Data Privacy at a Glance

The protection and security of your personal data is important to us. This privacy policy describes how we treat personal data that you provide to us on our websites or elsewhere where we refer to this privacy policy, and helps you understand what personal data we collect from you, why we collect it, what we do with it, and how long we store it.

The following entity is responsible for the data processing described below:

Wikimedia Deutschland – Gesellschaft zur Förderung Freien Wissens e. V.
Tempelhofer Ufer 23-24
10963 Berlin

Telefon: +49 (0)30-577 11 62-0
E-Mail: datenschutz@wikimedia.de

You can contact our data protection officer, attorney Thorsten Feldmann, LL.M. (UCLA), at datenschutz@wikimedia.de.

When you visit our website and use its features, we process personal data. You are under no obligation to provide us with personal data. However, we may then be unable to provide you with our website and the services offered on it.

In the following sections, we explain what data we process, for what purposes, for how long, and on what legal basis. You will also learn to whom we pass on your data. At the end of the privacy policy, you will also find information about our storage periods, general recipients, and automated decision-making.

Purposes: When you visit our website, we process certain data to enable you to use our website and the functions it contains.

Categories of data: The data processed when you use the website regularly includes your IP address, which is necessary to deliver the content of online offers to your device, as well as all information you enter on our website (e.g., language selection, entries in forms, search functions, or similar).

Recipients:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen
• Bananenbiegerei, Richardstraße 79, 12043 Berlin

Legal basis: The legitimate interest in pursuing the aforementioned purposes (Art. 6 para. 1 lit. f) GDPR).

Storage period: We do not permanently store any personal data for the aforementioned purposes.

Purposes: Access to our servers is stored in so-called server log files. The server log files can be used for security purposes, e.g., to prevent server overload, and to ensure server utilization and stability.

Categories of data: IP address, address and name of the websites and files accessed, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page).

Recipients:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen
• Bananenbiegerei, Richardstraße 79, 12043 Berlin

Legal basis: The legitimate interest in pursuing the aforementioned purposes (Art. 6 para. 1 lit. f) GDPR).

Storage period: Data is only stored for a period of 24 hours. All log files created by our systems are then automatically deleted.

Purposes: When you visit our website, we ask for your consent to store information on your device (e.g., cookies) and to process your data for specific purposes. Your consent is documented to comply with our legal obligation to provide evidence and to technically control the setting of cookies. Cookies may also be used for this purpose. You can adjust your settings at any time and/or revoke your consent.

Categories of data: Your IP address, the date of your consent, a pseudonymous ID, and your selected settings are stored for the purpose of obtaining, managing, and tracking your consent.

Recipients:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: The legitimate interest in pursuing the aforementioned purposes (Art. 6 para. 1 lit. f) GDPR).

Storage period: The data will be stored for 1 year and then deleted.

Purposes: You can create a user account on some of our pages. We then process your personal data to create your account and subsequently to maintain it. In doing so, we may also contact you by email to inform you of important changes, such as changes to the scope of our services or technically necessary changes.

Categories of data: Data that you provide when creating a user account or in connection with a user account, including, but not limited to: username, email address.

Recipients:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR).

Storage period: The data will generally be processed for as long as you maintain your user account with us. After termination of the user account, your data will be deleted unless statutory retention obligations prevent the deletion of individual data or documents.

Purposes: You can post comments or subscribe to comments in some areas of our offerings.

Categories of data: We process your comment, information about when the comment was posted, your email address, your IP address, and, if you do not post anonymously, the name you have chosen.

Recipients:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: Performance of a contract (Art. 6 para. 1 lit. b) GDPR), the legitimate interest in pursuing the aforementioned purposes (Art. 6 para. 1 lit. f) GDPR).

Storage period: The comments and associated data (e.g., IP address) are stored and remain on our website until the commented content has been completely deleted or the comments must be deleted for legal reasons (e.g., offensive comments).

Right to object: You can unsubscribe from emails at any time via a link in the info emails. In this case, the data entered when subscribing to comments will be deleted; however, if you have provided this data to us for other purposes and elsewhere (e.g., newsletter subscription), it will remain with us.

Purposes: You have the option of subscribing to our newsletter, in which we regularly inform you about new developments.

We use technologies in our newsletters that allow us to measure interactions with the newsletters (e.g., email opening, links clicked). We use this data for general statistical evaluations and to optimize and further develop our content and communication with interested parties. This is done with the help of small graphics embedded in the newsletters (so-called pixels).

Categories of data: Consent data (name, email address/telephone number or other identifier, time, IP address), usage data (messages opened, links clicked), personalization data.

Recipients:

• Digital Zolutions, Stresemannstraße 23, 10963 Berlin
• Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf
• Positive Group Deutschland GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau

Legal basis: We process your data on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and, with regard to the evaluations, on the basis of our legitimate interests (Art. 6 para. 1 lit. f) GDPR), whereby the legitimate interest lies in the purposes pursued.

Storage period: The data will be processed until you revoke your consent.

Purposes: When you contact us (e.g., by email or phone), your data will be processed to the extent necessary to respond to your inquiry and any follow-up measures.

Categories of data: Inventory data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., entries in online forms).

Recipients:

• Google Ireland Ltd., Google Building Gordon House, Barrow St, Dublin, D04 E5W5, Ireland
• Digital Zolutions, Stresemannstraße 23, 10963 Berlin

Legal basis: Contact requests within the scope of contractual or pre-contractual relationships are answered to fulfill our (pre-)contractual obligations (Art. 6 para. 1 lit. b) GDPR) and otherwise on the basis of the legitimate interest in responding to the requests.

Storage period: The data will generally be processed for as long as it is necessary to process the request.

Purposes: Under certain conditions, you can request an email address. We will then process your personal data to create this address and subsequently to maintain it and make it available to you. In doing so, we may also contact you by email to inform you of important changes, such as changes to the scope of our services or technically necessary changes.

Categories of data: Inventory data (e.g., names, addresses), contact details (e.g., email, phone numbers).

Recipients: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR).

Storage period: The data will generally be processed for as long as you keep your email address with us. After the domain is terminated, your data will be deleted unless there are legal retention obligations that prevent the deletion of individual data or documents.

You have the option of taking advantage of our mailing list offer. You can either set up your own mailing list or join an existing list.

Purposes: Your personal data is processed to enable the creation and administration of a mailing list you have requested as part of our mailing list offer. This includes reviewing and processing your request, assigning the mailing list to your user account created with Wikimedia Unified Login (account in the Wikimedia projects), and the technical provision and administration of the mailing list. In addition, we use your data to contact you in case of queries or technical problems and to ensure the ongoing operation of the mailing list.

Categories of data: In particular, first and last name, user name, email address, message content, and any other voluntary information provided in your communication with us.

Recipients: Host Europe c/o WeWork, Friesenplatz 4, 50672 Cologne, Germany

Legal basis: Processing is carried out for the purpose of implementing contractual measures and fulfilling contractual obligations in connection with the mailing list support service, Art. 6 (1) lit. b) GDPR.

Storage period: We store your data for as long as you have an active user account or a mailing list operated by you. After deletion of your account or the list, your data will be deleted unless there are legal retention obligations to the contrary.

Purposes: When you join a mailing list, we process your personal data to enable your participation. This includes, in particular, the technical processing of sending and receiving messages within the list and displaying your contributions to other list members. If the archive function has been activated by the administrators, your contributions will also be stored permanently and made available to all users in the archive. The processing also serves to manage memberships, control access, and ensure the secure and proper operation of the mailing list.

Categories of data: In particular, email address, name, message content, and file attachments, as well as metadata such as the time of sending.

Recipients: Your messages will be delivered to all users of the respective mailing list.

Legal basis: Processing is carried out within the framework of contractual or pre-contractual relationships in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period: Your data will be stored for as long as you are a member of the respective mailing list. Messages in archives remain stored until the archive function is deactivated or the mailing list is deleted. In addition, statutory retention periods may apply.

Purposes: If you request access to an instance of the OTRS Service Management Suite (OTRS), we will process your personal data for the purpose of setting up and managing this access. The request requires you to register for a user account and is made using a form in which you provide the necessary information. Upon receipt of your request, we will review it and send you a confirmation by email. If your request is accepted, we will process your data to set up and maintain a corresponding user account for you. We will then send you your user data by email.

