Privacy notice
Draft. Derived from what the product actually stores — the sign-up fields, the practice days, the city-level aggregation, and the sending of reminders.
Everything marked in orange must be replaced with real information before launch, and the final text must be reviewed by a lawyer. This page is not legal advice.
This is a courtesy translation. In case of doubt, the German version applies.
Controller
Universal Peace Foundation Europe e.V., address, email. A data protection officer has / has not been appointed.
What data we process
- Email address. Required at sign-up. It is also the key to your own settings; there is no password.
- Phone number. Optional, only for a reminder via WhatsApp.
- Answer to the Upadesam question. Optional. It only decides which courses you are shown.
- Time zone and language. So the reminder arrives at the right local time.
- Practice days. One date per day on which the minute was taken.
- Location at city level. For the map on the homepage, aggregated and never more precise than the city. A city with fewer than three participants does not appear at all.
- App device details, if a device is voluntarily connected.
Purpose and legal basis
The reminder and your account are based on consent under Art. 6 (1) (a) GDPR, given at sign-up. Course bookings are based on Art. 6 (1) (b) GDPR (contract). Consent can be withdrawn at any time with effect for the future; every reminder contains a one-click link for that.
WhatsApp is a separate channel with separate consent. If you do not provide a number, you receive no messages. Add provider, data processing agreement and third-country transfer
Recipients
- Hosting and database: provider, location in the EU
- Email delivery: provider with an EU option and a data processing agreement
All data is held in the European Union. A transfer to third countries does not take place / takes place only for WhatsApp.
No confirmation email
We deliberately send no confirmation email at sign-up so the first minute can begin immediately. An unconfirmed address counts as unconfirmed: if the first reminder hard-bounces, delivery stops and the record is marked accordingly.
Retention period
Until the account is deleted. After that all personal data is removed; the city-level aggregation remains because it no longer identifies anyone. Commercial and tax retention periods apply to bookings.
Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Export and deletion run directly in your own settings, with no request and no waiting time. We answer enquiries within one month (Art. 12 (3) GDPR).
You have the right to lodge a complaint with a supervisory authority; the competent one is supervisory authority at the association's registered office.
Cookies and analytics
To be added once decided — as it stands, the website sets no cookies for analytics or advertising purposes. As soon as analytics are used, they belong here and require separate consent.