Privacy policy
Here you can find out which personal data is processed when you use our website, why we need it and what rights you have.
Who is responsible for processing your data
The controller is:
Resonanz Augsburg e.V.
Werderstraße 19
86159 Augsburg
Email: info@resonanz-verein.de
Represented by the board:
1st board member: Laurenz Lenke
2nd board member: Moritz Kronthaler
3rd board member: Jarl Bergmann
Each of the board members named above is authorised to represent the association individually.
For questions about data protection or to exercise your rights, you can contact the email address above.
Website provision, hosting and technical maintenance
This website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. According to the provider, hosting takes place in German data centres. When you visit the website, the hosting provider processes the technical data that your browser transmits to establish the connection and deliver the requested content. This includes, in particular, your IP address, the date and time, the page or file requested, information about your browser and operating system and, where applicable, the page previously visited, insofar as your browser transmits it as a referrer.
This processing serves to provide the website, secure its operation and investigate technical faults or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in maintaining a functioning and secure website.
According to the current Raidboxes documentation, the server logs accessible for website operation cover no more than seven days. This statement concerns the server logs described here. Other security logs, delivery logs and backups may have their own retention cycles. We do not treat IP addresses and the associated access data as anonymous by default.
The person responsible for technical maintenance has administrative access to the website. In this role, they may encounter technical logs and other personal data held in the system. This access is used to set up, maintain, troubleshoot and secure the website. The underlying processing is also based on our legitimate interest in reliable and secure website operation.
The connection between your browser and our website is encrypted using HTTPS. This does not mean that an email subsequently sent is end-to-end encrypted along its entire transmission route.
Locally hosted content and currently no website analytics
Our fonts, images and the preview image for the embedded video are served locally through the website. The Inter font used on this website does not establish a connection to Google Fonts.
The animation on the home page is also self-hosted. It does not transmit its own analytics data to an external service.
At present, no website analytics service is active. Independent Analytics is deactivated, and the SEOPress analytics feature is also switched off.
Contact form and email contact
When you contact us, we process the information you provide to understand and answer your enquiry and, where necessary, continue the conversation.
The contact form has three required fields: name, email address and message. In its current configuration, the form cannot be submitted without this information. There is no legal obligation to use the form or provide us with this information.
If your enquiry concerns a contract with you or related steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is in being available for questions about the association and our cultural activities and responding to them. We do not treat the act of sending a message as consent under data protection law.
The form entries are processed on the web server and sent by email. The configured message contains the three form fields; your email address is also used as the reply-to address. No additional archiving of form entries in a WordPress form database is configured. Nor is additional email logging by the website or forwarding to a newsletter service configured.
Server-side field and security checks are used to validate the form. No external CAPTCHA or spam-checking service is integrated for this purpose. Independently of this, the hosting provider and the email services involved may generate technical transport, security and error logs.
Receipt of contact form messages
Messages from the contact form are currently forwarded to a private Gmail mailbox belonging to the person responsible for technical maintenance. This person therefore receives your name, email address and the content of your message. This temporary receipt is used to set up and test delivery of form messages.
For Gmail in the European Economic Area, Google identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the company responsible under data protection law. During delivery and storage, Google processes message content and associated technical data. This includes, for example, processing to detect spam and misuse; further smart or personalised features depend on the settings of the Google account concerned. At present, these form messages are not stored exclusively at STRATO.
Processing outside the European Economic Area is possible. You can find further information in the section “Google data processing outside the European Economic Area”.
How long contact information is stored
The necessary retention period depends on the enquiry concerned. To deal with an enquiry, the message and associated correspondence are needed until the matter has been resolved and any necessary follow-up questions have been answered.
Further retention is considered only insofar as it is necessary for a specific, continuing purpose, for example to perform an agreed service, fulfil a statutory retention obligation that actually applies, or establish, exercise or defend legal claims. Depending on the purpose, this further processing is based on Article 6(1)(b), (c) or (f) GDPR. Not every message is subject to a statutory retention obligation.
Messages sent solely for testing are no longer needed for that test purpose once the relevant functional and delivery checks have been completed.
Cookies and browser storage
The website currently does not load a cookie banner and does not use active consent management. No new Complianz status cookies are set. Cookies from an earlier cookie choice may remain until they expire or are deleted through your browser settings.
The self-hosted video does not require approval for an external video service. No website analytics service is currently active.
Local session storage for the website display
The website uses your browser’s session storage, known as sessionStorage. The resonanz-page-color entry remembers the colour view you choose as you navigate within the current browser session. WordPress may also cache the result of a technical emoji-support check under wpEmojiSettingsSupports. These entries serve to display the website, rather than to collect visitor statistics. They generally last only for the current browser session and can be deleted using your browser’s features.
The requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) apply to storing or accessing information on your device. Insofar as personal data is processed for the technical display of the website, we rely on Article 6(1)(f) GDPR and our interest in a functioning website.
