Privacy Policy

Note: draft. This text is a working draft and is not yet legally binding. It must be reviewed and signed off by a qualified lawyer before publication. Everything in square brackets […] still has to be completed or confirmed by dokun e.V.

Protecting your personal data matters to us. Below we explain which data we process when you visit this website, write to us, sign up as a volunteer or make a donation — for what purpose we do so, and what rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

dokun e.V.
[Street and number]
[Postcode] Cologne
Germany
E-mail: [e-mail address]
Phone: [phone number]

The association is represented by its board: [First name Last name], [First name Last name]. The remaining mandatory details are set out in our imprint.

2. Data protection officer

[Please complete: has a data protection officer been appointed? Under section 38 of the German Federal Data Protection Act (BDSG) this is required where at least 20 people are permanently engaged in the automated processing of personal data. If so, enter their name and contact details here; if not, delete this section.]

3. Visiting the website and server log files

Every time this website is called up, the web server automatically stores data in what are known as log files: the IP address of the requesting device, the date and time of access, the address requested, the previously visited page (referrer), the browser and browser version, the operating system, the HTTP status code and the volume of data transferred.

Purpose: delivering the website, keeping the system stable and secure, and investigating misuse.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in operating this website securely and free of technical faults.
Retention period: [retention period for server log files at the hosting provider, usually 7 to 14 days].

This website is hosted by [name and address of the hosting provider]. The provider processes the data named above on our behalf, on the basis of a data processing agreement under Art. 28 GDPR. [Please confirm that this agreement has been concluded.]

4. Contact form

When you write to us through the contact form, we process your name, your e-mail address and your message. These details are not stored in this website’s database; they are only forwarded by e-mail to our contact address.

Purpose: handling and answering your enquiry.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). Where your enquiry is aimed at entering into or performing a contract, or at membership, Art. 6 (1) (b) GDPR applies in addition.
Retention period: until your request has been dealt with conclusively, and at most [retention period for e-mail correspondence, e.g. 12 months]. Statutory retention duties remain unaffected.

Through the volunteer form we process your name and e-mail address as mandatory details and — where you provide them — your phone number, your town or city, your areas of interest and your message. These details are stored in this website’s database and are also sent by e-mail to our team.

You may optionally create a user account in order to view your applications. In that case we process your name, your e-mail address and your password. WordPress stores the password only as a cryptographic hash; we never see it in plain text.

Purpose: reviewing your sign-up, matching you to a suitable role, contacting you and supporting your involvement.
Legal basis: Art. 6 (1) (b) GDPR (taking steps at your request prior to entering into an arrangement, and supporting the volunteering relationship); Art. 6 (1) (b) GDPR also applies to the user account.
Retention period: [retention period for volunteer applications, e.g. 24 months after the last contact]. A user account exists until you ask us to delete it.

To protect against automated bulk submissions, we limit the number of form submissions per IP address. Your IP address is not stored in plain text for this purpose, only as a hash value and only for the duration of the relevant one-hour window. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing misuse).

6. Donations and payment processing via Stripe

We use the payment service provider Stripe to process donations (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).

You do not enter your payment details on this website. When you submit the donation form, you are redirected to a payment page operated and hosted by Stripe (Stripe Checkout). You enter your card number, expiry date, security code and comparable payment details exclusively there. That data never reaches our server at any point; we neither store it nor see it.

In our own database we store the following for each donation: name (optional) and e-mail address, amount, currency, frequency (one-time or monthly), the chosen donation purpose, the language of the form, the timestamp, and the identifiers issued by Stripe (the checkout session as well as the customer, payment, subscription and invoice IDs). An automatic notification from Stripe (a webhook) tells us whether a payment succeeded; no payment details are transmitted in the process.

Stripe processes payment data partly on our behalf and partly as a controller in its own right — for example for fraud prevention and to meet its own regulatory and anti-money-laundering obligations. This may involve transfers to affiliated companies in third countries, in particular to Stripe, Inc. in the USA; Stripe bases these transfers on the European Commission’s standard contractual clauses. Details can be found in Stripe’s own privacy policy at https://stripe.com/privacy. [Please check and confirm the contractual relationship and the data processing agreement with Stripe.]

Purpose: carrying out and recording your donation, sending a donation confirmation by e-mail, managing recurring donations, and bookkeeping.
Legal basis: Art. 6 (1) (b) GDPR (carrying out the donation as a contractual relationship), Art. 6 (1) (c) GDPR (compliance with statutory retention and record-keeping duties under tax and commercial law) and Art. 6 (1) (f) GDPR (fraud prevention).

