As a foundation under German civil law, we are subject to the provisions of the European General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

Below, we provide you with comprehensive information about the processing of personal data in connection with the “Little Foresters’ Forest” tree-planting event.

1. Controller

The controller responsible for the processing of personal data in connection with the “Little Foresters’ Forest – 100 Roots for the Future” tree-planting event is:

Carl und Marisa Hahn-Stiftung
Erich-Bammel-Weg 1
38446 Wolfsburg
Germany
Email: info@hahn-stiftung.org

2. Categories of Personal Data

In connection with participation in the tree-planting event, we process the following personal data:

• Basic data (name and age of the child, name of the legal guardian)
• Contact details (email address of the legal guardian)
• Photographs and/or video recordings of the child and/or accompanying person

If you voluntarily provide us with the following information, we will also process:

• Telephone number of the legal guardian
• The daycare centre or school attended by the child

With your consent, we will publish photographs and/or video recordings from the event on our website (www.hahn-stiftung.org), on the Foundation’s Instagram account and/or in press and print media.

3. Purposes and Legal Bases of Processing

We process basic data and contact details for the purpose of registration and organisation of the event. The legal basis for this processing is the performance of a contract pursuant to Art. 6(1), first subparagraph, point (b) GDPR.

We collect your telephone number on a voluntary basis so that we can contact you if necessary, e.g. if a registered child does not attend the event. The legal basis is your consent pursuant to Art. 6(1), first subparagraph, point (a) GDPR.

We collect information about the daycare centre or school attended by the child in order to gain an overview of the group of participants and to help us better plan and develop our work in the future. The legal basis is your consent pursuant to Art. 6(1), first subparagraph, point (a) GDPR.

The taking and publication of photographs and/or video recordings serves our public relations activities. The legal basis for taking the photographs and/or video recordings is our legitimate interest pursuant to Art. 6(1), first subparagraph, point (f) GDPR. As a foundation, we have a legitimate interest in taking photographs and/or video recordings at our events for possible use in our public relations activities.

The legal basis for publishing these photographs and/or video recordings is your consent pursuant to Art. 6(1), first subparagraph, point (a) GDPR. Consent is voluntary. Participation in the event is also possible without giving this consent. You may withdraw your consent at any time with effect for the future.

4. Recipients of Personal Data

For registration for the event, we use the online tool provided by Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA (“Jotform”). Jotform processes the data entered during registration on our behalf. For this purpose, we have entered into a data processing agreement with the provider pursuant to Art. 28 GDPR. When using Jotform, personal data may be transferred to the United States.

If we publish photographs and/or video recordings on Instagram, these will be processed by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). In this context, personal data may also be transferred to Meta servers in the United States.

The transfer of data to the United States is based on the European Commission’s adequacy decision of 10 July 2023. Pursuant to Art. 45 GDPR, the European Commission may determine by means of an adequacy decision that a country outside the European Union ensures a level of data protection equivalent to the standards of the EU. With regard to the United States, the European Commission has stipulated that companies established there must additionally be certified under the EU-U.S. Data Privacy Framework (“DPF”). By obtaining certification, the companies concerned undertake to comply with certain requirements laid down by the DPF in order to ensure an adequate level of data protection. Meta and Jotform are certified under the DPF.

5. Storage Period

We store the personal data collected from you for the duration of the project. We will subsequently delete the data unless and insofar as statutory retention obligations require us to retain it.

Photographs and video recordings will be stored and published until you withdraw your consent.

6. Withdrawal of Consent

Giving consent is voluntary. You have the right to withdraw your consent at any time. As a result, we will no longer be permitted to continue the data processing based on this consent in the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You will not suffer any disadvantages as a result of withdrawing your consent. Consent may be withdrawn informally using any of the contact details provided above.

Following withdrawal of consent, we will remove the photographs and/or video recordings from the channels under our control (e.g. our own website and our own Instagram account) and will not initiate any further distribution. Please note that content already provided to third parties (e.g. the press) or copied by third parties may not be capable of being completely removed and that data once published on the internet may remain accessible there permanently.

7. Requirement to Provide Data and Profiling

There is no statutory obligation to provide us with personal data. No automated decision-making within the meaning of Art. 22 GDPR takes place.

8. Your Rights

This section provides information about the rights you have in relation to your personal data.

Right to Object

Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. As a result, we will no longer be permitted to continue the data processing based on this consent in the future. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Pursuant to Art. 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1), point (e) or (f) GDPR, including profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing.

Right of Access

You have the right to obtain confirmation as to whether personal data concerning you are being processed and to obtain further information about such processing within the scope of Art. 15 GDPR, as well as a copy of the personal data being processed.

Right to Rectification

Pursuant to Art. 16 GDPR, you have the right to request the completion of incomplete personal data concerning you and the rectification of inaccurate personal data concerning you.

Right to Erasure and Restriction of Processing

Subject to the conditions set out in Art. 17 GDPR, you have the right to request the erasure of personal data stored about you. Subject to the conditions set out in Art. 18 GDPR, you also have the right to request restriction of processing.

Right to Data Portability

You have the right, in accordance with Art. 20 GDPR, to receive personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format, or to request that such data be transmitted to another controller.

Right to Lodge a Complaint

In accordance with Art. 77 GDPR and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data relating to you infringes the GDPR.

For our registered office in Wolfsburg, the competent supervisory authority is in particular:

The State Commissioner for Data Protection of Lower Saxony
(Der Landesbeauftragte für den Datenschutz Niedersachsen)
Postfach 221
30002 Hannover
Germany
Email: poststelle@lfd.niedersachsen.de
Telephone: +49 511 120-4500

The complaint form is available here: https://www.lfd.niedersachsen.de/beschwerde