Privacy Policy
Privacy Policy
Last updated: 5 August 2026
1. Controller
The controller responsible for the processing of personal data through this
website is:
Young Global Citizens Assembly e.V.
Holzmarktstraße 66, 1. OG
10179 Berlin
Germany
Email: info@ygca-ev.org
Young Global Citizens Assembly e.V. is registered in the Vereinsregister of
the Amtsgericht Charlottenburg under registration number VR 37194 B.
For questions concerning data protection or the exercise of your rights,
please contact us at info@ygca-ev.org.
2. Scope of this Privacy Policy
This Privacy Policy explains how Young Global Citizens Assembly e.V.
collects, uses, stores and discloses personal data when you:
• visit our website at https://ygca-ev.org;
• contact us by email or through a contact form;
• make a donation;
• subscribe to a newsletter, where this service is offered;
• apply for employment, an internship or a volunteer position through the
website or by email; or
• otherwise interact with services made available through this website.
This Privacy Policy applies only to this website and the processing activities
described here.
Our project websites, external platforms, partner websites and social-media
profiles may be subject to separate privacy policies. Where you follow an
external link, the privacy information of the relevant provider applies.
3. General principles and legal bases
We process personal data only where there is a valid legal basis under the
General Data Protection Regulation (GDPR).
Depending on the purpose of the processing, the legal basis may be:
• Article 6(1)(a) GDPR, where you have given your consent;
• Article 6(1)(b) GDPR, where processing is necessary to perform a contract
or take steps at your request before entering into a contract;
• Article 6(1)(c) GDPR, where processing is necessary to comply with a legal
obligation;
• Article 6(1)(f) GDPR, where processing is necessary for our legitimate
interests or those of a third party and your interests or fundamental
rights do not override those interests; or
• other applicable legal provisions where special categories of personal
data or employment-related data are processed.
Where processing is based on consent, you may withdraw your consent at any
time with effect for the future. The withdrawal does not affect the
lawfulness of processing carried out before the withdrawal.
4. Access to the website and server log files
When you access our website, technical information may automatically be
transmitted by your browser to our web server or hosting provider.
This information may include:
• IP address;
• date and time of access;
• requested page or file;
• referring website;
• browser type and version;
• operating system;
• device information;
• language settings;
• amount of data transferred; and
• server response or access status.
We process this information to:
• provide and display the website;
• ensure the security and stability of our systems;
• identify and prevent misuse, attacks and technical errors;
• maintain the website; and
• investigate security incidents.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the
secure, reliable and technically functional operation of the website.
Log data are deleted or anonymised when they are no longer required for these
purposes, unless longer storage is necessary to investigate a security
incident, establish or defend legal claims, or comply with a legal obligation.
5. Hosting and technical service providers
We use contracted hosting and technical service providers to operate,
maintain and secure our website.
These providers may process technical data, including server log information,
on our behalf.
Where a provider acts as our processor, we enter into a data processing
agreement in accordance with Article 28 GDPR. Service providers may process
personal data only in accordance with our documented instructions, unless
they are legally required to process the data for another purpose.
Access to personal data is limited to persons and service providers who need
the information to perform their respective tasks.
6. Cookies and similar technologies
Our website may use cookies and similar technologies, including local
storage, session storage, scripts, tags and comparable technologies.
Strictly necessary technologies may be used where they are required to:
• provide a function expressly requested by you;
• maintain website security;
• store your privacy and cookie preferences;
• manage secure sessions; or
• ensure the basic technical operation of the website.
Optional technologies, including analytics, tracking or external-media
technologies, are not activated unless you have given the required consent.
Where information is stored on or read from your device, the requirements of
section 25 of the German Telecommunication Digital Services Data Protection
Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) apply.
Where personal data are processed through optional technologies, the legal
basis is generally Article 6(1)(a) GDPR.
You can accept, reject or customise optional technologies through the cookie
banner. You can review or change your decision at any time through the
“Cookie Settings” link in the website footer.
Further information is available in our Cookies and Similar Technologies
Policy and in the Cookie Settings interface.
7. Contacting us
You may contact us by email, post or, where available, through a contact form.
