PRIVACY POLICY

Status 15.06.2021

With the publication of this privacy policy, all previous privacy policies lose their validity.

1 Data protection information

We take the protection of your personal data very seriously. We would like to inform you in the following comprehensively and in detail about what we collect your personal data for, what we do with it, to whom we pass on this data if necessary and where and how long we store your data.

In addition, you have numerous rights as a data subject, which we would also like to inform you about. We provide this information to you on the basis of Regulation (EU) 679/2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC, hereinafter referred to as the GDPR.

2 Who processes your personal data?

We are the entities listed below. We operate the data processing jointly and are your contact persons in all matters of data protection in accordance with Art. 26 GDPR as joint controllers.

Campus for Christ e.V.
Am Unteren Rain 2
35394 Giessen

Responsible persons at CFC:
Kurt Burgherr
Andreas Boppart
Andreas Fürbringer
Raphael Funck
Friedemann Schwinger
Julia SpankaFlorian Stielper

Global Aid Network (GAiN) gGmbH
Am Unteren Rain 2
35394 Gießen

Responsible persons at GAiN:
Klaus Dewald
Raphael Funck

Phone +49 (0)641 - 975 18-0

Our data protection officer, Mr Marc Dauenhauer (contact at datenschutz(at)campus-d.de), is available to answer any questions you may have regarding the processing of your data.

3 Principles of data processing

3.1 Legal basis

3.1.1 General

We process your personal data on the basis of the legal requirements of the GDPR and the German Federal Data Protection Act (BDSG) in its current version. In detail, we process your personal data:

within the scope of legal obligations,
as far as we need them for the fulfilment of contracts which we have concluded with you,
as far as they are necessary for pre-contractual measures (e.g. offers),
as far as you have given your consent,
within the scope of our legitimate interests, which include marketing and direct advertising, as well as for the purpose of Safeguarding our legal rights.

3.1.2 Special types of personal data

We would like to point out that we consider ourselves to be a religiously oriented organization within the meaning of Article 9 (2) (d) of the GDPR. Therefore, we are also permitted to process special categories of personal data such as religious or ideological beliefs, insofar as these relate to our members or persons who are in regular contact with us in the course of our activities. We treat this data as particularly confidential and do not disclose it to the outside world without your explicit consent.

3.2 Disclosure of data

As a matter of principle, we do not pass on data to third parties unless,

You have consented to the disclosure,
we are obliged to do so by law, it is necessary for the performance of a contract with you, or
we commission external service providers to carry out tasks.
In this case, we ensure that our service providers provide sufficient guarantees that appropriate technical and organisational measures are in place and that processing operations comply with the GDPR (Art. 28 GDPR). For this reason, we select such service providers very carefully.

3.3 Consents

3.3.1 Obtaining consent

We obtain your consent to the processing of personal data - if required - electronically or in writing. We secure electronic consent by means of a corresponding double opt-in procedure and record your consent.

3.3.2 Revocation

Once you have given your consent, you can revoke it at any time with effect for the future. The legality of the data processing carried out on the basis of the consent until the revocation is not affected by this. You can address your revocation to one of the offices mentioned under 2.

3.3.3 Legal consequences of revocation

If the processing of your personal data is based on your consent, we will terminate this as a result of your revocation. This may also mean that services obtained from you (e.g. newsletter) can no longer be provided.

3.3.4 Consent of children and adolescents

With our offers, we also address children and young people, among others. We therefore ensure, within the scope of technical and organisational possibilities, that any consent given to the processing of a child's personal data is in accordance with Article 8 of the GDPR.

3.4 Processing in third countries

As a matter of principle, we process your data within the EU or the European Economic Area. An exception is the use of IT systems of partners and service providers that are operated in the USA or other third countries. In these cases, we ensure that appropriate safeguards are in place to protect your personal data before it is transferred. The processing of your data in the USA is carried out in accordance with Art. 46(2)(c) and (d) GDPR on the basis of appropriate contracts using approved standard contractual clauses of the EU Commission. We will be happy to provide you with more detailed information on this upon request.

3.5 Online forms

If you use any online form on our websites to contact us, your personal data will be forwarded to us by e-mail. We ask you not to transmit any confidential information in this way, as we cannot ensure the protection of this information during the transmission of unencrypted e-mails.

3.6 Storage and deletion periods

We store your personal data only as long as it is necessary to fulfil its processing purpose or due to legal retention obligations. After that, the personal data will be deleted.

Notwithstanding the foregoing, we will not delete your contact information until after four (4) years in which you have not contacted us, subscribed to our newsletter, participated in any of our events, or taken advantage of any of our other offers.

Of course, your rights to deletion, blocking, restriction of processing or the right to be forgotten remain unaffected.

3.7 Data subject rights

3.7.1 Right of access (Art. 15 GDPR)

Data subjects have the right to request information as to whether or not personal data relating to them is being processed. If personal data is processed by our company, there is a right to information about:

the purposes of processing;
the categories of personal data (type of data) processed;
the recipients or categories of recipients to whom their data have been or will be disclosed;
this applies in particular if data have been or are to be disclosed to recipients in third countries outside the scope of the GDPR;
the planned storage period, insofar as this is possible; if it is not possible to specify the storage period, the criteria for determining the storage period (e.g. statutory retention periods or similar) must be provided in any case;
Your right to rectification and erasure of data concerning you, including the right to restrict processing and/or the possibility to object (see also the following paragraphs);
the existence of a right of appeal to a supervisory authority;
the origin of the data, if personal data have not been collected directly from the data subject.

You also have the right to be informed whether your personal data is the subject of an automated decision within the meaning of Article 22 of the GDPR and, if this is the case, which decision-making criteria form the basis of such an automated decision (logic) and what effects and scope the automated decision may have for you.

If personal data is transferred to a third country outside the scope of the GDPR, you have the right to be informed whether and, if so, on the basis of which guarantees an adequate level of protection within the meaning of Articles 45, 46 of the GDPR is ensured at the data recipient in the third country.

You have the right to request a copy of your personal data. We generally provide copies of data in electronic form, unless you have specified otherwise. The first copy is free of charge, for further copies a reasonable fee may be charged. The provision is subject to the rights and freedoms of other persons who may be affected by the transmission of the data copy.

3.7.2 Right of rectification (Art. 16 GDPR)

You have the right to demand that we correct your data if it is incorrect, inaccurate and/or incomplete; the right to correction includes the right to completion through supplementary declarations or notifications. A correction and/or completion must be made immediately - i.e. without culpable hesitation.

3.7.3 Right to erasure (Art. 17 GDPR)

You have the right to request that we delete your personal data, insofar as

the personal data are no longer necessary for the purposes for which they were collected and processed;
the data processing is based on your consent and you have revoked your consent, unless there is another legal basis for the data processing;
you have objected to data processing pursuant to Art. 21 GDPR and there are no overriding legitimate grounds for further processing,
you have objected to data processing for the purpose of direct marketing pursuant to Art. 21 (2) GDPR;
your personal data have been processed unlawfully;
it concerns data of a child collected in relation to information society services pursuant to Article 8(1) of the GDPR.

A right to the deletion of personal data does not exist, as far as

the right to freedom of expression and information precludes the request for deletion;
the processing of personal data is necessary (i) for compliance with a legal obligation (e.g. legal retention obligations), (ii) for the performance of public tasks and interests under Union law and/or Member State law (this includes public health interests) or (iii) for archiving and/or research purposes;
the personal data is necessary for the assertion, exercise or defence of legal claims.

The deletion must take place immediately - i.e. without culpable delay. If personal data has been made public by us (e.g. on the Internet), we must ensure, as far as is technically possible and reasonable, that third party data processors are also informed of the deletion request, including the deletion of links, copies and/or replications.

