Privacy Policy

Privacy Notice pursuant to Art. 13 GDPR

This privacy notice covers the website of the Youth Parliament Network Europe (YPNE). YPNE is a project run by and organisationally attached to the Dachverband der bayerischen Jugendvertretungen e.V. (DVBJ). The DVBJ remains the controller responsible for data processing on this website within the meaning of the GDPR; the services, tools and infrastructure described below are used by YPNE because it is affiliated with, and hosted under the umbrella of, the DVBJ.

Controller

Dachverband der bayerischen Jugendvertretungen e.V.
Jahnstraße 25
85049 Ingolstadt, Germany
+49 841 93892461
info@dvbj.de

If you have any questions about data protection, please contact us at info@dvbj.de or at the postal address given above.

Data processing on our website and other online services

Log files when visiting our website

When our website is accessed, log files are created for the purpose of analysing errors and security incidents. These contain:

• IP address
• Date and time of access
• Page accessed
• User agent (browser and device)
• Referrer URL

The log files are stored by our hosting provider, IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), for a maximum of 7 days and are then automatically deleted. The server location is Germany/EU. A data processing agreement (DPA) under Art. 28 GDPR is in place with IONOS.

Processing takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest in the security and functionality of the website). YPNE relies on this processing as a project of, and using the hosting infrastructure provided by, the DVBJ. The log files serve error analysis, security monitoring and statistical evaluation (without personal reference).

Web analytics with Statify

For statistical analysis of the use of our website, we use the WordPress plugin “Statify”.

Statify collects only aggregated access data (e.g. the number of page views and the content accessed). No cookies are set, and no IP addresses or other personal data are stored. It is not possible to link the data collected to individual persons.

The data is stored for up to 30 days on our server (hosted by IONOS SE, Germany/EU) and is then automatically deleted.

Processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing and optimising our website. As a DVBJ project, YPNE uses the DVBJ’s server infrastructure and, correspondingly, the analytics tools operated on it.

The statistical data collected is not passed on to third parties.

Note: Statify is open-source software (source code: Statify GitHub).

Content Delivery Network (CDN) – bunny.net

To deliver content on our website (e.g. videos) quickly and securely, we use the service bunny.net provided by BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia.

In doing so, the IP address, country code, user agent and referrer URL are processed briefly in order to deliver content efficiently (legal basis: Art. 6(1)(f) GDPR).

• Retention period: 20–30 seconds (deleted thereafter).
• Place of processing: exclusively within the European Union (EU). Data is stored at the replication locations Frankfurt am Main (Germany) and Stockholm (Sweden) and delivered via data centres within the EU.

GDPR: bunny.net/gdpr
GDPR sub-processors: bunny.net/gdpr/sub-processors
Privacy policy: bunny.net/privacy

Processing takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest in fast and secure delivery of content). YPNE, as a DVBJ project, makes use of this service via the DVBJ’s existing contractual arrangement with bunny.net.

Contact forms

If you send us a message via the contact form on our website, your details (e.g. name, email address, telephone number, message, and any other information you provide) will be transmitted to us.

Processing takes place on the basis of Art. 6(1)(b) GDPR (pre-contractual measures – in particular for membership enquiries) or Art. 6(1)(f) GDPR (legitimate interest in processing your enquiry).

Technical implementation:

• Emails are sent via the servers of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany).
• A data processing agreement (DPA) under Art. 28 GDPR is in place with IONOS.
• The data is not passed on to third parties.

Retention period:

Your data will be deleted no later than 6 months after your enquiry has been dealt with, unless statutory retention obligations apply (e.g. for pre-contractual measures under Section 147 of the German Fiscal Code, AO).

Captcha service: mosparo

To protect our contact forms, login pages and ticketing tool from misuse and automated access (e.g. spam), we use the open-source captcha service mosparo. We operate mosparo ourselves on our own server, which is hosted by IONOS SE (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS. No external captcha providers are used.

