This is a translation for comprehension. The German original is the binding version. Verein is translated as “association”; it is the Swiss legal form of Starship Factory.
This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter “data”) within our online offering and the websites, functions and content connected with it, the internal administrative tasks of the association, and external online presences such as our social media profiles (hereinafter jointly referred to as the “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Controller
Starship Factory
CH-4000 Basel (Switzerland)
Email address: board@starship-factory.ch
Link to the imprint: https://www.starship-factory.ch/en/imprint/
Types of data processed
- Master data (e.g. names, addresses, membership agreement, payment status).
- Contact data (e.g. email, telephone numbers).
- Content data (e.g. text entries, drawings, photographs, models, videos).
- Usage data (e.g. websites visited, interest in content, access times).
- Meta and communication data (e.g. device information, IP addresses).
Categories of data subjects
Visitors and users of the online offering as well as members of the association (hereinafter we also refer to the data subjects collectively as “users”).
Purpose of processing
- Provision of the online offering, its functions and content.
- Answering contact enquiries and communicating with users.
- Administration of memberships, voting entitlements and the association’s assets.
- Security measures.
- Reach measurement / marketing.
Terms used
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Relevant legal bases
In accordance with Art. 13 GDPR we inform you of the legal bases of our data processing. Where the legal basis is not stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing to fulfil our services and carry out contractual measures, as well as to answer enquiries, is Art. 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In the event that vital interests of the data subject or of another natural person make processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.
Security measures
In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
Those measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as the access, input, transfer, availability and separation relating to it. Furthermore we have set up procedures that ensure the exercise of data subject rights, the erasure of data and a response to threats to the data. We also take the protection of personal data into account already during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).
Cooperation with processors and third parties
Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit data to them or otherwise grant them access to the data, this only takes place on the basis of a legal permission (e.g. where a transfer of the data to third parties, such as payment service providers, is necessary under Art. 6(1)(b) GDPR for the performance of a contract), where you have consented, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, and so on).
Where we commission third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.
Transfers to third countries
Where we process data in a third country (that is, outside the European Union (EU) or the European Economic Area (EEA)), or where this happens in the course of using third-party services or disclosing or transferring data to third parties, this only takes place in order to fulfil our (pre-)contractual obligations, on the basis of your consent, because of a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process the data, or have it processed, in a third country only where the special conditions of Art. 44 ff. GDPR are met. That is, processing takes place for example on the basis of special guarantees, such as the officially recognised determination of a level of data protection corresponding to that of the EU (e.g. for the USA through the “Privacy Shield”), or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).
Rights of data subjects
You have the right to request confirmation as to whether data concerning you is being processed, and to information about that data as well as further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
In accordance with Art. 17 GDPR you have the right to request that the data concerned be erased without delay, or alternatively, in accordance with Art. 18 GDPR, to request a restriction of the processing of the data. Erasure of the data concerned is only carried out within a reasonable period.
You have the right to request to receive the data concerning you that you have provided to us, in accordance with Art. 20 GDPR, and to demand its transfer to other controllers.
You further have the right, under Art. 77 GDPR, to lodge a complaint with the competent supervisory authority.
Right of withdrawal
You have the right to withdraw consent you have given, in accordance with Art. 7(3) GDPR, with effect for the future.
Right to object
You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR. The objection may in particular be made against processing for the purposes of direct marketing.
Cookies and the right to object to direct marketing
“Cookies” are small files stored on users’ computers. Different information can be stored within cookies. A cookie primarily serves to store information about a user (or about the device on which the cookie is stored) during or after their visit to an online offering. Cookies that are deleted after a user leaves an online offering and closes their browser are called temporary cookies, “session cookies” or “transient cookies”. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. Cookies that remain stored even after the browser is closed are called “permanent” or “persistent”. For instance, the login status can be saved for users who return after several days. Likewise, such a cookie may store the interests of users, which are used for reach measurement or marketing purposes. A “third-party cookie” is a cookie offered by a provider other than the controller who operates the online offering (otherwise, if they are only the controller’s own cookies, they are called “first-party cookies”).
