Privacy policy

English courtesy translation — the German Datenschutzerklärung is the legally binding version. This policy explains how personal data is processed when you visit this website and use our online forms — joining, changing or cancelling a membership, funding requests and contact inquiries. We process as little data as possible and set no tracking cookies whatsoever.

Controller

Hosting, CDN and server logs

This website is hosted on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in Falkenstein. For delivery and attack protection we use Cloudflare, Inc. (101 Townsend St, San Francisco, USA) as a content delivery network. Server logs store, for at most 14 days: IP address, access time, referrer URL, user agent and requested URL. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability). The website is operated and maintained by Digital Domination (Berlin) as a processor under Art. 28 GDPR. Data-processing agreements are in place with all providers; transfers to the USA rest on the EU-US Data Privacy Framework plus the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Cookies and local storage

The public part of this website sets no cookies — neither technical nor tracking, marketing or analytics cookies. Only your design preference (light or dark mode) is stored locally in your browser after you click the toggle (localStorage, § 25(2) no. 2 TDDDG — strictly necessary, never transmitted to us or to third parties). Only the password-protected admin area, used solely by the board, sets a session cookie and — if "stay signed in" is chosen there — a login cookie; both are strictly necessary for signing in (§ 25(2) no. 2 TDDDG) and you will never encounter them as a visitor.

Online forms (join, upgrade, cancel, funding request, contact)

When you use one of our forms, we process the data you enter — depending on the form: salutation, name, address, email address, phone number, your child's class, the chosen membership tier and, for joining and reimbursements, your bank details (IBAN, account holder) for the SEPA direct-debit mandate or transfer. Legal basis: Art. 6(1)(b) GDPR (establishing and administering the membership or handling your request). For spam protection we additionally process your IP address in pseudonymized form (hash) and the submission time (Art. 6(1)(f) GDPR). Form contents are sent to the board by email and are additionally kept for 180 days in the website's protected admin area so the board can review submissions; bank details are stored there only in masked form (e.g. “DE…1234”), and entries are deleted automatically after that period. Email delivery (board notification and your confirmation) uses the provider Resend (Plus Five Five, Inc., USA; EU region Ireland) — a data-processing agreement is in place; third-country transfers rest on the EU-US Data Privacy Framework plus the EU standard contractual clauses. Privacy: resend.com/legal. For membership administration our Datenschutzordnung (German) additionally applies.

File uploads with funding requests

Receipts you attach to a funding request (quotes, invoices) are forwarded to the board exclusively as email attachments and are not stored on the web server. Legal basis: Art. 6(1)(b) GDPR (processing your funding request).

Project tracking for funding requests (Trello)

The board tracks funding requests on a Trello board (Atlassian Corporation, USA). Every request that arrives becomes a card there automatically, carrying the project details—short title, description, requested amount, how it is to be paid, your connection to the school, any travel details (destination, dates, the name of the supervising teacher, and confirmation that public funding was checked), and your name as the card title—plus a link back into the protected admin area of this website. Your email address, phone number and bank details are not sent to Trello; they stay on our own server and in the board's email. Legal basis: Art. 6(1)(b) GDPR (processing your funding request). The processing is governed by Atlassian's Data Processing Addendum; the transfer to the USA relies on the EU-US Data Privacy Framework, under which Atlassian is certified, and additionally on the EU standard contractual clauses. Privacy policy: atlassian.com/legal/privacy-policy.

Website analytics

We use GoatCounter (self-hosted on our server in Falkenstein, maintained by our processor Digital Domination) to collect anonymized, aggregated usage statistics such as page views and referrer sources. No IP addresses, cookies or other personal data are stored or shared with third parties. More: goatcounter.com.

No other trackers

Beyond the cookie-free measurement described above we use no Google Analytics, no Facebook pixel, no Matomo, no tag manager and no other third-party trackers that set cookies or build user profiles.

External merch shop

Our merch shop at fichte.shop runs on the SumUp platform and is a separate service with its own privacy policy. Clicking the shop link takes you off this website.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). An email to vorstand@fichtefreunde.de is all it takes. You also have the right to complain to a data protection authority — responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de).

Last updated

This privacy policy was last updated in August 2026. We will inform you here of any material future changes.