Privacy Policy

Privacy Policy

1. Introduction

With the following information, we would like to provide you, as the “data subject,” with an overview of the processing of your personal data by us and of your rights under data protection laws. Use of our website is generally possible without providing personal data. However, if you wish to make use of special services offered by our company via our website, processing of personal data may become necessary. If the processing of personal data is required and there is no statutory basis for such processing, we generally obtain your consent.

The processing of personal data, such as your name, address, or email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to the Private Ganztagsschule Holzkirchen. With this privacy policy, we would like to inform you about the scope and purpose of the personal data collected, used, and processed by us.

As the controller responsible for processing, we have implemented numerous technical and organizational measures to ensure the most comprehensive protection possible of personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, you are free to transmit personal data to us via alternative means, such as by telephone or postal mail.

You too can take simple and easy-to-implement measures to protect yourself against unauthorized third-party access to your data. Therefore, at this point we would like to provide you with some guidance on the secure handling of your data:

• Protect your account (login, user, or customer account) and your IT system (computer, laptop, tablet, or mobile device) with secure passwords.
• Only you should have access to these passwords.
• Ensure that you use each password only for a single account (login, user, or customer account).
• Do not use the same password for different websites, applications, or online services.
• Especially when using publicly accessible or shared IT systems, you should always log out completely after each session on a website, application, or online service.

Passwords should consist of at least 12 characters and be chosen so that they cannot be easily guessed. Therefore, they should not contain common everyday words, your own name, or names of relatives, but should include a mix of upper- and lowercase letters, numbers, and special characters.

2. Controller

The controller within the meaning of the GDPR is:
Private Ganztagsschule Holzkirchen
Krankenhausstraße 7, 83607 Holzkirchen, Germany

3. Data Protection Officer

You can contact the Data Protection Officer as follows:
Stephan Krischke, datenschutz@ganztagsschule.de

You may contact our Data Protection Officer at any time with questions or suggestions regarding data protection.

4. Definitions

This privacy policy is based on the terminology used by the European legislator when adopting the GDPR. Our privacy policy is intended to be easily readable and understandable for the general public, customers, and business partners alike. To ensure this, we explain the terminology used below.

We use, among others, the following terms in this privacy policy:

1. Personal data
   Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2. Data subject
   A data subject is any identified or identifiable natural person whose personal data are processed by the controller.

3. Processing
   Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

4. Restriction of processing
   Restriction of processing means the marking of stored personal data with the aim of limiting their future processing.

5. Profiling
   Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

6. Pseudonymization
   Pseudonymization means the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures ensuring non-attribution.

7. Processor
   A processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

8. Recipient
   A recipient is a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

9. Third party
   A third party is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons authorized to process the personal data under the direct authority of the controller or processor.

10. Consent
    Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which the data subject signifies agreement to the processing of personal data relating to them, either by a statement or by a clear affirmative action.

5. Legal basis for processing

Article 6(1)(a) GDPR (in conjunction with § 25(1) TDDDG, formerly TTDSG) serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

Where the processing of personal data is necessary for the performance of a contract to which you are a party, such processing is based on Article 6(1)(b) GDPR. This also applies to processing operations required to carry out pre-contractual measures.

Where processing is necessary to comply with a legal obligation, such as tax obligations, the processing is based on Article 6(1)(c) GDPR.

In rare cases, processing may be necessary to protect vital interests of the data subject or another natural person. In such cases, the processing is based on Article 6(1)(d) GDPR.

Finally, processing operations may be based on Article 6(1)(f) GDPR if processing is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights, and freedoms of the data subject do not override those interests.

Our services are generally directed at adults. Persons under the age of 16 may not transmit personal data to us without the consent of their parents or legal guardians. We do not knowingly collect personal data from children or adolescents.

6. Disclosure of data to third parties

Personal data are not transferred to third parties for purposes other than those listed below.

