Privacy

This Privacy Policy applies to the processing of personal data in connection with offerings by Heidelberg Vis Arbitration Moot Alumni e.V. to the general public. This includes data processing

• when visiting the website heidelberg-vis-alumni.de and
• when contacting us by email at addresses with the suffix “@heidelberg-vis-alumni.de”.

I. Data Controller and Data Protection Officer

The data controller, i.e. the person responsible for processing your personal data under data protection law within the meaning of the GDPR and other national data protection laws, is the

represented by the Executive Board: Niels Elsner, Stella Elmentaler, Dominik Stefer.

The Association is not currently required to appoint a data protection officer, as the number of persons entrusted with data processing does not exceed 20 and no other grounds for a mandatory appointment apply.

II. Website

1. What data is processed and for what purpose?

Each time the content of the website (heidelberg-vis-alumni.de) is accessed, data that may permit identification is temporarily stored. The following data is collected in this process:

• date and time of access,
• IP address,
• country from which the access is made,
• page visited on our website,
• message of whether the retrieval was successful,
• information about the browser type and version used,
• operating system,
• device type.

The temporary storage of this data is necessary for the duration of a website visit in order for the website to be displayed. Data is also stored in log files to ensure the functionality of the website and the security of our IT systems. These purposes also constitute our legitimate interest in processing the data.

2. On what legal basis is this data processed?

The legal basis for processing this data is Art. 6(1)(f) GDPR.

3. Are there any recipients of the personal data other than the data controller?

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). All data collected in connection with the website is stored by Cloudflare. The data is stored on various servers located in various data centers. A list of these data centers is available on Cloudflare’s website ↗. It cannot be ruled out that personal data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework. Therefore, an adequacy decision pursuant to Art. 45 GDPR exists, so that the transfer can take place without the need for further transfer instruments or additional measures. Further information about the EU-US Data Privacy Framework can be found here ↗. In addition, we have entered into a data processing agreement with Cloudflare. This ensures that personal data is only processed in accordance with our instructions and in compliance with the GDPR. You can obtain further information from Cloudflare regarding data protection from their website here ↗ and here ↗.

4. How long is the data stored?

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of the website, this occurs when the respective session ends. The log files are stored in a manner accessible only to administrators. After 30 days, they are permanently deleted.

5. Cookies

We do not use cookies on our website.

6. Web Analytics

We do not use Cloudflare Web Analytics or any other web analytics software.

III. Email

1. What data is processed and for what purpose?

When you contact the Association by email (“…@heidelberg-vis-alumni.de”), only the personal data you yourself provide in the email is collected.

2. On what legal basis is this data processed?

The legal basis for processing this data is Art. 6(1)(b) GDPR, provided that the email contact is related to the performance of a contract or is necessary for pre-contractual measures. If you have given us your consent—which you may withdraw at any time—the legal basis for processing this data is Art. 6(1)(a) GDPR. In all other cases, the legal basis for processing this data is Art. 6(1)(f) GDPR because we have a legitimate interest in the effective processing of inquiries addressed to us.

3. Are there any recipients of the personal data other than the data controller?

The Association uses Google Workspace for email correspondence, which means that all data collected in this context is stored by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data is stored on various servers located in various data centers. A list of these data centers is available on Google’s website ↗. It cannot be ruled out that personal data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework. Therefore, an adequacy decision pursuant to Art. 45 GDPR exists, so that the transfer can take place without the need for further transfer instruments or additional measures. Further information about the EU-US Data Privacy Framework can be found here ↗. In addition, we have entered into a data processing agreement with Google. This ensures that personal data is only processed in accordance with our instructions and in compliance with the GDPR. You can obtain further information from Google regarding data protection from their website here ↗ and here ↗.

4. How long is the data stored?

The data will be deleted as soon as you request us to delete it, object to its processing, withdraw your consent, or the purpose of processing the data has been fulfilled (e.g., when your request has been conclusively processed). The request for deletion, objection to processing, or revocation of consent is made by email to nvXElQKMXn0Am3yDdC2cRQemwBkrH1PHghSl4FiBzJZExI1jyAQAn5EzSK4AazHu-PfT47hsy6dL.

IV. Rights of the Data Subject

• Pursuant to Art. 15 GDPR, you may request access to your personal data that we process.
• If inaccurate or incomplete personal data is processed, you have the right to rectification or completion pursuant to Art. 16 GDPR.
• Pursuant to Art. 17 GDPR you have the right to erasure of your personal data.
• Pursuant to Art. 18 GDPR you have the right to restriction of processing of your personal data.
• Pursuant to Art. 20 GDPR you have the right to data portability. Under this right, you may request that data we process by automated means on the basis of your consent or in the performance of a contract be transferred to you or to a third party. This does not apply to the processing of data for the provision of the website and the storage of log files, as these are strictly necessary for the operation of the website. Their processing is therefore based neither on consent under Art. 6(1)(a) GDPR nor is it required for the performance of a contract or pre-contractual measures under Art. 6(1)(b) GDPR. Accordingly, the requirements of Art. 20(1) GDPR are not fulfilled in this regard. The processing of your personal data in connection with email contact also does not fulfill the requirements of Art. 20(1) GDPR, as the processing is not carried out by automated means.
• Pursuant to Art. 21 GDPR, you may object to the processing of your personal data. In particular, you may, at any time, object, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. The data controller will then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. The processing of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website.
• You have the right to withdraw any consent you may have given at any time. The withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.
• Should you wish to exercise any of the rights set out above, please contact us by email at 4IwJGGCcbp0L4H0BjHK-5Obw8fIwb4RGom1WNCvvEasl_p7twA4TpDDfzKdYX-v830UBtsP36smq.
• If you believe that the processing of your personal data violates data protection law, you have the right under Art. 77(1) GDPR to lodge a complaint with a supervisory authority of your choice. This includes the supervisory authority with jurisdiction over the controller: