Privacy Policy

I. Purposes of processing and legal basis

1. Information for all users

1.1. Usage data

When you use our Websites, certain personal data – including information sent by your browser (e.g., IP addresses, previously visited websites, time and date, content viewed, amount of data transferred, language, browser version, and operating system) – is temporarily stored. If you use a mobile device to access our Websites, information such as the unique device identifier and configuration details – such as screen resolution – is also processed.

We use this usage data to display our Websites to you, to ensure their proper functioning and usability, and, if necessary, in the event of damage or violations of legal regulations, our Terms of Use, and the rights of third parties, to investigate and enforce such violations and the affected rights. The legal basis for this is our legitimate interest (Art. 6 para. 1 sentence 1 lit. f) GDPR), which lies in displaying and ensuring the functionality of our Websites as well as in investigating violations.

1.2. Processing of personal data when you contact us

If you contact us via the contact form or by other means, we will process the personal data you provide – in particular, your email address and the capacity in which you are writing to us – in order to respond to your inquiry. The legal basis for this processing is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures).

1.3 Processing of personal data when signing up for our newsletter

If you subscribe to our newsletter, we will process your email address for the purpose of sending you the newsletter. The legal basis for this is Article 6 para. 1 sentence 1 lit. a) GDPR (consent).

1.4 Processing of personal data when submitting a job application

If you submit an application to us via our Websites or by other means, we will process the personal data contained in the input fields and in any attached documents in order to review your application and contact you. The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures).

If you voluntarily provide special categories of personal data, the legal basis for their processing is Article 9 para. 2 lit. b) GDPR (processing for the exercise of rights under labor law, social security law, and social protection law, or to fulfill obligations in this regard) or Article 9 para. 2 lit. a) GDPR (consent).

1.5 Other purposes for which we process your personal data

We process your personal data:

• to protect our legitimate interests (Article 6 para. 1 sentence 1 lit. f) GDPR), including the following:

  • Restructuring of our legal entity (e.g., conversion to another nonprofit legal form, merger with another nonprofit organization, transfer of operations to another entity, or liquidation). In this context, personal data may be transferred to the parties involved in the restructuring and their advisors to the extent necessary to prepare for and carry out the restructuring. Our legitimate interest herein lies in carrying out and preparing for the restructuring, as well as in safeguarding our legal interests.
  • To protect our rights or property, as well as to establish, exercise, and defend legal claims.
• to comply with our legal obligations, court orders, or other binding decisions. The legal basis for this is Article 6 para. 1, sentence 1, lit. c) GDPR (legal obligation).

1.6 Processing of personal data through cookies

Our website app.authenticmemory.org (through which employees of institutions that collaborate with us can log in to their user accounts) uses cookies during and after the login process. Cookies are small, encrypted text files that are stored in your browser directories. Cookies collect information and technical details about users’ navigation (e.g., IP address, pages visited, menu selections, specific information entered into forms).

We use only cookies that are technically necessary to enable the login process. The legal basis for the use of necessary cookies is § 25 para. 2 no. 2 TDDDG.

1.7. Processing of personal data by Netlify Web Analytics

Our website authenticmemory.org uses Netlify Web Analytics to measure reach. Netlify Web Analytics analyzes only the server logs that are generated anyway and does not use cookies or any other technologies. The tool does not create individual user profiles, and the data is evaluated only in aggregated form (page views, most popular paths, approximate geographic information at the country level, referrers) and is not shared with third parties. The legal basis for this processing is our legitimate interest (Article 6 para. 1 sentence 1 lit. f) GDPR) in measuring reach.

2. Information for institutions

2.1 Processing of personal data for contract administration and billing

We process various types of information from the institutions we work with in order to fulfill our contract with them and issue invoices. This includes, in particular, information about the institution, contact and billing information, details regarding the services we provide, and payment processing. As a general rule, this information does not constitute personal data; to the extent that personal data is processed in individual cases, the legal basis is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures) or Article 6 para. 1 sentence 1 lit. c) GDPR (legal obligation) with regard to compliance with statutory retention requirements.