We may use temporary and permanent cookies, and we explain this in our privacy policy.
If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional restrictions of this online offering.
A general objection to the use of cookies used for online marketing purposes can be declared for a large number of services, above all in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be prevented by switching them off in the browser settings. Please note that in that case not all functions of this online offering may be usable.
Erasure of data
The data we process is erased or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated within this privacy policy, the data stored by us is erased as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent erasure. Where the data is not erased because it is required for other, legally permissible purposes, its processing is restricted. That is, the data is blocked and not processed for purposes other than those required by law. This applies, for example, to data that must be retained for commercial or tax law reasons.
Under statutory requirements in Switzerland, retention is in particular for 10 years pursuant to Art. 958f CO for the account books and accounting vouchers as well as the annual report and the audit report. It is 15 years for tax documents and 5 years for rent and tradesmen’s invoices and insurance premiums.
Business-related processing
In addition we process
- contract data (e.g. subject matter of the contract, term, membership contracts).
- payment data (e.g. bank details, payment history)
of our members, patrons and business partners for the purpose of administering membership, the association’s assets, voting entitlements, providing contractual services and advertising.
Agency services
We process the data of our members within the scope of our contractual services under the membership contract, which include software and design development/consulting or maintenance, implementation of processes/handling, server administration and training services.
In doing so we process master data (e.g. member master data such as names or addresses), contact data (e.g. email, telephone numbers), content data (e.g. text entries, photographs, videos), contract data (e.g. membership and membership fee, subject matter of the contract, term), payment data (e.g. bank details, payment history), usage and metadata (e.g. in the context of evaluating and measuring the success of events and offerings). In principle we do not process special categories of personal data. The data subjects include our members, users, website visitors or board members as well as third parties. The purpose of the processing is the provision of contractual services, billing and our visitor service. The legal bases of the processing arise from Art. 6(1)(b) GDPR (contractual services) and Art. 6(1)(f) GDPR (analysis, statistics, optimisation, security measures). We process data that is necessary for the establishment and performance of the contractual services, and point out the necessity of providing it. Disclosure to external parties only takes place where it is necessary in the context of an assignment. When processing data provided to us in the context of an assignment, we act in accordance with the instructions of the client and the statutory requirements for processing on behalf of a controller under Art. 28 GDPR, and do not process the data for any purposes other than those of the assignment.
We erase the data on expiry of statutory warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, erasure takes place after their expiry. In the case of data disclosed to us by a client in the context of an assignment, we erase the data in accordance with the specifications of the assignment, in principle after the end of the assignment.
External payment service providers
We use external payment service providers through whose platforms users and we can carry out payment transactions (e.g., each with a link to their privacy policy, Postfinance (https://www.postfinance.ch/de/detail/rechtliches-barrierefreiheit.html), Paypal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full)).
In the context of performing the membership contract, accepting donations and other contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR. Otherwise we use external payment service providers on the basis of our legitimate interests under Art. 6(1)(b) GDPR in order to offer our users an effective and secure payment option.
The data processed by the payment service providers includes master data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient-related details. This information is necessary in order to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. That is, we receive no account or credit card related information, only information confirming or declining the payment. Under certain circumstances the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is identity and creditworthiness checking. In this respect we refer to the terms and conditions and data protection notices of the payment service providers.
The terms and conditions and the data protection notices of the respective payment service providers apply to payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for further information and for asserting rights of withdrawal, access and other data subject rights.
Administration, financial accounting, office organisation, contact management
We process data in the context of administrative tasks as well as the organisation of our operations, financial accounting and compliance with legal obligations such as archiving. In doing so we process the same data that we process in the course of providing our contractual services. The bases of processing are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Members, interested parties, business partners and website visitors are affected by the processing. The purpose of, and our interest in, the processing lies in administration, financial accounting, office organisation and archiving of data — that is, tasks that serve to maintain our business activities, perform our duties and provide our services. The erasure of data with regard to contractual services and contractual communication corresponds to the information given for those processing activities.