3.7.4 Right to restrict processing (Art. 18 GDPR)

You have the right to have the processing of your personal data restricted in the following cases:
If you have disputed the accuracy of your personal data, you can demand that your data not be used for other purposes for the duration of the accuracy check and be restricted in this respect.
In the event of unlawful data processing, you may demand the restriction of data use in accordance with Art. 18 GDPR instead of data deletion in accordance with Art. 17 (1) d GDPR;
If you need your personal data for the assertion, exercise or defence of legal claims, but your personal data is otherwise no longer required, you may request us to restrict processing to the aforementioned legal pursuit purposes;
If you have objected to data processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether our interests in processing outweigh your interests, you may request that your data not be used for other purposes for the duration of the review and be restricted to this extent.

Personal data whose processing has been restricted at your request may - subject to retention - only be processed (i) with your consent, (ii) to assert, exercise or defend legal claims, (iii) to protect the rights of other natural or legal persons, or (iv) for reasons of important public interest. In the event that a restriction on processing is lifted, you will be informed in advance.

3.7.5 Right to data portability (Art. 20 GDPR)

You have the right - subject to the following regulations - to demand the return of the data concerning you in a common electronic, machine-readable data format. The right to data transfer includes the right to transfer the data to another data controller; upon request, we will therefore - as far as technically possible - transfer data directly to a data controller named by you or yet to be named. The right to data transmission only exists for data provided by you and requires that the processing is based on consent or for the performance of a contract and is carried out with the aid of automated processes. The right to data transfer according to Art. 20 GDPR does not affect the right to data deletion according to Art. 17 GDPR. The data transfer is subject to the rights and freedoms of other persons whose rights may be affected by the data transfer.

3.7.6 Right of objection (Art. 21 GDPR)

In the case of processing of personal data for the performance of tasks in the public interest (Art. 6 para. 1 lit e GDPR) or for the performance of legitimate interests (Art. 6 para. 1 lit f GDPR), you may object to the processing of personal data relating to you at any time with effect for the future. In the event of an objection, we must refrain from any further processing of your data for the aforementioned purposes, unless,

there are compelling legitimate grounds for processing which override your interests, rights and freedoms, or
processing is necessary for the establishment, exercise or defence of legal claims.

You can object to the use of your data for the purpose of direct advertising at any time with effect for the future; this also applies to profiling, insofar as it is connected with direct advertising. In the event of an objection, we must refrain from any further processing of your data for the purpose of direct advertising.

3.7.7 Prohibition of automated decisions / profiling (Art. 22 GDPR) [as relevant].

Decisions which have legal consequences for you or which significantly affect you must not be based solely on automated processing of personal data - including profiling. This does not apply if the automated decision

is necessary for the conclusion or fulfilment of a contract with you,
is permitted by Union or Member State legislation, provided that such legislation contains adequate measures to safeguard the rights and freedoms and legitimate interests of your person, or
with your express consent.

Decisions based exclusively on the automated processing of special categories of personal data are in principle inadmissible unless Article 22 (4) in conjunction with Article 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as the legitimate interests of your person.

3.7.8 Legal protection options / right to complain to a supervisory authority

In the event of complaints, you can contact the competent supervisory authority of the Union or the member states at any time. For our company, the supervisory authority mentioned in section II is responsible.

4 Detailed information on individual processing operations

Below we have detailed the various purposes for which we collect and process personal data, what data we process and how we handle personal data or to whom we may disclose it.

4.1 Processing for the purpose of communication with interested parties, general advertising to interested parties, marketing and public relations, solicitation of donors

4.1.1 Purpose and legal basis

Our legitimate interest is that as many people as possible learn about us and support us and our projects. Therefore, we process your contact details if you have either already contacted us in some way or we think you might be interested in us and our work. Our work is predominantly funded by donations. Therefore, it is equally important for us to keep in touch with existing and potential donors and to inform them regularly about our work.

4.1.2 Scope of data processing

In order to contact you and inform you according to your interests, we process the following data:

Name,
Address,
E-mail address,
Phone number,
date of birth,
Interests,
Event Attendance,
Donations,
Denomination,
Faith information/stories.

4.1.3 Origin of data

We have received this data from you personally or from persons in your personal environment.

4.1.4 Retention and deletion periods

According to the basic rules under 3.6

4.1.5 Special notes

Any additional personal data that you have entrusted to the Campus employee with whom you are in personal contact will remain confidential and will not be stored or processed by us.

