Preliminary note:
We hereby inform you about the use of data by Social Impact gGmbH (hereinafter "Social Impact"). This privacy policy explains the type, scope, and purpose of processing personal data within our online offering and related websites, functions, and content, as well as external online presences (e.g., Social Impact's social media profiles). Regarding the terminology used, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
To allow you to use the information, offers, and services provided on our website, Social Impact collects, processes, and uses (personal) data. By agreeing to this privacy policy, you consent to the collection, processing, and use of your (personal) data in accordance with the following provisions and in compliance with data protection laws. We process personal data of users only in accordance with applicable data protection regulations, particularly respecting the principles of data minimization and data avoidance. This means that your data will only be processed if a legal permit exists, especially when the data is necessary to provide our contractual or other services, is legally required, or if consent is given.
Personal data is any information relating to an identified or identifiable natural person. Data collected during your visit to our website that cannot be directly linked to your identity is not considered personal data.
You can revoke your consent at any time with future effect and/or object to the future use of your data, provided that the data is not needed for contract execution. Social Impact will delete the data when any legal retention periods have expired, you have asserted a deletion claim, or further storage is no longer necessary to fulfill the original (contractual) purpose.
In accordance with Art. 13 GDPR, we will inform you of the legal basis for our data processing activities. If the legal basis is not mentioned in the privacy policy, the following applies: The legal basis for obtaining consent is derived from Art. 6(1) GDPR.
Your personal data will only be transmitted by Social Impact in encrypted form. We use SSL (Secure Socket Layer) encryption for this purpose. In addition, Social Impact ensures that websites and other systems are protected against unauthorized access, alteration, or distribution of data through appropriate technical and organizational measures.
1. Responsible party and data protection officer
The responsible party for the collection, processing, and use of your personal data in accordance with the German Federal Data Protection Act (BDSG) and the General Data Protection Regulation (GDPR) is Social Impact gGmbH, Schiffbauergasse 7, 14467 Potsdam, represented by the managing directors Norbert Kunz, Gabriela Spangenberg, and Thorsten Jahnke.
The contact details of our data protection officer:
The data protection officer of Social Impact gGmbH can be reached via email at datenschutz@socialimpact.eu.
IITR Datenschutz GmbH
Dr. Sebastian Kraska
Marienplatz 2
80331 Munich
2. Collection, storage, and use of personal data
a) Provision of our statutory and business-related services
We process the data of our supporters, interested parties, customers, or other individuals in accordance with Art. 6(1)(b) GDPR, provided that we offer them contractual services or act within an existing business relationship or are recipients of services and benefits. Additionally, we process the data of affected persons according to Art. 6(1)(f) GDPR based on our legitimate interests, for example, when it involves administrative tasks or public relations work.
The data processed, its type, scope, purpose, and necessity of processing are determined by the underlying contractual relationship. This generally includes inventory and master data, such as names, addresses, and contact data, as well as relevant project data. We delete data that is no longer necessary for the provision of our statutory and business-related purposes. This determination is based on the relevant tasks and contractual relationships. In the case of business-related processing, we retain data as long as it is relevant for business operations, as well as in terms of potential warranty or liability obligations. The necessity for data retention is reviewed every three years, with legal retention obligations also applying.
b) Visiting the website
When you visit our website www.socialimpact.eu, the browser on your device automatically sends information to the server of our website. This information is temporarily stored in a log file. The following information is automatically collected and stored until its automatic deletion:
- IP address of the requesting device
- Date and time of access
- Name and URL of the accessed file
- Website from which the access is made (referrer URL)
- Browser used and, if applicable, your device’s operating system, as well as the name of your access provider.
The mentioned data is processed by us for the following purposes:
- Ensuring a smooth connection to the website,
- Ensuring comfortable use of our website,
- Utilization of the offered services,
- Evaluation of system security and stability, and
- Further administrative purposes.
The legal basis for the data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the aforementioned purposes of data collection. In no case do we use the collected data to draw conclusions about you personally.
c) Newsletter subscription
If you have expressly consented pursuant to Art. 6(1)(a) GDPR, we use your email address to send you our newsletter regularly. To receive the newsletter, providing an email address is sufficient.
The newsletter subscription occurs through a double-opt-in procedure. This means you will receive an email requesting confirmation of your subscription after signing up. This confirmation is necessary to prevent unauthorized use of email addresses. Subscriptions to the newsletter are logged to verify the registration process in accordance with legal requirements. This includes saving the time of registration and confirmation, as well as the IP address. Changes to your data stored by the email service provider are also logged.
You can unsubscribe at any time via a link provided at the end of each newsletter or by sending an email to newsletter(at)socialimpact.eu.
The newsletter is sent via the email service provider “MailChimp,” a platform provided by Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the privacy policy of the email service provider here: [mailchimp.com/legal/privacy](https://mailchimp.com/legal/privacy). The service provider is used based on our legitimate interests according to Art. 6(1)(f) GDPR and a data processing agreement pursuant to Art. 28(3) GDPR.
The email service provider may use the data of recipients in pseudonymous form, i.e., without assigning it to a user, to improve its services technically or for statistical purposes, such as optimizing the delivery and display of newsletters. However, the provider does not use the data of our newsletter recipients to contact them independently or to pass the data on to third parties.
d) Using our contact form
If you have any questions, we offer the opportunity to contact us using a form provided on the website. It is necessary to provide a valid email address so that we know who sent the inquiry and can respond. Additional information may be provided voluntarily.
Data processing for the purpose of contacting us is based on your voluntary consent (Art. 6(1)(a), (b) GDPR) or your inquiry.
Personal data collected through the contact form is automatically deleted after your inquiry is resolved.
e) Surveys, tenders, & job applications
Social Impact may conduct surveys and tenders via this website. It is also possible to apply for jobs online at Social Impact. Unless otherwise stated, the personal data you provide for participation in these surveys, tenders, or applications will only be collected, processed, and used to the extent necessary to carry out the respective survey, tender, or application. Processing of such data is necessary for fulfilling our (pre)contractual obligations in connection with the survey, tender, or application (Art. 6(1)(b) GDPR).
The corresponding forms are created using Wufoo, a service of SurveyMonkey Inc., 101 Lytton Avenue, Palo Alto, CA 94301, USA. We have agreements in place to ensure that Wufoo collects and processes your data exclusively on our behalf and according to our instructions. Wufoo will not sell or share your data with third parties. For more details, refer to Wufoo's privacy policy: [Wufoo Privacy Policy](https://de.surveymonkey.com/mp/legal/privacy-policy/).
f) Google Analytics / Google Tag Manager / Google DoubleClick / Google Ads
Google Analytics
If you have given your consent, Google Analytics 4 is used on this website, a web analytics service provided by Google LLC. The responsible entity for users in the EU, EEA, and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Scope of processing
Google Analytics uses cookies that allow an analysis of your use of our website. The information collected via cookies about your use of this website is usually transmitted to a Google server in the USA and stored there. However, IP anonymization is activated by default in Google Analytics 4, meaning your IP address is shortened by Google within the member states of the European Union or other states party to the Agreement on the European Economic Area before transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.
During your website visit, your user behavior is recorded in the form of "events," including page views, first-time website visits, session starts, your "click path," interactions with the website, scrolling, clicks on external links, internal searches, interactions with videos, file downloads, and seen/clicked ads.
Additional information captured includes:
- Your approximate location (region)
- Your IP address (in anonymized form)
- Technical information about your browser and the devices used (e.g., language setting, screen resolution)
- Your Internet service provider
- The referrer URL (from which website/advertising medium you reached this website)
Purpose of processing
On behalf of the operator of this website, Google will use this information to evaluate your pseudonymous use of the website and compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website.
Recipient
Recipients of the data include:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a data processor under Art. 28 GDPR)
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
US authorities may access data stored by Google.
Transfer to third countries
If data is processed outside the EU/EEA and an adequate level of data protection comparable to European standards does not exist, we have entered into standard contractual clauses with the provider to ensure an adequate level of data protection. Google LLC, headquartered in California, USA, processes data in the USA. Transferring data to the USA and the possibility of US authorities accessing it cannot be ruled out. The USA is currently considered a third country in terms of data protection.
g) Social Media and YouTube Plugins
We use social plugins from social networks such as Facebook, Twitter, and Instagram based on our legitimate interest (Art. 6(1)(f) GDPR) to make Social Impact better known. The respective provider ensures the privacy-compliant operation of these plugins. Integration of these plugins is done through a two-click process to protect website visitors.
Google Signals
As an extension to Google Analytics, this website may use Google Signals to create cross-device reports. If you have personalized ads enabled and have linked your devices to your Google account, Google may analyze your usage behavior across devices and create database models, including cross-device conversions, subject to your consent according to Art. 6(1)(a) GDPR. We do not receive personal data from Google, only statistics.
If you wish to stop cross-device analysis, you can deactivate the "Personalized Ads" feature in your Google account settings. Follow the instructions here: [Google Support](https://support.google.com/ads/answer/2662922?hl=en). For more information on Google Signals, visit: [Google Analytics Help](https://support.google.com/analytics/answer/7532985?hl=en).
g) Social Media and YouTube Plugins
We use social media plugins from Facebook, Twitter, Instagram, and YouTube based on Art. 6(1)(f) GDPR to make Social Impact more widely known. This advertising purpose is considered a legitimate interest under GDPR. The providers are responsible for ensuring compliance with data protection regulations.
aa) Facebook
We use social media plugins from Facebook Ireland Ltd. on our website, such as the "LIKE" or "SHARE" buttons. This is a service provided by Facebook.
When you visit a page on our website containing such a plugin, your browser establishes a direct connection to Facebook's servers. The content of the plugin is transmitted directly to your browser and embedded in the webpage. As a result, Facebook receives information that your browser has accessed the corresponding page on our website, even if you do not have a Facebook account or are not logged in. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the USA and stored there.
If you are logged in to Facebook, Facebook can associate your visit to our website directly with your Facebook account. If you interact with the plugins, such as by pressing the "LIKE" or "SHARE" button, this information is also transmitted directly to a Facebook server and stored there. The information is also posted on Facebook and visible to your Facebook friends.
Facebook may use this information for advertising, market research, and tailored Facebook pages. Facebook creates user, interest, and relationship profiles to evaluate your use of our website in relation to ads shown to you on Facebook, inform other Facebook users about your activities on our website, and provide other services related to Facebook use.
If you do not want Facebook to associate the data collected via our website with your Facebook account, you must log out of Facebook before visiting our website.
You can find more details in Facebook’s privacy policy: [Facebook Privacy Policy](https://www.facebook.com/about/privacy/).
bb) Twitter
On our website, we have integrated plugins from Twitter International Company, such as the tweet button. When you access a page on our website that contains a Twitter plugin, a direct connection is made between your browser and the Twitter server. Twitter is thereby informed that your IP address has visited our website. If you click the tweet button while logged in to your Twitter account, you can link content from our pages to your Twitter profile. Twitter can then associate your visit to our pages with your account.
For more information, see Twitter’s privacy policy: [Twitter Privacy Policy](https://twitter.com/privacy).
cc) Instagram
Our website uses social plugins from Instagram, which is operated by Facebook Ireland Ltd. When you visit a page on our website that contains an Instagram plugin, your browser connects directly to Instagram's servers. Instagram is informed that your browser has accessed our website, even if you do not have an Instagram account or are not logged in.
For more details, check Instagram's privacy policy: [Instagram Privacy Policy](https://help.instagram.com/155833707900388).
dd) YouTube
We use YouTube plugins on our website, operated by Google Ireland Limited. When you visit a page on our website that contains a YouTube plugin, a connection is made to YouTube’s servers. The YouTube server is informed about the pages you visited.
For more information on how YouTube handles user data, check their privacy policy: [YouTube Privacy Policy](https://policies.google.com/privacy).
h) Presence in social networks & external links
We maintain presences on various social media platforms, which you can access via buttons on our website or by entering the address in your browser. If you visit these presences or interact with them, personal data may be transferred to the provider of the social network.
The social network may process data related to the device you are using, including your IP address, processor type, and browser version. For more details on how these platforms collect data, please refer to their respective privacy policies.
i) Use of Web Fonts
aa) Google Fonts
We use external fonts from Google Fonts on our website, a service provided by Google Ireland Limited. The integration of these web fonts occurs through a server call, typically to a Google server in the USA. As a result, Google is informed about the pages you have visited, and your IP address may be transmitted.
For more details, refer to Google's privacy policy: [Google Privacy Policy](https://policies.google.com/privacy).
bb) Adobe Typekit Webfonts
We also use Adobe Typekit web fonts. This service is provided by Adobe. Your IP address may be stored by Adobe when your browser requests the font from their servers.
For more information, see Adobe’s privacy policy: [Adobe Typekit Privacy Policy](https://www.adobe.com/privacy/policies/typekit.html).
j) Usercentrics (Cookie-Consent Tool)
We use Usercentrics, a consent management service from Usercentrics GmbH, to manage and document the consent of website users regarding data processing. This service is required to comply with our legal obligations (Art. 6(1)(c) GDPR).
The following data is processed by Usercentrics:
- Date and time of the visit
- Browser information
- Device information
- Geographical location
- Consent preferences
Further details can be found in Usercentrics’ privacy policy: [Usercentrics Privacy Policy](https://usercentrics.com/de/datenschutzerklaerung/).
k) Hubspot
We use HubSpot, a marketing and sales platform, on our website. This tool processes personal data, including name, email address, and any additional information provided through forms. HubSpot processes data in the USA, which is classified as a third country under GDPR. To ensure data protection, HubSpot has implemented Standard Contractual Clauses (SCCs) to guarantee that EU data protection standards are met when transferring data to the USA.
For more details, visit: [HubSpot Privacy Policy](https://legal.hubspot.com/de/privacy-policy).
l) LinkedIn Insight Tag
Our website uses the LinkedIn Insight Tag to track and analyze visitor behavior. LinkedIn encrypts the collected data, which includes IP address and browser properties, and anonymizes it after seven days.
For more information on LinkedIn’s privacy practices, see: [LinkedIn Privacy Policy](https://de.linkedin.com/legal/privacy-policy).
3. Data sharing
Your personal data will only be shared with third parties if:
- You have given your explicit consent (Art. 6(1)(a) GDPR),
- Sharing is necessary for the establishment, exercise, or defense of legal claims and there is no reason to assume you have an overriding interest in not having your data shared (Art. 6(1)(f) GDPR),
- We are legally obligated to share data (Art. 6(1)(c) GDPR),
- Or sharing is necessary for contract fulfillment (Art. 6(1)(b) GDPR).
4. Cookies
We use cookies on our website to enhance user experience and gather statistical data. Cookies are small files that are stored on your device by your browser when you visit our site.
These cookies do not harm your device and do not contain viruses or other harmful software. Cookies store specific information related to the device you are using.
For more details on the cookies we use, refer to our cookie policy.
5. Rights of the data subject
As a data subject, you have the following rights:
- Right to information (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
6. Right to object
You have the right to object to the processing of your personal data based on legitimate interests (Art. 6(1)(f) GDPR) if there are reasons relating to your particular situation.
7. Data security
We use SSL encryption to protect your data during transmission. Additionally, we take appropriate technical and organizational measures to secure your data against unauthorized access, loss, or destruction.
8. Protection of minors
We do not knowingly collect data from individuals under the age of 18 without parental consent.
9. Changes to this privacy policy
This privacy policy is current as of November 2023 and is subject to change as we update our website or legal requirements.
10. Currency and Changes to this Privacy Policy
This privacy policy is currently valid and has the status of November 2023. As we continue to develop our website and offers or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. You can access and print the most up-to-date version of the privacy policy at any time on the website under PRIVACY POLICY.