In this context we disclose or transmit data to the tax administration, to advisers such as tax advisers or auditors, and to further fee offices and payment service providers.
Furthermore, on the basis of our business interests, we store information about suppliers, event organisers and other business partners, for example for the purpose of contacting them later. This predominantly association-related data we store permanently in principle.
Business analyses and market research
In order to run our association economically and to be able to recognise the wishes of members, visitors, contractual partners and users, we analyse the data available to us on business transactions, contracts, enquiries, and so on. In doing so we process master data, communication data, contract data, payment data, usage data and metadata on the basis of Art. 6(1)(f) GDPR, where the data subjects include contractual partners, interested parties, members, visitors and users of our online offering.
The analyses are carried out for the purposes of business evaluation, marketing and market research. In doing so we may take into account the profiles of registered users with information such as the services they have used. The analyses serve to increase user friendliness, to optimise our offering and for business efficiency. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values.
Where these analyses or profiles relate to individuals, they are erased or anonymised when members terminate their membership, otherwise two years after conclusion of the contract. Otherwise, overall business analyses and general trend determinations are prepared anonymously where possible.
Provision of our statutory and business services
We process the data of our members, supporters, interested parties, visitors or other persons in accordance with Art. 6(1)(b) GDPR where we offer them contractual services or act within an existing business relationship, for example towards members, or are ourselves the recipient of services and donations. Otherwise we process the data of data subjects under Art. 6(1)(f) GDPR on the basis of our legitimate interests, for example where administrative tasks or public relations are concerned.
The data processed in this context, the nature, scope and purpose and the necessity of its processing are determined by the underlying contractual relationship. This includes in principle master and base data of the persons (e.g. name, address, and so on), contact data (e.g. email address, telephone, and so on), contract data (e.g. services used, content and information communicated, names of contact persons) and, where a membership relationship exists or we offer services or products subject to payment, payment data (e.g. bank details, payment history, and so on).
We erase data that is no longer required for the provision of our statutory and business purposes. This is determined according to the respective tasks and contractual relationships. In the case of business processing, we retain the data for as long as it may be relevant for the conduct of business as well as with regard to any warranty or liability obligations. The necessity of retaining the data is reviewed every three years; otherwise the statutory retention obligations apply.
Registration function
Members can create a user account. During registration, the required mandatory information is communicated to the users and processed on the basis of Art. 6(1)(b) GDPR for the purposes of providing the user account. The data processed includes in particular the login information (name, password and an email address). The data entered during registration is used for the purposes of using the user account and its purpose.
Users can be informed by email about information relevant to their user account, such as technical changes. If members have terminated their membership of the association, their data relating to the user account is erased, subject to a statutory retention obligation. It is incumbent on users to secure their data before the end of the contract once notice has been given. We are entitled to irretrievably erase all of a user’s data stored during the term of the contract.
When our registration and login functions are used, and when the user account is used, we store the IP address and the time of the respective user action. Storage takes place on the basis of our legitimate interests, and those of the users, in protection against misuse and other unauthorised use. This data is in principle not passed on to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so under Art. 6(1)(c) GDPR. IP addresses are anonymised or erased after 24 hours at the latest.
Comments and contributions
When users leave comments or other contributions, their IP addresses may be stored for 72 hours on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is for our own safety, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, and so on). In that case we ourselves can be held liable for the comment or contribution and are therefore interested in the identity of the author.
Furthermore we reserve the right, on the basis of our legitimate interests under Art. 6(1)(f) GDPR, to process users’ information for the purpose of spam detection.
The data provided in the context of comments and contributions is stored by us permanently until users object.
