The Joachim Herz Stiftung (hereinafter referred to as "JHS") welcomes you to these websites. Personal data is only collected on these websites to the extent technically necessary. In the following, we provide information about the collection of personal data when you use our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. We have taken extensive technical and operational precautions to protect your data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.

This privacy policy applies to the JHS website at www.joachim-herz-stiftung.de. The other JHS websites have a separate privacy policy.

1. controller for data processing
The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is

Joachim Herz Stiftung
Langenhorner Chaussee 384
22419 Hamburg
T. +49 40 533295-0
info(at)joachim-herz-stiftung(dot)de

2. contact details of the data protection officer
You can reach our data protection officer at datenschutz(at)joachim-herz-stiftung(dot)de or at our postal address with the addition "the data protection officer".

3. your rights
You have the following rights vis-à-vis us with regard to your personal data:

3.1 General rights
You have a right to information, rectification, erasure, restriction of processing, objection to processing and to data portability. If processing is based on your consent, you have the right to withdraw this consent from us with effect for the future.

3.2 Rights in data processing based on legitimate interest
In accordance with Art. 21 para. 1 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 letter e GDPR (data processing in the public interest) or on Art. 6 para. 1 letter f GDPR (data processing to protect a legitimate interest); this also applies to profiling based on this provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

3.3 Rights in the event of direct advertising
If we process your personal data for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising in accordance with Art. 21 para. 2 GDPR; this also applies to profiling insofar as it is associated with such direct advertising.

If you object to processing for the purposes of direct marketing, we will no longer process your personal data for these purposes.

3.4 Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with a competent data protection supervisory authority about our processing of your personal data.

4. collection of personal data when you visit our website
When you use the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security. The legal basis for this is Art. 6 para. 1 letter f GDPR:
IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request comes, browser, operating system, and its interface, language and version of the browser software.

5. contact by e-mail or contact form
When you contact us by e-mail or via a contact form, e.g. in the context of funding inquiries, the data you provide (your e-mail address, possibly your name and telephone number) will be stored by us in order to answer your questions. If we request information via our contact form that is not required for contacting you, we have always marked this as optional. We use this information to specify your request and to improve the processing of your request. This information is provided expressly on a voluntary basis and with your consent, Art. 6 (1) (a) GDPR. If this involves information on communication channels (e.g. email address, telephone number), you also consent to us contacting you via this communication channel in order to respond to your request. You can of course revoke this consent at any time for the future. To do so, please contact: datenschutz(at)joachim-herz-stiftung(dot)de.

We delete the data arising in this context after storage is no longer necessary, or restrict processing if there are statutory retention obligations.

6. PlayEconomy
Users of the PlayEconomy project who are interested in the simulation game can register online as course/game leaders and thus gain access to a password-protected area with various information, license applications and teaching materials (e.g. software, presentation, task sheets, manuals, etc.) for download. If you (course/play leader) decide to register with the PlayEconomy project, your personal data (first name, surname, postal address, name of institution/school), with which you register for the protected area of PlayEconomy via the corresponding form, will be stored on our servers in order to check the necessary requirements for registration, to be able to offer you the protected area with your individually available materials and to ensure communication between you and JHS. For the purpose of communication, the personal data will also be made available to the regional coordinators if they take over the communication for the JHS.

The personal data mentioned here can be viewed by all registered users. This is intended to enable a personal, primarily regional, exchange of experience on the use of the simulation games between registered users. The legal basis for data processing is your consent, Art. 6 para. 1 letter a GDPR.

Users can request the deletion of their registration at any time. In this case, JHS will delete all personal data immediately.

In addition, in connection with access to the PlayEconomy server via our login area, other personal data that allows the user to be identified (e.g. IP address, date, time of access, etc.) is also temporarily stored on the servers we use for data security purposes. The data mentioned here is not evaluated, except for statistical purposes and in anonymized form.

Please also note the terms of use for the protected area of PlayEconomy.

