Privacy policy

The controller responsible for data processing on this website is:

Enactus Mannheim e.V.L1, 1 Postfach 31, 68161 Mannheim

Email: teamvorstand@unimannheim.enactus.team

Enactus Mannheim e. V. has not appointed an in-house data protection officer; the statutory conditions requiring one are not met.

This policy describes which personal data we process when you visit this website, for what purpose, on what legal basis, and for how long we keep it.

It applies to every page on this website, including the application form, the application-start notification, and the contact form. Linked third-party websites, for instance our projects, partners, or Enactus Germany, have their own privacy policies.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and served from the Frankfurt am Main location (region "fra1").

Loading a page processes technically necessary access data:

• IP address of the requesting device
• date and time of access
• the address requested and the amount of data transferred
• the server's status message
• the referring page, where transmitted
• browser type, browser version, and operating system

This data is technically required to deliver the website and serves operational security and defence against attacks. We do not combine it with any other data source.

We store applications, contact messages, and application-start notification sign-ups in a Postgres database from provider Neon Inc., USA. The database runs in the "eu-central-1" region (Frankfurt am Main), so the data stays within the European Union.

The CV is not stored in the database, but separately in a private file store (Vercel Blob, Frankfurt am Main region). It can only be retrieved there after authenticating through the password-protected board area. In addition, the CV is transmitted once as an attachment to the notification email sent to the board, and from then on also resides in its email inbox.

We collect only what a given purpose requires, and delete it once that purpose no longer applies (Art. 5(1)(c) and (e) GDPR). The specific periods are in the "Retention" section.

We use Resend (Plus Five Five, Inc., USA) to send automatically generated emails. These include the application confirmation, the forwarding of contact inquiries, the application-start notification confirmation, and notifications to the board about received applications, Ideathon signups, and contact inquiries, including any file attachments sent with them. Sending happens from the Ireland region ("eu-west-1"), within the European Union.

We transmit the recipient's email address, the sender's email address, and the content of the respective message. For notifications about received applications, we additionally transmit the attached files, that is, the application details as a PDF and, if provided, the uploaded CV.

Our emails carry no open tracking, no click tracking, and no tracking pixels. Those features are deliberately switched off on our account. Links in our emails go straight to their destination and are never redirected through an intermediary service.

We use Vercel Analytics for anonymous evaluation of page views. The service sets no cookies, stores no identifiers on your device, and builds no cross-device profiles. We only collect aggregated figures such as the page viewed, an approximate country-level region, device type, and referring page.

This gives us no way to identify individual people. Because no information is stored on or read from your device, no consent under § 25 TDDDG (the German cookie-consent law) is required. That's why this website shows no cookie banner.

Every font is embedded locally on our own server. There is no connection to Google Fonts or any other external font provider; your IP address is never transmitted to a third party for this.

Video embeds

We embed project pitches and similar videos behind a click-to-load preview. Before you click, no connection to YouTube is made, no data is transmitted, and no cookies are set. Only a preview image served from our own server is shown.

Only once you click the preview image does the embedded player load from the youtube-nocookie.com domain. From that point on, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes your data under its own responsibility; Google's privacy policy applies. We have no influence over the nature or extent of that processing.

Through the "Mitmachen" page you can apply for membership. We collect:

Your CV must be uploaded as a PDF file, 4 MB maximum. The file is not scanned for malware; open it with the same care you would any email attachment. We ask you not to include any special category personal data under Art. 9 GDPR in your CV or elsewhere in your application, for instance about health, religious or philosophical belief, political opinion, or sexual orientation, and to leave out a photo, date of birth, nationality, or marital status. Such information is not required for selection.

Through the "Ideathon" page you can sign up for the Ideathon. We collect:

While the application window is closed, you can sign up to be notified once it opens.

We store your email address, the time you signed up, the time you confirmed, the IP address used for that confirmation, and two randomly generated tokens for confirmation and unsubscribing.

Sign-up uses the double opt-in procedure: after submitting, you receive an email with a confirmation link. We only add you to the list once you confirm. We store the time and IP address of your confirmation as proof of your consent; without that proof, we could not demonstrate the sending was lawful.

Through the "Kontakt" page you can send us a message. We collect your name, email address, a subject, and the content of your message.

You are of course also welcome to reach us by email directly, without the form.

To defend against automated bulk submissions, we use the following measures:

• a form field invisible to you, filled in only by automated programs
• a check of the time between loading and submitting the form
• a limit on the number of submissions per sender within a time window

For that limit, we store your IP address only as a cryptographic hash, from which the original address cannot be recomputed. These values are deleted automatically once the respective time window elapses.

We deliberately do not use a CAPTCHA. It would be a barrier for people with disabilities and would transmit additional data to third parties.

Statutory retention obligations remain unaffected. Where such an obligation prevents deletion, we restrict processing instead.

We do not pass on personal data for advertising purposes and do not sell it. Data is transmitted only to the following service providers, who act as our processors under Art. 28 GDPR:

We have data-processing agreements in place with every provider listed.

No automated decision-making, including profiling under Art. 22 GDPR, takes place. Decisions about applications are made exclusively by people.

This website is delivered exclusively over an encrypted (TLS) connection. You can recognize this by the lock icon in your browser's address bar. This protects everything you submit through our forms from being read by third parties in transit.

You have the following rights against us:

• Access to whether and which data we process about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common format (Art. 20 GDPR)
• Objection to processing based on a legitimate interest (Art. 21 GDPR)
• Withdrawal of a given consent with effect for the future (Art. 7(3) GDPR)

An informal message is enough to exercise these rights: teamvorstand@unimannheim.enactus.team

Independently of the above, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-WürttembergLautenschlagerstraße 2070173 Stuttgart

You can also contact the supervisory authority where you live or work.

We update this policy whenever the legal situation, our services, or the nature of our data processing changes. The version published on this page always applies. The date of the last change is at the top of this policy.