Privacy Policy

1. Definitions

The privacy policy of Tales&Legends gemeinnützige UG (haftungsbeschränkt) is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our privacy policy should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.

• a) Personal Data
  Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• b) Data Subject
  Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.
• c) Processing
  Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• d) Restriction of Processing
  Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.
• e) Profiling
  Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• f) Pseudonymisation
  Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
• g) Controller or Controller Responsible for the Processing
  Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• h) Processor
  Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• i) Recipient
  Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
• j) Third Party
  Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• k) Consent
  Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member States of the European Union and other provisions related to data protection is:

Tales&Legends gemeinnützige UG (haftungsbeschränkt)
Reiboldschachtring 28
01705 Freital
Germany
Phone: +49 351 8967226-0
E-mail: nils@talesandlegends.org
Website: https://talesandlegends.org

3. Cookies

The internet pages of Tales&Legends gemeinnützige UG (haftungsbeschränkt) use cookies. Cookies are text files that are stored in a computer system via an internet browser.

Many internet sites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string through which internet pages and servers can be assigned to the specific internet browser in which the cookie was stored. This allows visited internet sites and servers to differentiate the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognized and identified using the unique cookie ID.

Through the use of cookies, Tales&Legends gemeinnützige UG (haftungsbeschränkt) can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.

The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an internet browser or other software programs. This is possible in all popular internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our website may be entirely usable.

4. Collection of General Data and Information

The website of Tales&Legends gemeinnützige UG (haftungsbeschränkt) collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.

When using these general data and information, Tales&Legends gemeinnützige UG (haftungsbeschränkt) does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website as well as its advertisement, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. These anonymously collected data and information are therefore analysed by Tales&Legends gemeinnützige UG (haftungsbeschränkt) statistically, and with the aim of increasing the data protection and data security of our enterprise. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

5. Hosting and Technical Infrastructure (Microsoft Azure)

For the operation, provision, and security of our website and all associated services and applications, we use services from Microsoft Azure. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (for users in the European Economic Area). The parent company is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

We have concluded a Data Processing Agreement (DPA) with Microsoft Ireland Operations Limited pursuant to Art. 28 GDPR, which ensures that Microsoft processes personal data exclusively on our instructions and for the purpose of providing the service. All Azure services we use are operated in European data centres (region "Europe"). Microsoft participates in the EU Data Boundary programme and commits to storing and processing EU customer data within the European Union. A transfer of data to the USA is nonetheless possible in individual cases; Microsoft Corporation has joined the EU-U.S. Data Privacy Framework. The transfer to third countries is additionally carried out on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

We use the following Azure services in particular:

a) Azure App Service and Azure Functions (Hosting and API)
Our website and the underlying API services are operated via Azure App Service and Azure Functions. In the course of operations, technical access data (IP address, browser type, operating system, URLs accessed, date and time of access) are recorded in server log files and stored for a short period. These data serve to ensure secure and stable operations and are automatically deleted after a maximum of 30 days unless a security-related evaluation is required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation of the website).

b) Azure Cosmos DB (Donor Data)
Personal data of donors (name, address, e-mail address, donation amount, payment method) are stored in an Azure Cosmos DB database. The database is operated in European data centres. Storage is necessary for the processing of the donation relationship and for compliance with statutory retention obligations under tax law. The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation). For the storage period, please refer to section 24 (Donor Data Processing).

c) Azure Blob Storage (Donation Receipts)
Issued donation receipts (Zuwendungsbestätigungen) are stored as files in Azure Blob Storage. These documents contain personal data of donors (name, address, donation amount). Storage takes place in European data centres. The legal basis is Art. 6(1)(c) GDPR (legal obligation pursuant to §§ 147 AO, 14b UStG); the retention period is ten years.

d) Azure Communication Services (Email Dispatch)
We use Azure Communication Services for transactional email dispatch (e.g. donation confirmations, notifications). In this context, the email addresses of recipients, sender information, and metadata for delivery monitoring (delivery status, timestamps) are processed. Message contents are not stored permanently after successful delivery. The legal basis is Art. 6(1)(b) GDPR (performance of the donation relationship) or Art. 6(1)(f) GDPR (legitimate interest in reliable communication).

e) Azure Application Insights (Logging and Monitoring)
To monitor application performance, detect errors, and ensure stability, we use Azure Application Insights, a Microsoft application telemetry service. Application Insights collects and stores technical telemetry data that may also contain personal data:

• IP address of the accessing system (anonymised or truncated before storage)
• Browser type and version, operating system
• URLs accessed and referrer
• Date, time and duration of requests
• HTTP status codes and response times
• Error messages and exception stack traces (without user-specific content)
• Session identifier (anonymised)

These data are used exclusively for technical analysis and diagnostic purposes and are not linked to other personal data. Personal content data (e.g. e-mail addresses, names) are not deliberately recorded in Application Insights. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure, stable, and error-free operation of our services). Telemetry data are automatically deleted after 90 days.

Further information on Microsoft's and Azure's data protection practices can be found at https://privacy.microsoft.com/en-us/privacystatement and https://azure.microsoft.com/en-us/explore/trusted-cloud/privacy.

6. Newsletter Subscription

On the website of Tales&Legends gemeinnützige UG (haftungsbeschränkt), users are given the opportunity to subscribe to our enterprise's newsletter. The personal data transmitted to the controller when ordering the newsletter can be seen from the input mask used for this purpose.

Tales&Legends gemeinnützige UG (haftungsbeschränkt) informs its customers and business partners regularly by means of a newsletter about enterprise offers. The newsletter may be received by the data subject only if (1) the data subject has a valid e-mail address and (2) the data subject registers for the newsletter. For legal reasons, a confirmation e-mail will be sent to the e-mail address registered for the newsletter for the first time, using the double opt-in procedure. This confirmation e-mail is used to prove whether the owner of the e-mail address, as the data subject, is authorised to receive the newsletter.

During registration for the newsletter, we also store the IP address assigned by the Internet service provider (ISP) of the computer system used by the data subject at the time of registration, as well as the date and time of the registration. The collection of this data is necessary in order to understand the (possible) misuse of the e-mail address of a data subject at a later date, and it therefore serves the aim of the legal protection of the controller.

The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. The subscription to our newsletter may be terminated by the data subject at any time. The consent to the storage of personal data, which the data subject has given for shipping the newsletter, may be revoked at any time. For the purpose of revocation of consent, a corresponding link is found in each newsletter.

To send our newsletter we use the EmailOctopus service provided by Three Hearts Digital Ltd, 86–90 Paul Street, London EC2A 4NE, United Kingdom, registered at Companies House under number 09897211 and trading as EmailOctopus. The provider processes subscriber data exclusively on our behalf and on our instructions, as a processor within the meaning of Art. 28 GDPR.

The subscription form collects the e-mail address as a mandatory field, as well as first name, last name and the selection under “Interests”. We maintain separate lists for the German and the English version of our website. Subscriber data is stored by the provider on Amazon Web Services servers in Ireland and therefore within the European Economic Area. According to the provider, staff of the service providers it engages may also access the data from outside the United Kingdom and the European Economic Area.

The subscription form is served by us. The data subject's browser establishes no connection to EmailOctopus when the form is displayed or submitted; the subscription data is transmitted to the provider by our server. To protect the form against automated sign-ups we use Cloudflare Turnstile — see section 22 for that service and the data it processes. The Turnstile widget is only loaded once the form is actually used.

The provider's privacy policy is available at https://emailoctopus.com/legal/privacy.

7. Newsletter-Tracking

The newsletter of Tales&Legends gemeinnützige UG (haftungsbeschränkt) contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails, which are sent in HTML format to enable log file recording and analysis. This allows a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, Tales&Legends gemeinnützige UG (haftungsbeschränkt) may see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up by data subjects.

Such personal data collected in the tracking pixels contained in the newsletters are stored and analysed by the controller in order to optimise the shipping of the newsletter, as well as to adapt the content of future newsletters even better to the interests of the data subject. These personal data will not be passed on to third parties. Data subjects are at any time entitled to revoke the respective separate declaration of consent issued by means of the double opt-in procedure.

The counting pixels and the evaluation of opens and clicks are implemented technically by EmailOctopus (Three Hearts Digital Ltd, see section 6) acting as a processor. The evaluation is carried out on our behalf and exclusively for the purposes stated in this section.

8. Contact Possibility via the Website

The website of Tales&Legends gemeinnützige UG (haftungsbeschränkt) contains information that enables a quick electronic contact to our enterprise, as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If a data subject contacts the controller by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.

9. Blog Comment Subscription

The comments made in the blog of Tales&Legends gemeinnützige UG (haftungsbeschränkt) may be subscribed to by third parties. In particular, there is the possibility that a commenter subscribes to the comments following his comments on a particular blog post.

If a data subject decides to subscribe to the option, the controller will send an automatic confirmation e-mail to check, using the double opt-in procedure, whether the owner of the specified e-mail address decided in favour of this option. The option to subscribe to comments may be terminated at any time.

10. Routine Erasure and Blocking of Personal Data

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.

If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

11. Rights of the Data Subject

• a) Right of confirmation
  Each data subject shall have the right granted by the European legislator to obtain from the controller the confirmation as to whether or not personal data concerning him or her are being processed.
• b) Right of access
  Each data subject shall have the right granted by the European legislator to obtain from the controller free information about his or her personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant the data subject access to information regarding: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored; the existence of the right to request rectification or erasure of personal data; the existence of the right to lodge a complaint with a supervisory authority; where the personal data are not collected from the data subject, any available information as to their source; and the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR.
• c) Right to rectification
  Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.
• d) Right to erasure (Right to be forgotten)
  Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the data subject withdraws consent; the data subject objects to the processing; the personal data have been unlawfully processed; or the personal data have to be erased for compliance with a legal obligation.
• e) Right of restriction of processing
  Each data subject shall have the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies: the accuracy of the personal data is contested by the data subject; the processing is unlawful and the data subject opposes the erasure; the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
• f) Right to data portability
  Each data subject shall have the right granted by the European legislator to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means.
• g) Right to object
  Each data subject shall have the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.
  
  Tales&Legends gemeinnützige UG (haftungsbeschränkt) shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
  
  If Tales&Legends gemeinnützige UG (haftungsbeschränkt) processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing.
• h) Automated individual decision-making, including profiling
  Each data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not based on the data subject's explicit consent.
• i) Right to withdraw data protection consent
  Each data subject shall have the right granted by the European legislator to withdraw his or her consent to processing of his or her personal data at any time.

12. Data Protection in Applications and the Application Procedure

The data controller shall collect and process the personal data of applicants for the purpose of the processing of the application procedure. The processing may also be carried out electronically. This is the case, in particular, if an applicant submits corresponding application documents by e-mail or by means of a web form on the website to the controller. If the data controller concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by the controller, the application documents shall be automatically erased two months after notification of the refusal decision, provided that no other legitimate interests of the controller are opposed to the erasure.

13. Data Protection for Facebook

The controller has integrated components of the enterprise Facebook on this website. Facebook is a social network.

A social network is a place for social meetings on the internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences, or enable the internet community to provide personal or business-related information. Facebook allows social network users to include the creation of private profiles, upload photos, and network through friend requests.

The operating company of Facebook is Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside of the USA or Canada, the controller for the processing of personal data is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

With each call-up to one of the individual pages of this website, which is operated by the controller and into which a Facebook component (Facebook plug-in) was integrated, the web browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding Facebook component from Facebook through the Facebook component. During the course of this technical procedure, Facebook is made aware of what specific sub-site of our website was visited by the data subject.

If the data subject is logged in at the same time on Facebook, Facebook detects with every call-up to our website by the data subject—and for the entire duration of their stay on our website—which specific sub-site of our internet page was visited by the data subject. The data subject may prevent Facebook from collecting data by logging out of their Facebook account before any call-up to our website is made.

The data policy published by Facebook, which is available at https://de-de.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook.

14. Data Protection for Google Analytics 4 (GA4)

The controller has integrated Google Analytics 4 (GA4) on this website. Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behaviour of visitors to websites. A web analytics service collects, among other things, data on the website from which a data subject came to a website (so-called referrer), which subpages were accessed, and how often and for what duration a subpage was viewed. Web analytics is mainly used to optimise a website.

The operator of Google Analytics 4 is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

GA4 is not embedded directly but loaded through Google Tag Manager (see section 16). GA4 is only executed if the data subject has consented to the “Analytics” category via our cookie consent banner. Without that consent no analytics tag is triggered, no information is stored on or read from the device, and no analytics data is transmitted to Google; until then all consent signals are set to denied. The legal basis for the processing is consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

GA4 truncates IP addresses by default and without any separate configuration before they are stored. No additional IP anonymisation flag is required for this, and GA4 does not provide one.

The purpose of using GA4 is to analyse visitor flows on our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us showing the activities on our websites, and to provide further services related to the use of our website.

Where consent to the “Analytics” category has been given, GA4 sets cookies on the data subject's device, in particular _ga and _ga_<identifier>. Through these cookies, the time of access, the subpages accessed, the referrer and the frequency of visits are processed, among other things. Each time the visitor moves to another subpage of our website, a page view is transmitted to Google. In the course of this technical procedure, Google obtains knowledge of the data subject's IP address.

A transfer of personal data to Google LLC in the United States of America cannot be ruled out in this context. According to Google, transfers to a third country are made on the basis of the standard contractual clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR; Google LLC has additionally certified under the EU-U.S. Data Privacy Framework.

The data subject can withdraw consent at any time with effect for the future by opening the cookie settings in the footer of any page of our website and withdrawing consent for analytics cookies; we then delete the affected cookies. Cookies can also be prevented at any time via the settings of the browser used, and cookies already set can be deleted. In addition, collection by Google Analytics can be objected to in general by downloading and installing the browser add-on provided by Google at https://tools.google.com/dlpage/gaoptout.

