Privacy – Venture Club Münster

1. Data Protection at a Glance

This privacy statement informs you about which personal data Venture Club Münster e.V. processes when you visit and use this website, for what purposes and on what legal basis we do so, to whom we disclose data, how long we retain it, and what rights you have.

You can use our website without providing any personal information. For technical reasons we still process some data, such as your IP address (Section 4). We only process additional data when you voluntarily provide it—e.g., via a form, when you give consent, or when a page loads the registration form or a script from Luma (Section 14).

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications Digital Services Data Protection Act (TDDDG).

All connections to our website are encrypted (HTTPS). Nevertheless, data transmissions on the internet can have security vulnerabilities; perfect protection does not exist. You can also write to us by mail (address in Section 3).

2. Definitions

This privacy statement uses the terms defined in the GDPR (Article 4 GDPR). We explain the most important ones here:

Personal Data

Personal data are all information relating to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more special characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Data Subject

A data subject is any identified or identifiable natural person whose personal data are processed by the data controller.

Processing

Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, matching or linking, restriction, erasure, or destruction.

Restriction of Processing

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

Profiling

Profiling is any form of automated processing of personal data that involves using that data to evaluate certain personal aspects relating to an individual, in particular to analyze or predict aspects such as work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that individual.

Pseudonymization

Pseudonymization is the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure the personal data cannot be linked to an identified or identifiable natural person.

Data Controller

The controller is the natural or legal person, authority, institution or other entity that alone or together with others determines the purposes and means of processing personal data.

Processor

A processor is a natural or legal person, authority, institution or other entity that processes personal data on behalf of the controller.

Recipient

Recipient is a natural or legal person, authority, institution or other entity to whom personal data is disclosed, regardless of whether it is a third party or not. Authorities that may receive personal data in the context of a specific investigative request under Union law or the law of the Member States, however, are not considered recipients.

Third party

A third party is a natural or legal person, authority, institution or other entity other than the data subject, the controller, the processor and the persons who, under the direct responsibility of the controller or processor, are authorized to process the personal data.

Consent

Consent is any voluntary, specific, informed and unambiguous indication of the data subject’s wishes, expressed by a statement or by any other clear affirmative action, by which the data subject signifies that they agree to the processing of their personal data.

3. Name and address of the controller

The controller within the meaning of the GDPR is:

Venture Club Münster e.V.
Universitätsstr. 14–16
48143 Münster
Germany
Email: info@ventureclub-muenster.de
Website: ventureclub-muenster.de

Represented by:
Dominik Mossakowski, Charlotte Kühnle, Yannick Brusa, Luca di Stefano Perusquia, Eva-Maria Reiners, Philipp Merz

For any questions about data protection and exercising your rights, you can reach us at info@ventureclub-muenster.de or by mail at the above address.

4. Hosting and server logs

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The processing is subject to Vercel’s privacy policy (vercel.com/legal/privacy-policy). The server functions of the website run in Vercel’s Frankfurt am Main region. Pages, images and other files are delivered by Vercel through its global network of data centers, usually from a data center near you. Vercel resizes images for display and stores the resized versions in a cache.

Each time our website is accessed, Vercel processes technically necessary data: your IP address and the approximate location derived from it, the date and time of the request, the accessed URL with parameters, the request type, the response status code, as well as information about the browser and operating system (User-Agent). Some of this data is stored in runtime logs that Vercel deletes after one hour under our plan. Our application also writes its error messages to these logs; in rare cases they contain information you entered into a form.

We need this data to deliver the website, ensure its secure and stable operation, defend against attacks, and fix errors. We do not draw conclusions about individual persons from it.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and error‑free provision of the website. For transfers to the USA, see Section 19.

5. Database and media storage

We store the website content (pages, news, events, jobs), submissions from forms, sign‑ups for “New jobs by e‑mail” and the administration data (section 16) in a PostgreSQL database on Microsoft Azure (Azure Database for PostgreSQL). Images, videos and other files that we upload through the administration are kept in our non‑public media storage on Microsoft Azure (Azure Blob Storage). Both are located in the Azure region “Denmark East” in Denmark. Our server functions in Frankfurt am Main (section 4) access them via encrypted connections.

