Data protection

With the following information Deutsche Umwelthilfe e.V. (hereinafter referred to as DUH) gives you an overview of the processing of your personal data as a member, donor, interested party and business partner in accordance with the GDPR.

I. Controller / Contact Person

The controller within the meaning of the GDPR is

Deutsche Umwelthilfe e. V.
Fritz-Reichle-Ring 4
78315 Radolfzell

Phone: 07732 999 5-0
e-mail: info@duh.de

Federal Managing Directors: Jürgen Resch, Sascha Müller-Kraenner, Barbara Metz
Executive Board: Prof. Dr. Harald Kächele (†), Burkhard Jäkel, Carl-Wilhelm Bodenstein-Dresler

AG Hannover VR 202112

If you have any questions about the processing of your personal data by us or about data protection in general, please contact the data protection officer at the address given in the imprint or at the following e-mail address: datenschutz@duh.de. If you wish to maintain confidentiality, please contact our data protection officer by post.

II. Categories of personal data

Which categories of personal data are processed by DUH depends to a large extent on the occasion and the framework in which a contact or a contractual relationship with you is established or exists.

A distinction must be made, for example, between (supporting) members, donors, interested parties and business or project partners. Within the scope of a membership, a donation, a participation campaign, the ordering of information material, a petition, an inquiry, the provision of free advertisement publication (online/offline) or any other contract, DUH usually processes the following categories of data depending on the concrete relationship. In forms with which personal data is collected, it is marked in each case which data is absolutely necessary for this and which data can be communicated voluntarily.

• surname, first name, address, contact details (telephone, e-mail), date of birth, branch/occupation, other data, such as any interests, as well as member and donor numbers;
• enterprise name, if necessary also consisting of surname, first name, address, contact data (telephone, e-mail), industry, contact person in the enterprise with surname, first name, function, contact data (telephone, e-mail);
• if necessary, legitimation data (e.g. ID card data), authentication data (e.g. specimen signature), tax ID;
• payment transaction and order data (e.g. bank details / credit card data, payment orders);
• order history and turnover with business partners;
• data in the context of litigation (e.g. on the parties involved, attorneys, courts);
• (sponsor)member and donor histories, history of interested parties with regard to activities and legacies.

If direct contact is made with you during (sponsor)membership, donation and interested party support of join-in campaigns or a business relationship, further data, such as information on the contact channel, date, occasion and result and copies of correspondence will be processed.

III. Personal data not obtained from the data subject

Occasionally DUH also obtains address data (e.g. first name, surname, address) not from the data subject, e.g. for a content-related or promotional approach based on the weighing of interests in accordance with Art. 6 (1) f) GDPR, but from public directories (e.g. telephone/industry directories), from generally accessible sources (e.g. Internet) or from address service providers. You can object to this use of content or advertising at any time with effect for the future by using the above contact details (see section I. and VIII.).

In the event that consent is granted to receive further telephone information about the work of DUH in accordance with Art. 6 (1) b) GDPR, which may be revoked at any time vis-à-vis DUH with effect for the future, DUH shall collect the telephone number for telephone contact from publicly accessible telephone directories. The telephone number shall only be processed if it can be clearly assigned to your person. The telephone number will not be queried within the scope of the consent, as no authentication is possible in contrast to the e-mail address in the double opt-in procedure.

IV. Purposes of data processing and legal basis

DUH processes your aforementioned personal data and categories of personal data in order to fulfil the respective contract (e.g. (sponsor)membership, donation, chargeable orders, invitations, workshops/conferences, other business relationship) or to carry out pre-contractual measures (e.g. contact requests with regard to contractual measures) with you according to Art. 6 (1) b) GDPR. For these purposes your contact data will also be used, e.g. in the context of specific information and queries.

DUH is also subject to various legal requirements (e.g. money laundering law, tax laws) and processes your data in this respect also on the basis of legal requirements according to Art. 6 (1) c) or in the public interest according to Art. 6 (1) e) GDPR. The purposes of processing include

• the application and documentation requirements in connection with grants from public authorities;
• the control and verification obligations in the context of the allocation of fines and financial obligations;
• the obligation to provide evidence in the context of the execution of wills and legacies;
• the fulfilment of obligations under social security law (e.g. statutory accident insurance) within the scope of insurance cover, e.g. for volunteers; the prevention of fraud and money laundering
• the fulfilment of fiscal control and reporting obligations and auditing requirements;
• the fulfilment of official and court instructions and orders;
• as well as the evaluation and control of risks at DUH.

If necessary, DUH will process your data within the framework of the balancing of interests according to Art. 6 (1) f) GDPR in order to protect the legitimate interests of DUH or third parties. For example:

• participation in participatory actions of providing free publication of advertisements, ordering free information materials and general inquiries;
• participation in petitions (online or via signature lists);
• meetings and exchange of contact data/experience between DUH and participants in workshops, conferences, working groups etc. and as well as sending further project-specific information;
• the publication of images on the website, in print products and on social media channels in connection with the coverage of events of DUH;
• measures for the management of associations and further development of statutory tasks, also in connection with other organisations, such as the Global Nature Fund (GNF) International Foundation for Environment and Nature;
• exchange of experience with other national and international environmental protection organisations in the context of global strategies and global environmental protection;
• transfer of contact data between the inquirers and internal and external environmental experts of DUH;
• statistical evaluations with regard to the use of the newsletter services of DUH;
• assertion of legal claims and defence in legal disputes;
• ensuring the IT security and IT operation of DUH;
• prevention of crime;
• measures for building and plant security (e.g. access controls);
• use of the guest WLAN;
• data exchange with credit agencies to determine creditworthiness or default risks of business partners.

