Privacy policy

This is a translation for your convenience. Only the German version is legally binding: Datenschutzerklärung.

1. Controller

Our legal notice is available at www.project-care-coin.org/en/legal-notice.

2. General information and SSL/TLS encryption

This privacy policy explains the type, scope and purpose of the processing of personal data on the website www.project-care-coin.org (hereinafter “website”), in our surveys (section 7), our newsletter (section 8) and when you contact us by email (section 9).

Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). This includes in particular your name, email address and IP address. According to the case law of the Court of Justice of the European Union (CJEU, judgment of 19 October 2016, C-582/14), IP addresses are personal data.

SSL/TLS encryption: For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar and the padlock symbol. When encryption is active, the data you send us cannot be read by unauthorised third parties. The encrypted connection ends at our hosting provider Cloudflare (see section 4), which processes the data on our behalf.

3. Legal bases for processing

Art. 6(1) GDPR provides six equally valid legal bases for processing data. We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR – consent: the data subject has given consent to one or more specific processing operations.
• Art. 6(1)(b) GDPR – performance of a contract: the processing is necessary to perform a contract or to take steps prior to entering into a contract.
• Art. 6(1)(c) GDPR – legal obligation: the processing is necessary to comply with a legal obligation.
• Art. 6(1)(f) GDPR – legitimate interests: the processing is necessary for the legitimate interests of the controller or a third party, unless these are overridden by the interests or fundamental rights of the data subject.

We name the relevant legal basis for each processing operation in the following sections.

Obligation to provide data: You are under no legal or contractual obligation to provide us with personal data. However, the website cannot be delivered without processing the technically necessary connection data (section 4). To receive the newsletter, you need to provide an email address; without it, we cannot send you the newsletter.

4. Hosting and content delivery network (Cloudflare)

4.1 Provider and function

The website is hosted and delivered via Cloudflare’s content delivery network (CDN):

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

Cloudflare provides hosting infrastructure, CDN services and security features (including protection against DDoS attacks). For the service to work, network traffic – including your IP address and other technical connection data – is routed through Cloudflare’s servers.

4.2 Data processed and purposes

• IP address
• Time and duration of the page visit
• Browser type and version, operating system
• Referrer URL
• HTTP status codes and amount of data transferred

This data is processed in so-called server log files. It is technically necessary to deliver the website in a stable, secure and fast way and to detect and prevent attacks and misuse.

4.3 Legal basis

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, reliably and quickly, and in protecting it against cyber attacks and unlawful access.

4.4 Storage period

Server log files and IP addresses are stored only briefly and deleted as soon as they are no longer needed for operation and security. In the event of a specific security incident, individual log data may be kept longer for the duration of the investigation.

4.5 Data processing agreement and transfer to third countries

We have a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. As Cloudflare is based in the USA, personal data is transferred to the USA. The transfer is protected by the following safeguards:

• EU-U.S. Data Privacy Framework (DPF): Cloudflare, Inc. is certified under the European Commission’s adequacy decision of 10 July 2023.
• EU standard contractual clauses (SCCs): In addition, the standard contractual clauses approved by the European Commission (Decision 2021/914) have been agreed.

5. Cookies and similar technologies

Cookies are small text files stored on your device. Under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing information on your device or accessing information stored on it is only permitted with your consent, unless it is strictly necessary to provide the service (Section 25(2) no. 2 TDDDG).

This website does not set any cookies and does not store any information in your browser, neither for analytics nor for marketing purposes. Plausible Analytics works without cookies (see section 6), fonts are loaded from our own server, and links to social networks such as LinkedIn or X are simple links without embedded content. A consent request (cookie banner) is therefore not required.

Should we use technologies that require consent in the future, we will ask for your consent beforehand and update this privacy policy accordingly.

Links to LinkedIn and X: Our website links to our pages on LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland) and X (X Internet Unlimited Company, Dublin, Ireland). These are simple links without embedded content; no data is transferred to these providers when you visit our website. Only when you follow a link does the respective provider’s privacy policy apply.

6. Plausible Analytics

6.1 Provider and purpose

To analyse how our website is used, we use the web analytics service Plausible Analytics:

Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia

Plausible Analytics collects aggregated usage statistics (e.g. page views, referrer URLs, device used, approximate origin at country level) so that we can improve our website and measure the reach of our content.

6.2 Special features of the service

Plausible Analytics is designed to be privacy-friendly: it sets no cookies and creates no personal profiles. IP addresses are not stored permanently; to recognise unique visits, a daily changing, server-side hashing method is used that does not allow tracing back to individuals. Individual visitors are not tracked across days.

6.3 Data processed

• Shortened or hashed IP address (not stored permanently)
• Page visited (URL), referrer URL
• Browser type, operating system, device type
• Country of origin (at country level)

6.4 Legal basis

Plausible Analytics sets no cookies and stores no information on your device. When a page is loaded, the script only reads the information needed for counting, such as the page address, the referring page and whether the visit is automated. It also checks whether an exclusion of the site owner’s own visits has been set in the browser. Individual visitors are not recognised across several days. In our assessment, no consent under Section 25 TDDDG is required for this. The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to analyse and improve the use and reach of our website without intruding on your privacy.