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes the data as our data processor (Art. 28 GDPR) under the Microsoft Products and Services Data Protection Addendum. The services are part of Microsoft’s EU Data Boundary: Microsoft stores the data in Denmark and processes it in EU and European Free Trade Association (EFTA) states. In limited exceptional cases Microsoft also transfers data to other countries, mainly the United States, for example for remote access by support and security teams or for directory data of the login (sections 16 and 19). Microsoft automatically creates backup copies of the database and deletes them after at most 35 days. Deleted files remain in the media storage for another 7 days for possible restoration.

You always retrieve images and files through our own domain; your browser does not connect to Microsoft for that. When someone from the editorial team uploads a file, the browser sends it directly to the media storage on Microsoft (section 16).

The legal basis is Art. 6(1)(f) GDPR (reliable operation of the website) or the legal basis for the specific processing, which we describe in the following sections.

6. Cookies and Browser Storage

Cookies are small text files that your browser stores for a website. The local storage (Local Storage) and session storage (Session Storage) of your browser work in a similar way. Our website stores only a few pieces of information there.

For all visitors:

vcm_consent stores your choices in the consent banner (settings version, statistics yes or no, external media yes or no). We only set it after you make a selection. Storage period: 183 days, after which we ask again. Legal basis: § 25(2)(2) TDDDG, Art. 6(1)(f) GDPR (respecting your choice without asking you again on every visit).
vcm_banner remembers that you closed the notice banner at the top of the page. Depending on the notice setting, we either store only its text until the end of the session (session storage) or we store the text together with the time it was closed in local storage, until you delete the entry from your browser. Legal basis: § 25(2)(2) TDDDG, Art. 6(1)(f) GDPR (not showing a closed notice again).

During login, in the administration, and in the preview (section 16):

vcm_session keeps admins and editorial staff logged in after they sign in. The cookie is signed, transmitted only encrypted, and is not readable by scripts in the browser. Storage period: 12 hours; it is deleted upon logout. Legal basis: § 25(2)(2) TDDDG, Art. 6(1)(b) GDPR.
vcm_oidc_tx protects the Microsoft login process from tampering; we set it as soon as you start the login, for example via “Member login” in the footer or “Log in with Microsoft” in the administration. Storage period: 10 minutes. Legal basis: same as above. vcm_session.
onpage stores whether the editor on the page is in edit mode or view mode. Storage period: 12 hours. Legal basis: same as above. vcm_session.
__prerender_bypass shows admins and the editorial team unpublished content in preview. Retention period: until the preview ends or the browser session ends. Legal basis: as with vcm_session.
onpage_preview and __prerender_bypass we also set it when you open a preview link that someone from the editorial team sent you; this lets you see content that hasn't been published yet. Both expire with the link, usually after 24 hours. Legal basis: § 25 Abs. 2 Nr. 2 TDDDG, Art. 6 Abs. 1 lit. f DSGVO (review of content before publication).
In the admin area, the editorial system stores the selected interface language (cookie payload-lng, up to 365 days) as well as interim states such as copied content in local storage and session storage. Legal basis: as with vcm_session.

When you sign in via Microsoft, Microsoft places cookies on its own pages; the Microsoft privacy notice applies (microsoft.com/de-de/privacy/privacystatement). Embedded content from other providers (Sections 10 and 14) may use cookies or similar technologies in their own domains.

You can delete or block cookies and stored data in your browser at any time. This may cause some features of our website to stop working, especially sign‑in and saving your choices in the consent banner.

7. Consent Banner

On your first visit we ask in a banner whether you allow the categories “Statistics” (Section 8) and “External Media” (Section 10). The buttons “Accept All”, “Necessary Only”, and “Settings” are equivalent. We store your choice only in your browser (cookie vcm_consent, Section 6), not on our server. You can change or withdraw it at any time via “Cookie Settings” in the footer of any page. If we make fundamental changes to the settings, we’ll ask you again.

Without consent, the Luma sign‑up form on the “Get Involved” page and, if a notice banner links to an event at Luma, a Luma script are loaded; what is transferred is described in Section 14.

8. Statistics with Vercel Web Analytics and Speed Insights (consent required only)

If you consent to the “Statistics” category, we may use Vercel Web Analytics and Vercel Speed Insights from Vercel Inc. (address in Section 4). Without your consent we do not measure anything.

