Privacy Policy

VielfaltMenü GmbH (hereinafter “VielfaltMenü”) and its subsidiaries (VielfaltMenü Verwaltungs GmbH and VielfaltMenü Service GmbH & Co. KG), Berlin office, Oberlandstraße 13–14, 12099 Berlin, telephone +49 (0) 3494 6694400, email servicecenter@vielfaltmenue.com, provide the following information about the processing of personal data carried out by us.

You can contact our Data Protection Officer by email at datenschutz@vielfaltmenue.com.

Below, we have compiled the most important information about typical data-processing activities, arranged by groups of data subjects. Where processing concerns only a specific group, the statutory information is provided separately.

Where the term “data” is used below, it refers exclusively to personal data within the meaning of the General Data Protection Regulation (“GDPR”).

1. Website visitors
2. Visitors to VielfaltMenü social-media profiles
3. Customers with their own profile on the VielfaltMenü website or app
4. Users of the Telli AI tool
5. Customers and their contacts
6. Participants in video conferences
7. Communication partners and prospective customers
8. Survey participants
9. Recipients of marketing communications
10. Rights of data subjects and further information

1. Website visitors

1.1 Server log data

When you use the website, the browser on your device sends certain technically necessary information to our website server. This data is stored and processed on our server.

(i) Purposes. We process the data listed below to deliver the requested website content, safeguard the security of the IT infrastructure used, troubleshoot errors, enable and simplify website searches, and manage cookies. We do not intend to change these purposes.

(ii) Data. HTTP data, meaning log data generated for technical reasons when the website is accessed using Hypertext Transfer Protocol (Secure), or HTTP(S). This includes the IP address, browser type and version, operating system, requested page, previously visited page (referrer URL), and date and time of access. HTTP(S) data is also generated on service-provider servers, for example when third-party content is retrieved.

(iii) Legal basis. Our legitimate interest in the technical operation of an online presence under Article 6(1)(f) GDPR.

(iv) Source. The visitor’s browser provides the data automatically.

(v) Recipients. IT service providers engaged by us under data-processing agreements.

(vi) Retention. IP addresses are anonymised at the end of the session. Pseudonymous usage data is deleted no later than 14 days after collection.

(vii) Requirement to provide data. The website cannot be used without disclosing personal data such as an IP address. Communication through the website is technically impossible without providing data.

1.2 Technically necessary cookies

We use cookies on the website. Cookies are small text files that a browser may save on the relevant device when the website is visited. When the website is accessed again using the same device, we can read and process the information stored in those cookies. This uses the device browser’s processing and storage functions and retrieves information from the browser’s storage.

These notices distinguish between technically necessary cookies, statistics cookies, marketing cookies, and external-media content. Cookies technically necessary for the website cannot be disabled through the website’s cookie-management function, but cookies can be disabled generally in the browser. Browser configuration methods vary. Some website functions may cease to work properly if cookies are disabled generally.

a) Session cookies

We use session cookies to manage login to the ordering platform and the technical display of website images. They allow us to save individual settings and certain decisions or actions during a visit, such as login status.

(i) The purposes are to enable login and individual settings and to display website content and images technically.

(ii) The data comprises ordering-platform account and settings data plus the HTTP data described in section 1.1.

(iii) The legal basis is our legitimate interest in providing individual sessions (Article 6(1)(f) GDPR and section 25(2)(2) TDDDG).

(iv) The visitor’s browser supplies the data automatically.

(v) Recipients are contracted IT processors.

(vi) The cookie is set only following successful login, deleted automatically at logout, and otherwise expires after 24 hours.

(vii) The website cannot be used without providing the data.

b) Google Tag Manager

Google Tag Manager enables us to manage cookies and control when they are deployed, including implementing consent, withdrawal of consent, and opt-out choices.

(i) The purposes are controlling cookie deployment and ensuring application security.

(ii) Data comprises HTTP data and consent data, including online identifiers and cookie IDs.

(iii) The legal basis is our legitimate interest in simple, reliable cookie control and legally compliant presentation of cookie notices (Article 6(1)(f) GDPR; section 25(2)(2) TDDDG).

(iv) The browser supplies the data automatically.