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy and under https://marketingplatform.google.com/about/analytics/terms/en/.

15. Data Protection for Google Ads

The controller has integrated Google Ads on this website. Google Ads (formerly Google AdWords) is a service for internet advertising that allows the advertiser to place ads in Google search engine results and the Google advertising network. Google Ads allows an advertiser to pre-define specific keywords with the help of which an advertisement on Google's search engine results will appear only when the user retrieves a keyword-relevant search result with the search engine.

The operating company of Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

If a data subject reaches our website via a Google advertisement, a conversion cookie is filed on the information technology system of the data subject by Google. A conversion cookie loses its validity after thirty days and is not used to identify the data subject. If the cookie has not expired, the conversion cookie is used to check whether certain sub-pages were accessed on our website. Through the conversion cookie, we and Google can understand whether a person who reached our website through an Ad generated revenue.

In addition, we use Google Ads Remarketing. Remarketing enables us to display interest-based advertisements to users who have previously visited our website on other websites within the Google Display Network. For this purpose, Google analyses previous user behaviour on our website and assigns the data subject to one or more remarketing target groups. Based on this assignment, interest-based advertising is displayed to the data subject on third-party websites.

The data subject may, at any time, prevent the setting of cookies by our website by means of a corresponding setting of the internet browser used and thus permanently deny the setting of cookies. Furthermore, the data subject may object to interest-based advertising by Google by calling the link https://www.google.de/settings/ads from each of the browsers used. Alternatively, users may deactivate the use of cookies by third-party providers on the deactivation page of the Network Advertising Initiative at https://optout.networkadvertising.org/.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.de/intl/de/policies/privacy/.

16. Data Protection for Google Tag Manager

The controller uses Google Tag Manager on this website. Google Tag Manager is a tag management system that makes it possible to manage tracking codes and associated code fragments (so-called tags) centrally via a web-based user interface and to integrate them on a website. Via Google Tag Manager, the services described in this privacy policy, such as Google Ads, Google Analytics and other third-party tools, are controlled and delivered on our website.

The operating company of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google Tag Manager itself does not set cookies and does not process personal data. However, the service triggers other tags which may themselves collect data. The tools and services managed via Google Tag Manager process personal data in accordance with the respective data protection provisions described in this privacy policy for each service.

Each time our website is accessed, the data subject's browser establishes a connection to Google servers in order to load the Tag Manager configuration. In doing so, data such as the IP address, browser type and operating system may be transmitted to Google. A transfer to the United States of America is possible. Google has joined the EU-U.S. Data Privacy Framework; the transfer to third countries is carried out on the basis of Art. 45 GDPR (adequacy decision) and additionally on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

The legal basis for the use of Google Tag Manager is Art. 6(1)(f) GDPR (legitimate interest) insofar as the Tag Manager controls exclusively technically necessary tags. For tags used for analytics, marketing or tracking purposes, the legal basis is Art. 6(1)(a) GDPR (consent of the data subject), which is obtained via the Cookie Consent Management Tool used on our website. Tags for which no consent has been given are not triggered by the Tag Manager.

Further information about Google Tag Manager and the data protection provisions of Google may be retrieved under https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/ and https://www.google.de/intl/de/policies/privacy/.

17. Data Protection for Google Maps

The controller has integrated the mapping service Google Maps on this website (in particular on the events page). Google Maps is an online map service of Google Ireland Limited that allows interactive maps to be embedded directly into the website and enables convenient use of the map function.

The operating company of Google Maps is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Through the integration of Google Maps, a connection to Google servers is automatically established when the relevant page is accessed, even if the map is not actively used. The following personal data may be transmitted to Google:

• IP address of the data subject
• Location data, if the data subject has enabled location sharing in the browser
• Browser type and version as well as the operating system used
• Date and time of access
• the sub-page of our website accessed (referrer)
• where applicable, search queries entered in Google Maps

Google Maps uses cookies and other technologies (e.g. local storage) to save user settings and to analyse usage behaviour. This information may be used by Google for the purposes of advertising, market research and the needs-based design of Google services.

A transfer of personal data to the United States of America is possible. Google LLC has joined the EU-U.S. Data Privacy Framework; the transfer to third countries is carried out on the basis of Art. 45 GDPR (adequacy decision) and additionally on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

The legal basis for the use of Google Maps is the consent of the data subject pursuant to Art. 6(1)(a) GDPR, which is obtained via the Cookie Consent Management Tool used on our website. Google Maps is only loaded after consent has been granted. The consent may be revoked at any time with effect for the future by accessing the cookie settings on our website and withdrawing consent for map cookies.

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy. The terms of use for Google Maps are available at https://maps.google.com/help/terms_maps.html.

18. Data Protection for Meta Pixel (Facebook Pixel)

The controller has integrated the Meta Pixel (formerly Facebook Pixel) on this website. The Meta Pixel is a JavaScript code snippet provided by Meta Platforms and is used to collect and analyse user behaviour on our website for advertising purposes. It enables us to measure the effectiveness of our advertisements on Facebook and Instagram, to build target audiences for our advertising, and to re-address users who have already visited our website with relevant advertisements (remarketing).

The operating company of the Meta Pixel is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The parent company and co-responsible party for data processing in the USA is Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

Through the integration of the Meta Pixel, a connection to Meta servers is automatically established when our website is accessed. The following personal data may be collected and transmitted to Meta:

• IP address of the data subject (usually truncated and anonymised)
• Browser type and version as well as the operating system used
• Referrer URL (the previously visited page)
• Sub-pages visited and duration of stay
• Actions performed on our website (so-called events, e.g. page views, clicks, form completions)
• If available: hashed e-mail address or telephone number for customer matching
• Cookie information, in particular cookie IDs _fbp and _fbc

This information is used by Meta to provide us with statistical evaluations on the effectiveness of our advertisements, to create so-called Custom Audiences and Lookalike Audiences, and to address users who have visited our website on the Facebook and Instagram platforms with interest-based advertising.

The personal data are transferred to servers of Meta Platforms, Inc. in the United States of America and processed there. Meta Platforms has joined the EU-U.S. Data Privacy Framework; the transfer is carried out on the basis of Art. 45 GDPR (adequacy decision) and additionally on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

We and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR with regard to the data collected via the Meta Pixel. Our joint controllership is limited to the collection and transmission of the data to Meta; the subsequent processing of the data by Meta is the sole responsibility of Meta. The key elements of the joint controllership agreement can be accessed at https://www.facebook.com/legal/controller_addendum.

The legal basis for the use of the Meta Pixel is the consent of the data subject pursuant to Art. 6(1)(a) GDPR, which is obtained via the Cookie Consent Management Tool used on our website. The Meta Pixel is only activated after consent has been granted.

The data subject may revoke their consent at any time with effect for the future by accessing the cookie settings on our website and withdrawing consent for marketing cookies. In addition, it is possible to object to interest-based advertising by Meta in the advertising settings of the individual Facebook account at https://www.facebook.com/ads/preferences/.

Further information and the applicable data protection provisions of Meta may be retrieved under https://www.facebook.com/privacy/policy/.

19. Data Protection for Instagram

The controller has integrated components of the service Instagram on this website. Instagram is a service that may be qualified as an audiovisual platform, which allows users to share photos and videos, as well as disseminate such data in other social networks.

The operating company of the services of Instagram is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

With each call-up to one of the individual pages of this website, which is operated by the controller and on which an Instagram component (Insta-Button) was integrated, the internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding Instagram component of Instagram.

If the data subject is logged in at the same time on Instagram, Instagram detects with every call-up to our website by the data subject, and for the entire duration of their stay on our website, which specific sub-page was visited by the data subject. This information is collected through the Instagram component and associated with the respective Instagram account of the data subject. If the data subject is logged in to Instagram, they can prevent transmission by logging out of their Instagram account before calling up our website.

Further information and the applicable data protection provisions of Instagram may be retrieved under https://privacycenter.instagram.com/policy/.

20. Data Protection for LinkedIn

The controller has integrated components of the LinkedIn Corporation on this website. LinkedIn is an internet-based social network that enables users with existing business contacts to connect and to make new business contacts. Over 400 million registered persons in more than 200 countries use LinkedIn.

The operating company of LinkedIn is LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. For privacy matters outside the USA LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible.

With each call-up to one of the individual pages of this internet site, which is operated by the controller and on which a LinkedIn component (LinkedIn plug-in) was integrated, the internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding LinkedIn component of LinkedIn. Further information about the LinkedIn plug-ins may be accessed under https://developer.linkedin.com/plugins.

If the data subject is logged in to LinkedIn, LinkedIn recognises with every call-up to our website by the data subject—and for the entire duration of their stay on our internet site—which specific sub-page of our internet page was visited by the data subject. This information is collected through the LinkedIn component and associated by LinkedIn with the respective LinkedIn account of the data subject.

LinkedIn offers the possibility to unsubscribe from e-mail messages, SMS messages and targeted ads, as well as the ability to manage ad settings under https://www.linkedin.com/psettings/guest-controls. The applicable data protection provisions of LinkedIn may be accessed under https://www.linkedin.com/legal/privacy-policy.