The measurement scripts load from our own domain (path /_vercel/); the measurement data is sent to Vercel. Web Analytics records for each page view the timestamp, the requested URL, the referrer page, the approximate location (country, region, city), the operating system and browser (including versions), and the device type. According to Vercel, Web Analytics does not set third‑party cookies; Vercel instead identifies individual visits by a hash of the request, which Vercel discards after 24 hours, and the measurement data is not linked to any person or IP address. Speed Insights captures load times and performance metrics (Web Vitals) along with the page URL, network speed, browser, device type, operating system, and country.

For administration we retrieve aggregated values daily (number of visits and page views as well as the most popular pages, referring sites, countries, devices, browsers, and operating systems) and store them in our database without any link to individual persons.

The legal basis is your consent (§ 25 Abs. 1 TDDDG, Art. 6 Abs. 1 lit. a DSGVO). You can withdraw it at any time via “Cookie Settings”; after that we will no longer send any measurement data.

9. Background video on the homepage

In the header area of the homepage, a silent background video plays. It is stored, like the website images, in our media library (section 5) and loads via our own domain, only after the page has fully loaded; no data is transferred to third‑party providers. If you have “Reduce motion” enabled on your system or use your browser’s data‑saving mode, we’ll show only a still image.

10. Embedded videos in posts and pages (YouTube, Vimeo)

In individual posts and pages we embed videos from YouTube or Vimeo. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; we use the enhanced privacy mode (youtube-nocookie.com). The provider of Vimeo is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA; we embed the player with the “Do Not Track” setting.

These videos load only after you click “Load video” or have consented to the “External media” category (two‑click solution). Only then does your browser transmit data such as your IP address, our website’s address, the selected video, and information about your browser and device to the provider, also in the USA, and the provider may use cookies or similar technologies like your browser’s local storage. You can find more information in Google’s privacy notice (policies.google.com/privacy) and Vimeo (vimeo.com/legal/privacy/policy).

With “Always load” you allow external media on all pages; we store that in a cookie vcm_consent. The legal basis is your consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR), which you can withdraw via “Cookie Settings”.

11. Jobwall and “New Jobs by Email”

The Jobwall is hosted on our own website; the job listings do not load content from other providers (see the notice banner with a Luma sign‑up in section 14). We maintain the listings ourselves in our editorial system. When you click “Apply now”, you leave our site; the privacy notice of the respective company then applies. If you apply via email, your message goes directly to the company’s address. If you click “Join group”, WhatsApp opens (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland); WhatsApp’s privacy notice applies there (whatsapp.com/legal/privacy-policy-eea).

New jobs by email: If you enter your email address on the Jobwall, we store it in our database (section 5) and first send you an email with a confirmation link (double opt‑in). Only after you confirm will you receive at most one email per day when new positions go live. We store only the address and the timestamps of the sign‑up, the confirmation, and the last email. If you don’t confirm, we delete the address after seven days. You can unsubscribe via the unsubscribe link in every email with new jobs; then we delete the address immediately. We protect the sign‑up from spam just like our forms (section 12). The delivery is handled by Microsoft 365 (section 12); we do not retain copies of these emails. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time via the unsubscribe link or by emailing us.

12. Contact form, FAQ form, and email

You can reach us via the contact form, the “Your question is missing?” form on the FAQ page, or by email.

With the contact form we process your first name, your email address, your message, your confirmation that you have read the privacy policy, and the submission timestamp. With the FAQ form we process the suggested question and the timestamp; we do not ask for a name there.

We store the submissions in our database (section 5) and send a notification with all details to a mailbox of the association. The delivery is handled by Microsoft 365 (Microsoft Ireland Operations Limited, address in section 5) from a mailbox of the association; a copy remains there in the “Sent Items” folder. If you provided an email address, we can reply directly to it.

To protect against spam we use three cookie‑free methods: an invisible field that only automated programs fill out; a minimum time between loading and submitting the form (based on a signed timestamp that we do not store); and a limit of ten attempts per hour per internet connection. For the limit we do not store your IP address, only a hash (HMAC) created with a secret key together with the timestamps of the attempts. We delete these entries during our daily cleanup as soon as the one‑hour window has passed.

We automatically delete submissions from the database after six months. We delete the notifications and their copies in the mailbox as soon as the request is fulfilled and no retention obligation remains.