(v) The processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google relies on EU Standard Contractual Clauses (2021/914, Module 3), and relevant Google companies, including Google LLC, are certified under the EU–US Data Privacy Framework.

(vi) IP addresses are anonymised within 24 hours; pseudonymous usage data is deleted after six months.

(vii) The website cannot be used technically without the relevant data.

c) Cookiebot CMP by Usercentrics

We use the Usercentrics consent manager “Cookiebot CMP” to manage users’ consent, withdrawals, and objections concerning cookies.

(i) The purposes are managing cookie choices and ensuring application security.

(ii) Data includes HTTP log data (IP address, browser, operating system, requested and referring pages, access time, language and geolocation) and consent-cookie data (choices for cookies or cookie groups, time of choice and last visit, consent ID, consent date and time, browser user agent, and consent status).

(iii) The legal basis is our legitimate interest in reliable cookie control (Article 6(1)(f) GDPR; section 25(2)(2) TDDDG).

(iv) Visitors actively provide their choices; browsers automatically provide logs and timestamps.

(v) The processor is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Its subprocessors include Microsoft Ireland Operations Ltd and Microsoft Corporation in the USA, and Akamai Technologies, Inc., 145 Broadway, Cambridge, MA 02142, USA. Relevant transfers are protected by EU Standard Contractual Clauses; Microsoft and Akamai are certified under the EU–US Data Privacy Framework.

(vi) Withdrawal records are retained for three years for accountability; the management cookie is deleted six months after the last visit; log data is anonymised before storage.

(vii) The website cannot be used technically without providing relevant data.

d) Google reCAPTCHA

Google reCAPTCHA distinguishes human input, for example in a contact form, from abusive automated processing by bots.

(i) The purposes are protecting our IT infrastructure from automated access and spam and safeguarding website security.

(ii) Data includes HTTP data, interaction data such as mouse movements, clicks, time spent and input sequences, and browser fingerprints such as plug-ins and screen resolution.

(iii) The legal basis is our legitimate interest in website security and preventing abuse and spam (Article 6(1)(f) GDPR and section 25(2)(2) TDDDG).

(iv) The browser provides the data automatically.

(v) Google Ireland Limited is the processor and uses Google LLC in the USA; the safeguards described for Google Tag Manager apply.

(vi) Data is stored only as long as required for security verification; IP addresses are generally anonymised or deleted immediately unless needed for security analysis.

(vii) Without this processing, the security of functions such as forms cannot be ensured and those functions are not offered without reCAPTCHA.

1.3 Statistics cookies

a) Google Analytics (Advanced Consent Mode)

If you consent, we use Google Analytics cookies to examine website use in pseudonymous and anonymous form. Where data sharing for Google products and services is enabled, Google Ireland Limited acts as an independent controller for its own product-improvement purposes. Google’s privacy information applies: business.safety.google/privacy.

You may disable Google Analytics in our cookie settings or use Google’s opt-out browser add-on. If you do not consent to Analytics cookies, Google sets no such cookies. Google may instead receive “cookieless pings” through consent-aware tags communicating consent status and user activity.

(i) Purposes: analysing website usage and, where enabled, sharing data with Google for product improvement.

(ii) With consent, data includes Analytics HTTP data, device data and client ID, measurement data concerning traffic sources, approximate location, browser, device, page views, frequency, duration and conversions, aggregated report data, and consent identifiers. Without consent, cookieless pings may include consent status, conversion events, timestamps, user agent, referrer, whether an advertising click ID occurs in a URL, Boolean consent information, a per-page random number, consent-platform information, and an IP address used solely to transmit the ping and not stored.

(iii) Cookies and enabled data sharing rely on consent (Article 6(1)(a) GDPR; section 25(1) TDDDG). Cookieless pings rely on our legitimate interest in cookie-free usage analysis (Article 6(1)(f) GDPR).

(iv) The browser supplies the data automatically.

(v) Google Ireland Limited processes the data and uses Google LLC in the USA. EU Standard Contractual Clauses and EU–US Data Privacy Framework certification apply. For Google’s own product improvement, Google acts as an independent controller and Module 1 clauses apply.

(vi) We do not store the IP address; other Analytics data is deleted after six months. Google’s own retention rules apply to data processed for its purposes.

(vii) Provision is voluntary and is not required by law or contract. Without it, we cannot perform the corresponding Analytics analysis.

b) Microsoft Clarity (session replay, heatmaps and machine-learning insights)

If you consent, we use Microsoft Clarity to understand interactions through behavioural metrics, heatmaps and session replay and improve VielfaltMenü’s offering. Microsoft may also collect and process usage data as an independent controller. See Microsoft’s Privacy Statement. You may disable Clarity in our cookie settings or block cookies in your browser.

(i) Purposes: evaluating website usage through session replay, heatmaps and machine-learning insights, and enabling Microsoft’s collection under purposes determined by Microsoft.

(ii) Data includes page and payload metadata; interaction events such as clicks, scrolling, mouse movement, resizing, selection and input; diagnostic and performance events; page events; custom events; and DOM and mutation data used for replay, including node position, layout and masked content for privacy-sensitive fields.

(iii) Consent is the legal basis (Article 6(1)(a) GDPR; section 25(1) TDDDG).

(iv) The browser provides the data automatically.

(v) Microsoft Ireland Operations Limited is an independent controller. Transfers to the USA cannot be excluded; Microsoft is responsible for appropriate safeguards.

(vi) Click data and aggregated page data are deleted after 13 months, playback data after 30 days, and labelled or favourited sessions after 13 months. Microsoft’s own retention rules also apply.

(vii) Provision is voluntary. Without it, we cannot analyse usage through Clarity.

1.4 Marketing cookies

a) Google Ads conversion tracking

If you consent, Google Ads conversion tracking lets us measure the success of advertisements placed through Google. You may disable it through our cookie settings, Google’s opt-out add-on, or your browser’s cookie controls.

(i) The purpose is to measure the reach and success of our Google advertisements. Google places a conversion cookie after an ad click; if you later visit the linked page before expiry, the click and referral can be recognised. We receive only aggregated, anonymised evaluations. Data includes Google Ads HTTP logs, ad clicks, time spent, visited pages and conversion results.

(ii) The legal basis is consent (Article 6(1)(a) GDPR; section 25(1) TDDDG).

(iii) The browser provides the data.

(iv) Google Ireland Limited processes it and uses Google LLC in the USA, protected by EU Standard Contractual Clauses and EU–US Data Privacy Framework certification.

(v) Cookies expire after 30 days and, apart from the cookie ID, are not intended to identify you personally.

(vi) Provision is voluntary; without it, conversion tracking is unavailable.

b) Microsoft Advertising conversion tracking

If you consent, Microsoft Ireland Operations Limited may collect data for Microsoft Advertising conversion tracking. Following a Microsoft ad click, Microsoft stores a conversion cookie. Microsoft and the advertiser can recognise a later visit to the linked website while the cookie remains valid. We receive only aggregated, anonymised evaluations and cannot identify individuals. Microsoft’s privacy statement applies. You may disable the processing in our cookie settings or browser settings.

(i) Microsoft determines the purposes of its collection and processing.

(ii) According to Microsoft, data includes HTTP logs, ad clicks, time spent, visited pages and conversion results.

(iii) Our legal basis for enabling collection is consent (Article 6(1)(a) GDPR; section 25(1) TDDDG). Microsoft determines its own legal bases.

(iv) Microsoft generates conversion data and may use other sources.

(v) Microsoft Ireland Operations Limited is the controller; transfers to the USA cannot be excluded and Microsoft is responsible for safeguards.

(vi) Cookies expire after 30 days. We do not collect or store this data ourselves.

(vii) Provision is voluntary; without it Microsoft cannot provide conversion tracking.

c) Meta Pixel

If you consent, we use Meta Pixel cookies from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel enables Meta to collect information about activity on our website. We receive no personally identifying information; Meta provides only aggregated, anonymised evaluations. Meta processes the data under its own responsibility. See Meta’s Privacy Policy. You may disable the pixel in our cookie settings, browser settings, or applicable industry opt-out tools.

(i) The purpose is to enable Meta’s collection and processing under purposes determined by Meta.

(ii) According to Meta, data includes HTTP logs, a device ID, website events such as conversions, link clicks and page views, associated parameters such as contact-detail submissions or downloads, and analysis data concerning ad effectiveness and audience assignments.