21. Data Protection for YouTube and YouTube Shorts

The controller has integrated components of YouTube on this website, including regular YouTube videos as well as YouTube Shorts. YouTube is an internet video portal that enables video-publishers to set video-clips and other users to view, rate, and comment on them free of charge. YouTube Shorts are short-form videos (up to 60 seconds) provided through the same infrastructure and subject to identical data protection requirements.

The operating company of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We embed YouTube videos and YouTube Shorts in the so-called extended privacy mode using the domain youtube-nocookie.com. In this mode, no cookies are set by YouTube on the data subject's computer system and no data is transferred to YouTube merely by accessing our website. A connection to YouTube servers and thus a data transmission only occurs when the data subject actively plays the embedded video. From that point, the following data may be transmitted to YouTube and Google:

• IP address of the data subject
• the sub-page of our website accessed
• browser type and version as well as operating system used
• date and time of access
• if logged in: the respective YouTube or Google account of the data subject

If the data subject is logged into YouTube or Google at the time of video playback, YouTube will associate this information with the respective account. To prevent this association, the data subject must log out of their YouTube or Google account before playing the video.

A transfer of personal data to the United States of America is possible. Google LLC has joined the EU-U.S. Data Privacy Framework; the transfer to third countries is carried out on the basis of Art. 45 GDPR (adequacy decision) and additionally on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

The legal basis for the integration of YouTube and YouTube Shorts is the consent of the data subject pursuant to Art. 6(1)(a) GDPR, which is obtained via the Cookie Consent Management Tool used on our website. Integration and data transmission only occur after consent has been granted. The consent may be revoked at any time with effect for the future by accessing the cookie settings on our website and withdrawing consent for media cookies.

The data protection provisions published by YouTube are available at https://policies.google.com/privacy.

22. Data Protection for Cloudflare Turnstile

The controller has integrated the service Cloudflare Turnstile on this website. Cloudflare Turnstile is a service for protection against automated access (so-called bots) and serves as a privacy-friendly alternative to conventional CAPTCHA solutions. The service makes it possible to distinguish between human users and automated systems without necessarily requiring the solution of a task.

The operating company of Cloudflare Turnstile is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. For users in the European Economic Area, Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 München, Germany, is additionally named as a contact.

Through the integration of Cloudflare Turnstile, data may be transmitted to Cloudflare when any correspondingly protected page of our website is accessed. This may include in particular the IP address of the data subject, information about the browser and operating system used, the sub-page of our website accessed (referrer URL), date and time of access, and interaction data in the course of the verification process.

The processing of the aforementioned data is based on Art. 6(1)(f) GDPR. Our legitimate interest is to protect our website against automated misuse attempts, spam, and other harmful access, and to ensure the functionality and security of our services.

The personal data collected are transferred to servers of Cloudflare, Inc. in the United States of America and processed there. Cloudflare has joined the EU-U.S. Data Privacy Framework; the transfer to third countries is additionally carried out on the basis of Standard Contractual Clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR.

The applicable data protection provisions of Cloudflare may be retrieved under https://www.cloudflare.com/de-de/privacypolicy/. Further information about Cloudflare Turnstile can be found at https://developers.cloudflare.com/turnstile/.

23. Data Protection for Donor Data Processing

Tales&Legends gemeinnützige UG (haftungsbeschränkt) accepts donations to fulfil its statutory charitable purposes. In the course of processing donations, personal data of donors is collected and processed.

When receiving a donation, the following personal data may be collected:

• First and last name, and if applicable organisation name
• Address (street, house number, postcode, city, country) – in particular required for the issuance of donation receipts
• E-mail address (for communication in connection with the donation)
• Donation amount, donation purpose and date of payment
• Payment method and where applicable payment data (e.g. IBAN for bank transfers; for PayPal donations, the data protection provisions of PayPal additionally apply, see section 23)

The personal data are processed for the following purposes:

• Processing and accounting of the donation
• Issuance of donation receipts (Zuwendungsbestätigungen) pursuant to § 10b German Income Tax Act (EStG) in conjunction with §§ 50, 51 German Income Tax Implementing Regulation (EStDV), which entitle donors to claim the donation for tax purposes
• Communication with donors regarding the respective donation
• Fulfilment of statutory record-keeping and retention obligations under tax law and requirements regarding charitable status

The legal bases for processing donor data are:

• Art. 6(1)(b) GDPR (performance of a contract): insofar as the data processing is necessary for the handling of the donation relationship;
• Art. 6(1)(c) GDPR (legal obligation): insofar as the processing is necessary for the fulfilment of statutory tax obligations, in particular for the issuance and retention of donation receipts and for the fulfilment of accounting obligations pursuant to §§ 140 et seq. of the German Fiscal Code (AO);
• Art. 6(1)(f) GDPR (legitimate interest): for the internal administration and statistical evaluation of donation receipts in the context of our charitable activities.