The legal basis is Art. 6(1)(f) GDPR (responding to your request) or Art. 6(1)(b) GDPR when your request concerns a membership; for spam protection Art. 6(1)(f) GDPR. Microsoft processes the data as our processor (Art. 28 GDPR). If you email us directly, we process your information in our Microsoft‑365 mailbox to handle your request (legal bases as above) and delete the email once the request is fulfilled and no retention obligation remains.

13. Application for Membership and Waiting List

The application for membership and the entry on the waiting list are handled through Microsoft Forms in our Microsoft‑365 account (provider as in section 5). When you apply, we process the information from the form, including your desired team, to carry out the admission procedure (Art. 6(1)(b) GDPR). If you become a member, we transfer the information to our member management system. If no membership results, we delete your application after the admission procedure is completed. When you add yourself to the waiting list, we use your information only to notify you when the next application phase starts (Art. 6(1)(b) GDPR); after that we delete the entry.

14. Registration for the Info Evening and Events

For registration to the info evening we embed a registration form from Luma on the “Get Involved” page. The provider is Luma Labs, Inc., 548 Market St PMB 36143, San Francisco, CA 94104, USA. The form loads without prior consent as soon as you open the “Get Involved” page. In doing so Luma technically receives your IP address, browser and device information, and the page that referred the request; Luma may use cookies or similar technologies in the form.

If we display a banner at the top of the page that links to an event at Luma, your browser loads on every page where the banner is enabled, without a click and without prior consent, a script, a stylesheet and an image from Luma (embed.lu.ma), so that the registration can open directly when you click the button above the page. In this case Luma also receives your IP address, browser and device information, and the referring page.

You enter your registration details directly in Luma. For registrations to our events, Luma processes the data as our data processor (Art. 28 GDPR) and stores it in the United States. We receive the registration details to organize the event (Art. 6(1)(b) GDPR). We delete the registration details from Luma as soon as we no longer need them for organizing and following up on the event and there is no legal retention requirement. The data that is sent to Luma when the form and script load is processed by Luma on its own responsibility; we do not obtain consent for that. The legal basis for the integration is Art. 6(1)(f) GDPR; our legitimate interest is a simple registration without detours. If you use Luma beyond that, for example with your own account, Luma is also responsible for that; Luma’s privacy notice applies (luma.com/privacy-policy).

For individual events we use a Microsoft Forms registration form in our Microsoft 365 account (provider as described in Section 5). We process your information to organize the event (Art. 6(1)(b) GDPR) and delete it as soon as we no longer need it for that purpose and there is no legal retention obligation. For other events we link to registration pages of other providers, such as Eventbrite; the privacy notice of the respective provider applies there.

15. Links to Social Networks and Other Websites

We link to our profiles on Instagram, LinkedIn, Facebook, YouTube, TikTok, and Eventbrite, and for events we link to venue maps. These are simple links: only when you click one do you leave our website, and the respective provider receives data from you. We do not embed plug‑ins or “Like” buttons from social networks.

16. Registration and Administration

Admins and the editorial team sign in via Microsoft (Microsoft Entra ID, provider as described in Section 5). Only people with an account in the association’s Microsoft 365 directory can log in. From Microsoft we receive an identifier for your account, your name, and your email address (or, if missing, your login name). We also store your role (member, editorial team, or admin), your account status, and the time of your last login. We reject any login that does not have the editorial team or admin role; we still store the data we receive from Microsoft. For admins and the editorial team we create a session for each login with an expiration time and a hash of your browser’s identifier (User-Agent) (Cookie vcm_session, Section 6).

We automatically delete accounts that have not been used to log in for two years. Exceptions are locked accounts (so the lock remains effective), admin accounts kept for emergencies, and the most recent active admin account. We delete expired sessions daily.

We log changes that admins and the editorial team make to content, recording the person, the affected content, the type of change, and the timestamp; we delete the log after twelve months. The editorial system also retains previous versions of pages, news items, and events (up to 25 per item). For translated content it records who approved the English version and when. It also records who is currently editing a piece of content (edit lock) and your personal interface settings; we delete those settings when your account is removed.