Categories of data: Data that you provide when creating a user account or in connection with your request for access to an ORTS instance, including, but not limited to: Name, username, email address.

Recipient: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: Processing is carried out for the purpose of implementing pre-contractual measures and fulfilling a contract for the use of OTRS access in accordance with Art. 6 (1) lit. b) GDPR.

Storage period: Your data will be stored for the duration of your active use of OTRS access. After termination of use or blocking of access, your data will be deleted unless statutory retention obligations prevent deletion.

Purposes: You can support the work of Wikimedia by making a donation via bank transfer or using the donation form on the website. You can donate via direct debit, bank transfer, credit card, PayPal, or instant transfer using our donation form.

If you make a donation to us, we will add you to our donation newsletter, unless you object to this in advance. In this case, we will use your email address to send you information about our latest fundraising appeals. If you have already donated to us, we will use your data to personalize the newsletters we send you and, for example, to refer to previous donations. You can find more information about our data processing in connection with the newsletter under point 2.6.

We occasionally send donation appeals by post. For this purpose, we use the address details you provided when making your donation. You can object to receiving promotional mail at any time.

Categories of data: In particular, name, email address, postal address, account information (IBAN, name of bank), donation amount.

Recipients:

• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
• Micropayment GmbH, Scharnweberstraße 69, 12587 Berlin
• Donation form: manitu GmbH, Welvertstraße 2, 66606 St. Wendel

Legal basis: The legal basis is Art. 6 (1) (b) and (c) GDPR.

Storage period: Our log files are stored for 30 days.

If you have given us your consent to receive emails or have not objected to receiving our donation newsletter after making a donation, we will generally process and store your data until you revoke your consent or object. However, if we send you the donation newsletter on the basis of our legitimate interest, we will process your data for this purpose for a maximum period of 3 years, beginning at the end of the year in which you made your last donation.

According to Section 147 of the German Tax Code, we are required to retain accounting records for ten years (after the end of the calendar year in which the last donation was made). The accounting data will be deleted as soon as the statutory period of ten years has expired.

Purposes: You can apply for open positions or submit an unsolicited application. We will process the information provided in your application to evaluate your application and decide whether we can offer you a position with us.

Recipients: softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin.

Legal basis: The legal basis for processing is Section 26 (1) BDSG.

Storage period: We process your data for the purposes stated until a decision has been made on your application. We then store your data for a period of 6 months for the purpose of defending against any legal claims.

Purposes: We operate a portal for active and new volunteers of Wikimedia projects on the German Wikipedia at https://de.wikipedia.org/wiki/Wikipedia:Förderung (hereinafter referred to as “funding portal”). We only collect the data entered via the support portal using the corresponding form (https://de.wikipedia.org/wiki/Wikipedia:Förderung/Projektplanung and https://foerderung.wikimedia.de/). Otherwise, the pages are operated by the Wikimedia Foundation and its privacy policy applies at de.wikipedia.org: https://meta.wikimedia.org/wiki/Privacy_policy/de as well as the information on the use of cookies: https://wikimediafoundation.org/wiki/Cookie_statement.

This data is processed in order to process your funding application and, if applicable, to provide funding. The approval of certain funding measures (e.g., literature grants) will be published on the respective Wikipedia user page of the person who submitted the request. Funded individuals are also asked to publish their project results under their username on a Wikipedia page or to provide links to project results (e.g., Wikipedia articles).

For certain funding projects, especially those involving funding of more than EUR 1,000, the fact that you have received funding will be published on the project page. More extensive funding projects usually also require a public application. Results obtained within the framework of funding measures may also be published by Wikimedia in its regular activity and financial reports, together with the username of the person receiving funding, if applicable. For all funding projects, Wikimedia also processes user data (including names, information on volunteer projects, funding amounts, evaluation results, project durations) for internal evaluation purposes.

Categories of data: We generally collect the following data:

• Last name
• First name
• User name
• Email
• Funding measure/project participation (only required for funding)
• Gender (optional).

In the context of certain funding, it may be necessary to process the following additional data:

• Address (e.g., for sending materials, creating business cards, issuing editorial confirmations, and, if applicable, volunteer cards)
• Bank details (e.g., for reimbursement of expenses)
• Date of birth (e.g., for registrations for press events, travel bookings)
• Telephone numbers (e.g., for queries about funding projects, business card printing)
• Rail card number or date of birth and last 4 digits of your ID card (e.g., for ticket bookings)
• Clothing size (e.g., for giveaways)
• Employment status (e.g., for hardship cases)
• Health restrictions (e.g., for special subsidies, such as travel expense reimbursements).

Recipients:

• Service providers, retailers, and other institutions, such as hotels or booked accommodations, whose services we use to fulfill the subsidy. In individual cases, this may involve transfer to a third country, which (unless already justified by an adequacy decision or appropriate safeguards such as standard contractual clauses) is generally justified by the fact that it is necessary for the performance of the subsidy (Art. 49 (1) (b) or (c) GDPR).

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR).

Storage period: We process your personal data for a period of 3 years from the date of application for control and verification purposes (e.g., to check for multiple applications) and delete it thereafter.

We would like to point out that funding published on Wikipedia will still be publicly available there even after this period. We store your emails and contact details for as long as is necessary to process your request and then store them for a period of 3 years in case you contact us again with reference to your original question.

Purposes: Wikimedia Deutschland e. V. is obliged to use donations in accordance with the association’s purpose of promoting free knowledge and thus, among other things, to support the improvement of work in Wikimedia projects. This is done primarily in accordance with the “Community Support Policy” through project funding, services, participation grants, and advisory services. In exceptional cases, funding may be suspended in order to protect the communities or WMDE from harm.

If funding is suspended, this may be published using the user’s name if this is necessary to enforce the suspension. This legitimate interest in publishing the suspension of funding exists in particular if at least one of the following criteria is met:

• Violations of the effects of a funding suspension (e.g., participation in a funded event)
• Necessary correction of false claims in connection with the funding suspension that severely damage the reputation of WMDE or community members
• Special protection needs for participants in projects and events

Categories of data: The publication will be made on the WMDE website, stating the user’s name.

Recipients:

• The persons against whom a funding ban has been imposed will be entered on a public list.
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR).

Storage duration: The publication will remain in place for as long as the funding ban is active and Wikimedia Germany can demonstrate a legitimate interest in informing the person concerned about the funding ban for the past three years.

Purposes: Your data will also be processed in order to send you messages, in particular by email or letter. The purpose of these messages is to inform you about further funding and participation opportunities, project ideas or changes of funding guidelines. You may also receive an invitation to participate in a survey to improve funding or other greetings and thank-you messages. To connect active participants in Wikimedia projects, Wikimedia generally uses their user names published in Wikimedia projects, unless otherwise requested.

Categories of data: Usernames, contact details (in particular email address and, if applicable, postal address), information on funding applied for and/or granted.

Recipients:

• Google Ireland Ltd., Google Building Gordon House, Barrow St, Dublin, D04 E5W5, Ireland

Legal basis: The legal basis is Art. 6 (1) lit. f) GDPR, whereby the legitimate interest is to maintain contact and transmit the relevant information.

Storage period: The data will be processed until you revoke your consent to receiving the messages.

Right to object: You have the right to object to receiving the messages at any time. You can raise an objection at any time with effect for the future via one of the contact addresses known to you.

Purposes: You have the option of becoming a member of our association, either as a supporting member or an active member. To do so, you must apply for membership on our website: https://spenden.wikimedia.de/apply-for-membership. The data you provide will be processed in order to process and implement your membership application. We will also send you regular information about the work of the association to keep you up to date.

Essential parts of the general meeting include master data maintenance, membership fee accounting, dunning, and communication with members.

Categories of data: In particular: Name, address, date of birth, email address, type of membership desired, bank details, selected membership fee, date of entry, type of membership, and payment of membership fees.

Recipients:

• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
• Micropayment GmbH, Scharnweberstraße 69, 12587 Berlin

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR).

Storage period: We process your data for as long as your membership is active and, after you leave, for the period until any claims arising from the membership relationship have expired (usually 3 years, beginning with the end of the year in which you left).

