Privacy Policy of Futouris e.V.

Futouris e.V. provides this Privacy Policy to inform you about how personal data is collected and processed on our website and within the scope of our association membership, as well as about the rights of data subjects. Data protection is of great importance to us, and we are committed to respecting your privacy and personal rights. We only collect, process and use your personal data insofar as this is permitted under the German Federal Data Protection Act (BDSG) and the General Data Protection Regulation (Datenschutz-Grundverordnung - DSGVO, "GDPR").

1. General Information / Definitions

This Privacy Policy is based on the terminology used in the GDPR and is intended to be easy to read and understandable for all individuals. Therefore, we would like to clarify several key terms in advance:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its future processing.

e) Pseudonymisation

Pseudonymisation means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

f) Controller

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) Processor

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) Recipient

A recipient is a natural or legal person, public authority, agency or another body to which personal data is disclosed, whether or not it is a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

i) Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

j) Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Controller Responsible for Data Processing

Below, we inform you about the collection of personal data by Futouris e.V. Personal data means all information relating to an identified or identifiable person, such as name, address, email address, user behaviour, etc. The controller according to Article 4(7) GDPR is:

Futouris e.V.
Heidenkampsweg 58
20097 Hamburg
Germany

Phone: +49 (0) 40 8090344055
Data Protection Coordinator: Inga Meese

Futouris e.V. has implemented technical and organisational measures to ensure the most complete protection of personal data processed through this website. However, internet-based data transmissions may in principle have security vulnerabilities, so absolute protection cannot be guaranteed.

You are therefore free to transmit personal data to us via alternative means, e.g., by telephone.

3. Your Rights

a) Right to withdraw consent

Pursuant to Article 7(3) GDPR, you have the right to withdraw your consent at any time. Consequently, we may no longer continue the data processing that was based on this consent for the future.

b) Right of access / Additional rights

Pursuant to Article 15 GDPR, every data subject has the right to obtain from the controller, free of charge, information about the personal data stored about them and a copy of this information. Furthermore, the data subject has the following rights:

• Right to rectification of inaccurate data

• Right to erasure (“right to be forgotten”)

• Right to restriction of processing

• Right to data portability

• Right to information about the source of the data if not collected from the data subject

• Right to object to processing

• Right to information about automated decision-making, including profiling, and the right to request meaningful information about the logic involved

c) Right to rectification

Under Article 16 GDPR, you have the right to request the immediate rectification of inaccurate personal data stored by us, or to have incomplete personal data completed.

d) Right to erasure

According to Article 17 GDPR, you have the right to request the deletion of your personal data unless processing is required for exercising freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

e) Right to restriction of processing

Under Article 18 GDPR, you have the right to request restriction of processing where you contest the accuracy of the data, the processing is unlawful and you oppose erasure, we no longer need the data but you require it for legal claims, or you have objected to processing pursuant to Article 21 GDPR.

f) Right to data portability

Under Article 20 GDPR, you have the right to receive your personal data provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller.

g) Right to information on transfers

You also have the right to be informed whether personal data has been transferred to a third country or an international organisation, and if so, about the appropriate safeguards relating to the transfer.

h) Right to object

Where your personal data is processed based on legitimate interests under Article 6(1)(f) GDPR, you have the right to object to processing on grounds relating to your particular situation. You may exercise this right by emailing info@futouris.org or contacting us at the address mentioned above.

If your objection concerns direct marketing, you have a general right to object without providing reasons.

i) Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority. The authority responsible for our organisation is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22
20459 Hamburg
Tel.: +49 (0) 40 428 54 - 4040
Email: mailbox@datenschutz.hamburg.de

You may also contact us at any time for questions or concerns regarding data protection via the above postal address or via info@futouris.org.

4. Data Protection in Connection with Contacting Us

If you contact us by email or via a contact form, the data you provide (your email address, and if applicable your name and telephone number) will be stored for the purpose of processing your enquiry. This data, voluntarily provided by a data subject, will be used exclusively for handling the enquiry. It will not be used for other purposes nor shared with third parties.

We delete the data once storage is no longer necessary, or restrict processing if statutory retention periods apply. Legal bases: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

5. Data Protection for Membership Enquiries

We collect and process personal data such as name, address, telephone number and email address of company representatives who express interest in becoming Futouris members. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the preparation and conclusion of new memberships.

6. Data Protection in Recruitment Processes

We collect and process applicant data for the purpose of conducting recruitment procedures. Processing may occur electronically, e.g., by submitting applications via email or through a form on our website.

If an employment contract is concluded, the data will be stored for employment-related purposes. If no contract is concluded, application documents are deleted unless legitimate interests (e.g. obligations under the German General Equal Treatment Act – AGG) oppose deletion.