Additional Administration Tools:

Upload Files: The browser transfers files directly to our media storage on Microsoft Azure (Section 5); Microsoft receives the IP address in the process.
Translation: With a single click, we can automatically translate German website texts into English. To do this, we send the texts to uniGPT, a service provided by the University of Münster (Schlossplatz 2, 48149 Münster). We only use models that the university runs on its own servers. The university processes the requests according to its own privacy notice (uni-muenster.de/IT/services/arbeitsplatz/unigpt/datenschutz.html) and deletes logs after 14 days, as stated. The texts may contain names that appear on the website or are intended to be published there; we do not send any visitor data.
Background removal: For this feature, the browser loads a model from Hugging Face (Hugging Face, Inc., 20 Jay Street, Suite 620, Brooklyn, NY 11201, USA) and program files from jsDelivr (Volentio JSD Limited, England and Wales). Both receive the IP address and browser information; the image itself stays in the browser. The feature only runs when you select it yourself.
Statistics: The admin panel only displays aggregated values (Section 8).

The legal bases are Art. 6(1)(b) GDPR (membership and participation in the association) and Art. 6(1)(f) GDPR (security, traceability of changes, and efficient maintenance of the website, including translation).

17. People on our website

On our website we introduce members of our team and the Board with first and last name, role, and photo, and optionally a link to their LinkedIn profile and email address. Former Board members are also listed in the archive with their names and roles, sometimes with a group photo. In news items, the name of the author may be shown. We do this only with the individual's consent (Art. 6(1)(a) GDPR). If someone withdraws consent, we remove their information from the website. The names of the legally authorized Board members and the person responsible for the content are listed in the imprint because the law requires it (Art. 6(1)(c) GDPR in conjunction with § 5 DDG and § 18(2) MStV). We also list the Board members in Section 3 so you know who represents the association (Art. 6(1)(f) GDPR).

We publish photos from our events to report on our association’s activities (Art. 6(1)(f) GDPR). If you don’t want to appear in a photo, let us know (contact information in Section 3); we’ll remove it from the website.

18. Fonts

We serve the fonts for our website from our own domain (hosting as described in Section 4). No connection to Google Fonts or other font providers is made when you visit our site.

19. Recipients and transfers to third countries

Personal data is only disclosed to the following recipients; the purpose and legal basis are listed in the respective sections:

Vercel Inc., USA: hosting and analytics (Sections 4 and 8)
Microsoft Ireland Operations Limited, Ireland, as our data processor: database and media storage in Denmark, email sending, Microsoft Forms, and registration (Sections 5, 11–14, and 16)
Google Ireland Limited, Ireland (YouTube), and Vimeo.com, Inc., USA: embedded videos, only when you choose them (Section 10)
Luma Labs, Inc., USA: event registration as our data processor; loading of registration forms and scripts is handled under our own responsibility (Section 14)
University of Münster, Germany: machine translation of website texts (Section 16)
Hugging Face, Inc., USA, and Volentio JSD Limited (jsDelivr), United Kingdom: only for the “Background removal” feature in the admin panel (Section 16)

Transfers to countries outside the EU and the European Economic Area:

USA – Vercel, Microsoft, Google, Vimeo: These companies (for Microsoft and Google the parent companies Microsoft Corporation and Google LLC) are certified under the EU‑US Data Privacy Framework. The transfer relies on the adequacy decision of the European Commission dated July 10, 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). You can find the list of certified companies at dataprivacyframework.gov.
Weitere Länder – Microsoft: For transfers to other countries outside the EU and the European Economic Area (section 5), the European Commission’s standard contractual clauses in Microsoft’s data protection addendum apply (Art. 46(2)(c) GDPR); for Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR).
USA – Luma: Luma is not certified under the EU‑US Data Privacy Framework. For your registration to our events, the European Commission’s standard contractual clauses in Luma’s data processing agreement apply (Art. 46(2)(c) GDPR, luma.com/dpa). For the data that is sent to Luma already when loading the registration form and script, there is neither an adequacy decision nor such guarantees.
USA – Hugging Face: Hugging Face is not certified under the EU‑US Data Privacy Framework; no additional guarantees exist. The transfer only occurs when someone from the editorial team initiates the “remove background” feature themselves.
Vereinigtes Königreich – jsDelivr: For the United Kingdom there is an adequacy decision of the European Commission (Art. 45 GDPR). jsDelivr delivers the files via networks of other providers, including Cloudflare and Fastly in the USA, which are certified under the EU‑US Data Privacy Framework.