In addition, we are subject to certain statutory retention obligations. For example, according to Section 147 of the German Tax Code (Abgabenordnung), we are obliged to retain accounting documents for ten years (after the end of the calendar year in which the last donation was made). The accounting data will be deleted as soon as the statutory period of ten years has expired.

Purposes: As a member, you can participate in our general meetings digitally or on site. When you register for a general meeting, we process your personal data for the purpose of registration.

When conducting the general meeting, we process your responses to surveys and votes. This processing is carried out in particular to enable us to conduct and count the elections and votes within the framework of the general meeting. If voting takes place by secret ballot, we will of course observe the election principles set out in the Articles of Association and, in accordance with the principle of secret voting, will not establish any link between the identity of the voter and the vote cast.

We will record the general meeting in order to create minutes for internal purposes. The recording is used exclusively for this purpose and will not be published.

Categories of data: In particular: Name, email address, voting data.

Recipient:

• Polyas GmbH, Marie-Calm-Straße 1-5, 34131 Kassel
  Company privacy policy: https://www.polyas.de/datenschutz
• Service providers and volunteers who support us in organizing and conducting the general meeting, in particular in conducting elections and votes

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR) as well as Art. 6 para. 1 lit. f) GDPR, whereby our legitimate interest lies in the purposes described.

Storage period: In accordance with § 7 of our election regulations, data relating to votes cast will be stored until the minutes have been drawn up and will then be destroyed. The remaining data processed for the purpose of holding the general meeting will also be deleted after the end and completion of the general meeting.

The recording of the general meeting will be deleted after the minutes have been drawn up, at the latest 14 days after the general meeting.

Purposes: In some cases, we allow registration for events we organize, which can usually be done online, but in some cases also offline. Certain personal data is required for successful registration.

We use this data primarily to organize the participation of the person registering for the event and to carry out the event. This also includes contacting participants if necessary for organizational purposes.

We also use the data for statistical evaluations of participation and interest in our events.

Categories of data: Among other things: name, email address, address

Recipients:

• Service providers who support us in organizing and running the event
• Depending on your wishes: hotels, travel agencies, the State Department, other authorities of foreign countries for the issuance of visas.

These recipients may also be located in third countries for which no adequacy decision has been made by the EU Commission. In such cases, however, we only transfer data that is necessary for the fulfillment of the contract between you and us or for the conclusion or fulfillment of a contract concluded between us and the recipient in your interest.

Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 lit. b) GDPR) and legitimate interest, in particular with regard to statistical evaluation (Art. 6 para. 1 lit. f) GDPR), whereby the legitimate interest lies in the purposes described.

Storage period: We generally store this data for the above-mentioned purposes until the event has taken place.

We then store the data for an additional period of three years. This storage is based on our legitimate interest in defending ourselves against any legal claims that may arise from the event or in being able to assert such claims.

We may store data in pseudonymized form for up to 3 years for statistical analysis.

Purposes: We are subject to statutory retention obligations for certain documents, in particular those relating to tax and fiscal law. These documents also contain personal data, which we retain for the purpose of storage and in the event of an audit or inspection to prove that we are acting in accordance with the law.

Categories of data: With regard to tax and accounting retention obligations: the documents specified in Section 147 of the German Fiscal Code (AO).

Recipients: Legal and tax advisors, auditors, and the authorities responsible for auditing.

Legal basis: Legal obligation pursuant to Art. 6 (1) (c) GDPR and § 147 AO.

Storage period: The tax and accounting retention period is 6 or 10 years, depending on the type of document, and begins at the end of the year in which the respective documents were created.

For the purposes mentioned above, we also store information on your device and access information stored on your device. This is done using cookies or similar technologies such as local storage, session storage, or IndexedDB (hereinafter referred to as cookies for simplicity).

Some of these cookies are absolutely necessary (“essential”) for us to provide our services to you (Section 25 (2) No. 2 TDDDG). We only use cookies that are not absolutely necessary for our offer with your express consent (Section 25 (1) TDDDG), which you can give at any time via the cookie settings and revoke with effect for the future.

You can also see there which cookies are specifically stored and how long these cookies remain stored on your device. There you will also find the assignment of cookies to the processing purposes and providers used, as listed above.

