With the following information, the community foundation VR Bank in Holstein provides the data subject with an overview as well as information about the processing of personal data and the resulting data protection rights. The processing of personal data includes any operation such as collection, recording, storage, organization, arrangement, use, disclosure by transmission, linking and erasure. In doing so, the community foundation VR Bank in Holstein observes the legal requirements of data protection and processes personal data only to the extent that this is legally permissible and necessary.

1. person responsible for data processing

Bürgerstiftung VR Bank in Holstein
Bismarckstraße 11-13
25421 Pinneberg

If the data subject has any questions about this privacy statement, he or she may contact the following address:

Bürgerstiftung VR Bank in Holstein
Bismarckstraße 11-13
25421 Pinneberg
E-Mail buergerstiftung@vrbank-ih.de

2. person concerned

A data subject is any natural person whose personal data is processed by Bürgerstiftung VR Bank in Holstein. A data subject thus basically enters into contact with the Civic Foundation VR Bank in Holstein, for example as:

• Donor
• Founder
• Applicant for project funding
• Partner for projects
  
  

3. personal data

In accordance with the legal definition, Bürgerstiftung VR Bank in Holstein understands personal data to be any information that relates to an identified or identifiable natural person. A natural person is considered to be identifiable if he or she can be identified directly or indirectly, in particular by means of association with an identifier such as a name, with another identification number or with location data. The same applies with regard to identification by several special characteristics of the natural person that are an expression of their physical, physiological, genetic, psychological, economic, cultural or social identity, insofar as such are processed by us as Bürgerstiftung VR Bank in Holstein.

Bürgerstiftung VR Bank in Holstein only processes special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation (DS-GVO) if this is exceptionally permissible and necessary, i.e. primarily personal data that the person concerned has made public himself/herself.

4. data sources

The VR Bank in Holstein community foundation primarily processes data that it receives directly from the data subject on the basis of the business relationship and that is necessary for this purpose. In addition, the necessary data is also processed by the parent company, VR Bank in Holstein eG, as well as from publicly accessible sources, in particular foundation registers.

The categories of data originating from third parties and processed by Bürgerstiftung VR Bank in Holstein are in particular:

• Names and addresses for donation receipts
• Names and addresses of project partners
  
  

For more detailed information, in particular on the transfer of personal data by third parties to the community foundation VR Bank in Holstein or from the community foundation VR Bank in Holstein to third parties, the data protection officer is available as a contact person under the contact details provided.

In cases where Bürgerstiftung VR Bank in Holstein collects personal data from third parties and not from the data subject, the data subject generally has a right of appeal to the supervisory authority.

5. processing purpose and legal bases

Data processing is always carried out in accordance with the provisions of data protection law, first and foremost in order to fulfill the contractual and legal obligations in the provision of services, donations and other transactions of the community foundation VR Bank in Holstein. In doing so, the community foundation VR Bank in Holstein particularly observes the principle of data minimization so that, as a matter of principle, only the data specifically required for the transaction in question is processed. This includes, in particular, necessary demand analyses and product optimizations within the scope of the business relationship, e.g. for sending donation confirmations.

a) If the data subject gives consent to the processing of personal data for specific purposes (e.g. transfer of data within the group), the lawfulness of the processing follows from Art. 6 (1) sentence 1 a) DS-GVO. Consent may be revoked at any time with effect for the future. This also applies to consent given to the model organization before the DS-GVO came into force, i.e. before May 25, 2018. However, the revocation of consent does not affect the lawfulness of the data processed until the revocation or the further processing based on another legal basis.

b) For the fulfillment of contractual obligations and for the implementation of pre-contractual measures, which are carried out at the request of the data subject pursuant to Art. 6 para. 1 p. 1 b) DS-GVO, the following data are required, for example, as follows:

• Name
• Adress
• Date of grant
• Documentation data to be able to prove the communication during the business relationship
  
  

c) Data processing is often based on a legal or regulatory obligation within the meaning of Art. 6 (1) p. 1 c) DS-GVO. These include, for example, the BGB and the EstG.

d) Some processing operations are carried out pursuant to Article 6 (1) sentence 1 e) of the GDPR on the basis of the performance of tasks that are in the public interest. These include, in particular, donation activities to non-profit institutions.

e) Insofar as it is necessary from the point of view of Bürgerstiftung VR Bank in Holstein, it shall also process the personal data in accordance with Art. 6 (1) p. 1 f) DS-GVO beyond the actual fulfillment of the contractual obligations in order to safeguard its legitimate interests or the interests of third parties. However, this is only done if these interests outweigh the conflicting interests of the data subject after weighing them against each other. As a rule, the community foundation VR Bank in Holstein acts on the basis of its own economic interests. The legitimate interests of the community foundation VR Bank in Holstein to process personal data are:

• Donation receipts
• Financial reports

6. data sharing

Within Bürgerstiftung VR Bank in Holstein, only those offices will have access to your data that require it for the fulfillment of their tasks. In addition, data within Bürgerstiftung VR Bank in Holstein as well as the parent company of Bürgerstiftung VR Bank in Holstein are sometimes disclosed to the extent that this is covered by the aforementioned processing purposes and legal bases. The purposes of this data transfer are:

• Donation receipts
• Annual financial statements
• Accounting system
  
  

Furthermore, service providers and vicarious agents of the community foundation VR Bank in Holstein receive personal data for the aforementioned processing purposes if they maintain confidentiality and undertake to do so and the data transfer is otherwise based on one of the above-mentioned legal bases. The community foundation VR Bank in Holstein engages service providers partly on a temporary basis, partly on a long-term basis for accounting services including the preparation of annual financial statements. In all cases, the service providers and vicarious agents used receive only the data that is necessary and mandatory for the performance of individual tasks.

