Privacy policy

Sanskriti e.V., a registered non-profit association in Hamburg, Germany, is the controller for the personal data processed on this website under the General Data Protection Regulation (GDPR). You can reach us at admin@sanskriti-hamburg.de.

We have not appointed a data protection officer; an association of our size is not required to under Art. 37 GDPR and § 38 BDSG. Any question about data protection can go to the address above.

This website sets no cookies. There are no counting pixels, no fingerprinting and no recognition features, and no tracking of any kind — we use neither Google Analytics nor any comparable analytics tool, and no advertising or social media pixels.

The notice bar at the bottom of the screen therefore asks for no consent — there is nothing to consent to. It only tells you this is the case. If you dismiss it, your browser stores a single local-storage entry (the key sanskriti:privacy-notice) so the notice does not reappear on every page. That entry holds only a date, is never transmitted to us or to anyone else, stays in your browser, and can be cleared from your browser settings at any time. It is strictly necessary for a function you asked for and so needs no consent under § 25 (2) no. 2 TDDDG. Nothing else is stored on or read from your device.

Your data is never sold, never passed on for advertising and never used for profiling. It reaches only the service providers named in sections 3 and 4, each of which acts for us as a processor under Art. 28 GDPR, and any recipient we are legally obliged to disclose it to.

If we ever add analytics, maps or embedded video, we will ask for your consent first through a proper choice dialogue and update this policy.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, with delivery and server-side processing pinned to the Frankfurt am Main region in Germany. Our database runs at Neon Inc. (USA) in the Frankfurt region, and uploaded images and documents are stored with Cloudflare, Inc.(Cloudflare R2) in its EU region.

We have data processing agreements under Art. 28 GDPR with all of them. Because the parent companies are based in the USA, access from a third country cannot be entirely ruled out; the transfer relies on the European Commission's Standard Contractual Clauses under Art. 46 (2) (c) GDPR and, where the provider is certified, on the EU-US Data Privacy Framework (Art. 45 GDPR).

Every page request produces a server log entry: the address requested, the date and time, the amount of data transferred, the status code, your browser type and version, your operating system, the referring URL and your IP address. This is technically necessary to deliver the site and keep it secure. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest being the stable, secure and abuse-free operation of the website. We do not combine these records with other sources and we do not evaluate them for marketing.

When you submit the “Become a member” form we process what you enter: your name and email address (required), your phone number, location, the areas you would like to get involved in, your message, how you heard about us, your newsletter choice, and the page the form was sent from.

Purpose and legal basis: we use this only to answer you and to prepare your membership or involvement in the association. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract) and, as far as general contact is concerned, your consent under Art. 6 (1) (a) GDPR, which you give by ticking the consent box. You can withdraw that consent at any time with future effect by writing to admin@sanskriti-hamburg.de.

Recipients: entries are stored in our content management system (database in Frankfurt, see section 3) and additionally emailed to the responsible board and team members. We use Resend (Resend, Inc., USA) as a processor to send that mail, which transfers your name, email address and message to the USA on the basis of the Standard Contractual Clauses under Art. 46 (2) (c) GDPR. Our mailboxes are hosted by Zoho (Zoho Corporation B.V., Netherlands) on European servers.

Retention: if your enquiry does not lead to membership, we delete what you sent once it is no longer needed to deal with your request. If you do become a member, we continue to process your data on the basis of that membership, and the statutory retention periods apply — in particular tax periods of up to ten years (§ 147 AO).

Providing the data is voluntary. Without a name and an email address, though, we cannot respond to you.

If you choose the newsletter, we use your email address to send you news about the association's events and announcements. The only legal basis is your consent under Art. 6 (1) (a) GDPR. The box is not pre-ticked — you receive the newsletter only if you actively select it.

You can unsubscribe at any time, using the link in every email or by writing to admin@sanskriti-hamburg.de. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. Once you unsubscribe we remove your address from the list.

For donations we link to a payment page operated by Stripe (Stripe Payments Europe, Ltd., Ireland). You only leave our website when you click that link, and you enter payment and card details exclusively at Stripe — we never receive or store them. Stripe's own privacy policy applies to that processing: stripe.com/privacy. From Stripe we receive only the record of payments made, which we need for the association's accounts (Art. 6 (1) (c) GDPR together with § 147 AO).

If you transfer money to the association's bank account shown in the footer instead, we process the details your bank passes on to us for the same purpose.

All fonts are served from our own server. There is no connection to Google Fonts or any other font CDN, and your IP address is not transmitted to anyone for them.

We embed no videos, maps, social media feeds or other third-party content in our pages. The Instagram, Facebook and YouTube icons in the footer are plain links: no data whatsoever is transmitted to those networks unless you click them yourself. After that, the privacy terms of the network in question apply. The same is true of the “Get directions” links on our event pages, which open Google Maps only once you choose to follow them.

We publish photographs of our events on this website. Where individuals are recognisable, we rely on their consent (Art. 6 (1) (a) GDPR, §§ 22, 23 KUG) or, for general views of an event, on our legitimate interest in the association's public communication (Art. 6 (1) (f) GDPR). If you are recognisable in a photograph and would like it removed, a message to admin@sanskriti-hamburg.de is enough and we will take it offline promptly.

This website is delivered exclusively over a TLS-encrypted connection (HTTPS) — your browser shows a padlock. Anything you type into our forms is protected against being read in transit.

You have the following rights in relation to us:

• Access — to know whether and what data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure, where no retention obligation stands in the way (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Portability in a common format (Art. 20 GDPR)
• Objection to processing we base on a legitimate interest (Art. 21 GDPR)
• Withdrawal of consent you have given, with future effect (Art. 7 (3) GDPR)

For any of these, an informal message to admin@sanskriti-hamburg.de is enough. We reply within one month.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
datenschutz-hamburg.de

We update this policy whenever the processing on this website changes — for example when new features are added. The version published here is the one that applies; the date at the top shows when it was last revised.