Data processed:
When a form submission is verified, mosparo processes the data transmitted for that purpose. This includes:

• the address and title of the website on which the form was completed
• the data entered by the user in the form fields
• the user’s IP address and user agent
• the AS number and country of origin of the IP address, where the GeoIP function is enabled

GeoIP function:
To determine the country of origin and AS number (internet service provider), mosparo may use the GeoLite2 database provided by MaxMind (https://www.maxmind.com). The database is stored and queried locally on our server. According to our configuration, users’ IP addresses are not transmitted to MaxMind for this purpose.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Purpose and legal basis:
The processing serves to prevent spam, misuse and automated access, and thereby to safeguard the security of our online services. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our systems from misuse.

Storage and security:
Personal data from form submissions is stored by mosparo in encrypted form. The IP address is additionally stored in the form of a hash value so that misuse can be detected. Other data that does not form part of the submissions (e.g. user accounts, settings and rules) is not stored in encrypted form. In addition, we apply appropriate technical and organisational measures to protect the data against unauthorised access.

Retention period:
Submissions are considered obsolete after 14 days and are deleted automatically during the next system cleanup. Unused submission tokens (including the associated IP address) are considered obsolete after 24 hours and are likewise deleted during the next system cleanup.

Right to object:
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your data based on Art. 6(1)(f) GDPR. Further information on your rights can be found in the section “Your rights as a data subject” of this privacy policy.

Note on mosparo::
mosparo is open-source software (source code on GitHub). As we operate the service on our own infrastructure, the processing takes place within our sphere of responsibility.

Newsletter subscription

If you have subscribed to the newsletter on our association website, we use your email address to send you the newsletter regularly and keep you informed about matters relating to the association and YPNE. The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR).

We use the plugin “The Newsletter Plugin” by Web Agile S.a.s. di Fietta Roberto (VAT no.: P.I. 03809490240), registered in Veneto, Italy, website: thenewsletterplugin.com, to send the newsletter.

Technical implementation:

• The plugin runs exclusively on our server (hosted by IONOS SE, Germany/EU) as part of the DVBJ’s infrastructure used by YPNE.
• Emails are sent via the mail servers of IONOS SE.
• A data processing agreement (DPA) under Art. 28 GDPR is in place with IONOS.

Data processed:

• Email address
• First name
• Last name (if provided)
• Gender
• IP address (for the double opt-in procedure and anti-spam purposes)

Retention period:

• Your email address is deleted immediately after you withdraw your consent, unless it is needed for other purposes (e.g. general communication with association/project members).
• Technical logs (e.g. for double opt-in) are stored for 7 days and then automatically deleted.

Your rights:

You can withdraw your consent at any time by clicking the “unsubscribe” link in the newsletter email or by contacting us at info@dvbj.de.

Performance measurement/statistics (tracking)

To evaluate usage behaviour, we use tracking technologies when sending the newsletter:

• Open tracking: an invisible image embedded in the email (tracking pixel) records whether and when the email was opened.
• Click tracking: links in the email are routed via a redirect service provided by the newsletter plugin, which records which links you clicked.
• Data collected: time of opening/clicking, links clicked, anonymised IP address.
• Purpose: statistical analysis to improve newsletter content (e.g. which topics are relevant).
• Legal basis: consent, Art. 6(1)(a) GDPR (part of the newsletter sign-up).
• Retention period: for technical reasons, statistical data (opening and click behaviour) is currently retained for an extended period. We are working on automated deletion after 12 months. Until then, this data is cleared manually at regular intervals.
• Place of storage: the data is stored locally on our server at IONOS SE (Germany/EU).
• Objection: you can object to tracking by unsubscribing from the newsletter.

Newsletter plugin cookie

The plugin “The Newsletter Plugin” sets a technical cookie named “newsletter”. This is used to recognise logged-in subscribers, display the relevant notices/messages to them, and, where used, unlock subscriber-only content (content lock).

