Privacy Policy

1. General

The protection of your personal data is very important to us. Therefore, we want to provide you with full transparency regarding the processing of your data at TechLabs. This privacy statement applies to data processing that takes place when you visit our website www.techlabs.org, as well as data processing that takes place when you participate in our program as a 'Techie' or engage in TechLabs as a 'Volunteer'.

A 'Techie' is considered to be any participant who uses the online course offering. You can view the specific data processing of 'Techies' data in section 4 of this Privacy Policy. If you are active as a 'Volunteer' at TechLabs, you can find the specific information on the processing of your data in section 5 of this Privacy Policy.

The following information is intended to inform you about what we use your personal data for, what data is involved and what rights you have with regard to data processing. Personal data within the meaning of Art. 4 No. 1 GDPR (hereinafter also referred to as "data") is any information that at least indirectly allows the identification of a person or relates to an already identified person.

The responsible party within the meaning of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other data protection requirements is the

TechLabs e. V.

c/o phase-6 GmbH

Neue Schönhauser Str. 16

10178 Berlin

E-Mail-Adress: info@techlabs.org

represented by the Board of Directors: Sabrina Engling, Ranjini Kishen Kumar, Carolina Constant Sanchez and hereinafter referred to as the „responsible party“ or „we“:

2. General information on data processing

We process personal data within the legally permissible limits. This means that data processing operations are based on a legal basis according to Art. 6 GDPR. In the case of data processing based on your consent (Art. 6 para. 1 lit. a GDPR), you will be informed separately about the consent process, e.g. by a checkbox or a pop-up window. Insofar as we have not specified any other legal basis for the individual data processing and it is not required for the initiation of a contract or for the fulfillment of a contract pursuant to Art. 6 Para. 1 lit. b GDPR, the respective data processing pursuant to Art. 6 Para. 1 lit. f GDPR is based on our legitimate interest in being able to provide you with our service.

A transfer of personal data only takes place in the cases described below. If we transfer your data to a third country that is not part of the European Economic Area (EEA), this is always done on the basis of a legal basis pursuant to Art. 44 et seq. GDPR. Data transfers to countries for which an effective adequacy decision exists (such as Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, Canada, New Zealand, Switzerland or Uruguay) are made on this very basis. Unless we have received express consent from you pursuant to Art. 45 GDPR to transfer data to additional third countries (such as the USA), the transfer of data to these third countries will take place on the basis of Standard Contractual Clauses (SCC, Standard Data Protection Clauses) issued by the EU Commission, pursuant to Art. 46 (2) c) GDPR.

Personal data is processed by us only for the purposes described in clauses 3 to 5. As soon as the purpose of the processing ceases to apply, your personal data will be deleted. The same applies to the expiry of a prescribed storage period, subject to cases in which further storage is necessary for the conclusion or performance of a contract. In addition, there may be a legal obligation to store the data for a longer period or to pass it on to third parties (esp. to law enforcement agencies). In other cases, the storage period and type of data collected as well as the type of data processing depend on which functions of our website you use in each individual case. We will also be happy to provide you with information about this in individual cases in accordance with Art. 15 GDPR.

3. Data processing in connection with the use of our website

The use of our website with all its functions requires the processing of certain personal data. We would like to inform you that the provision of your data is not required by law or contract. However, if you do not provide your data, the consequence for you is that you may only be able to use the website to a limited extent.

3.1 Informational use of the website

The purely informative calling up of www.techlabs.org requires the processing of the following personal data and information: Browser type and version, operating system used, address of previously visited websites, address of the terminal device with which you access the website (IP address) and the time of the website call. All this information is automatically transmitted by your browser, should you not have configured it in such a way that transmission of the information is suppressed.

This personal data is processed for the purpose of the functionality and optimization of www.techlabs.org, as well as to ensure the security of our information technology systems. These purposes are at the same time legitimate interests according to Art. 6 para. 1 lit. f. GDPR.