(iii) Our legal basis is consent (Article 6(1)(a) GDPR; section 25(1) TDDDG). Meta determines its own legal bases.

(iv) Meta generates analysis data and may use other sources.

(v) Meta Platforms Ireland Limited is the recipient and uses Meta Platforms, Inc. in the USA; Meta is responsible for appropriate transfer safeguards.

(vi) We do not collect or store the data and do not know Meta’s retention period.

(vii) Provision is voluntary; without it Meta cannot provide the pixel.

(viii) We carry out no automated decision-making in our area of responsibility; we do not know the details of any automated decision-making by Meta.

d) TikTok Pixel

If you consent, we use the TikTok Pixel and cookies from TikTok Information Technologies UK Limited, WeWork, Aviation House, 125 Kingsway, London WC2B 6NH, United Kingdom, and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin D02 T380, Ireland, as joint controllers (“TikTok”). TikTok collects information about website activity. We receive only aggregated or pseudonymised evaluations and cannot identify individuals. See TikTok’s Privacy Policy. You may disable the pixel in our cookie settings or browser.

(i) The purpose is enabling TikTok’s collection under purposes determined by TikTok.

(ii) Data includes HTTP logs, a device ID, events such as conversions, clicks and page views, and analysis data about ad effectiveness and audience assignment.

(iii) Our legal basis is consent (Article 6(1)(a) GDPR; section 25(1) TDDDG).

(iv) TikTok generates analysis data and may use other sources.

(v) The two TikTok companies are joint controllers under Article 26 GDPR and may use providers in third countries; TikTok is responsible for transfer safeguards.

(vi) We do not collect or store the data and do not know TikTok’s retention period.

(vii) Provision is voluntary; without it TikTok cannot provide the pixel.

e) LinkedIn Insight Tag

If you consent, we use the LinkedIn Insight Tag and cookies from LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn collects information about website usage. We receive only aggregated, anonymised evaluations. See LinkedIn’s Privacy Policy. You may disable the tag in our cookie settings or browser.

(i) The purpose is enabling LinkedIn’s collection under purposes determined by LinkedIn.

(ii) Data includes HTTP logs, a unique device ID and report data about ad effectiveness and audience assignment.

(iii) Our legal basis is consent (Article 6(1)(a) GDPR; section 25(1) TDDDG). LinkedIn determines its own legal bases.

(iv) LinkedIn generates analysis data and may use other sources.

(v) LinkedIn Ireland Unlimited Company is the controller and uses LinkedIn Corporation in the USA; LinkedIn is responsible for transfer safeguards.

(vi) We do not collect or store the data. LinkedIn states that data is truncated or hashed, direct member identifiers are removed within seven days, and remaining pseudonymised data is deleted within 180 days. LinkedIn members have advertising controls in their accounts.

(vii) Provision is voluntary; without it LinkedIn cannot provide the tag.

1.5 External-media content

YouTube embedding and Google Fonts

When you click a YouTube video or enable the corresponding content in the cookie banner, you consent to our enabling Google, as YouTube’s provider, to collect data for its own purposes. Embedded videos are then loaded from YouTube’s servers, which receive the information automatically transmitted by your browser, including your IP address.

YouTube may place its own cookies, including cookies connected with Google Fonts, even if you have no YouTube account. If you are signed in to YouTube or Google, data is associated directly with your account. To prevent this association, sign out before activating the video or the relevant cookie-banner setting.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for this processing and uses Google LLC in the USA. We do not control Google’s processing. See Google’s Privacy Policy.

2. Visitors to VielfaltMenü social-media profiles

VielfaltMenü maintains social-media profiles. The platforms are operated by providers that process data to supply their services.

(i) Our purposes are to provide relevant content and interact with visitors. Depending on the service, usage data may also be analysed to improve our presence.

(ii) Data comprises content and usage data on the profiles.

(iii) Information displayed or shared may be accessible to the platform operator, its users, and contracted providers.

Instagram. We and Meta Platforms Ireland Limited are joint controllers for personal data processed through the VielfaltMenü Instagram profile. The Page Controller Addendum applies. Meta is responsible for informing data subjects. See Instagram’s Privacy Policy. Rights may be exercised against either VielfaltMenü or Meta. Our legal basis for profile analytics is our legitimate interest in improving the profile (Article 6(1)(f) GDPR).