Comment subscriptions
Follow-up comments can be subscribed to by users with their consent under Art. 6(1)(a) GDPR. Users receive a confirmation email in order to verify that they are the owner of the email address entered. Users can unsubscribe from ongoing comment subscriptions at any time. The confirmation email contains information about the options for withdrawal. For the purposes of proving users’ consent, we store the time of registration together with the user’s IP address, and erase this information when users unsubscribe from the subscription.
You can cancel receipt of our subscription at any time, that is, withdraw your consent. We may store the removed email addresses for up to three years on the basis of our legitimate interests before erasing them, in order to be able to prove consent previously given. The processing of this data is restricted to the purpose of a possible defence against claims. An individual erasure request is possible at any time, provided that the former existence of consent is confirmed at the same time.
Akismet anti-spam check
Our online offering uses the “Akismet” service offered by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. It is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. With the help of this service, comments by real people are distinguished from spam comments. For this purpose all comment details are sent to a server in the USA, where they are analysed and stored for comparison purposes for four days. If a comment has been classified as spam, the data is stored beyond that period. This information includes the name entered, the email address, the IP address, the comment content, the referrer, information about the browser used and the computer system, and the time of the entry.
Automattic, Inc. falls under the Privacy Shield agreement and is thus obliged to comply with the provisions of the GDPR: https://www.privacyshield.gov/participant?id=a2zt0000000CbqcAAC&status=Active.
Further information on the collection and use of data by Akismet can be found, in English, in Automattic’s privacy notices: https://automattic.com/privacy/.
Users are welcome to use pseudonyms, or to omit entering a name or email address. You can prevent the transmission of data completely by not using our comment system. That would be a shame, but unfortunately we see no alternatives that work equally effectively.
Starship Factory wiki
To collect information, tips and instructions, the association operates a website editable by members (a so-called “wiki”).
When editing content in the wiki, the user name, where applicable the email address given (when editing via version control), and the timestamp of the change are stored.
When members leave contributions in the wiki, their IP addresses may be stored for 72 hours on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is for our own safety, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, and so on). In that case we ourselves can be held liable for the comment or contribution and are therefore interested in the identity of the author.
Furthermore we reserve the right, on the basis of our legitimate interests under Art. 6(1)(f) GDPR, to process users’ information for the purpose of spam detection.
The data provided in the context of editing contributions in the wiki is stored by us permanently until users object.
Version control — GitHub
For the joint development of software and models, the association operates an organisation accessible to members on the version control platform “GitHub”. This platform is operated by the US-based company GitHub Inc., 88 Colin P Kelly Jr St, San Francisco CA, USA. GitHub falls under the Privacy Shield agreement and is thus obliged to comply with the provisions of the GDPR: https://www.privacyshield.gov/participant?id=a2zt000000001K2AAI&status=Active. You can view GitHub’s data protection provisions here: https://help.github.com/articles/github-privacy-statement/. A separate account is required in order to use this platform. As long as you do not create an account with GitHub, or download data from our organisation on GitHub, no data about you is transmitted to GitHub.
When publishing content on GitHub, the user name, where applicable the email address given (when editing via version control), and the timestamp of the change are stored.
The data provided in the context of developing software and models is stored by us permanently until users object.
Contacting us
When you contact us (e.g. via contact form, email, telephone or social media), the user’s details are processed in order to handle and deal with the contact enquiry under Art. 6(1)(b) GDPR. The users’ details may be stored in a customer relationship management system (“CRM system”) or comparable enquiry organisation.
We erase the enquiries once they are no longer required. We review the necessity every two years; furthermore the statutory archiving obligations apply.
Newsletter (the “Announce” mailing list)
With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedures, and about your rights of objection. By subscribing to our newsletter, you consent to receiving it and to the described procedures.
Content of the newsletter: we send newsletters, emails and further electronic notifications containing promotional information (hereinafter “newsletter”) only with the consent of the recipients or on the basis of a legal permission. Where the contents of a newsletter are specifically described when registering for it, those contents are decisive for the users' consent. Otherwise our newsletters contain information about our services and about us.
Double opt-in and logging: registration for our newsletter takes place in a so-called double opt-in procedure. That is, after registering you receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can register with someone else’s email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and of confirmation, as well as the email address. Changes to your data stored with the dispatch service provider are likewise logged.
Registration data: to register for the newsletter it is sufficient to provide your email address. Optionally we ask you to give a name, so that we can address you personally if we need to contact you directly in the event of technical difficulties.
The dispatch of the newsletter and the associated measurement of its success take place on the basis of the recipients’ consent under Art. 6(1)(a), Art. 7 GDPR, or, where consent is not required, on the basis of our legitimate interests and legal information obligations under Art. 6(1)(f) GDPR.
The logging of the registration procedure takes place on the basis of our legitimate interests under Art. 6(1)(f) GDPR. Our interest is directed at the use of a user-friendly and secure newsletter system which serves our association-related interests, corresponds to the expectations of users, and furthermore allows us to prove consent.
Cancellation/withdrawal — you can cancel receipt of our newsletter at any time, that is, withdraw your consent. You will find a link to cancel the newsletter at the end of every newsletter. We may store the removed email addresses for up to three years on the basis of our legitimate interests before erasing them, in order to be able to prove consent previously given. The processing of this data is restricted to the purpose of a possible defence against claims. An individual erasure request is possible at any time, provided that the former existence of consent is confirmed at the same time.
The “Open” mailing list
With the following information we inform you about our mailing list as well as the registration and dispatch procedure, archiving, and your rights of objection. By subscribing to one of our mailing lists, you consent to receiving it and to the described procedure.
Content of the mailing list: the association operates a mailing list in order to promote the exchange of information and ideas between members and interested parties. Emails are sent by members and interested parties, not by the association itself. Dispatch to subscribers takes place exclusively with the consent of the recipients.
Double opt-in and logging: registration for our mailing list takes place in a so-called double opt-in procedure. That is, after registering you receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can register with someone else’s email address. Registrations for the mailing list are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and of confirmation, as well as the email address. Changes to your data stored with the dispatch service provider are likewise logged.
Registration data: to register for the mailing list it is sufficient to provide your email address. Optionally we ask you to give a name, so that we can address you personally if we need to contact you directly (e.g. in the event of technical difficulties or the settlement of disputes).
Dispatch of the mailing list takes place on the basis of the recipients’ consent under Art. 6(1)(a), Art. 7 GDPR.
The logging of the registration procedure takes place on the basis of our legitimate interests under Art. 6(1)(f) GDPR. Our interest is directed at the use of a user-friendly and secure mailing list system which serves our association-related interests, corresponds to the expectations of users, and furthermore allows us to prove consent.
When users leave contributions on the mailing list, their email addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is for our own safety, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, and so on). In that case we ourselves can be held liable for the comment or contribution and are therefore interested in the identity of the author.
Furthermore we reserve the right, on the basis of our legitimate interests under Art. 6(1)(f) GDPR, to process users’ information for the purpose of spam detection.
Archiving — the data provided in emails sent to the mailing list is stored by us permanently until users object. The name given is stored publicly visible. The email address is stored in part, but is obscured. Users are welcome to use pseudonyms.
When contributions are sent to the mailing list, the sender’s email address is transmitted to all subscribers of the mailing list. This is a technically inherent limitation of mailing lists. You can prevent the transmission of data completely by not using our mailing list.
Cancellation/withdrawal — there is a right to object regarding the archived content. You can initiate the erasure of archived content at any time by sending an email to the mailing list moderators. For technical reasons, however, the withdrawal cannot extend to copies of the content already received by subscribers.
You can cancel receipt of our mailing list at any time, that is, withdraw your consent. You will find a link to cancel the mailing list at the end of every posting on this list. We may store the removed email addresses for up to three years on the basis of our legitimate interests before erasing them, in order to be able to prove consent previously given. The processing of this data is restricted to the purpose of a possible defence against claims. An individual erasure request is possible at any time, provided that the former existence of consent is confirmed at the same time.