When you contact us, we may process:
• your name;
• email address;
• postal address;
• telephone number;
• organisation or affiliation;
• the date and time of your communication;
• the content of your message;
• attachments; and
• any other information you voluntarily provide.
We process this information to respond to your request and manage our
correspondence.
Where your enquiry relates to an existing or potential contractual
relationship, the legal basis is Article 6(1)(b) GDPR.
For general enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate
interest is to communicate with website visitors, partners, supporters and
other interested persons.
Where processing is necessary to comply with a legal obligation, the legal
basis is Article 6(1)(c) GDPR.
We retain correspondence only for as long as necessary to process the
enquiry and any subsequent communication. Longer retention may apply where
the correspondence is relevant to a contractual relationship, accounting
obligations, grant documentation, legal claims or another statutory retention
requirement.
8. Donations
8.1 Donation form provided by twingle
Our donation page contains an embedded donation form provided by:
twingle GmbH
Prinzenallee 74
13357 Berlin
Germany
When the donation form is loaded, your browser may establish a connection to
twingle’s servers. In this context, twingle may receive technical information
such as your IP address, browser information, device information, the page
visited and the date and time of access.
When you use the donation form, the following information may be processed,
depending on your selections:
• name and title;
• postal address;
• email address;
• donation amount;
• donation frequency;
• intended donation purpose;
• selected payment method;
• payment and transaction information;
• bank-account information, where applicable;
• information required for a donation receipt;
• communication preferences; and
• technical and security information.
The data are processed to:
• receive and administer your donation;
• process the selected payment method;
• allocate the donation to the selected purpose;
• communicate with you about the donation;
• prepare and issue a donation receipt;
• comply with accounting, tax and documentation obligations;
• prevent fraud and misuse; and
• establish, exercise or defend legal claims.
The legal bases are, depending on the processing activity:
• Article 6(1)(b) GDPR for processing necessary to carry out the donation;
• Article 6(1)(c) GDPR for tax, accounting and statutory documentation
obligations;
• Article 6(1)(f) GDPR for secure donation administration, fraud prevention
and the establishment or defence of legal claims; and
• Article 6(1)(a) GDPR where you have given consent for an optional purpose,
such as receiving promotional communication.
Donation information may be shared with twingle and with the payment-service
provider selected by you, but only to the extent necessary to process the
donation.
Depending on the selected payment method, the relevant payment provider may
process personal data as an independent controller under its own privacy
policy.
Tax-relevant donation and accounting records are retained for the statutory
retention periods applicable to the organisation.
8.2 PayPal
Our donation page may provide an ordinary external link to PayPal.
Where PayPal is included only as a link, no direct connection to PayPal is
established merely because you visit our website.
When you actively select the PayPal link, you leave our website and are
redirected to a PayPal website or application. PayPal may then process
information under its own responsibility, including your IP address, account
details, transaction information, device information and payment data.
The processing performed by PayPal is governed by PayPal’s own privacy
information and contractual terms.
8.3 Donations by bank transfer
You may also donate directly to our bank account.
When you make a bank transfer, we receive information transmitted through the
banking system, which may include:
• name of the account holder;
• IBAN or account information;
• donation amount;
• payment date;
• payment reference; and
• other information included in the transfer.
We process this information to administer the donation, maintain accounting
records, issue donation receipts where requested and comply with legal
obligations.
The legal bases are Article 6(1)(b), Article 6(1)(c) and, where applicable,
Article 6(1)(f) GDPR.
9. Newsletter and informational emails
Where we offer a newsletter, registration is voluntary.
We may process:
• your email address;
• your name, where voluntarily provided;
• the date and time of registration;
• the IP address used during registration;
• the date and time of confirmation; and
• information documenting your consent.
Newsletter registration should use a double opt-in process. This means that
you receive a confirmation email and are added to the mailing list only after
confirming your registration.
The legal basis for sending the newsletter is Article 6(1)(a) GDPR.
We may retain limited evidence of consent where necessary to demonstrate
compliance with legal requirements. The legal basis for retaining this
evidence is Article 6(1)(f) GDPR. Our legitimate interest is to document that
valid consent was obtained.
You may withdraw your consent at any time by using the unsubscribe link
included in each newsletter or by contacting info@ygca-ev.org.
Newsletter opening and link-click tracking will be used only where this is
clearly disclosed and legally permitted. Where consent is required, such
tracking will not take place without your consent.
10. Applications for employment, internships and volunteer positions
If you apply for employment, an internship or a volunteer position, we may
process:
• name and contact details;
• address and country of residence;
• curriculum vitae;
• education and qualifications;
• employment and volunteering history;
• language skills;
• certificates and references;
• availability;
• motivation letter;
• interview notes;
• information you provide during the selection process; and
• other documents voluntarily submitted with your application.
Please do not provide special categories of personal data unless the
information is necessary for the application or specifically requested with
an appropriate legal basis.
We process application data to:
• assess your application;
• communicate with you;
• organise interviews;
• verify relevant qualifications;
• select suitable candidates;
• prepare a possible employment, internship or volunteer relationship; and
• establish or defend legal claims.
For employment-related applications, processing may be based on section 26
of the German Federal Data Protection Act (BDSG), in conjunction with
Article 88 GDPR.
For internships, volunteer relationships or other arrangements not covered
by section 26 BDSG, processing may be based on Article 6(1)(b) or
Article 6(1)(f) GDPR, depending on the nature of the relationship.
Where you consent to the retention of your application for future
opportunities, the legal basis is Article 6(1)(a) GDPR.
If an application is unsuccessful, the data will generally be deleted after
the period necessary to complete the selection process and defend against
possible legal claims, unless you have consented to longer retention or a
legal obligation requires it.
If the application is successful, relevant information may be transferred to
the personnel or volunteer record and processed under the privacy information
applicable to that relationship.
11. Participation in programmes and projects
Where the website is used to register for a programme, event, educational
activity or project, we may process information necessary to:
• assess eligibility;
• register participants;
• communicate about the activity;
• organise attendance;
• provide educational or project services;
• document participation;
• meet funding and reporting requirements; and
• protect the safety of participants.
The exact categories of data, purposes, recipients and retention periods
depend on the programme.
Where a programme requires additional or more sensitive information, we will
provide a separate project-specific privacy notice at the time the data are
collected.
Where participation involves minors, special categories of personal data,
photographs, recordings or transfers to international partners, additional
information and, where required, consent will be obtained separately.
12. External media and third-party services
Our website may include content or functions provided by external services,
such as videos, maps, security tools or other interactive content.
When external content is activated, the provider may receive:
• your IP address;
• browser and device information;
• the page visited;
• the date and time of access;
• interaction data; and
• information stored in or read from your device.
External media and other optional third-party services should remain blocked
until you actively consent to the relevant service or category.
The legal basis for optional processing is Article 6(1)(a) GDPR. Where
information is stored on or accessed from your device, the processing is also
subject to section 25(1) TDDDG.
The currently active external services, providers, purposes and storage
periods are listed in the Cookie Settings and in our Cookies and Similar
Technologies Policy.
13. Website analytics
Where we use analytics services, they are activated only after you have given
the required consent.
Analytics data may include:
• pages viewed;
• approximate geographic location;
• browser and device information;
• referring website;
• time spent on pages;
• interaction events; and
• shortened, pseudonymised or otherwise processed IP-address information.
The purpose is to understand how the website is used and improve its
structure, accessibility, content and technical performance.
The legal basis is Article 6(1)(a) GDPR and, where applicable,
section 25(1) TDDDG.
You may withdraw your consent at any time through the Cookie Settings.
14. Social-media links
Our website contains links to social-media profiles and external platforms.
Where a social-media service is included only as an ordinary link, no direct
connection to that provider is established merely because you visit our
website.
When you select the link, you leave our website. The relevant platform may
then process information, including your IP address, browser or device data
and information associated with your platform account.
The processing carried out on the external platform is governed by the
privacy policy of the relevant provider.
15. Recipients of personal data
Depending on the relevant processing activity, personal data may be disclosed
to:
• authorised board members, employees and volunteers;
• website hosting and IT service providers;
• email and communication service providers;
• donation-platform and payment-service providers;
• banks and financial institutions;
• accountants, auditors and tax advisers;
• project partners and funding bodies, where legally permitted and necessary;
• legal advisers and insurance providers;
• public authorities, courts or law-enforcement bodies where disclosure is
legally required; and
• other recipients where you have consented to the disclosure.
