Privacy
Introduction
With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").
The terms used are not gender-specific.
Status: 30 August 2022
Responsible
Better Birth Control e. V.
Einbecker Straße 107
10315 Berlin
Authorised representatives:
Jana Pfenning, Rita Maglio
E-mail address:
Imprint:
https://betterbirthcontrol.org/imprint
Overview of the processing operations
The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.
Types of data processed
Inventory data.
Payment data.
Contact data.
Content data.
Contract data.
Usage data.
Meta/communication data.
Categories of persons concerned
Interested parties.
Communication partners.
Users.
Purposes of the processing
Provision of contractual services and customer service.
Contact requests and communication.
Security measures.
Reach measurement.
Office and organisational procedures.
Managing and responding to enquiries.
Feedback.
Marketing.
Profiles with user-related information.
Registration procedures.
Provision of our online services and user experience.
Information technology infrastructure.
Relevant legal basis
Below you will find an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be decisive in individual cases, we will inform you of these in the data protection declaration.
Performance of a contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) DSGVO) - The processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures which are carried out at the request of the data subject.
Legitimate interests (Art. 6 (1) p. 1 lit. f) DSGVO) - Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, the processing for other purposes and the transmission and automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, data protection laws of the individual federal states may apply.
Security measures
We take appropriate technical and organisational measures in accordance with the law, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the level of threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.
The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. We also have procedures in place to ensure the exercise of data subjects' rights, the deletion of data and responses to data compromise. Furthermore, we already take the protection of personal data into account in the development or selection of hardware, software as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.
Shortening of the IP address: If IP addresses are processed by us or by the service providers and technologies used and the processing of a complete IP address is not necessary, the IP address is shortened (also referred to as "IP masking"). In this process, the last two digits or the last part of the IP address after a full stop are removed or replaced by wildcards. The shortening of the IP address is intended to prevent or make it considerably more difficult to identify a person by their IP address.
SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in the address line of your browser.
Provision of the online services and web hosting
We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.
Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).); security measures.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further information on processing processes, procedures and services:
Provision of online offer on rented storage space: For the provision of our online offer, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as "web hoster"); Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files". The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used on the one hand for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilisation of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further storage is necessary for evidentiary purposes is exempt from deletion until final clarification of the respective incident.
Content delivery network: We use a "content delivery network" (CDN). A CDN is a service with the help of which the content of an online offer, in particular large media files such as graphics or programme scripts, can be delivered more quickly and securely with the help of regionally distributed servers connected via the Internet; legal basis: legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Hetzner: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.hetzner.com; Privacy policy: https://www.hetzner.com/de/legal/privacy-policy; Order processing contract: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/.
BunnyCDN: To optimise the loading times of this website, BunnyCDN is used as a content delivery network (CDN). Static files used on the website, for example images and script files, are provided by the BunnyCDN network. All personal data is anonymised and not transmitted to third parties. BunnyCDN does not collect, store or distribute any information that could be used in any way to identify a user or contain their personal information. For more information about how BunnyCDN handles data, please visit the BunnyCDN website at https://bunny.net/gdpr/ and https://bunny.net/privacy/. BunnyCDN is used in the interest of a uniform and appealing presentation of this website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO.
Single sign-on registration
Single sign-on" or "single sign-on registration or "authentication" are procedures that allow users to register with a provider of single sign-on procedures (e.g. a social network), including our online offer, with the aid of a user account. The prerequisite for single sign-on authentication is that users are registered with the respective single sign-on provider and enter the required access data in the online form provided for this purpose, or are already registered with the single sign-on provider and confirm the single sign-on registration via a button.
Authentication takes place directly with the respective single sign-on provider. In the course of such authentication, we receive a user ID with the information that the user is logged in under this user ID at the respective single sign-on provider and an ID that cannot be used by us for other purposes (so-called "user handle"). Whether additional data is transmitted to us depends solely on the single sign-on procedure used, on the data releases selected in the context of authentication and also on which data users have released in the privacy or other settings of the user account with the single sign-on provider. Depending on the single sign-on provider and the user's choice, this can be different data, usually the e-mail address and the user name. The password entered as part of the single sign-on procedure with the single sign-on provider is neither visible to us nor is it stored by us.
Users are requested to note that their details stored with us may be automatically compared with their user account with the single sign-on provider, but that this is not always possible or actually occurs. If, for example, users' e-mail addresses change, they must change them manually in their user account with us.
We may use single sign-on login, where agreed with users, as part of or prior to the performance of the contract, where users have been asked to do so, process it as part of consent and otherwise use it based on the legitimate interests of us and the interests of users in an effective and secure login system.
Should users ever decide that they no longer wish to use the link between their user account and the single sign-on provider for the single sign-on procedure, they must remove this link within their user account with the single sign-on provider. If users wish to delete their data from us, they must cancel their registration with us.
Types of data processed: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: provision of contractual services and customer service; security measures; registration procedures.
Legal grounds: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further information on processing operations, procedures and services:
Google Single-Sign-On: authentication service; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.google.de; Privacy policy: https://policies.google.com/privacy; Opt-out: Settings for the display of advertisements: https://adssettings.google.com/authenticated.
Blogs and publication media
We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data are processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this data protection notice.
Types of data processed: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: provision of contractual services and customer service; feedback (e.g. collecting feedback via online form); provision of our online offer and user friendliness.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Contact and enquiry management
When contacting us (e.g. via contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed insofar as this is necessary to answer the contact enquiries and any requested measures.
The answering of contact requests as well as the administration of contact and request data in the context of contractual or pre-contractual relationships is carried out to fulfil our contractual obligations or to answer (pre-)contractual requests and otherwise on the basis of the legitimate interests in answering the requests and maintaining user or business relationships.
Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
Data subjects: Communication partners.
Purposes of processing: contact requests and communication; managing and responding to requests; feedback (e.g. collecting feedback via online form); providing our online offer and user experience; providing contractual services and customer service.
Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further guidance on processing operations, procedures and services:
Contact form: If users contact us via our contact form, e-mail or other communication channels, we process the data communicated to us in this context to process the communicated request. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfilment and otherwise on the basis of our legitimate interests as well as the interests of the communication partners in responding to the concerns and our statutory retention obligations; Legal bases: Contractual fulfilment and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Web analysis, monitoring and optimisation
Web analysis (also referred to as "reach measurement") is used to evaluate the flow of visitors to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of the reach analysis, we can, for example, recognise at what time our online offer or its functions or content are most frequently used or invite re-use. Likewise, we can understand which areas need optimisation.
In addition to web analysis, we may also use test procedures, e.g. to test and optimise different versions of our online offer or its components.
Unless otherwise stated below, profiles, i.e. data summarised for a usage process, may be created for these purposes and information may be stored in a browser or in a terminal device and read from it. The information collected includes, in particular, websites visited and elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data from us or from the providers of the services we use, location data may also be processed.
The IP addresses of the users are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear user data (e.g. e-mail addresses or names) is stored in the context of web analysis, A/B testing and optimisation, but pseudonyms. This means that we as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective procedures.
Types of data processed: Usage data (e.g. web pages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles).
Security measures: IP masking (pseudonymisation of the IP address).
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further information on processing, procedures and services:
Matomo (without cookies): Matomo is a data protection-friendly web analysis software that is used without cookies and in which the recognition of returning users is carried out with the help of a so-called "digital fingerprint", which is stored anonymously and changed every 24 hours; with the "digital fingerprint", user movements within our online offer are recorded with the help of pseudonymised IP addresses in combination with user-side browser settings in such a way that conclusions about the identity of individual users are not possible. The user data collected as part of the use of Matomo is only processed by us and is not shared with third parties; legal basis: legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); website: https://matomo.org/.
Presence in social networks (social media)
We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.
We would like to point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, it could make it more difficult to enforce the rights of the users.
Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, usage profiles can be created based on the usage behaviour and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behaviour and the interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the usage profiles (especially if the users are members of the respective platforms and are logged in to them).
For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.
In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.
Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: contact requests and communication; feedback (e.g. collecting feedback via online form); marketing.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further information on processing operations, procedures and services:
Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
TikTok: Social network / video platform; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) DSGVO); Website: https://www.tiktok.com; Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE.
Twitter: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent company: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
Management, organisation and auxiliary tools
We use services, platforms and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organising, managing, planning and providing our services. When selecting the third-party providers and their services, we observe the legal requirements.
In this context, personal data may be processed and stored on the servers of the third-party providers. This may involve various data which we process in accordance with this data protection declaration. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents.
If users are referred to the third-party providers or their software or platforms in the course of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimisation or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.
Types of data processed: Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Payment data (e.g. bank details, invoices, payment history); Contractual data (e.g. subject matter of contract, term, customer category).
Data subjects: Communication partners; users (e.g. website visitors, users of online services); interested parties.
Purposes of processing: provision of contractual services and customer service; office and organisational procedures; marketing; provision of our online offer and user-friendliness.
Legal grounds: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).
Further information on processing, procedures and services:
betterplace: On this website, we have integrated iFrames (e.g. integrated donation form, project widget, overlay donation button) of gut.org gAG, Schlesische Straße 26, 10977 Berlin (operator of the online donation platform betterplace.org, hereinafter referred to as "betterplace.org"). In these iFrames, betterplace.org uses third-party services. Details of the data processing that takes place in connection with the services can be found in the privacy policy of betterplace.org. The legal basis for the integration of the iFrames is Art. 6 para. 1 lit. f DSGVO. Our legitimate interest lies in optimising the user-friendliness of the website and enabling a user-friendly link between our website and the online donation platform of betterplace.org.
Amendment and updating of the data protection declaration
We ask you to regularly inform yourself about the content of our data protection declaration. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.
If we provide addresses and contact information of companies and organisations in this data protection declaration, please note that the addresses may change over time and please check the information before contacting us.
Rights of the data subjects
As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:
Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
Right to withdraw consent: You have the right to revoke any consent given at any time.
Right to information: You have the right to request confirmation as to whether data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with the legal requirements.
Right to rectification: You have the right, in accordance with the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.
Right to erasure and restriction of processing: You have the right, in accordance with the law, to request that data concerning you be erased without delay or, alternatively, to request restriction of the processing of the data in accordance with the law.
Right to data portability: You have the right to receive data concerning you, which you have provided to us, in a structured, common and machine-readable format in accordance with the legal requirements, or to demand that it be transferred to another person responsible.
Complaint to the supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the requirements of the GDPR.
Definitions of terms
This section provides you with an overview of the terms used in this privacy statement. Many of the terms are taken from the law and defined primarily in Art. 4 of the GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to help you understand them. The terms are sorted alphabetically.
Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Profiles with user-related information: The processing of "profiles with user-related information", or "profiles" for short, includes any type of automated processing of personal data that consists of using such personal data to analyse, evaluate or to predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are often used for profiling purposes.
Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offering and can include visitors' behaviour or interests in certain information, such as website content. With the help of reach analysis, website owners can see, for example, at what time visitors visit their website and what content they are interested in. This enables them, for example, to better adapt the content of the website to the needs of their visitors. For reach analysis purposes, pseudonymous cookies and web beacons are often used to recognise returning visitors and thus obtain more precise analyses of the use of an online offer.
Controller: "Controller" is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
Processing: "Processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and encompasses virtually any handling of data, be it collection, analysis, storage, transmission or erasure.