4.2 Processing for the purpose of donation management

4.2.1 Purpose and legal basis

If you donate to us or to an aid project, we have to process your data due to legal regulations (AO) and to fulfil your donation request.

4.2.2 Scope of data processing

If you have given us a specific donation order, we store the following personal data:

Name,
Address,
Marital status,
Denomination,
Nationality,
Date of birth,
E-mail address,
Phone number,
Bank details,
Donation Information.

4.2.3 Origin of data

We have received this data from you.

4.2.4 Transfer of data, processing in third countries

If you have made a donation for a specific project, your personal data will also be passed on to our project partners in the respective recipient country of your donation. If you give us a corresponding note with your donation, we will not forward your data.
In addition, we also pass on donor information to the relevant tax authorities as part of our legal obligations.

4.2.5 Retention and deletion periods

According to the general rules in 3.6

4.3 Processing for the performance of contracts and the enforcement of legal claims

4.3.1 Purpose and legal basis

We offer numerous services. These services include:

Events,
Organization of group tours,
Coaching,
Humanitarian aid and crisis management.

We offer these services to you within the framework of a contractual relationship with you. We process your personal data insofar as

this is necessary for the fulfilment of the contract,
we are obliged to do so by law,
it is necessary for the protection of our legitimate interests.
you have given your consent to the processing.

We pursue legitimate interests in particular in connection with the enforcement of legal claims, e.g. for payment of agreed fees for the provision of services.

4.3.2 Scope of data processing

We may process the following categories of data:

Name,
Address,
Contract Data,
Performance data for the service provided (e.g. location, date, expenses),
Costs for the provision of services,
Religious affiliation,
Marital status,
Living situation data,
Creed,
Bank details,
Dunning and payment data,
Collection Data,
Passport and visa data,
Vaccination data,
Pictures and videos (only with consent).

4.3.3 Origin of data

We have received the data from you, from our partners or from public authorities.

4.3.4 Transfer of data, processing in third countries

As a matter of principle, we only process your data within the framework of the principles listed under 3.2 and 3.4. In the context of travel events, additional data transfers to authorities in third countries (e.g. USA) may be necessary. You will be informed separately about this in connection with travel events.

4.3.5 Storage and deletion periods

In accordance with the principles set out in 3.6

4.4 Processing of applicant data

4.4.1 Purpose and legal basis

If you would like to work with us, either as a permanent employee or as a volunteer, we look forward to receiving your application. In doing so, we process the personal data that you have provided to us as part of the application, as well as the data that accrues in the course of the application process. These are pre-contractual measures.

We assume that by sending us your data, you have given us consent to process it as part of the application process. If we accept your application, we will continue to store your data as part of your cooperation in accordance with Art 6 (1) lit b GDPR in conjunction with Section 26 BDSG 2018.

If we reject your application, we will store the records of the application process for a maximum of a further 6 months in order to protect our legitimate interests.

4.4.2 Scope of data processing

We process the following data in the application process:

Name,
Address,
Marital status,
Denomination,
Qualifications,
Professional background,
Economic information (e.g. salary requirement),
Individual information that you have provided to us as part of your application.

4.4.3 Storage and deletion periods

We will delete this data 6 months after rejecting your application, with the exception of your contact data, unless statutory retention obligations provide for longer storage periods. We will also store your contact data beyond this period within the scope of the purposes set out in 4.1.

4.5 Processing to optimize and secure our online offer

4.5.1 Purpose and legal basis

We offer numerous online services for our members and interested parties. In addition to our website, this also includes an online shop. In order to ensure and further optimize the security, functionality and user-friendliness of our online offers, we collect personal data as soon as you use one of our online offers, including mobile apps.

4.5.2 Scope of data processing

We regularly collect the following data:

Your IP address,
Date and time of the retrieval,
Access status/http status code,
browser software used as well as its language and version,
operating system used,
URLs you come from and go to next,
the amount of data transferred and
the information whether the retrieval was successful.

4.5.3 Disclosure of data

We also use external service providers for the provision of our online offers, including mobile apps. These may also come into contact with your personal data. We select these service providers carefully and ensure that your data is protected by appropriate guarantees and technical-organisational measures. You can find more details under 3.2

4.5.4 Storage and deletion periods

This data is deleted within 7 days, unless it is exceptionally required for a longer period to protect legitimate interests. This may be necessary, for example, in the context of error correction or for the prosecution of criminal offences.

4.5.5 Information on the use of cookies on our Internet pages

Cookies are small text files that are sent by us to the browser of your end device when you visit our website and stored there. As an alternative to the use of cookies, information can also be stored in the local storage of your browser. Some functions of our website cannot be offered without the use of cookies or local storage (technically necessary cookies). Other cookies, however, enable us to perform various analyses, so that we are able, for example, to recognise the browser you are using when you visit our website again and to transmit various information to us (non-essential cookies). With the help of cookies, we can, among other things, make our website more user-friendly and effective for you, for example by tracking your use of our website and determining your preferred settings (e.g. country and language settings). If third parties process information via cookies, they collect the information directly from your browser. Cookies do not cause any damage to your end device. They cannot execute programs or contain viruses.

We provide information about the respective services for which we use cookies in the individual processing operations. Detailed information on the cookies used can be found in the cookie settings or in the Consent Manager of this website.

Domain	Name	Description	Storage period
.dartgain.eu	fe_typo_user	This cookie name is associated with the Typo3 web content management system. It is generally used as a user session identifier to enable user preferences to be stored, but in many cases it may not actually be needed as it can be set by default by the platform, though this can be prevented by site administrators. In most cases it is set to be destroyed at the end of a browser session. It contains a random identifier rather than any specific user data.	Session
.myfonts.net	__cf_bm	This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of their website.	30 minutes

4.6 Use of web analytics services, social network plugins and third-party services

4.6.2 Google Analytics

4.6.2.1 Nature and scope of processing

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, duration of visit, operating systems used and origin of the user. This data may be combined by Google into a profile that is assigned to the respective user or their end device.

Furthermore, Google Analytics can record your mouse and scroll movements and clicks, among other things. Google Analytics also uses various modeling approaches to augment the data sets it collects and employs machine learning technologies in its data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this analysis tool is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. If a corresponding consent has been requested (e.g. consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: privacy.google.com/businesses/controllerterms/mccs/ .

4.6.2.2 IP anonymization

We have activated the IP anonymization function on this website. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

4.6.2.3 Browser Plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: tools.google.com/dlpage/gaoptout?hl=de.

For more information on how Google Analytics handles user data, please see Google's privacy policy: support.google.com/analytics/answer/6004245?hl=de.

4.6.2.4 Order processing

We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

4.6.2.5 Demographic characteristics in Google Analytics

This website uses the "demographic characteristics" function of Google Analytics in order to be able to display suitable advertisements to website visitors within the Google advertising network. This allows reports to be generated that include statements about the age, gender and interests of site visitors. This data comes from interest-based advertising from Google as well as visitor data from third-party providers. This data cannot be attributed to any specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as shown in the item "Objection to data collection".

4.6.2.6 Storage period

Data stored by Google at user and event level that is linked to cookies, user identifiers (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) is anonymised or deleted after 2 months. For details, please see the following link: support.google.com/analytics/answer/7667196?hl=de

MyFonts Web Fonts

Our website uses fonts provided by the company MyFonts Inc., 600 Unicorn Park Drive, Woburn, MA 01801, USA When you access the website, data is also retrieved from a MyFonts server, which at least allows MyFonts to obtain knowledge of your IP address. In doing so, MyFonts also learns, among other things, that you have called up the font via our website, as well as some technical information about your browser, as almost every web browser automatically sends this data to the server each time you call up the website. Some browsers allow you to restrict or modify the data transmitted to the server, but whether this is possible depends on the browser manufacturer. Even if MyFonts only needs the transmitted information, in particular the IP address, to deliver the retrieved content, it is beyond our knowledge and influence whether and to what extent MyFonts also evaluates or stores this information statistically. Further information on data protection at MyFonts can be found under the following link: https://www.myfonts.com/info/terms-and-conditions