6.5 Data processing agreement, storage period and transfer to third countries

We have a data processing agreement with Plausible Insights OÜ pursuant to Art. 28 GDPR; it is part of Plausible’s terms of use. The data is processed in the EU and stored on servers in Germany. Aggregated statistics are stored for as long as we use Plausible. They do not contain any personal data. As a rule, no data is transferred to countries outside the EEA with this service. For more information, please see Plausible Analytics’ privacy policy at plausible.io/privacy.

7. Surveys and other forms (Tally)

7.1 Provider and purpose

For surveys and other online forms, for example for user research, we use the service Tally:

Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium

Tally makes it possible to create and process online forms. Our forms are either linked and then open on tally.so, or embedded in our website. With embedded forms, your browser loads the form from Tally as soon as you open the page; your IP address is transmitted to Tally in the process. When you fill in and submit a form, your information is sent to us via Tally’s infrastructure and stored in encrypted form in Europe. According to the provider, Tally’s built-in form statistics work without cookies and without personal data.

7.2 Data processed

The data we process depends on the form. Typically, this includes:

• Name
• Email address
• Your answers in the form
• Time of submission
• Technical connection data (IP address, browser type – via Tally’s infrastructure)

7.3 Legal basis

Your information in surveys and similar forms is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give directly in the form. Participation is voluntary. You can withdraw your consent at any time with effect for the future, e.g. by email to contact@project-care-coin.org.

7.4 Storage period

The data submitted via Tally is deleted once the evaluation is complete, at the latest 6 months after the end of the respective survey, or when you withdraw your consent. Where possible, we evaluate the results anonymously. We may keep aggregated, anonymised results beyond that.

7.5 Data processing agreement and transfer to third countries

We have a data processing agreement with Tally BV pursuant to Art. 28 GDPR. Tally is based in Belgium (EEA) and stores form data in encrypted form in Europe. However, Tally uses subprocessors, some of which are located in third countries, in particular the USA. Where data is transferred to third countries, this is done on the basis of an adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or the EU standard contractual clauses (see section 11). More information: tally.so/privacy.

8. Newsletter (Brevo)

8.1 Provider and purpose

We use the service Brevo (formerly Sendinblue) to send our newsletter:

Sendinblue SAS, 9–17 rue Salneuve, 75017 Paris, France

When you subscribe to our newsletter, your information is sent directly to Brevo via a server-side interface of our website and processed there to send and manage the newsletter and to evaluate it anonymously. No Brevo scripts or cookies are used on our website for this.

8.2 Data processed

• Email address (required)
• Language selected (German or English)
• Time of sign-up and confirmation (double opt-in)
• IP address from which you confirmed your sign-up; Brevo stores it together with the time of confirmation as proof of your consent
• Opens and clicks in anonymised, aggregated form (not linked to you as a person)

8.3 Double opt-in

You sign up for the newsletter using the double opt-in procedure. After signing up, you receive an email with a confirmation link. Only when you click this link do we add your email address to our mailing list. This ensures that nobody can subscribe to our newsletter with someone else’s email address.

8.4 Legal basis

Your data is processed for sending the newsletter on the basis of your consent (Art. 6(1)(a) GDPR) in conjunction with Section 7(2) no. 2 of the German Act against Unfair Competition (UWG).

Brevo technically records opens of our emails and clicks on links in them using a tracking pixel and links routed through Brevo. We have activated anonymous tracking: opens and clicks are only counted in aggregate and are not linked to you as a person or to your contact. Individual reading behaviour is not analysed. The legal basis for this anonymous tracking is your consent, which you give when signing up for the newsletter and which includes a note on anonymous tracking (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). You can withdraw this consent at any time with effect for the future, for example via the unsubscribe link in every email. When the tracking pixel loads or a link is clicked, your IP address is technically transmitted to Brevo. If you disable image loading in your email program, opens are not recorded.

8.5 Storage period and withdrawal

Your newsletter data is stored until you withdraw your consent. You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter email or by email to contact@project-care-coin.org. After you withdraw your consent, you will no longer receive the newsletter. Your email address then remains only on a blocklist to make sure we don’t write to you again. The sign-up log data (proof of double opt-in) may be kept for an appropriate period as evidence.

8.6 Data processing agreement and transfer to third countries

We have a data processing agreement with Sendinblue SAS pursuant to Art. 28 GDPR (data protection agreement as part of Brevo’s terms of use). Brevo is based in France and stores data on servers in the EU (France and Belgium). However, Brevo uses subprocessors and group companies, some of which are located in third countries, in particular the USA and India, for example for delivery, security, customer service and maintenance. Transfers to these countries are protected by the EU-U.S. Data Privacy Framework, EU standard contractual clauses or binding corporate rules (see section 11). More information: brevo.com/legal/privacypolicy.