A transfer of data to bodies outside the direct geographical scope of the GDPR shall only take place insofar as

• it is necessary for the execution of the orders of the data subject
• it is required by law or
• the data subject has consented

7. duration of data storage

The storage of personal data is a processing operation that is also governed by the respective contractual and legal requirements. As soon as the stored data is no longer required for the underlying processing purposes, it is compulsorily deleted. As a rule, however, Bürgerstiftung VR Bank in Holstein is obliged to retain personal data beyond the end of the contractual relationship for reasons of commercial law, tax law and other legal requirements. The period may be up to ten years. Reference is made to the relevant laws, in particular § 257 of the German Commercial Code, § 147 of the German Fiscal Code, § 8 of the German Money Laundering Act and EstG. Insofar as Bürgerstiftung VR Bank in Holstein requires data and documents with a personal reference as evidence for the assertion, exercise or defense of legal claims, Bürgerstiftung VR Bank in Holstein shall refrain from deleting them primarily in accordance with the respective limitation periods and shall restrict their processing for other purposes. In special cases, such as a donation commitment without disbursement due to lack of bank details or realization of the project, the relevant documents and data are also retained for a longer period of time due to current case law as evidence in consideration of legitimate concerns.

8. rights of the data subject

The data subject has a variety of rights vis-à-vis Bürgerstiftung VR Bank in Holstein, in particular the right to obtain information from Bürgerstiftung VR Bank in Holstein about the personal data concerned (Art. 15 DS-GVO), rectification (Art. 16 DS-GVO), erasure (Art. 17 DS-GVO), restriction of processing (Art. 18 DS-GVO), data portability (Art. 20 DS-GVO) and objection to processing (Art. 21 DSGVO). In the case of the right to information and the right to rectification, the restrictions of Sections 34 and 35 BDSG must be observed. In the case of the right to object to public bodies, the restriction of Section 36 BDSG. Furthermore, the data subject has the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 DS-GVO, § 19 Bundesdatenschutzgesetz), to which we expressly refer.

Furthermore, Bürgerstiftung VR Bank in Holstein shall notify all recipients to whom personal data have been disclosed of any rectification or erasure of the personal data or restriction of processing pursuant to Articles 16, 17 (1) and 18 DSGVO, unless this proves impossible or involves a disproportionate effort. Bürgerstiftung VR Bank in Holstein shall inform the data subject about these recipients if the data subject so requests.

9. obligations of the data subject

The data subject is obliged to disclose those personal data which the community foundation VR Bank in Holstein is legally obliged to process and which are necessary for the establishment as well as the performance of the contractual relationship. Without these personal data to be processed and specifically required, the community foundation VR Bank in Holstein will regularly not be in a position to conclude a typical business contract with the data subject and to fulfill the contractual as well as legal obligations, e.g. trust foundation.

10. right of objection

The data subject may exercise the right to object pursuant to Article 21 DS-GVO to the processing of personal data concerning him or her which is carried out on the basis of Article 6 (1) sentence 1 e) and f) DS-GVO, and at any time to the processing of personal data concerning him or her for the purposes of direct marketing, including any related profiling. The data subject may contact the Bürgerstiftung VR Bank in Holstein at the address specified above. The community foundation VR Bank in Holstein has set up - in particular also for an objection to direct marketing - the e-mail address, which can be used:

buergerstiftung@vrbank-ih.de

The objection to data processing and the revocation of consent (cf. item 5 a)) apply in parallel. In the event of an objection, the personal data concerned will in principle no longer be processed by Bürgerstiftung VR Bank in Holstein. Exceptionally, the data will nevertheless continue to be processed - except in the case of an objection to direct marketing - if compelling legitimate grounds are demonstrated which override the interests, rights and freedoms of the data subject, or if the processing serves to assert, exercise or defend legal claims.

The community foundation VR Bank in Holstein will inform the data subject who has exercised his/her right to object without delay (but at the latest within one month of receipt of the objection) of measures that it has taken or will take following the objection in order to safeguard the rights and freedoms of the data subject and to implement his/her right. If the community foundation VR Bank in Holstein does not comply with the objection - for example, due to a lack of objection requirements - and does not take appropriate measures, the community foundation VR Bank in Holstein will inform the data subject of the reasons, including his or her rights to lodge a complaint with a supervisory authority or to seek judicial remedy.

Pinneberg, November 26, 2019

Bürgerstiftung VR Bank in Holstein