7. newsletter
With your consent in accordance with Art. 6 para. 1 letter a GDPR, you can subscribe to our newsletter, which we use to inform you about our current offers. We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an email to the email address you have provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month.

In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

The only mandatory information for sending the newsletter is your e-mail address. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1 letter a GDPR. We will store your email address until you unsubscribe from the newsletter.

You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail by e-mail to Kommunikation(at)joachim-herz-stiftung(dot)de or by sending a message to the contact details given in the imprint.

8. registration
You have the option of registering with us and creating an account. To register, we collect and store the following data from you:

• Salutation
• First name
• Surname
• e-mail address
• password

Once you have registered, you will receive personal, password-protected access and will be able to view and manage the data you have stored. Registration is voluntary, but may be a prerequisite for using our services. If you use our portal, we will store your data until you permanently delete your access. The legal basis is Art. 6 para. 1 letter a GDPR.

9. events
We offer you the opportunity to register for events at various points on our website using appropriate forms. In addition, we may process your personal data, for example in the form of lists of participants in face-to-face events. As a rule, your name and contact details as well as any other specific personal data required for the administration of the respective event are collected for this purpose (see the corresponding registration forms). The legal basis for the associated processing of your personal data is Art. 6 para. 1 b GDPR and Art. 6 para. 1 a GDPR if you provide us with further information in addition to the data marked as mandatory. We delete the data collected in this context after storage is no longer necessary, restrict processing if there are statutory retention obligations or delete it if you withdraw your consent.

We also use the LimeSurvey service (LimeSurvey GmbH Papenreye 63, 22453 Hamburg) for surveys and registrations for our events. We have concluded an order processing contract with our service provider within the meaning of Art. 28 GDPR in order to guarantee the security and legality of the processing. In this context, we only process the data from you that is required for the registration or the survey. The legal basis is your express consent in accordance with Art. 6 para. 1 lit. a) GDPR, which you can revoke at any time with effect for the future. Your data will be deleted after the purpose has been fulfilled.

10. applications for vacancies
You can apply to us electronically, in particular by e-mail. We will of course only use your details to process your application and will not pass them on to third parties. Please note that unencrypted e-mails are not transmitted with access protection.

If you have applied for a specific position and it has already been filled or we consider you to be equally or even more suitable for another position, we would be happy to forward your application within the company. Please let us know if you do not agree to your application being forwarded.

Your personal data will be deleted immediately after completion of the application process, or after a maximum of 6 months, unless you have expressly given us your consent to store your data for longer or a contract has been concluded. The legal basis is Article 6(1)(a), (b) and (f) GDPR and Section 26 BDSG.

11. application for funding programs of JHS
Personal data of applicants will be processed exclusively for the purpose of carrying out the application process for the respective funding program. The legal basis for the processing of the applicants' personal data required for this purpose is Art. 6 para. 1 sentence 1 a and b GDPR. The personal data will be passed on to jury members and, if applicable, to cooperation partners of our foundation. The personal data will be stored for as long as is necessary for the respective application process.

12. fellows on uMap
As part of our fellow collaboration, we work with the uMap software (from the provider Fossgis e.V., Bundesallee 23, 10717 Berlin). With the help of this application, current and former Fellows should be able to obtain a worldwide overview of where other Fellows are or have been. The uMap application is designed to be extremely data-friendly using the open source solution from OpenStreetMap (https://openstreetmap.org). Only the server log files (browser type, browser version, operating system used, referrer URL, host name and time of the server request) and the IP address are processed. Fellows are free to decide whether to participate in this offer and place their pins on the map independently.

The legal basis for the processing is the legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. The purposes of the processing lie in the Fellows' networking opportunities. The data will be deleted as soon as it is no longer required to achieve the purpose.