Access is limited to the data necessary for the respective purpose.
16. International data transfers
Some service providers or project partners may process personal data outside
the European Economic Area.
Where personal data are transferred to a country for which the European
Commission has adopted an adequacy decision, the transfer may be based on
that decision.
In other cases, we use an appropriate transfer mechanism where required,
such as the European Commission’s Standard Contractual Clauses, together
with supplementary safeguards where necessary.
Where no other transfer mechanism is available, a transfer may take place
only where another exception under Chapter V GDPR applies.
Additional information concerning a specific international transfer may be
requested by contacting info@ygca-ev.org.
17. Retention and deletion
We retain personal data only for as long as necessary for the purposes for
which they were collected.
The applicable retention period depends on:
• the nature and purpose of the processing;
• contractual requirements;
• statutory tax, accounting and documentation obligations;
• grant and funding requirements;
• limitation periods;
• the need to establish or defend legal claims; and
• whether valid consent for longer retention has been given.
When personal data are no longer required and no legal basis for continued
retention exists, they are deleted or anonymised.
18. Data security
We use appropriate technical and organisational measures to protect personal
data against:
• unauthorised access;
• unlawful disclosure;
• accidental loss;
• alteration;
• destruction; and
• other unlawful processing.
These measures may include access restrictions, encrypted transmission,
secure passwords, backups, system updates and internal confidentiality
requirements.
However, no transmission or storage system can guarantee absolute security.
19. Your data-protection rights
Subject to the applicable legal requirements, you may have the following
rights:
• right of access under Article 15 GDPR;
• right to rectification under Article 16 GDPR;
• right to erasure under Article 17 GDPR;
• right to restriction of processing under Article 18 GDPR;
• right to data portability under Article 20 GDPR;
• right to object under Article 21 GDPR;
• right to withdraw consent under Article 7(3) GDPR;
• right not to be subject to certain decisions based solely on automated
processing under Article 22 GDPR; and
• right to lodge a complaint with a supervisory authority under
Article 77 GDPR.
To exercise your rights, contact:
info@ygca-ev.org
We may request reasonable information to verify your identity before
responding to a request.
20. Right to object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have
the right to object to the processing at any time on grounds relating to your
particular situation.
We will then stop processing the personal data unless we demonstrate
compelling legitimate grounds that override your interests, rights and
freedoms, or the processing is necessary for the establishment, exercise or
defence of legal claims.
Where personal data are processed for direct-marketing purposes, you may
object at any time without providing reasons. After receiving your objection,
we will no longer process your personal data for that purpose.
21. Supervisory authority
You have the right to lodge a complaint with a data-protection supervisory
authority.
The supervisory authority responsible for organisations established in
Berlin is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
You may also contact the supervisory authority at your habitual residence,
place of work or the place of the alleged infringement.
22. Children and young people
Our organisation works with young people and may offer programmes that are
also relevant to minors.
We do not intentionally collect personal data from minors through the
website beyond what is necessary for a clearly identified activity.
Where an activity is directed to minors and processing is based on consent,
we will obtain the consent required under applicable law and provide the
information in an age-appropriate and understandable form.
Parents or legal guardians may contact us at info@ygca-ev.org if they have
questions about the processing of a minor’s personal data.
23. Automated decision-making
We do not use personal data collected through this website to make decisions
based solely on automated processing that produce legal effects or similarly
significantly affect individuals, unless this is expressly disclosed in
connection with a particular service.
24. Changes to this Privacy Policy
We may update this Privacy Policy when:
• our website or services change;
• new service providers are introduced;
• processing activities change;
• legal or regulatory requirements change; or
• supervisory authorities issue relevant guidance.
The current version and date of the latest update will be published on this
page.
Where a change materially affects processing based on consent, we will
request renewed consent where required.
25. Contact
For questions concerning this Privacy Policy or the processing of personal
data, please contact:
Young Global Citizens Assembly e.V.
Holzmarktstraße 66, 1. OG
10179 Berlin
Germany
Email: info@ygca-ev.org