browser type and version used,
• operating system,
• device type.

The temporary storage of this data is necessary to enable the submission of the contact form. This data is also stored in log files to ensure the functionality of the contact form and the security of our IT systems. These purposes also constitute our legitimate interest in processing this data.

2. On What Legal Basis Is This Data Processed?

The legal basis for processing the data you enter into the contact form is your consent—which you may withdraw at any time—pursuant to Art. 6(1)(a) GDPR. The legal basis for storing your consent as proof thereof (Art. 7(1) GDPR) is Art. 6(1)(c) GDPR. The legal basis for processing the data additionally stored in log files when the contact form is submitted is Art. 6(1)(f) GDPR.

3. Are There Any Recipients of the Personal Data Other Than the Data Controller?

The contact form is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). The data you enter into the contact form is processed by Cloudflare in order to transmit it to the Association by email. Cloudflare only stores your name, the subject of the email and the data additionally stored in log files when the contact form is submitted. In all other regards, the information on Cloudflare under II. 3. applies accordingly.

Like any email addressed to the Association, the email containing the data you provide in the contact form as well as the date and time of submission is processed and stored by Google. In this regard, the information on Google under III. 3. applies accordingly.

4. How Long Is the Data Stored?

The data additionally stored in log files when the contact form is submitted is stored in a manner accessible only to administrators. After 30 days at the latest, it is permanently deleted.

In all other regards, the data will be deleted as soon as you request us to delete it, object to its processing, withdraw your consent or the purpose of processing the data has been fulfilled (e.g. when your request has been conclusively processed). The request for deletion, objection to processing or revocation of consent is made by email to YTCZccoIp8FdgAnwL3pjDJTm6lGlkixcyfoGfy7_jPzd2BGnOIHKCIKQ_l3SrLEC--doOnv1gcQM.

V. Rights of the Data Subject

• Pursuant to Art. 15 GDPR, you may request access to your personal data that we process.
• If inaccurate or incomplete personal data is processed, you have the right to rectification or completion pursuant to Art. 16 GDPR.
• Pursuant to Art. 17 GDPR, you have the right to erasure of your personal data.
• Pursuant to Art. 18 GDPR, you have the right to restriction of processing of your personal data.
• Pursuant to Art. 20 GDPR, you have the right to data portability. Under this right, you may request that data we process by automated means on the basis of your consent or in the performance of a contract be transferred to you or to a third party. This does not apply to the processing of data for the provision of the website and the storage of log files, as these are strictly necessary for the operation of the website. Their processing is therefore based neither on consent under Art. 6(1)(a) GDPR nor is it required for the performance of a contract or pre-contractual measures under Art. 6(1)(b) GDPR. Accordingly, the requirements of Art. 20(1) GDPR are not fulfilled in this regard. The processing of your personal data in connection with email contact and the contact form also does not fulfil the requirements of Art. 20(1) GDPR, as the processing is not carried out by automated means.
• Pursuant to Art. 21 GDPR, you may object to the processing of your personal data. In particular, you may, at any time, object, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. The data controller will then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. The processing of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website.
• You have the right to withdraw any consent you may have given at any time. The withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.
• Should you wish to exercise any of the rights set out above, please contact us by email at ucAVjM3rjibkklej9mDPRsBno4w1dMAihxIVW3VGhL1mXwA33sEEmMNqi4OhOHIv-TL2mxTgziv1.
• If you believe that the processing of your personal data violates data protection law, you have the right under Art. 77(1) GDPR to lodge a complaint with a supervisory authority of your choice. This includes the supervisory authority with jurisdiction over the data controller: