Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Viadrina Consulting Group e.V.
Große Scharrnstraße 59
15230 Frankfurt (Oder), Germany
Email: 1.vorstand@vcg-ev.de

The association is represented by its board (see legal notice). If you have questions about data protection, please contact us at the email address above.

2. Summary

• This website sets no cookies and uses no tracking or analytics tools.
• Fonts, images, videos and all other files are served from our own web server. No third-party content is embedded.
• We only process personal data if you send it to us through one of our forms or by email, and as technically necessary access data when you visit the website.
• Form entries are not stored on the web server; they are sent by email to the people responsible within the association.

3. Hosting and server log files

This website is hosted by 1blu GmbH, Riedemannweg 60, 13627 Berlin, Germany. 1blu processes the data on our behalf (Art. 28 GDPR) on servers in Germany.

When you visit the website, your browser automatically sends data to the server, where it is processed for technical reasons: IP address, date and time of access, requested page or file, HTTP status code, amount of data transferred, the previously visited page (referrer), browser and operating system.

This processing is necessary to deliver the website and to keep it secure and stable, in particular to detect and fend off attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

According to 1blu, the IP addresses of accesses are stored to trace attacks and to avert threats. Access statistics are kept with anonymised IP addresses only, for one calendar month each, and deleted after the first week of the following month. We do not analyse the log files ourselves and do not combine them with other data.

4. Encryption

For security reasons, this website uses TLS encryption (recognisable by “https://” in the address bar). Data you send to us, for example through forms, cannot be read by third parties.

5. Storage in your browser (colour scheme)

If you choose a light or dark colour scheme with the switch, the website stores this choice in your browser’s local storage (localStorage, entry vcg-theme with the value light or dark). The entry contains no personal data, is not sent to us and stays on your device only. Choosing “System” deletes it; you can also remove it at any time in your browser settings. Storing it is strictly necessary for this function you requested (Section 25(2) no. 2 TDDDG).

6. Contact form and contact by email

If you write to us using the contact form, we process your topic, your name, your email address, your message and, if you provide them, your company or organisation, subject and details on partnership, type of project and non-profit status. The details are sent by email to the mailbox of the full board (GV@vcg-ev.de) and are not stored on the web server. The same applies if you email us directly.

We use the data only to handle your request and to get in touch with you. The legal basis is your consent (Art. 6(1)(a) GDPR) and, if your request concerns a project or a collaboration, steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).

We delete the data once your request has been dealt with, unless statutory retention obligations apply. If a project or partnership results, we keep the correspondence for the duration of the collaboration and afterwards within the statutory retention periods.

7. Membership application and SEPA direct debit mandate

With the “Become a member” form we process the details needed for your admission and for managing memberships: name, gender, date of birth, country and city of birth, address, email address, phone number, start of studies, degree programme and degree you are studying for, languages and, voluntarily, work experience, interests, internship wishes and skills. To collect membership fees, the details of the SEPA direct debit mandate are added (bank, IBAN, place and date and, if applicable, the name and address of a different account holder).

The details are sent by email to the responsible departments of the association: IT (membership management), finance (fee collection), human resources (HR) and the board members responsible for registrations. You receive a confirmation at the email address you provided. To collect fees, we pass the account details on to our bank.

The legal basis is establishing and carrying out the membership (Art. 6(1)(b) GDPR); this also covers the direct debit mandate details we need to collect membership fees. By ticking the checkbox in the form, you confirm that you have taken note of the information on how these details are processed. For accounting records, our legal obligations apply (Art. 6(1)(c) GDPR).

We store the data for the duration of your membership. When you leave, we delete it unless statutory retention obligations apply; records relating to fee collection are kept for up to ten years under tax and commercial law. If no membership results, we delete the details as soon as this is clear.

8. Register-interest form

With the “Register interest first” form we process your name, phone number, university email address, preferred way of contact and, if you provide them, your gender and your message. The details are sent by email to the association’s HR and IT departments and to the mailbox of the full board (GV@vcg-ev.de) so that we can invite you to events and tell you about membership. If you choose WhatsApp as your way of contact, we will get in touch through this service; WhatsApp’s privacy terms then also apply.

The legal basis is your consent (Art. 6(1)(a) GDPR). We delete the details as soon as they are no longer needed for this purpose, for example when you become a member or are no longer interested, and at the latest when you withdraw your consent.

9. Sending emails via Microsoft 365

We send the emails from our forms via our Microsoft 365 account (Microsoft Exchange Online), where the association’s mailboxes are also hosted. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as a processor under the Microsoft Products and Services Data Protection Addendum (Art. 28 GDPR).

A transfer to the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

10. Spam protection

We protect our forms against automated submissions without external services: with a field that is invisible to humans and a minimum time between opening and sending the form. No additional personal data is collected or stored for this.

11. Links to social networks

We refer to our LinkedIn and Instagram profiles with plain links. No content from these services is embedded and no data is sent to them unless you click the link. After clicking, the privacy terms of the respective provider apply.

12. Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal.

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to 1.vorstand@vcg-ev.de is enough for any of these requests.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Brandenburg Commissioner for Data Protection and Access to Information (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

13. Obligation to provide data, no automated decisions

You are not obliged by law or contract to provide data to us. Without the details marked as required, however, we cannot handle your request, membership application or registration of interest. There is no automated decision-making, including profiling (Art. 22 GDPR).

14. Changes

We update this privacy policy when the website or the legal requirements change. The version published here applies.