We only disclose your personal data if:

1. you have given your explicit consent pursuant to Article 6(1)(a) GDPR;
2. disclosure is permissible pursuant to Article 6(1)(f) GDPR to protect our legitimate interests and there is no reason to assume that you have an overriding legitimate interest in non-disclosure;
3. there is a legal obligation pursuant to Article 6(1)(c) GDPR; or
4. disclosure is legally permissible and necessary pursuant to Article 6(1)(b) GDPR for the performance of a contractual relationship.

As part of the processing described in this privacy policy, personal data may be transferred to the USA. Companies in the USA only provide an adequate level of data protection if they are certified under the EU‑US Data Privacy Framework. Otherwise, we conclude standard contractual clauses with service providers to safeguard your data.

7. Technology

7.1 SSL/TLS encryption

This website uses SSL or TLS encryption to protect the transmission of confidential content. You can recognize an encrypted connection by the “https://” prefix and the lock symbol in your browser’s address bar.

7.2 Data collection when visiting the website

When you use our website for informational purposes only, we collect only the data that your browser transmits to our server (server log files), such as browser type, operating system, referrer URL, visited subpages, date and time of access, IP address, and internet service provider.
The legal basis is Article 6(1)(f) GDPR.

8. Cookies

8.1 General information about cookies

Cookies are small files automatically created by your browser and stored on your device when you visit our website. Cookies do not directly identify you.

8.2 Legal basis for cookies

Cookies necessary for the proper functioning of the website are processed on the basis of Article 6(1)(f) GDPR. All other cookies are processed on the basis of your consent pursuant to Article 6(1)(a) GDPR.

9. Content of our website

9.1 Contact / contact form

Personal data collected via contact forms or email are processed exclusively to handle your inquiry. The legal basis is Article 6(1)(f) GDPR or Article 6(1)(b) GDPR if the inquiry relates to a contract.

9.2 Applicant management

We process applicant data for the purpose of handling applications. The legal basis is Article 6(1)(b) GDPR. Applicant data are deleted after six months in the event of rejection, or after 24 months if consent to inclusion in the applicant pool has been given.

9.3 Schulmanager

Schulmanager is a web and app-based solution for communication between schools, teachers, parents, and students. Provider: Schulmanager Online GmbH, Augustenstraße 77, 80333 Munich.
Further information: https://www.schulmanager-online.de/datenschutz.html

10. Our activities on social networks

We maintain social media profiles to communicate with you. We are jointly responsible with the platform providers pursuant to Article 26 GDPR.
Data may be processed outside the EU/EEA, and user profiles may be created by the platforms.

10.1 Instagram

Joint controller in Germany:
Meta Platforms Ireland Ltd., Dublin, Ireland

Meta may process content of adult EU users for AI training unless an objection is raised.
Privacy policy: https://instagram.com/legal/privacy/

11. Web analytics

11.1 Google Analytics Universal

We use Google Analytics to analyze website usage on the basis of your explicit consent pursuant to Article 6(1)(a) GDPR. IP anonymization is enabled.
Privacy policy: https://support.google.com/analytics/answer/6004245

12. Plugins and other services

12.1 Google Maps

Google Maps is used to display interactive maps. Data are only processed with your consent pursuant to Article 6(1)(a) GDPR.
Privacy policy: https://www.google.de/intl/de/policies/privacy/

12.2 Google Tag Manager

Used to manage website tags. Data processing occurs only with consent pursuant to Article 6(1)(a) GDPR.

12.3 Google Web Fonts

Google Web Fonts are used for uniform font display. Processing occurs only with consent pursuant to Article 6(1)(a) GDPR.

12.4 Vimeo (videos)

Vimeo plugins are embedded in our website. Data processing occurs only with your consent pursuant to Article 6(1)(a) GDPR.
Privacy policy: https://vimeo.com/privacy

13. Your rights as a data subject

You have the right to:

• confirmation of processing (Art. 15 GDPR),
• information and access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR),
• withdrawal of consent (Art. 7(3) GDPR), and
• lodge a complaint with a supervisory authority.