We use permanent and temporary cookies (“session cookies”). Session cookies remain on your device only until you end your browser session. Permanent cookies remain stored on your device until they expire or are deleted.

These cookies enable basic functions and are essential for the website to function properly.

Purposes: Web analysis is used to evaluate visitors to our online offering and may include behavior, interests, or demographic information about visitors. This allows us to identify, for example, at what time our online offering or its functions or content are used most frequently. Furthermore, we can identify areas that require optimization. In addition to web analysis, we may also use test procedures to test and optimize different versions of our online offering or its components, for example.

Categories of data:

• Pseudonymous usage data (e.g., website visited and elements used there and technical information, access times), meta/communication data (e.g., device information).
• Interests
• Demographic information
• If users have consented to the collection of their location data, this may also be processed depending on the provider.
• The IP addresses of users are also stored. Where possible, particularly in connection with Google Analytics, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address).

Stored cookies:

• _pk_id.1.64ac
• _pk_ses.1.64ac

Service providers used:

• Matomo and Heatmap
  Provider: InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.
  Third-country transfer: We operate our own Matomo instance, so personal data is not transferred to third parties.
  Privacy policy: https://matomo.org/privacy/.

Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) and legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Storage period: We store the data collected via Matomo for a period of 12 months.

Purposes: We use various technologies to provide additional features on our website —such as embedded videos or social media posts —with your consent.

Categories of data:

• The respective providers will at least receive your IP address in order to establish a connection to your device and display the content to you. You can find out whether and to what extent further collection and processing takes place in the respective privacy policies of the providers.

Service providers used:

• Bluesky
  Provider: Bluesky Social, PBC d.b.a. Bluesky.
  Privacy policy: https://bsky.social/about/support/privacy-policy.
• Vimeo
  Provider: Vimeo.com, Inc.; Attention: Data Protection Officer, 330 West 34th Street, 10th Floor, New York, New York 10001, USA
  Third country transfers: Data may be transferred to the USA and, if necessary, to other third countries. Vimeo is certified under the Data Privacy Framework, which ensures an adequate level of protection during processing. Standard contractual clauses have also been concluded. You can access the standard contractual clauses here, here, and here.
• YouTube
  Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  Privacy policy: https://policies.google.com/privacy.
• Facebook and Instagram
  Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
  Privacy policy: https://www.facebook.com/about/privacy and https://privacycenter.instagram.com/.
• Embetty
  Provider: Heise Medien GmbH & Co. KG
  Privacy policy: https://www.heise.de/Datenschutzerklaerung-der-Heise-Medien-GmbH-Co-KG-4860.html.

Legal basis: Art. 6 (1) (a) GDPR insofar as consent is obtained and Art. 6 (1) (f) GDPR for processing carried out on the basis of our legitimate interest in pursuing the purposes described.

Storage period: We do not store any personal data in this context.

We have profiles on social networks. Our social media accounts complement our website and offer you the opportunity to interact with us. As soon as you access our social media profiles on social networks, the terms and conditions and data processing guidelines of the respective operators apply. The data collected about you when you use the services is processed by the networks and may also be transferred to countries outside the European Union where there is no adequate level of protection for the processing of personal data. We have no influence on data processing in social networks, as we are users of the network just like you. Information on this and on what data is processed by the social networks and for what purposes the data is used can be found in the privacy policy of the respective network listed below. We use the following social networks:

Our page can be accessed at: https://www.facebook.com/WikimediaDE and https://www.instagram.com/wikimedia_deutschland/

Network operator: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Network privacy policy: https://www.facebook.com/about/privacy and https://privacycenter.instagram.com/.

Our page can be accessed at: https://www.linkedin.com/company/wikimedia-deutschland-e-v-/.

The network operator is: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Network privacy policy: https://www.linkedin.com/legal/privacy-policy.

Our page can be accessed at: https://www.xing.com/pages/wikimediadeutschlande-v.

The network operator is: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

Network privacy policy: https://privacy.xing.com/de.

Our page can be accessed at: https://bsky.app/profile/wikimediade.bsky.social.

The network operator is: Bluesky Social, PBC d.b.a. Bluesky.

The network’s privacy policy: https://bsky.social/about/support/privacy-policy.