13. reCAPTCHA
We use reCaptcha on our websites. reCaptcha is an offer from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and serves to prevent abusive automated entries in web forms and thus to protect the technical systems of my host. When you visit one of our websites in which reCaptcha is integrated, a connection to Google's servers is established. In any case, your IP address is transmitted, but this is anonymized in EU/EEA countries after retrieval.

In addition, reCaptcha collects the following data

• a recording of the user's browser window at the time of interaction with reCaptcha
• browser plugins used
• the cookies set by Google in the last 6 months
• the number of mouse clicks and touches you have made on this screen
• CSS information for the page accessed
• Javascript objects
• the date
• the browser language

A reCaptcha cookie is set. The legal basis is the legitimate interest, Art. 6 para. 1 f GDPR. You can prevent Google from using your data for advertising purposes here: https://adssettings.google.com/anonymous. You can find Google's privacy policy here: www.google.com/policies/privacy/.

14. use of cookies
When you use our website, cookies are stored on your computer. Cookies are small text files that are stored on your hard disk and assigned to the browser you are using and through which certain information flows to the place that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall. We also use cookies to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for each visit.

This website uses the following types of cookies, the scope and function of which are explained below:

14.1 Transient cookies
These cookies are automatically deleted when you close your browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

14.2 Persistent cookies
These cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies at any time in the security settings of your browser.

14.3 Preventing cookies
You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that you may then not be able to use all the functions of this website.

14.4 Legal bases and storage duration
The legal bases for possible processing of personal data and their storage duration vary and are presented in the following sections.

15. website analysis
We use various services for the purpose of analyzing and optimizing our websites, which are described below. For example, we can analyze how many users visit our site, which information is most in demand or how users find the offer. Among other things, we collect data about the website from which a data subject came to a website (so-called referrer), which subpages of the website were accessed or how often and for how long a subpage was viewed. This helps us to design and improve our services in a user-friendly way. The data collected is not used to personally identify individual users. Anonymous or at most pseudonymous data is collected. The legal basis for this is Art. 6 para. 1 letter f GDPR.

16. competitions
If you take part in competitions, we collect data that is necessary to carry out the competition. This is usually an individual competition entry (e.g. a comment or the answer to a question), as well as your name and contact details. We may pass on your data to our competition partners, e.g. to send you the prize. Data processing and data transfer may vary depending on the competition and is therefore specifically described in the respective conditions of participation. Participation in the competition and the associated data collection is, of course, voluntary. The legal basis for data processing is Art. 6 para. 1 lit. b) GDPR. Your data will be deleted after the end of the competition or after fulfillment of legal retention periods.

17. data transfer
Your data will not be transferred to third parties unless we are legally obliged to do so, or the transfer of data is necessary for the execution of the contractual relationship or you have previously expressly consented to the transfer of your data.
Insofar as external service providers may come into contact with your personal data, we ensure that they comply with the provisions of the data protection laws in the same way as part of order processing in accordance with Art. 28 GDPR. Please also note the respective data protection notices of the providers. The respective service provider is responsible for the content of external services, whereby we check the services for compliance with the legal requirements within the scope of reasonableness.

18. Matomo (formerly Piwik)
This website uses the web analysis service Matomo (formerly Piwik) to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. The legal basis for the use of Matomo is Article 6(1)(f) GDPR.

Cookies are stored on your computer for this analysis. You can stop the analysis by deleting existing cookies and preventing the storage of cookies. If you prevent the storage of cookies, we would like to point out that you may not be able to use this website to its full extent. You can prevent the storage of cookies by changing the settings in your browser. You can prevent the use of Matomo by unchecking the following box to activate the opt-out plug-in:

This website uses Matomo with the "Privacy Manager" extension. This makes IP addresses unrecognizable, so that they cannot be directly linked to individuals. The IP address transmitted by your browser using Matomo is not merged with other data collected by us.

The Matomo program is an open source project. Information from the third-party provider on data protection can be found at matomo.org/privacy/.

19. data security
We have taken extensive technical and operational precautions to protect your data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.

Status December 2023