The storage period of your personal data is a maximum of 30 days. This personal data will not be merged with other data sources. Data will only be passed on to third parties in the cases mentioned, except in the case of a legal, judicial or official obligation. Unless otherwise stated in this privacy policy, no data will be transferred to third countries or international organizations.

3.2 External Content and Hosting Infrastructure

To ensure the proper technical operation, security, and user-friendly performance of our website, we rely on external hosting and content delivery services provided by Wix.com Ltd. (40 Namal Tel Aviv St., Tel Aviv 6350671, Israel). Wix hosts our website, delivers all related content, and provides the technical infrastructure necessary for website performance and security.

Wix uses Content Delivery Network (CDN) technology to deliver our website quickly and reliably. When you access our website, requests are routed through regionally distributed servers in order to optimize loading times and protect the site from security threats such as DDoS attacks.

For this purpose, your IP address and certain technical information (e.g., browser type, access time, device information) are transmitted to the servers used by Wix and their CDN providers. This processing is based on our legitimate interest in providing a secure and efficient website (Art. 6(1)(f) GDPR).

Wix may process data through servers located outside the European Union, including in the United States and Israel. Israel has an adequacy decision under the GDPR, and Wix implements additional safeguards (such as Standard Contractual Clauses) for transfers to other third countries. Further information is available in Wix’s Privacy Policy: https://www.wix.com/about/privacy

3.3 Analysis tools and cookies

Our website uses cookies and similar technologies to ensure proper functionality, provide secure and reliable access, and—subject to your consent—improve performance and user experience. Cookies are small text files stored on your device when you visit our website.

We use the following cookies on our website:

Strictly necessary cookies which are essential for the operation and security of our website. They enable basic functions such as page navigation, session control, and fraud prevention. These cookies do not require consent.
Functional cookies which enable improved usability, such as remembering user preferences. These cookies are activated only if you provide consent.
Performance cookies which collect aggregated information about website usage to help us analyze and optimize site performance. These cookies are set only with your consent.
Marketing cookies may be used to deliver relevant content or measure interaction with embedded third-party services. This includes cookies that may be set by embedded YouTube videos. Such cookies are only activated if you consent to them in our cookie banner.

When you first visit our website, you are presented with a cookie banner allowing you to:

Accept all cookies
Reject all non-essential cookies
Customize your cookie preferences

No functional, performance, or marketing cookies are set unless you actively consent to them. You may change or withdraw your consent at any time clicking the fingerprint icon on the bottom left of the page.

3.4 Payments

If you choose to make a donation via PayPal on our website, the data required to process the transaction will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. This may include your name, email address, payment amount, IP address, and other technical data necessary for the execution of the payment.

The processing of this data is based on Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (our legitimate interest in enabling secure and efficient payment processing).

PayPal may process the transmitted data for its own purposes, such as creditworthiness checks or fraud prevention. For more information, please refer to PayPal’s Privacy Policy.

4. Data processing when you participate as a Techie

When you join our program as a Techie, we process the following data from you:

4.1 Email newsletter

We send a general email newsletter and another one for communication with cooperation partners. For this purpose, we use the service provider Mailchimp of Rocket Science Group, LLC (675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA), as a processor. A data transfer to the USA takes place on the basis of Standard Contractual Clauses (SCC) adopted by the European Commission. For more information on data processing, please click here:

https://mailchimp.com/legal/privacy/

If you agree, we will be happy to inform you about news related to Techlabs as part of our email newsletter. Processed data categories here are contact data, master data, usage data, connection data. You will only receive the newsletter if you have expressly consented to the use of your e-mail address for this purpose as part of the so-called double opt-in procedure. For this purpose, we will send you an e-mail with a confirmation link, which you must click to confirm your consent. The legal basis for this data processing is Art. 6 para. 1 lit. a GDPR.

This consent to the newsletter also includes a reach measurement, where we can determine by means of an embedded pixel whether the contents of our email were also retrieved. As soon as you open the email, we automatically record your IP address and the time of the call and can use this basis to adapt the design of our newsletter to meet your needs. The legal basis for this data processing is Art. 6 para. 1 lit. a GDPR.

If you no longer wish to receive our newsletter, you can click on an unsubscribe link at the end of each email. We will then store your email address in a so-called blacklist and will not send you any further newsletters to this email address.

4.2 Joint processing with local TechLabs locations

The purposes and means of the data processing listed in this subsection are jointly determined by the main TechLabs site and the respective local site and are therefore carried out under joint responsibility. For this purpose, the main site has concluded joint responsibility agreements with the respective local sites pursuant to Art. 26 GDPR, in which the more detailed circumstances of the cooperation are regulated.

The cooperation between the main site and the respective local site is carried out in such a way that the organizational framework is defined by the main site, which also provides the technical infrastructure. Within this framework, the local site decides on the details of the data processing. If you have any questions or wish to exercise your rights explained in Section 7, please contact your local TechLabs site.

4.2.1 Online Learning

We use your name, email address and track selection to provide you with appropriate online learning content. For this purpose, you will receive an email with individual access to learning content from edyoucated (edyoucated GmbH, Hafenweg 16, 48155 Münster, Germany). This data processing is necessary for the fulfillment of our obligations under the user agreement. The legal basis for this data processing is Art. 6 para. 1 lit. b GDPR. You can find more information on data protection at edyoucated at: https://edyoucated.org/de/privacy

4.2.2 Online Learning Community

To enable you to communicate with your team members, we provide a Slack Channel for your team. You will receive access via email. For this process, we process your name as well as your email address and transmit this data to Slack (Slack Technologies Limited, One Park Place, Upper Hatch Street, Dublin 2, Ireland). This data processing is necessary for the fulfillment of our usage contract concluded with you. The legal basis for this data processing is Art. 6 (1) lit. b GDPR.

If Slack transfers the data to the USA, this takes place on the basis of Standard Contractual Clauses (SCC , Standard Contractual Clauses) adopted by the European Commission. You can find more information on data processing at Slack here: https://slack.com/intl/de-de/trust/privacy/privacy-policy?geocode=de-de

4.2.3 Alumni program

To keep in touch with you in our alumni program, we use your name, track selection and information about your current professional activity. We collect this data via the service Typeform (C/Bac de Roda, 163 (Local), 08018 - Barcelona (Spain)), or Fillout (operated by Restly, Inc., 9450 SW Gemini Dr, PMB 39088, Beaverton, Oregon 97008) and process it via the services of Google GSuite. The email dispatch is carried out by the provider Mailchimp (see 4.1). If information is transferred to the USA during data processing, this is done on the basis of Standard Contractual Clauses (SCC).

We will only contact you if you have expressly consented to the use of your e-mail address for this purpose as part of the so-called double opt-in procedure. For this purpose, we will send you an e-mail with a confirmation link, which you must click to confirm your consent. The legal basis for this data processing is Art. 6 para. 1 lit. a GDPR.

5. Data processing if you are active as a 'Volunteer'

5.1 Joint data processing

If you are active as a volunteer at TechLabs, we process the data listed in this section of the Privacy Policy from you. The purposes and means of this data processing are determined jointly by the TechLabs main site in Münster and the respective local site and are therefore carried out under joint responsibility. For this purpose, the main site has concluded joint responsibility agreements with the respective local sites pursuant to Art. 26 GDPR, in which the more detailed circumstances of the cooperation are regulated.

The cooperation between the main site and the respective local site is carried out in such a way that the organizational framework is defined by the main site, which also provides the technical infrastructure. Within this framework, the local site decides on the design of the data processing in detail. If you have any questions or wish to exercise your rights explained in Section 7, please contact your local TechLabs site.

5.2 Additional data processors used for volunteers

Additionally to the tools mentioned under 4., volunteer data is also processed using Notion (operated by Notion Labs, Inc., 685 Market Street, San Francisco, CA 94105, United States) and easyVerein (operated by SD Software-Design GmbH, c/o Abt. easyVerein, Basler Landstraße 8, 79111 Freiburg im Breisgau, Germany).

5.3 Retention of volunteer application data

We process personal data submitted as part of volunteer applications solely for the purpose of evaluating the application and communicating with the applicant. If no volunteering relationship is established, we retain the application data for a maximum of 12 months after the decision date, after which the data is deleted or anonymised. This retention period allows us to review applications for future opportunities and to address any potential questions regarding the application process. If you withdraw your application, your data will be deleted immediately.

6. Order processing

In some cases, we use external service providers such as Google GSuite (platform for office services), Typeform and Fillout (survey tools), Mailchimp (email delivery), edyoucated (learning platform) and Slack (communication tool) to process your data. These service providers have been carefully selected and commissioned by us. They are bound by our instructions and are regularly monitored. In doing so, our order processing contracts comply with the strict requirements of Art. 28 GDPR.

7. Data subject rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and as a user you have the following rights vis-à-vis the controller:

7.1 Right to information

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing exists, you may request information from the controller about the following:

the purposes for which the personal data are processed;
the categories of personal data which are processed;
the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed; the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for determining the storage period;
the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
the existence of a right of appeal to a supervisory authority;
any available information about the origin of the data, if the personal data are not collected from the data subject;
the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information about whether personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

7.2 Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you are inaccurate or incomplete. The controller shall carry out the rectification without undue delay.

7.3 Right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;
the controller no longer needs the personal data for the purposes of processing, but you need it for the assertion, exercise or defense of legal claims; or
if you have objected to the processing pursuant to Article 21 (1) GDPR and it is not yet clear whether the legitimate grounds of the controller outweigh your grounds.

If the processing of personal data concerning you has been restricted, such data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

7.4 Right to deletion

You may request the controller to erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay, if one of the following reasons applies:

The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
You revoke your consent on which the processing was based pursuant to Art. 6 (1) a or Art. 9 (2) a GDPR and there is no other legal basis for the processing.
You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
The personal data concerning you has been processed unlawfully.
The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
The personal data concerning you has been collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, it shall take reasonable measures, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to or copies or replications of such personal data.

The right to erasure does not exist insofar as the processing is necessary for

to exercise the right to freedom of expression and information; for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in (1) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or for the assertion, exercise or defense of legal claims.

7.5 Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right vis-à-vis the controller to be informed about these recipients.

7.6 Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, common and machine-readable format and to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and that the processing is carried out with the help of automated procedures.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7.7 Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to processing of the personal data concerning you for the purposes of such marketing; this also applies to profiling, insofar as it is related to such direct marketing. If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services - notwithstanding Directive 2002/58/EC - to exercise your right to object by means of automated procedures using technical specifications.

7.8 Right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

The processing is lawful until your revocation - the revocation thus only affects the processing after receipt of your revocation. You can declare the revocation informally by mail or e-mail. The processing of your personal data will then no longer take place, subject to permission by another legal basis. If this is not the case, your data must be deleted immediately after the revocation in accordance with Art. 17 (2) GDPR.

Your revocation should be addressed to TechLabs e.V. which can be reached via the contact details mentioned in 1. General.

7.9 Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

8. Automated decisions in individual cases including profiling.

Automated decisions in individual cases including profiling do not take place.

9. Notification obligations of the responsible party.

If your personal data have been disclosed to other recipients (third parties) with legal grounds, we will notify them of any rectification, erasure or restriction of the processing of your personal data (Art. 16, Art. 17(1) and Art. 18 GDPR). The notification obligation does not apply if it is associated with a disproportionate effort or is impossible. We will also inform you about the recipients upon request.