LinkedIn. We and LinkedIn Ireland Unlimited Company are joint controllers for personal data processed through the VielfaltMenü LinkedIn profile. See the joint-controller addendum and LinkedIn Privacy Policy. Rights may be exercised against either party. Our legal basis for analytics is our legitimate interest in improving the profile (Article 6(1)(f) GDPR).

YouTube. We operate a YouTube channel. Google Ireland Limited is solely responsible for collection and processing and uses Google LLC in the USA. We do not control Google’s processing. See Google’s Privacy Policy.

3. Customers with their own profile on the VielfaltMenü website or app

Customers can create a profile on the VielfaltMenü website or app and place orders.

(i) We process data to provide the platform, app and ordering function.

(ii) Data includes registration and profile data (customer number and password); meal-participant data (name, date of birth, class and group, and status as pupil/child, teacher/educator or company participant); order details (meals, quantity, price and fulfilment details); contracting-party data (name, date of birth, address, telephone, email, billing data and order date); IP address; and registration/login date and time.

(iii) For contracts with individuals, the legal bases are contract performance (Article 6(1)(b) GDPR) and legal obligations, particularly tax and commercial law (Article 6(1)(c) GDPR). For contacts at organisational customers, the basis is our legitimate interest in customer communication (Article 6(1)(f) GDPR). Product information relies on our legitimate interest in advertising, and transfer of payment data relies on our legitimate interest in centrally managed payment processing (Article 6(1)(f) GDPR).

(iv) The contracting party supplies meal-participant data when ordering. IP address and registration/login time are collected automatically; other data is supplied by the data subject.

(v) Processors provide and maintain IT systems. Microsoft Ireland Operations Limited is a processor. We instruct Microsoft to use European servers, but maintenance access from third countries such as the USA may occur; EU Standard Contractual Clauses protect such access. PAYONE GmbH, Lyoner Straße 15, 60528 Frankfurt am Main, independently processes payment data; see PAYONE’s privacy information.

(vi) Profile information may be changed or deleted unless contractually or accounting-relevant. Contract and accounting data is retained for ten calendar years after the contract ends under tax and commercial-law requirements.

(vii) Without data, profiles and ordering cannot be used.

4. Users of the Telli AI tool

Users may chat with the “Telli” AI tool on our website or telephone its voice-bot version with questions about our products. Recording is technically required for Telli to function. Use is optional; you may instead contact servicecenter@vielfaltmenue.com.

(i) Purposes: efficient communication with interested persons, logging and documenting enquiries, IT security and functionality.

(ii) Data includes the caller’s telephone number, communication date and time, chatbot metadata (topic, IP address and device/hardware information), communication content often including name and customer number, recordings, transcripts and summaries.

(iii) The legal basis for offering Telli is our legitimate interest in simple digital communication; transcripts and summaries rely on our legitimate interest in documenting and evaluating communications; security and functionality rely on our legitimate interest in secure, functional AI-assisted communication (Article 6(1)(f) GDPR).

(iv) Name, customer number, content, recordings, timing and audio are collected from the data subject. Metadata is supplied automatically by the browser or device. Transcripts and summaries are generated from recordings and content.

(v) BotFriends GmbH, Eichhornstraße 28, 97070 Würzburg, provides Telli as our processor. Our IT processors also receive relevant data. BotFriends uses subprocessors including Microsoft Ireland Operations Ltd for Microsoft Azure OpenAI. Data is processed in the EU under the EU Data Boundary, although security metadata may be processed on servers outside the EU. Microsoft uses EU Standard Contractual Clauses and is certified under the EU–US Data Privacy Framework.

(vi) Data is deleted after seven days. Summaries are deleted manually when no longer needed; necessity is reviewed every three years.

(vii) Data is required to use Telli.

(viii) Automated creation of transcripts and summaries does not involve automated decision-making.

5. Customers and their contacts

(i) We process data to perform contracts and handle payments, including advice, support and information about product updates and new products.

(ii) Data includes meal-participant data; order details; contracting-party data; other contract data; and contract-related communications.