Our site can be accessed at: https://social.wikimedia.de/@wikimediaDE

The network operator is: Mastodon gGmbH, Mühlenstraße 8a 14167 Berlin, Germany

The network’s privacy policy: https://joinmastodon.org/privacy-policy.

Purposes: We process personal data as our own controller when you send us inquiries via social media profiles. We process this data to respond to your inquiries. In addition, we are jointly responsible with the following networks and for the following processing operations (Art. 26 GDPR). When you visit our profile on LinkedIn, Facebook, and Instagram, the network collects aggregated statistics (“Insights data” or “Analytics data”) that are created from certain events logged by their servers when you interact with our profiles and the content associated with them. We receive these aggregated and anonymous statistics from the network about the use of our profile. We are generally unable to associate the data with specific users. To a certain extent, we may be able to determine the criteria according to which the network compiles these statistics for us. We use these statistics to make our profiles more interesting and informative for you.

Further information on this data processing by LinkedIn can be found in the joint controller agreement at: https://legal.linkedin.com/pages-joint-controller-addendum. Otherwise, the network is solely responsible for the processing of your data.

Further information on this data processing by Facebook and Instagram can be found in the joint controller agreement at: https://www.facebook.com/legal/terms/information_about_page_insights_data

Legal basis: The processing is carried out on the basis of our legitimate interest (Art. 6 para. 1 lit. f) GDPR). The interest lies in the respective purpose.

Storage period: We do not store any personal data ourselves within the scope of joint responsibility. With regard to contact requests outside the network, the information provided above regarding contact requests applies accordingly.

When we process your data, it may be necessary to transfer or disclose your data to other recipients. In the sections on processing above, we name the specific recipients as far as we are able to do so. If recipients are located in a country outside the EU, we indicate this separately under the individual points listed above. Unless we expressly refer to an adequacy decision, no adequacy decision exists for the respective recipient country. In such cases, we will agree on appropriate safeguards in the form of standard contractual clauses to ensure an adequate level of data protection (unless other appropriate safeguards, such as binding corporate rules, are in place). You can access the current versions of the standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

In addition to these specific recipients, data may also be transferred to other categories of recipients. These may be internal recipients, i.e., persons within our company, but also external recipients.

We generally process your personal data for the storage period described above. However, data is often processed for more than one purpose, meaning that we may continue to process your data for a specific purpose even after the storage period has expired. In this case, the storage period specified for this purpose applies. We will delete your data immediately once the last storage period has expired.

We do not use automated decision-making that has legal effects on you or significantly affects you in a similar way. Please note that you are not legally or contractually obliged to provide us with your data. Nevertheless, you must provide information when creating an account or performing other actions. Without this information, we cannot enter into a contractual relationship with you or provide you with the relevant offers.

You have the following rights, provided that the legal requirements are met. To exercise these rights, you can contact us at the addresses provided. However, we would prefer that you use the following address: datenschutz@wikimedia.de.

• Art. 15 GDPR – Right to information of the data subject:
  You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and, where that is the case, what personal data is being processed and the details of the data processing.
• Art. 16 GDPR – Right to rectification:
  You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Art. 17 GDPR – Right to erasure:
  You have the right to demand that we delete personal data concerning you immediately.
• Art. 18 GDPR – Right to restriction of processing:
  You have the right to demand that we restrict processing.
• Art. 20 GDPR – Right to data portability:
  You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, or to have the data transmitted directly to another controller, where technically feasible.
• Art. 77 GDPR in conjunction with Section 19 BDSG – Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority at any time, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes applicable law.

• Art. 21 GDPR – Right to object:

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is necessary for the purposes of the legitimate interests pursued by us, for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object to this processing at any time. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

You can raise an objection at any time with effect for the future via one of the contact addresses known to you.

• Withdrawal of consent:

You can revoke your consent at any time with effect for the future via one of the contact addresses known to you

You have no contractual or legal obligation to provide us with personal data. However, without the data you provide, we will not be able to offer you our services.

We take all possible precautions to protect and secure your data. We welcome your questions and comments on data protection. If you have any questions about the collection, processing or use of your personal data, for information, correction, blocking or deletion of data and revocation of consents granted, please contact us using the contact details given above.

Status: May 2025