Donor data are only disclosed to third parties insofar as this is necessary for payment processing (e.g. to PayPal or credit institutions) or a statutory obligation to do so exists (e.g. to the responsible tax authority in the context of the tax examination of charitable status). No further disclosure to third parties takes place.

Donation receipts and associated accounting documents are retained for a period of ten years in accordance with §§ 147 AO, 14b UStG. Correspondence in connection with donations is retained for a period of six years. After expiry of the respective statutory retention period, the data are routinely deleted, provided no other reason for retention exists.

For enquiries regarding the processing of your donor data, please contact: nils@talesandlegends.org.

24. Payment Method: Data Protection Provisions on the Use of PayPal as a Payment Method

The controller has integrated components of PayPal on this website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. PayPal is also capable of processing virtual payments through credit cards when a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there are no classic account numbers. PayPal makes it possible to trigger online payments to third parties or to receive payments.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If the data subject chooses "PayPal" as the payment option during the ordering process on our website, data of the data subject are transmitted automatically to PayPal. By selecting this payment option, the data subject agrees to the transfer of personal data required for payment processing.

The personal data transmitted to PayPal is usually first name, last name, address, email address, IP address, telephone number, mobile phone number, or other data necessary for payment processing. The processing of the purchase contract is also possible with such personal data, which are in connection with the respective order.

The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

25. Organiser Toolbox: Online Tools for Event Organisers

At talesandlegends.org/en/tools/ we provide free calculators, assistants and templates for planning cultural events (hereinafter „tools“). We have built these tools to work with as little data as possible. This section explains what happens when you use them.

25.1 Using the tools without data transfer

The tools run entirely in your browser. Everything you enter – event details, numbers of people, floor areas, cost items, hazard assessments or concept modules – is processed exclusively on your device. It is not transmitted to our server or to any third party. We have no access to this data and cannot view it.

When you open the tool pages, technically necessary connection data is processed in the server log files, as with every page of our website. Please see section 4 „Collection of General Data and Information“ of this privacy policy.

25.2 Storage in your browser (local storage)

So that you can resume a calculation or concept later without re-entering everything, the tools save your entries in your browser’s local storage. This storage takes place exclusively on your device; the data does not leave your browser and is not transmitted to us. It is not used to recognise you across websites or for advertising purposes.

This storage is necessary to provide a function you have expressly requested (resuming your entries) and therefore does not require consent under Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can delete the stored data at any time yourself, either via the „Delete all data“ function in the respective tool or via your browser settings (clear site data). Otherwise the data remains stored until you delete it or your browser removes the site data.

If you export an event profile or a calculation as a file (JSON export), that file resides only with you. When you import such a file, the data is again processed only locally in your browser.

25.3 Export by e-mail (PDF, templates)

Some tools offer to send a result as a PDF document or a template (e.g. an Excel file) to an e-mail address. If you use this function, we transmit the e-mail address you provide and the tool content required for the export to our server, generate the document there and send it to the address given.

The sole purpose of this processing is to deliver the document you requested. The legal basis is Art. 6 (1) (b) GDPR (performance of a service you have requested). Sending is carried out via the e-mail service of Azure Communication Services, a service provided by Microsoft (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). We operate the service with the data location „Europe“, so that processing and storage of the delivery data take place within the European Union. A data processing agreement under Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum). Insofar as Microsoft transfers data to the USA in the course of operating the service, this is based on Microsoft’s certification under the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses. Further information can be found in Microsoft’s privacy statement at https://privacy.microsoft.com/en-gb/privacystatement.

The e-mail address and the transmitted content are deleted after successful delivery and in any case no later than 7 days (this period serves to resolve delivery failures). No further storage or use takes place unless you have at the same time consented to receiving the Organiser Briefing (see 25.4).

Use of the tools themselves does not depend on providing an e-mail address. All calculations and results are available to you in the browser without exporting; most tools additionally offer a print view that lets you save the result via your browser’s print function without providing an e-mail address.

25.4 Organiser Briefing (newsletter for event organisers)

We offer an e-mail newsletter for event organisers, the „Organiser Briefing“. It is published roughly monthly and contains notes on deadlines relevant to cultural event organisers, new or updated tools, practical knowledge on event organisation, and information about events, volunteering and ways to support Tales&Legends.

You can subscribe to the Organiser Briefing via the sign-up form on the tool pages or via the sign-up checkbox when exporting by e-mail. Subscription is voluntary and only takes place if you actively tick the corresponding box. Export by e-mail (25.3) works regardless of whether you subscribe to the Organiser Briefing.

We use the double opt-in procedure for subscriptions: after signing up you receive an e-mail with a confirmation link. Your address is only added to the mailing list once you click this link. This ensures that nobody can subscribe you without your knowledge. We log the sign-up, the confirmation and the IP address used, each with a timestamp, in order to be able to prove consent.