9. Contact by email

If you contact us by email, for example via the “Get in touch” button, we process your email address, your name (if provided), the content of your message and the time it was received in order to answer your enquiry.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to receive, handle and answer enquiries addressed to us and to enable communication with interested people, supporters and partners. If your enquiry aims at concluding or performing a contract, the legal basis is Art. 6(1)(b) GDPR.

Your information is deleted once your enquiry has been fully dealt with, unless statutory retention obligations apply (e.g. 6 or 10 years under the German Commercial Code or Fiscal Code).

Our email inboxes are operated via Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have a data processing agreement with Google pursuant to Art. 28 GDPR. Data may also be transferred to the USA in this context; see section 11 for details.

10. Storage periods and deletion

Personal data is only stored for as long as necessary for the respective purpose or as required by statutory retention obligations. In detail, the following periods apply:

• Server log files / IP addresses (Cloudflare): only briefly; the data is deleted as soon as it is no longer needed for operation and security. In the event of a security incident, longer storage may be necessary for the duration of the investigation.
• Newsletter data (Brevo): until consent is withdrawn; afterwards only an entry on a blocklist. Double opt-in log: an appropriate period as evidence.
• Email enquiries: until the enquiry has been fully dealt with; longer if statutory retention obligations apply (e.g. 6 or 10 years under the German Commercial Code or Fiscal Code).
• Survey and form data (Tally): until the evaluation is complete, at the latest 6 months after the end of the survey, or until you withdraw your consent.
• Plausible Analytics: aggregated statistics for as long as we use Plausible; they do not contain any personal data.

When the respective period expires or the purpose no longer applies, the data is routinely deleted or anonymised, unless statutory retention obligations apply.

11. Transfers to third countries (Art. 44–50 GDPR)

With the following services, personal data may be transferred to third countries outside the EEA, in particular the USA. Appropriate safeguards are in place for these transfers.

Cloudflare (hosting)

• Recipient: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
• Purpose: hosting, content delivery network, security services
• Safeguards: EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023; Cloudflare is certified under the DPF); EU standard contractual clauses pursuant to Decision 2021/914

Google Workspace (email)

• Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC, USA, as subprocessor
• Purpose: operating our email inboxes
• Safeguards: EU-U.S. Data Privacy Framework (Google LLC is certified under the DPF); EU standard contractual clauses as part of Google’s data processing agreement

Brevo (newsletter)

• Recipients: subprocessors and group companies of Sendinblue SAS, in particular in the USA and India; the current list is part of Brevo’s data protection agreement
• Purpose: delivery, security, customer service and maintenance
• Safeguards: EU-U.S. Data Privacy Framework, EU standard contractual clauses or binding corporate rules

Tally (surveys and forms)

• Recipients: subprocessors of Tally BV (list at tally.so/help/gdpr)
• Purpose: operation, sending notifications, error analysis and payment processing of the form platform
• Safeguards: EU-U.S. Data Privacy Framework or EU standard contractual clauses

You can check certifications under the EU-U.S. Data Privacy Framework at dataprivacyframework.gov. Plausible Analytics processes data exclusively in the EU; there is no transfer to third countries in this respect.

12. Your rights

You have the following rights vis-à-vis the controller:

12.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data about you. If so, you have the right to access this data and the information listed in detail in Art. 15 GDPR.

12.2 Right to rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected without undue delay or incomplete personal data completed.

12.3 Right to erasure (Art. 17 GDPR)

You have the right to request the deletion of your personal data if the requirements of Art. 17 GDPR are met (e.g. if the data is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent and there is no other legal basis).

12.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing of your personal data if one of the conditions listed in Art. 18(1) GDPR applies (e.g. while we verify the accuracy of the data).

12.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller, provided the processing is based on consent (Art. 6(1)(a) GDPR) or a contract (Art. 6(1)(b) GDPR) and is carried out by automated means.

12.6 Right to withdraw consent (Art. 7(3) GDPR)

Where the processing of your personal data is based on consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

12.7 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is:

You can also contact the supervisory authority of your usual place of residence or work.

To exercise your rights, please contact: Email: contact@project-care-coin.org, Phone: +49 157 9234 1658

13. Separate notice of your right to object (Art. 21 GDPR)

Objection to processing based on legitimate interests (Art. 21(1) GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Objection to direct marketing (Art. 21(2) GDPR): Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time; this also applies to profiling to the extent that it is related to such direct marketing. After your objection, the data will no longer be processed for these purposes.

You can object informally; please send your objection to: contact@project-care-coin.org

14. Automated decision-making and profiling (Art. 22 GDPR)

No automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR takes place on our website.

15. Updates to this privacy policy

We update this privacy policy when the legal situation, case law, our website or our data processing changes. It is a good idea to check back from time to time to stay informed about how your data is protected.

As of: October 2026