2.2 Processing of personal data during registration and login to your institution's signature portal

If you register as an employee or representative of an institution that works with us and log in to your institution’s signature portal to carry out a file signing process, we process, in particular, your email address, your name, your role within the institution, the name of the institution, your account status, and information regarding the time of your last and current login. In addition, we process the YubiKey IDs assigned to you, the username you selected, and technical details such as the transmission method.

The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures) or our legitimate interest (Article 6 para. 1 sentence 1 lit. f) GDPR) in carrying out the registration and login for the purposes of the signing process or cooperation with us.

2.3 Processing of personal data for communication and file access

If you, as an employee or representative of an institution that works with us, communicate with us and provide us with files, we process the personal data you provide in the process – in particular, your contact information and, if applicable, information regarding your professional position within the institution – in order to continue communicating with you, to fulfill our contractual obligations, and within the scope of our business relationship with the institution. If you make files available to us via an API, we process technical data such as your IP address, an API key, or login credentials. The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures) or our legitimate interest (Article 6 para. 1 sentence 1 lit. f) GDPR) in cooperating with your institution.

2.4 Processing of personal data when scheduling an appointment

If you would like to schedule an appointment with us via our Websites, you will be redirected to the appointment scheduling tool cal.com. We process the personal data you enter during the booking process (i.e., name, email address, and any additional information included in notes) in order to organize and conduct the appointment. The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures) or our legitimate interest (Article 6 para. 1 sentence 1 lit. f) GDPR) in organizing and conducting a meeting with you.

3. Information for private users

If you, as a private user, upload files to our Websites for verification, only hash values are generated from the uploaded file within your browser; these are then compared with our database to show you whether or not we can verify the file. The hash values are pseudonymous and do not allow us to directly identify you as a user. The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract or implementation of precontractual measures).

4. Information for individuals whose personal data is contained in the verified files

If the files made available to us by institutions with which we collaborate or by private users contain personal data about you (such as photos, videos, or audio recordings, or the mention of names or other identifying information), this data is primarily processed to generate a hash value for the file, which is then stored in our database. In addition, we may process metadata or additional information about the files if this information is provided to us by the institutions with which we collaborate or is intended to be made available to users. The legal basis for this is our legitimate interest (Article 6 para. 1 sentence 1 lit. f) GDPR) in building our database for verification purposes.

II. Recipients of personal data

We may engage companies to process personal data on our behalf, for example, for website hosting, technical support, sending newsletters, or scheduling appointments. These service providers process the data only on our behalf and in accordance with our instructions as data processors (Art. 28 of the GDPR).

In addition, we transfer personal data to third parties when required by law, when necessary to assert or defend legal claims, or when third parties provide certain services on our behalf (e.g., attorneys, tax advisors).

To the extent that we transfer personal data to third countries outside the EU, we ensure an adequate level of data protection through appropriate safeguards. If you would like to receive a copy of these safeguards, please contact us.

III. Retention of personal data

Unless a specific data retention period is specified in this Privacy Policy, we process your data only for as long as is necessary for the respective purposes or as required by statutory retention obligations. Once the respective purpose of processing no longer applies and the retention obligations have ended, your data will be routinely deleted unless there are specific reasons (such as the assertion, exercise, or defense of legal claims) requiring further storage.

IV. Your rights

You have the right

• to request information about your personal data that we process;
• to request the erasure, rectification, or restriction of the processing of your personal data;
• to receive the personal data you have provided which we process using automated means based on your consent or for the performance of a contract in a commonly used, machine-readable format, or, where technically feasible, to have it transferred directly from us to another controller;
• to withdraw your consent to the processing of personal data at any time, without this affecting the lawfulness of the processing prior to withdrawal;
• to object at any time to the processing of your personal data that is based on our legitimate interests, for reasons arising from your particular situation, or – in the case of processing for direct marketing purposes – without providing any reasons;
• to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the location where you believe a violation has occurred.

To exercise these rights, please contact us using the contact information provided above.