The “Members” mailing list
The “Members” mailing list is a special case, in that membership of this mailing list goes together with membership of the Starship Factory association.
By joining the Starship Factory association, you consent to receiving it and to the described procedures. The declaration of membership serves as evidence of consent.
Content of the mailing list: the association operates a mailing list in order to enable confidential communication between members. Emails are sent by members, not by the association itself. Dispatch to subscribers takes place exclusively with the consent of the recipients.
Registration data: registration on the mailing list takes place on the basis of data provided in connection with joining the association, and belongs directly to the subject matter of the declaration of membership. Through the declaration of membership, consent is given under Art. 6(1)(a), Art. 7 GDPR.
Dispatch of the mailing list takes place on the basis of the recipients’ consent under Art. 6(1)(a), Art. 7 GDPR.
When users leave contributions on the mailing list, their email addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is for our own safety, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, and so on). In that case we ourselves can be held liable for the comment or contribution and are therefore interested in the identity of the author.
Furthermore we reserve the right, on the basis of our legitimate interests under Art. 6(1)(f) GDPR, to process users’ information for the purpose of spam detection.
Archiving — the data provided in emails sent to the mailing list is stored by us permanently until users object. The name given is stored visible to current and future members. The email address is stored in part, but is obscured. Users are welcome to use pseudonyms.
When contributions are sent to the mailing list, the sender’s email address is transmitted to all subscribers of the mailing list. This is a technically inherent limitation of mailing lists. You can prevent the transmission of data completely by not using our mailing list. It should however be borne in mind that only other members of the association receive the emails.
Cancellation/withdrawal — there is a right to object regarding the archived content. You can initiate the erasure of archived content at any time by sending an email to the mailing list moderators. For technical reasons, however, the withdrawal cannot extend to copies of the content already received by subscribers.
You can cancel receipt of our mailing list at any time by ending your membership of the association, that is, withdraw your consent. Membership is terminated informally by an email or a letter to the association’s treasurer.
Newsletter & mailing list — dispatch service provider
The newsletters are sent using the dispatch service provider Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland. You can view the dispatch service provider’s data protection provisions here: https://www.hostpoint.ch/hostpoint/kontakt-agb.html. The dispatch service provider is used on the basis of our legitimate interests under Art. 6(1)(f) GDPR and a data processing agreement under Art. 28(3) sentence 1 GDPR.
The dispatch service provider may use the recipients’ data in pseudonymous form, that is, without attribution to a user, to optimise or improve its own services, for example for the technical optimisation of dispatch and of the presentation of newsletters, or for statistical purposes. However, the dispatch service provider does not use our newsletter recipients’ data to write to them itself, or pass the data on to third parties.
Collection of access data and log files
We, or our hosting provider, collect data about every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. The access data includes the name of the website accessed, the file, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum of 8 hours and then erased. Anonymised data on the number of accesses to individual subpages may be retained for up to 52 weeks, as long as establishing a personal reference is technically impossible. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the respective incident has been finally clarified.
Online presences in social media
We maintain online presences within social networks and platforms in order to be able to communicate with the members, interested parties and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.
Unless otherwise stated in this privacy policy, we process users’ data where they communicate with us within social networks and platforms, for example by writing contributions on our online presences or sending us messages.
Integration of third-party services and content
Within our online offering we use content or service offerings from third-party providers, on the basis of our legitimate interests (that is, an interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).
This always presupposes that the third-party providers of this content are aware of the users' IP address, since without the IP address they could not send the content to their browser. The IP address is thus necessary for the display of this content. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may furthermore use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. “Pixel tags” allow information such as visitor traffic on the pages of this website to be evaluated. The pseudonymous information may furthermore be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further details about the use of our online offering, as well as being linked with such information from other sources.
YouTube
We embed videos from the “YouTube” platform of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.
Google Maps
We embed maps from the “Google Maps” service of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The data processed may include in particular users’ IP addresses and location data, which are however not collected without their consent (normally given within the settings of their mobile devices). The data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.