Privacy policy

1. Controller

The controller responsible for data processing on this website (Art. 4(7) GDPR):

Jam The Van e.V. i.G.
Rothenbacher Weg 27
51503 Rösrath
Represented by: Sophie Kitching
E-mail: info@jamthevan.de

2. The key points in brief

• This website does not set any cookies.
• Only the campaign timeline saves your entries, and only locally in your browser. This information is not sent to us.
• Whatever you enter in a contact form only ends up in our protected inbox. The database is located in Frankfurt am Main.
• We do not use any tracking or analytics tools and no advertising services.
• The fonts are hosted locally. No connection to Google Fonts is made.
• Links to social networks are plain links. Data only goes to the provider when you click.
• When you visit the website, technically necessary server log files are created at our hosting provider.

3. Hosting and server log files

This website is hosted on Firebase Hosting. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Every time you visit, your browser automatically sends data to the server. This creates server log files containing:

• IP address
• date and time of the request
• page or file requested
• amount of data transferred and status code
• website you came from (referrer)
• browser and operating system (user agent)

Purpose: delivering the website, keeping it running stably and securely, detecting errors and misuse. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Storage period: According to Firebase, it keeps the IP addresses from the server log files for a few months and then deletes them.

Processing on our behalf: Google processes the data on our behalf. This is based on a data processing agreement under Art. 28 GDPR (Firebase Data Processing and Security Terms).

Transfers outside the EU: Google may also transfer data to countries outside the EU, for example to the USA. The basis for this: Google LLC is certified under the EU-US Data Privacy Framework. These transfers are covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Google has concluded EU standard contractual clauses (Art. 46 GDPR).

4. No cookies, storage in your browser

This website does not set any cookies. That is why there is no cookie banner.

Storage in your browser (campaign timeline)

On the campaign timeline page you can enter the first day of your collection week and tick off items. So that you find them again on your next visit, your browser saves this information in its local storage (localStorage) under the key jtv-fahrplan-v1:

• the date you chose for the collection week
• which items you have ticked off as done

The information stays on your device only. It is not sent to us or to anyone else, and we cannot see it. Nothing is saved until you enter a date or tick off an item.

Legal basis: § 25 Abs. 2 Nr. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Saving is necessary so that the timeline you are using keeps your entries.

Deleting: with the “Delete saved data” button in the timeline or in your browser settings (clear site data).

5. No tracking, no analytics

We do not use analytics tools such as Google Analytics, tracking pixels or advertising services. We do not analyse how you use the website and do not create usage profiles.

6. Fonts

We use the fonts Fredoka, Figtree and Gochi Hand. They are hosted locally and delivered together with the website. Your browser does not connect to Google Fonts or any other font service for this.

7. Links to social networks and other websites

We link to our profiles on:

• Instagram (Meta Platforms Ireland Limited)
• Facebook (Meta Platforms Ireland Limited)
• TikTok (TikTok Technology Limited)
• LinkedIn (LinkedIn Ireland Unlimited Company)

These are plain links. Our website contains no plugins, no buttons that transmit data and no embedded content from these networks. Only when you click a link does your browser open the provider's page. The provider then receives data such as your IP address. From then on, the privacy policy of the provider in question applies.

On campaign pages there is a link for sharing via WhatsApp (WhatsApp Ireland Limited). Only when you tap it does WhatsApp open with the prepared text and the link to the campaign. The privacy policy of WhatsApp then applies.

The same applies to links to other websites, for example to press articles.

8. Contact forms and e-mail

This website has forms for enquiries from schools, companies, the press and funders, for membership applications and for general questions. When you submit a form, we store what you enter: name, e-mail address, your message and, depending on the form, further details such as school, town, company or the type of membership you want. We also store the time and the page from which you sent the enquiry. We use this data only to answer your enquiry and, for a membership application, to manage the membership.

Where the data is stored: The enquiries are stored in a Google Cloud Firestore (Firebase) database in the data centre in Frankfurt am Main. Only our team can read them, through a protected login. When you submit a form, your browser connects to Google servers for this, which technically transmits your IP address. The contractual partner is the same as for hosting: Google Ireland Limited. Google processes the data on our behalf. This is based on a data processing agreement under Art. 28 GDPR (Firebase Data Processing and Security Terms).

Notification and confirmation: After you submit a form, an automated service (Google Cloud Functions, also in the data centre in Frankfurt am Main) e-mails your enquiry to our mailbox info@jamthevan.de and sends you a short confirmation that it has arrived. The confirmation only contains your first name and a few details from the form (such as school and town), not your message. The e-mails are sent through our mailbox at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur.

Protection against misuse: So that nobody can use the form for spam or to flood other people's mailboxes, we limit how many enquiries arrive from one device (at most 5 per hour and 20 per day) and with one e-mail address (at most 3 per hour), and each address receives at most 3 confirmations per day. For this we do not store your IP address or e-mail address in plain text, only an encrypted check value (HMAC hash) and the times of the enquiries. For IPv6 addresses we only use the first part, which identifies the connection. These check values are deleted automatically after 24 hours at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating the forms securely.

Legal basis: Art. 6(1)(b) GDPR if it concerns a collaboration or a membership, for example a campaign at your school or your membership application. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries.

Storage period: We delete enquiries from the forms as soon as they have been dealt with and no further questions are expected, at the latest after twelve months. We keep membership applications for as long as the membership lasts. Statutory retention obligations remain unaffected.

By e-mail: You can also write to us at info@jamthevan.de. We then process your e-mail address, your name if you give it, and the content of your message, again only in order to reply. The legal bases are the same as for the forms.

Mailbox: Our mailbox is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur.

Storage period: We delete e-mails as soon as the enquiry has been dealt with and no further questions are expected, at the latest after twelve months. Statutory retention obligations remain unaffected.

9. Your rights

You have the following rights towards us at any time:

• Access to your stored data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

Right to object: If we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. An informal message via our contact form or to info@jamthevan.de is enough.

For any request about your data, a message via our contact form or to info@jamthevan.de is enough.

10. Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where the alleged infringement took place. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de

11. Obligation to provide data, automated decisions

You do not have to give us any data. Without the data in the server log files, however, the website cannot be delivered. We do not make automated decisions and do not carry out profiling (Art. 22 GDPR).

12. Changes

If new features are added, we will update this policy beforehand. The version published here at the time applies.