You can request a copy of the standard contractual clauses from us (contact in section 3).

20. Retention periods at a glance

How long we retain personal data depends on the purpose of processing and legal retention obligations. In detail:

Runtime logs at Vercel: 1 hour
Hash value from Vercel Web Analytics for distinguishing visits: 24 hours
Backup copies of the database on Microsoft Azure: up to 35 days
Deleted files in media storage: 7 days for recovery
Cookie vcm_consent: 183 days
Entry vcm_banner: until the end of the session or until you delete it in your browser
Cookie vcm_session: 12 hours
Cookie vcm_oidc_tx: 10 minutes
Cookie onpage: 12 hours
Cookie __prerender_bypass in the admin: until the end of the preview or the browser session
Preview link cookies (onpage_preview, __prerender_bypass): until the link expires
Cookie payload-lng in the admin: up to 365 days; interim states in local storage until you delete them, in session storage until the end of the session
Submissions from contact and FAQ forms in the database: 6 months
Emails to us, notifications about submissions and their copies in the association’s mailbox: until the request is completed, as long as no retention obligation applies
Spam protection entries: until the one‑hour window expires, deleted during the next daily cleanup
Registrations for “New Jobs by Email”: unconfirmed for 7 days, confirmed until unsubscribed
Login accounts: up to 2 years after the last login (exceptions in section 16); personal admin settings: until the account is deleted
Sessions: until they expire, deleted during the next daily cleanup
Administration change log: 12 months
Earlier versions of content: up to 25 per content, until the content is deleted
Applications via Microsoft Forms: until the admission process is completed; if you become a member, for the duration of your membership
Entries on the waiting list: until the start of the next application phase
Registrations for events (Luma, Microsoft Forms): until the post‑event follow‑up, as long as no retention obligation applies
People on the website: team and Board until consent is withdrawn; photos from events until you object or we delete the post; names of the Board in the imprint for the duration of the term of office

21. Routine deletion and restriction of processing

We process and store personal data only as long as it is necessary for the purpose of storage or as required by the laws and regulations that apply to us.

If the purpose no longer applies or a statutory retention period expires, we routinely delete the personal data in accordance with legal requirements. If a retention obligation conflicts with deletion, we restrict the processing.

22. Rights of the data subject

For all the rights below, a simple informal message to us (contact in section 3) is sufficient.

Right of confirmation

You have the right to request from us a confirmation whether we are processing personal data concerning you (Art. 15(1) GDPR).

Right of access

You have the right to obtain, free of charge, at any time, information about the personal data stored about you and a copy of that data (Art. 15 GDPR). The information includes:

the purposes of processing
the categories of personal data that are processed
the recipients or categories of recipients to whom the personal data have been or will be disclosed, especially recipients in third countries or international organisations
if possible, the planned duration for which the personal data will be stored, or, if that is not possible, the criteria used to determine that duration
the existence of a right to rectification or erasure of your personal data or to restriction of our processing, or a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
if the personal data were not obtained from you: all available information about the source of the data
the existence of automated decision‑making, including profiling, pursuant to Art. 22(1) and (4) GDPR – and, at least in those cases, meaningful information about the logic involved as well as the significance and intended consequences of such processing for you

If personal data are transferred to a third country or an international organisation, you also have the right to be informed about the appropriate safeguards related to the transfer.

Right to Rectification

You have the right to demand the immediate correction of inaccurate personal data concerning you. Taking the purposes of processing into account, you can also request the completion of incomplete personal data, also by means of a supplementary statement (Art. 16 GDPR).

Right to Erasure (Right to be Forgotten)

You have the right to request that personal data concerning you be deleted without delay when one of the following reasons applies (Art. 17(1) GDPR):

The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
You withdraw your consent, on which the processing was based according to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
You object to the processing in accordance with Art. 21(1) GDPR, and there are no overriding legitimate reasons for the processing, or you object to the processing in accordance with Art. 21(2) GDPR.
The personal data were processed unlawfully.
The erasure of the personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which we are subject.
The personal data were collected in relation to offered information society services pursuant to Art. 8(1) GDPR.

This does not apply insofar as the processing is further necessary under Art. 17(3) GDPR, for example to fulfill a statutory retention obligation or to assert, exercise, or defend legal claims.