[If donation receipts (Zuwendungsbestätigungen) are issued: it must be added here that the donor’s postal address is collected for that purpose as well.]

7. Comments on posts

You can leave a comment underneath the posts on this website. Alongside the comment text, the name you give, your e-mail address, an optionally supplied website, your IP address and your browser identifier (user agent) are stored. This is WordPress’s standard behaviour and serves to attribute the comment and to guard against spam and misuse. The legal basis is Art. 6 (1) (f) GDPR; if you tick the box for storing your details in your browser, Art. 6 (1) (a) GDPR (consent) applies in addition. Comments remain stored until you or we delete them.

[Is the comment function actually in use? If not, it should be switched off in WordPress and this section deleted.]

8. Cookies and local storage

This website sets only a small number of strictly necessary cookies. No web analytics take place: there are no tracking or statistics services, no advertising networks, no social media plugins, and no external web fonts or content delivery networks. Fonts, stylesheets and scripts are served exclusively from our own server. We therefore have no need for a consent prompt (cookie banner).

In detail, the following are set:

pll_language stores the language you have chosen (German, English or Turkish) so that your next visit starts in that language again. Lifetime: one year. Set by the Polylang language plugin.
WordPress login cookies (wordpress_logged_in_…, wordpress_sec_…, wp-settings-…) are set only for logged-in users and keep the session alive. Lifetime: until you log out, or up to two weeks if you choose to stay signed in.
Comment cookies (comment_author_…) are set only if you tick the corresponding box when commenting.

The legal basis for the strictly necessary cookies is section 25 (2) no. 2 TDDDG (formerly TTDSG) in conjunction with Art. 6 (1) (f) GDPR; for the comment cookies it is section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

Neither the theme nor the donation plugin uses your browser’s local storage. WordPress itself writes a single entry (wpEmojiSettingsSupports) to session storage on page load, in order to test whether your browser can render emoji; that entry is technically necessary, contains no personal data, and is discarded when you close the browser tab at the latest. On Stripe’s payment page, Stripe sets its own cookies; Stripe’s privacy policy applies to those.

9. Recipients of the data

[Hosting provider] as a processor, for operating the website and its database.
Stripe, for processing donations — see section 6.
[E-mail or SMTP service provider, where dispatch does not run through the hosting provider] for sending confirmation and notification e-mails.
[Tax adviser or bookkeeping firm, where engaged] and the tax office, within the scope of statutory record-keeping duties.
Our bank, within the scope of payment processing.

We do not pass on or sell your data for advertising purposes.

10. Retention periods

We store personal data only for as long as it is needed for the relevant purpose or as long as statutory retention periods require:

Server log files: [period, see section 3].
Contact enquiries: until conclusively dealt with, then [period].
Volunteer applications and user accounts: [period], or until the account is deleted.
Donation and accounting records: ten years. This period follows from section 147 (1) and (3) of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB); it begins at the end of the calendar year in which the donation was received. Copies of any donation receipts issued must be retained under section 50 (4) EStDV, in addition to the record-keeping duties regarding the use of funds under section 63 (3) AO. [Please have the citations and periods confirmed as part of the legal review.]

If you ask us to delete your donor data, we anonymise the name and e-mail address in the record concerned. The bare transaction record (amount, date, status) is retained, because Art. 17 (3) (b) and (e) GDPR in conjunction with the retention duties named above require us to keep it.

11. Your rights as a data subject

You have the following rights vis-à-vis dokun e.V.:

Access to whether and which data we process about you (Art. 15 GDPR).
Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR).
Erasure of your data, to the extent no retention duty stands in the way (Art. 17 GDPR).
Restriction of processing (Art. 18 GDPR).
Notification of any rectification, erasure or restriction to all recipients of your data (Art. 19 GDPR).
Data portability, meaning release of the data you provided in a common, machine-readable format (Art. 20 GDPR).
Objection to processing based on Art. 6 (1) (f) GDPR, on grounds relating to your particular situation (Art. 21 GDPR).

You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR). An informal message to the contact details in section 1 is enough to exercise your rights.

12. Right to lodge a complaint with a supervisory authority

Independently of the above, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority. For dokun e.V., based in Cologne, the competent authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
https://www.ldi.nrw.de

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Changes to this privacy policy

We update this privacy policy whenever our processing activities or the legal requirements change. The version published on this page is the one that applies.

Last updated: [date of last update].

Image credits: “Habitat For Humanity Build 2011037” by National Leasing, licensed under CC BY 3.0, via Wikimedia Commons (https://commons.wikimedia.org/w/index.php?curid=15729740).