The legal basis for sending the newsletter is your consent under Art. 6 (1) (a) GDPR in conjunction with Section 7 (2) no. 2 of the German Act Against Unfair Competition (UWG); the legal basis for logging is our obligation to demonstrate consent under Art. 7 (1) GDPR in conjunction with Art. 6 (1) (c) GDPR.

As for our other mailing lists, we use the service EmailOctopus (Three Hearts Digital Ltd, United Kingdom) for sending. Data is stored on Amazon Web Services servers in Ireland (EU). The provider processes your e-mail address and the log data on our behalf; a data processing agreement under Art. 28 GDPR is in place. Insofar as the provider processes data in the United Kingdom, this is covered by the European Commission’s adequacy decision for the United Kingdom. Further information on EmailOctopus can be found in section 6 „Newsletter Subscription“ of this privacy policy. The Organiser Briefing e-mails contain links that are routed via the provider, so that it is recorded whether and which links you have clicked; it is also recorded whether an e-mail was opened. We use this measurement to identify which content is useful for event organisers and to improve the briefing accordingly. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you give when subscribing to the Organiser Briefing; the sign-up text refers to this measurement. If you do not wish to be measured, you can unsubscribe from the Organiser Briefing at any time; subscribing without measurement is not technically possible.

You can withdraw your consent at any time with effect for the future by clicking the unsubscribe link at the end of every e-mail or by sending a message to nils@talesandlegends.org. After withdrawal we delete your e-mail address from the mailing list. We retain the sign-up log data for up to three years after withdrawal so that we can prove that consent existed in the event of a dispute (Art. 6 (1) (f) GDPR; legitimate interest in legal defence).

25.5 Usage measurement on the tool pages

On the tool pages we use Google Analytics 4, as on the rest of the website; the information in section 14 „Data Protection for Google Analytics 4 (GA4)“ of this privacy policy (provider, cookies, retention period, data transfer to the USA, withdrawal) applies here as well. Measurement only takes place if you have consented via our consent banner (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); you can withdraw your consent at any time by opening the cookie settings in the footer of every page.

In addition to general page views, we record a few events on the tool pages to understand which tools are used and where users drop off: whether a calculation was triggered, an export dialogue opened, an export completed or the Organiser Briefing subscribed to, as well as the selected event profile (e.g. „LARP“ or „club festival“). These events contain none of the content of your entries – no event names, figures, cost items, assessments or e-mail addresses. Without your consent these events are not recorded either; the tools work fully regardless.

25.6 Feedback on the tools

Each tool contains a link through which you can send us feedback and error reports. The information in section 8 „Contact Possibility via the Website“ of this privacy policy applies. If you voluntarily include details about your event in your feedback, we use them solely to process your feedback and improve the tools.

25.7 No automated decisions, no disclosure

The tools provide guidance values based on published standards, regulations and rules of thumb. They do not make automated decisions with legal effect within the meaning of Art. 22 GDPR; decisions about your safety concept, your budget or your concept rest with you and the competent authorities. We do not pass on data from the use of the tools to third parties other than the processors named in this section, and we do not sell it.

25.8 Your rights

With regard to the processing described in this section, you have the rights described in section 11 „Rights of the Data Subject“, in particular the rights to access, rectification, erasure, restriction, data portability, objection and withdrawal of consent given. Please note: data stored exclusively in your browser (25.2) cannot be disclosed or deleted by us because we have no access to it – you delete this data yourself via the respective tool or your browser.

26. Legal Basis for the Processing

Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations which are necessary for carrying out pre-contractual measures, for example in the case of enquiries concerning our products or services. If our company is subject to a legal obligation by which processing of personal data is required, such as for the fulfilment of tax obligations, the processing is based on Art. 6(1)(c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured at our company. The processing would then be based on Art. 6(1)(d) GDPR. Finally, processing operations could be based on Art. 6(1)(f) GDPR. This legal basis is used for processing operations which are not covered by any of the above-mentioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

27. Legitimate Interests Pursued by the Controller or by a Third Party

Where the processing of personal data is based on Article 6(1)(f) GDPR our legitimate interest is to carry out our business in favour of the well-being of all our employees and the shareholders.

28. Period for which the Personal Data will be Stored

The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfilment of the contract or the initiation of a contract.

29. Statutory or Contractual Requirements to Provide the Personal Data; Necessity for the Conclusion of the Contract; Obligation of the Data Subject to Provide the Personal Data; Possible Consequences of Failure to Provide the Personal Data

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.

30. Existence of Automated Decision-Making

As a responsible company, we do not use automatic decision-making or profiling.