If we have made the personal data public and are required to delete them, we will, taking into account available technology and implementation costs, take appropriate measures, including technical ones, to inform other controllers who process the published data that you have requested the deletion of all links to these data or of copies or reproductions of these data.

Right to Restriction of Processing

You have the right to request that we restrict the processing when one of the following conditions applies (Art. 18 GDPR):

You contest the accuracy of the personal data for a period that allows us to verify the data’s accuracy.
The processing is unlawful, you refuse the erasure of the personal data and instead request the restriction of its use.
We no longer need the personal data for the purposes of processing, but you need them to assert, exercise, or defend legal claims.
You have lodged an objection to the processing pursuant to Art. 21(1) GDPR, and it has not yet been determined whether our legitimate reasons outweigh yours.

Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine‑readable format and to transmit those data to another controller without hindrance from us, provided the processing is based on consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract under Art. 6(1)(b) GDPR and the processing is carried out by automated means (Art. 20 GDPR). To the extent technically feasible and insofar as this does not affect the rights and freedoms of others, you may request that we transmit the data directly to another controller.

Right to Withdraw a Data‑Protection Consent

You have the right to withdraw your consent to the processing of personal data at any time, with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing that occurred before the withdrawal remains unaffected. You can most easily withdraw your consent for statistics and external media via “Cookie Settings” in the footer of any page, “New Jobs by Email” via the unsubscribe link in each email with new job postings, and any other consents by sending us a message (contact in Section 3).

Automated individual decisions, including profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that has legal effect concerning you or similarly significantly affects you (Art. 22 GDPR). We do not make such decisions (Section 28).

23. Right to Object

If we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on this provision (Art. 21(1) GDPR). We will then cease processing your data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing is necessary for the assertion, exercise, or defence of legal claims.

If we process personal data for direct marketing, you may object at any time (Art. 21(2) GDPR); we will then stop processing it for that purpose.

A simple, informal message to us (contact in Section 3) is sufficient to object. In the context of using information society services, you may also exercise your right to object through automated means that use technical specifications (Art. 21(5) GDPR).

24. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, your workplace, or the place of the alleged violation, if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR). The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
E-Mail: poststelle@ldi.nrw.de
Website: ldi.nrw.de

25. Legal Bases for Processing

If we obtain your consent for a specific processing purpose, Art. 6(1)(a) GDPR is the legal basis. If the processing is necessary for the performance of a contract to which you are a party, such as membership, it is based on Art. 6(1)(b) GDPR; this also applies to processing required for pre‑contractual measures, for example when applying for membership. When we are subject to a legal obligation that makes processing necessary, such as tax obligations or the duty to disclose provider information, the processing relies on Art. 6(1)(c) GDPR. Processing that is necessary to protect vital interests of you or another natural person—e.g., if someone is injured at one of our events and we need to provide information to emergency services—is based on Art. 6(1)(d) GDPR. Finally, processing may be based on Art. 6(1)(f) GDPR when it is necessary for the legitimate interests of ours or a third party and your interests, fundamental rights, and freedoms do not override them.

The storage of information on your device and access to it is also subject to § 25 TDDDG. Without your consent, we only store what is strictly necessary to provide a service you have explicitly requested (§ 25 Abs. 2 Nr. 2 TDDDG); everything else requires your consent (§ 25 Abs. 1 TDDDG). The exception is the registration form and Luma’s script (Section 14): they load without your consent, and Luma may store or read information on your device.

26. Legitimate Interests in Processing

If processing is based on Art. 6 Abs. 1 lit. f DSGVO, our legitimate interests are the safe and reliable operation of our website, responding to inquiries, providing an easy registration for our events, maintaining the website, and our association work: inspiring and empowering students for entrepreneurship and promoting our events and offerings. We also name the specific interest in each section.

27. Legal or Contractual Requirements for Providing Personal Data

Providing personal data is sometimes required by law, for example through tax regulations, or may arise from contractual provisions, such as information about the contracting party. If you want to become a member, you must provide us with the necessary details; without them, membership cannot be established. Required fields in our forms are marked; without them we cannot process your request or registration. Whether provision is mandatory or required in a specific case, we are happy to explain it to you upon request (contact in Section 3).

28. Existence of Automated Decision-Making

We do not engage in automated decision-making or profiling.