Video
The video on our About page is provided as an MP4 directly from our website server. The player does not establish a connection to YouTube or Google.
When the video file is loaded, the connection data necessary to deliver it is transmitted to our hosting provider. The processing of this data, in particular the IP address and technical browser information, is described in the section “Website provision, hosting and technical maintenance”.
The video player does not use YouTube cookies and does not permanently store sound or playback settings on your device.
Google data processing outside the European Economic Area
For the Google services described here, data may also be processed outside the European Economic Area, in particular by Google LLC in the United States.
Google LLC participates in the EU–US Data Privacy Framework. Insofar as a transfer is covered by the recipient’s active certification, it may rely on the European Commission’s adequacy decision under Article 45 GDPR. This decision does not apply indiscriminately to all companies or all processing in the United States.
For necessary transfers not covered by an adequacy decision, Google describes in particular the use of standard contractual clauses under Article 46 GDPR. You can find information about this and a contact route for requesting a copy in Google’s legal frameworks for data transfers. This does not mean that the association itself has concluded a corresponding contract with Google for every service described here.
Photos of association life and events
We publish photos on our website to introduce our association and provide information about cultural events and association life. People shown in these photos may be identifiable. Personal information may be apparent from the image itself and its context, for example its association with an event.
The images are served locally through our website. Published images are accessible worldwide to an unspecified group of people and may be saved or redistributed by others.
Publication based on your consent is governed by Article 6(1)(a) GDPR. You may withdraw this consent with effect for the future.
For suitable documentary photographs of events, Article 6(1)(f) GDPR may provide the legal basis if, in the individual case, our legitimate interest in reporting on the association’s work outweighs the conflicting interests and rights of the people shown. In particular, the event context, the identifiability and prominence of individual people, and special interests requiring protection must be taken into account. Attending an event alone does not constitute blanket consent to every publication of a photograph.
A photograph may remain published only for as long as the associated presentation or documentation purpose and its legal basis remain valid. Where a request for erasure is justified, we remove the images concerned from our website. We cannot guarantee that copies already made by third parties will be deleted everywhere; statutory obligations relating to the erasure of published data remain unaffected.
If you appear in a photo and would like information, a review or its removal, write to info@resonanz-verein.de. Where possible, identify the page and image concerned so that we can locate the photograph.
Links to other websites
Our Instagram links are ordinary outgoing links, rather than embedded Instagram content. Simply viewing our pages does not establish a connection to Instagram through these links.
Only when you open an external link do you visit the website of the relevant provider. Its privacy information applies to the processing that takes place there.
Your rights
Subject to the statutory requirements, you have the following rights:
Access and a copy of your data – Article 15 GDPR: You can find out whether we process personal data about you and, if so, which data, for what purposes, to which recipients it is disclosed, and how long it is stored or the criteria used to determine that period. In principle, this includes a copy of your personal data and, where available and relevant, information about its source.
Rectification – Article 16 GDPR: You can request that inaccurate personal data be corrected and incomplete personal data be completed.
Erasure – Article 17 GDPR: Where the statutory requirements are met, you can request erasure, for example if data is no longer needed, has been processed unlawfully or relevant consent has been withdrawn. This right may be limited, in particular, by statutory retention obligations or the necessary establishment, exercise or defence of legal claims.
Restriction – Article 18 GDPR: You can request restriction of processing, for example while disputed data or an objection is being reviewed, or if processing is unlawful and you prefer restriction to erasure.
Information about recipients – Article 19 GDPR: If we rectify or erase data or restrict its processing, we must generally notify the recipients to whom the data was disclosed, unless this is impossible or involves disproportionate effort. On request, we will inform you about these recipients.
Data portability – Article 20 GDPR: Insofar as we process data you have provided by automated means on the basis of consent or a contract, you can receive it in a structured, commonly used and machine-readable format and request its transmission to another controller, insofar as this is technically feasible and does not adversely affect the rights of others.
Automated decisions – Article 22 GDPR: In principle, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not make such decisions in connection with this website.
To exercise your rights, simply send a message to info@resonanz-verein.de. Requests are generally handled free of charge. The law generally requires a response within one month. If an extension is necessary because of the complexity or number of requests, we will inform you within that month of the reasons and the extended deadline.
Withdrawing consent and objecting to processing
You may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, you can contact info@resonanz-verein.de.
Right to object under Article 21 GDPR: If your data is processed on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
You have the right to object to processing for direct marketing without providing such grounds. No such direct marketing is configured as part of the website operation described here.
Complaining to a data protection supervisory authority
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. You do not have to contact us first.
The competent authority for our private association in Bavaria is:
Bavarian State Office for Data Protection Supervision – BayLDA
Postal address: Postfach 1349, 91504 Ansbach, Germany
Visitor address: Promenade 18, 91522 Ansbach, Germany
Telephone: +49 981 180093-0
Email for general enquiries: poststelle@lda.bayern.de
Contact BayLDA · Online data protection complaint. BayLDA recommends using its online form for complaints.