Legal basis: Article 6(1)(b) GDPR, Article 6(1)(f) GDPR and § 26 BDSG.

7. Data Protection in Connection with Membership in the Association

Upon joining Futouris e.V., we collect the following information from members (natural persons; legal entities and their authorised representatives):

• Form of address, title, first name, last name

• Address

• Email address

• Telephone number

• Bank details for SEPA direct debit authorisation

We use this data to:

• Identify you as a member

• Provide appropriate support and information

• Comply with legal obligations

• Correspond with you

• Issue invoices and conduct dunning procedures

• Assert potential claims

• Prepare and execute projects and events in line with the statutory objectives of Futouris e.V.

  • Member information via the Futouris mailing list (blind copy)

  • Collaboration in project working groups (open mailing lists)

  • Sending event invitations via Outlook (open distribution lists required technically)

We also maintain a contact list (name, email address, company address) provided to members and to the voluntary Scientific Advisory Board upon request.

New members are added to the newsletter mailing list. Legal basis: Article 6(1)(b) GDPR. Consent may be withdrawn at any time. Data is deleted upon termination of membership.

Use of photographs

We publish photos from events (e.g., annual meetings, strategy workshops, project meetings) on our website and social media (LinkedIn, Instagram). Consent for photography is obtained from each participant and may be withdrawn at any time. Legal basis: Article 6(1)(f) GDPR; for sensitive data: Article 9(2)(a) GDPR.

8. Futouris Newsletter

If you have consented under Article 6(1)(a) GDPR, we use your email address to send you our newsletter. A valid email address and registration via double opt-in are required.

Newsletter service provider

The newsletter is distributed via Brevo, to whom we transmit subscriber email addresses. Brevo and Futouris use this data exclusively for newsletter distribution. Brevo’s privacy policy can be found here.

Subscribers may receive emails regarding changes to the service. You may unsubscribe at any time via the link included in each newsletter or by contacting us at info@futouris.org.

9. Futouris Website

a) Information about your computer when visiting the website

When visiting our website, the browser on your device automatically transmits certain technically necessary data, which is stored in log files, including:

• IP address

• Date and time of access

• Name and URL of requested file

• Referrer URL

• Browser, operating system, device type

• Status codes and data volume transferred

Purposes:

• Ensuring a smooth website connection

• Technical provision of the website

• Evaluation of system stability and security

• Administrative purposes

Legal basis: Article 6(1)(f) GDPR (legitimate interest). We do not use this data for tracking or profiling.

b) Website hosting

Our hosting provider is Vercel Inc., USA. Technically necessary data is processed during website access. Legal basis: Article 6(1)(f) GDPR.

c) Cookies

We do not use cookies that store personal data or enable tracking. Only technical connection data is processed.

d) Content delivery via Storyblok

We use the headless CMS Storyblok (Storyblok GmbH, Austria). Only technical data required for content delivery via CDN is processed. No cookies or tracking. Legal basis: Article 6(1)(f) GDPR.

e) Web analytics with Umami (Cloud Version)

We use Umami, a privacy-friendly analytics tool without cookies or personal data processing. All data is anonymised. Legal basis: Article 6(1)(f) GDPR.

10. Public Relations via Social Media

a) Instagram

We maintain an Instagram profile provided by Meta Platforms Ireland Ltd. Access from our website occurs only when you click the external link.

Meta may then process your data (e.g., IP address, interaction data). If you are logged into Instagram, data may be linked to your account.

We have no control over Instagram’s data processing. Their privacy policy applies.

Joint controllership for Instagram Insights (Art. 26 GDPR)

We and Meta Platforms Ireland Ltd. jointly act as controllers regarding statistical Insights data. Meta bears primary responsibility, including for data subject rights. You may exercise rights with Meta or with us.

b) LinkedIn

We maintain a LinkedIn page operated by LinkedIn Ireland Unlimited Company. Data processing occurs only when accessing the LinkedIn website via external link.

Joint controllership for LinkedIn Page Insights (Art. 26 GDPR)

LinkedIn holds primary responsibility for Page Insights and data subject rights. You may contact LinkedIn directly or contact us to forward your request.

11. No Disclosure of Personal Data

We do not disclose your personal data to third parties unless you have consented, disclosure is necessary for contractual purposes, or we are legally authorised or obligated to do so (e.g., for law enforcement or protection of intellectual property).

12. Deletion or Blocking of Data

We adhere to the principles of data minimisation. Data is stored only for as long as necessary or as required by statutory retention periods. Once the purpose no longer applies, data is deleted or blocked.

Applicant data is deleted three months after the recruitment process ends unless legitimate interests prevent deletion.

13. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy to reflect legal changes or to update information about our services. The updated Privacy Policy will apply to your next visit.