• Retention period: 1 year
• Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TTDSG) (technically necessary cookie for providing a telemedia service expressly requested by you) in conjunction with Art. 6(1)(a) GDPR (in connection with your newsletter sign-up).

As this is a purely functional cookie, no separate cookie consent is required for it.

SMTP plugin for email dispatch (SureMail)

For the technical handling of email dispatch (e.g. contact form, newsletter), we use the plugin “SureMail” by Brainstorm Force US LLC (2093 Philadelphia Pike #3090, Claymont, DE 19703, USA).

Emails sent (content, sender, recipient, subject, timestamp) are logged exclusively on our own server at IONOS SE (Germany/EU) as part of the DVBJ infrastructure used by YPNE, for a maximum of 30 days, and are then automatically deleted. Email content or log data is not transmitted to Brainstorm Force or any other third party.

Legal basis:

Art. 6(1)(f) GDPR (legitimate interest in the functionality and traceability of email dispatch).

Note: when the plugin is used, Brainstorm Force collects technical metadata about our website (e.g. PHP version, WordPress version, server software, website URL, active plugins/themes) for compatibility checks. This data is non-personal and does not relate to your user data.

Data processing in connection with our association and project work

Microsoft 365 (internal communication & administration)

For internal association and project administration, communication and document storage, we use Microsoft 365 (formerly Office 365) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. As a DVBJ project, YPNE uses the DVBJ’s existing Microsoft 365 environment for these purposes.

Data processed:

• Emails (content, sender, recipient, subject, attachments)
• Contact details (name, email, telephone number)
• Calendar entries (appointments, participants)
• Documents & files (association/project documents stored in SharePoint/OneDrive)
• Teams chats & call data (messages, participants, timestamps)

Purpose:

• Organising association and YPNE activities (e.g. appointments, minutes)
• Internal communication between the board, staff and members/participants
• Document management (e.g. statutes, minutes, financial records)

Legal basis:

• Art. 6(1)(b) GDPR (performance of association membership, e.g. for internal coordination)
• Art. 6(1)(f) GDPR (legitimate interest in efficient administration of the association and its YPNE project)

Retention period:

• Emails & documents: for the duration of membership/project involvement plus 10 years (in accordance with tax-law retention obligations, Section 147 AO).
• Teams chats: 30 days (default setting, can be adjusted).
• Deleted data: retained in Microsoft 365 backups for up to 14 days before final deletion.

Place of processing:

• Primarily: EU data centres (Microsoft guarantees EU data processing for customers based in the EU).
• Sub-processors: Microsoft uses sub-processors listed in the list of Microsoft sub-processors.
• Transfers to third countries: where data is processed outside the EU, this is done on the basis of the EU Standard Contractual Clauses (SCCs) and additional technical measures (e.g. encryption).

Contractual safeguards:

A data processing agreement (DPA) under Art. 28 GDPR is in place with Microsoft. View DPA: Microsoft DPA

Security measures:

• Encryption (data at rest and in transit)
• Access controls (only authorised association/project members have access)

Google Workspace (data storage & automation)

For data storage and the processing logic of the accounting system, we use Google Workspace provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as part of the DVBJ’s infrastructure, which YPNE uses as a project of the DVBJ.

Data processed:

• Booking/accounting data (amount, date, purpose, cost centre)
• Contact and bank details of payees (name, IBAN, BIC)
• Uploaded receipt documents (e.g. invoices, receipts)
• Names of the association/project members recording the entries

Purpose:

• Recording and tracking association/project expenditure
• Filing and management of accounting receipts
• Internal cost-centre and project administration

Legal basis:

• Art. 6(1)(f) GDPR (legitimate interest in proper association/project bookkeeping)
• Art. 6(1)(c) GDPR (compliance with statutory retention obligations under Section 147 AO)

Retention period:

• Accounting data & receipts: 10 years (in accordance with tax-law retention obligations, Section 147 AO)
• Deleted data: remains in Google backups for up to 30 days before final deletion

Place of processing:

• Primarily: EU data centres (data region: European Union, configured via the Google Workspace admin console)
• Sub-processors: Google uses sub-processors listed in the list of Google Workspace sub-processors
• Transfers to third countries: where data is exceptionally processed outside the EU, this is done on the basis of the EU Standard Contractual Clauses (SCCs)

Contractual safeguards:

A data processing agreement under Art. 28 GDPR is in place with Google Ireland Limited (Google Workspace Data Processing Amendment). View DPA: Google Workspace DPA

Security measures:

• Encryption of data at rest and in transit
• Access controls (only authorised association/project members with a workspace account of the association have access)
• No access by unauthorised persons or third parties

Adobe PDF Services (document conversion)

For converting uploaded receipt documents into PDF format and for merging several documents into a single file, we use Adobe PDF Services provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, as part of the DVBJ’s toolset, used in connection with YPNE’s activities as a DVBJ project.

Data processed:

• Uploaded receipt documents (e.g. invoices, receipts as JPG, PNG, DOCX, XLSX)
• File metadata (file name, file size, file format)

Purpose:

• Converting receipt documents into PDF format for consistent archiving
• Merging several receipts into a single document

Legal basis:

Art. 6(1)(f) GDPR (legitimate interest in a consistent and audit-proof filing of receipts)

Retention period:

Uploaded files are cached at Adobe only for the duration of the conversion process and are automatically deleted immediately after completion. No permanent storage takes place at Adobe.

Place of processing:

• EU data centres (Adobe PDF Services EU region: Europe West)
• Transfers to third countries: Adobe Inc. is a US company. Where processing takes place outside the EU, this is done on the basis of the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR

Contractual safeguards:

A data processing agreement under Art. 28 GDPR is in place with Adobe. View DPA: Adobe DPA

Security measures:

• Encryption of data transfer (TLS)
• Automatic deletion once processing is complete
• Access only via an authenticated API connection using the association’s own Adobe account

Membership/participant administration

Membership and participant data (name, date of birth, place of birth, address, telephone number, email address, youth representation body) is processed by the respective officeholders of our association – including those responsible for the YPNE project – only for the purposes of the specific task assigned to them. In particular, this means:

• Where the board needs membership/participant data to carry out its tasks, it may access all data required for this purpose.
• The treasurer processes the data required for collecting membership fees; the auditor processes the data relevant to the audit. This comprises first name, surname, postal address and bank details/payment data, as well as, where applicable, access to the direct debit mandate including signature, provided the member has granted the association a direct debit mandate.
• The association’s/YPNE’s office processes membership and participant data for administration and support purposes.

The purpose of processing membership/participant data is to pursue and administer the purposes of the association, including its YPNE project. The legal basis is the association membership or equivalent participation relationship (Art. 6(1)(b) GDPR).

Membership/participant data is stored for the duration of membership/participation plus 1 month. Bank details and direct debit mandates are additionally retained for 10 years (in accordance with Section 257 of the German Commercial Code, HGB). The data is encrypted and only accessible to authorised persons.

Photographs at events

Photographs of association and YPNE events are published on our website for the purpose of external representation.

The legal basis for publishing the following photographs of adults on our website is our legitimate interest as described below, pursuant to Art. 6(1)(f) GDPR:

• Team photographs, on the basis of our legitimate interest in informing the public about association/project events (here: the team line-up),
• Photographs relating to the event or activity itself, on the basis of our legitimate interest in reporting on the (sporting or project-related) events,
• Photographs of the audience attending the event, or photographs in which individuals appear merely incidentally, on the basis of our legitimate interest in reporting on the event and its success.

You have the right to object to the use of a photograph in which you appear, pursuant to Art. 21(1) GDPR. The association will assess whether there are compelling legitimate grounds for the processing that override your interests, rights and freedoms. If not, the photograph in question will be deleted.

Other photographs in which an adult (an association/project member or a member of the audience) is the central subject, or where a person was specifically and deliberately photographed, are published only with that person’s consent (Art. 6(1)(a) GDPR). This consent may be withdrawn at any time with effect for the future.

Photographs of underage association/project members or children in the audience are published only where the parents or legal guardians have given consent pursuant to Art. 6(1)(a) GDPR. This consent may be withdrawn at any time with effect for the future.

If photographs are shared on social media platforms (e.g. Facebook, Instagram), the respective platform’s own privacy policies apply.

Ticketing system

For handling IT and support requests, we operate the association’s internal “DVBJ Ticketing System” on our server at our hosting provider IONOS SE (Germany/EU). As a DVBJ project, YPNE’s IT and support requests are handled through this same, shared system.

Data processed & authentication

• Master data & applications: name, email address, role/permissions, language, contact details (telephone, address, position, for account applications).
• Case data & attachments: subject, ticket text, comments, history, in-app notifications, and uploaded files of all kinds (photos, PDFs, Office files).
• System & log data: M365 Entra object ID, device/browser data per ticket (OS, browser, viewport; not raw user agents/IP addresses/geodata), profile picture cache (avatars), audit logs, application logs, session data and failed queue jobs.
• User administration: login takes place via M365/Entra ID (including automatic account synchronisation and deactivation) or via email/portal. Users without an M365 account receive case-specific direct links (magic links) by email. Automated notification emails are sent via our internal association mail server in Microsoft 365.

Purpose & legal basis

Processing serves the handling of requests, permissions management and IT security. The legal basis is Art. 6(1)(b) GDPR (membership/contract) as well as Art. 6(1)(f) GDPR (legitimate interest in efficient support and system integrity). Access is limited to the responsible caseworkers and the IT unit; no data is passed on to third parties.

Retention period & deletion concept

Automatic deletions:

• Tickets, comments & attachments (including files on the server): 12 months after closure (unless a retention hold/legal hold has been set).
• In-app notifications: 12 months.
• Failed queue jobs: 90 days.
• Profile picture cache: 180 days.
• Audit logs & device/browser data per ticket: 30 days.
• Application logs: 14 days.
• Unconfirmed support requests: 7 days.
• Unconfirmed account applications: 2 days.
• Sessions: cleared daily.
• Guest accounts without tickets: removed automatically.

Special system rules & exceptions (no automatic age-based deletion):

• Active agent/admin accounts: managed manually and deleted only once no longer needed for their purpose.
• Account application data (telephone, address, position): remains stored until the associated ticket is deleted after 12 months (the option for immediate anonymisation after provisioning is disabled).
• Image attachments (EXIF data): not cleaned in advance, but removed only when the entire ticket is deleted.
• Backups: covered by the general server backup routine.

Security & protection against misuse

Uploaded files are checked for file type, signature and hash before being stored. To protect against automated misuse, we use the self-hosted captcha service mosparo.

Data subject rights

Where we process your personal data, you have the following rights as a data subject:

• a right of access to the data processed and to a copy of it,
• a right of rectification where we process incorrect data about you,
• a right to erasure, unless an exception applies as to why we still store the data, for example retention obligations or limitation periods,
• a right to restriction of processing,
• a right to withdraw consent to data processing at any time,
• a right to object to processing carried out in the public interest or on the basis of a legitimate interest,
• a right to data portability,
• a right to lodge a complaint with a data protection supervisory authority if you consider that we are not processing your data properly. For our association (and its YPNE project) the competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht). If you are located in another German federal state or outside Germany, you may also contact the relevant supervisory authority there.

To exercise your rights, please contact us at info@dvbj.de or by post at the address given above.

Disclosure of data to third parties

Your data is only disclosed to third parties where this is required by law or where you have given your consent. Exceptions: processors (e.g. IONOS, bunny.net, Microsoft, Google, Adobe) engaged under Art. 28 GDPR, whose services are used both by the DVBJ and, on that basis, by its YPNE project.

Technical and organisational measures

We take technical and organisational measures to protect your data, such as encryption, access controls and regular backups.