Also within the framework of the balancing of interests according to Art. 6 (1) f) GDPR to safeguard the legitimate interests of DUH, DUH processes your data, e.g. on the basis of (sponsoring)membership, the donation relationship, participatory campaigns, existing contracts or requests for needs-based information oriented to your interests within the framework of the statutory purposes of DUH (self-advertising) according to the following standards:

• postal advertising, provided that you have not objected to this processing; you can object to this advertising use at any time with effect for the future by using the above contact details (see section I. and VIII.);
• telephone advertising to enterprises in the event of your presumed consent to this, unless you have objected to this processing; you can object to this advertising use at any time with effect for the future using the above-mentioned contact details (see section I. and VIII.)
• Matching of e-mail addresses or telephone numbers by means of an intermediary service provider against e-mail addresses or telephone numbers and address data of address service providers for the purpose of sending postal advertising by the address service provider using the lettershop procedure; in this case, your data is not transmitted to the address service provider and address data of the address service provider is not transmitted to DUH; only if you contact DUH as a result of the postal advertising, DUH will collect the necessary data directly from you; you can also opt out of this advertising use at any time with effect for the future under the above-mentioned contact details (see section I. and VIII.).

DUH will not transfer your data to third parties for advertising purposes.

Insofar as you have given us consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent in accordance with Art. 6 (1) a) GDPR. Any consent granted can be revoked at any time with effect for the future at the above contact details (see section I.). Consent may be given for

• the sending of the DUH newsletter, which may be oriented towards your interests (e.g. in the context of information requests and interest in certain topics of the newsletter) to your e-mail address;
• the use of the occasion/content of a participation in petitions for the possible design of the content of the newsletter according to the interests of the petitioner;
• telephone advertising within the framework of the statutory purposes of DUH also for donations in favour of DUH.

V. Recipients and categories of recipients of the data

Within DUH, only those offices that need access to your data to fulfil our contractual and legal obligations are granted access. Service providers employed by DUH may also receive data for these purposes if they are commissioned as processors in accordance with Art. 28 GDPR.

Possible recipients of personal data are, for example

• cooperation partners with whom joint actions and projects (e.g. join-in actions) are carried out online or by means of print products;
• national and international environmental protection organisations within the framework of global strategies and global environmental protection;
• public bodies and institutions (e.g. tax authorities, Federal Central Tax Office) if there is a legal or official obligation;
• grantor/third party funding, if the action, event or similar is financed by grant/third party funding;
• participants in workshops, conferences, working groups etc. of DUH;
• other credit and financial services institutions;
• processors, e.g. for member and donation recruitment, for the support/maintenance of IT/IT applications, archiving, document processing, call center services, compliance services, controlling, data screening in accordance with legal requirements, printing and sending personalized letters, e-mail dispatch, data destruction, auditing services and payment transactions;
• credit inquiry agencies in the context of a creditworthiness inquiry on enterprises;
• further data recipients on the basis of a consent given by you.

VI. Transfer of data to a third country or international organisation

Data will only be transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary for the execution of your orders, if it is legally required (e.g. tax reporting obligations), if you have given us your consent or if it is part of an order data processing. If service providers are used in the third country, which is currently not the case, they are obliged to comply with the level of data protection in Europe by means of appropriate measures (e.g. agreement of the EU standard contract clauses) in addition to written instructions.

VII. Duration of data storage

DUH processes and stores your personal data as long as it is necessary for the fulfilment of contractual and legal obligations as well as on the basis of the weighing of interests taking into account the respective data category. If the data are no longer required for this purpose, they are regularly deleted, unless their - temporary - further processing is necessary, e.g. in a separate archive with restricted access rights, for the following purposes:

• fulfilment of commercial and tax law retention periods (e.g. German Commercial Code, German Tax Code and Money Laundering Act with the retention or documentation periods specified therein for a period of two to ten years, e.g. for business letters, contracts, orders, invoices and grant certificates);
• preservation of evidence for a period of 30 years in accordance with § 197 BGB (German Civil Code), e.g. in the context of claims which have been determined to be legally binding, claims from enforceable settlements or enforceable deeds;
• preservation of evidence for a period of 3 years in accordance with § 195 BGB (German Civil Code) for purposes of proof and any necessary clarification of judicial or extrajudicial claims (e.g. correspondence in the context of processing the rights of the persons concerned).

VIII. Your further data protection rights

The following additional rights are available to you as a data subject in principle and, insofar as contractual and statutory obligations do not conflict with this:

• right of access (Art. 15 GDPR) with the restrictions according to §§ 34, 35 BDSG n.F;
• right to rectification (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR) with the restrictions of §§ 34, 35 BDSG as amended;
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to lodge a complaint with a supervisory authority (Art. 77 GDPR);

Rights to object

There is a right of objection (Art. 21 (I) GDPR) on a case-by-case basis for reasons arising from your particular situation and relating to data processing pursuant to Art. 6 (I) e) and Art. 6 (I) f) GDPR.

There is also a right to object to the processing of data for advertising purposes (Art. 21 (III) GDPR), the so-called right to object to advertising. You can object to the future use of your data for advertising purposes at any time by using the above contact details (see section I.).

IX. Obligation to provide data

Within the framework of a business relationship (e.g. (sponsoring)memberships, handling of donations, other contracts) you must provide those personal data which are necessary for the establishment and execution of a business relationship and the fulfilment of the associated contractual obligations or which we are legally obliged to collect. Without this data, we will usually have to refuse to conclude the contract or to execute the order or we will not be able to execute an existing contract and may have to terminate it.