(iii) Legal bases are contract performance for contracts with individuals (Article 6(1)(b) GDPR), legal obligations including tax and commercial law (Article 6(1)(c) GDPR), and our legitimate interests in communicating with contacts at organisational customers, advertising products and centrally managing payment processing (Article 6(1)(f) GDPR).

(iv) Data is supplied by the data subject or a supervisor; contracting parties supply meal-participant data.

(v) PAYONE GmbH independently processes payment data. In individual cases, data may be transferred to collection agencies, lawyers and courts. We also use processors for IT provision and maintenance.

(vi) Contract and accounting data is stored for ten calendar years after the contract ends.

(vii) Providing data is legally and contractually required; without it, the contractual relationship cannot be established or performed.

6. Participants in video conferences

Participants receive an invitation and may disable camera or microphone at any time. If a conference is to be recorded, a notice is displayed and camera and microphone remain disabled until the participant actively enables them. Recordings may be used to generate transcripts and summaries automatically, including with artificial intelligence.

(i) Purposes: organising, conducting and documenting video conferences; creating transcripts and summaries; IT security and functionality.

(ii) Data includes participant details (name, company, position, email), meeting date and time, metadata (topic, IP address and device/hardware information), communication content including chat, audio/video when enabled, and transcripts/summaries when enabled.

(iii) The legal bases are our legitimate interests in simple digital exchange, efficient meeting documentation, and secure functional conferencing (Article 6(1)(f) GDPR).

(iv) Participant details, content, timing, audio and video are collected from participants; metadata is supplied automatically; transcripts and summaries are generated technically.

(v) Other participants receive participant, communication, audio/video, transcript and summary data as applicable. Our IT processors include Microsoft Ireland Operations Ltd as Microsoft Teams provider. The EU Data Boundary applies, although security metadata may be processed outside the EU. Microsoft uses EU Standard Contractual Clauses and is certified under the EU–US Data Privacy Framework.

(vi) Participant data, timing and metadata are retained for 14 days. Unrecorded communications and audio/video are held only for seconds during transmission; recordings and transcripts are deleted within 14 days; summaries are deleted manually when no longer required.

(vii) Basic data is required to participate; audio and video are optional.

(viii) Automated transcripts and summaries do not involve automated decision-making.

7. Communication partners and prospective customers

(i) The purpose is preparing and performing a contract or otherwise communicating, including through our contact form.

(ii) Data includes name, contact details, communication content, time and technical metadata.

(iii) Legal bases are pre-contractual steps or contract performance for individuals (Article 6(1)(b) GDPR), our legitimate interest in communicating with relevant contacts for contracts with legal entities and documenting general communication (Article 6(1)(f) GDPR), and legal obligations including tax and commercial law (Article 6(1)(c) GDPR).

(iv) The person provides contact details; communication data and metadata are collected automatically.

(v) Contact and contract data may be sent to providers, business partners and public authorities where necessary to perform the contract or assignment. IT processors also receive data.

(vi) Data relating to contracting parties and providers, and enquiries and general communications, is deleted automatically ten calendar years after the contract, assignment or communication ends.

(vii) Data is required to perform contracts and communicate; without it communication may be seriously impaired or impossible.

8. Survey participants

If you consent to participate, we send links and content for pseudonymous surveys. Surveys specifically directed at children or minors always require parental consent.

(i) The purpose is conducting and evaluating surveys.

(ii) Data includes the participant’s name unless the survey is pseudonymous, answers, participation timestamp and technical metadata.

(iii) The legal basis is the participant’s consent or, for a minor, parental consent (Article 6(1)(a) GDPR).

(iv) Participants provide names and answers; the browser supplies other data automatically.

(v) IT processors support the service. Surveys use Microsoft Forms from Microsoft Ireland Operations Ltd, which uses Microsoft Corporation in the USA. EU Standard Contractual Clauses apply and Microsoft Corporation is certified under the EU–US Data Privacy Framework.

(vi) Data is deleted or fully anonymised two years after the survey.

(vii) Participation is voluntary.

(viii) In a purely pseudonymous survey we may be unable to identify you (Article 11 GDPR); you may withdraw by ending participation at any time.

9. Recipients of marketing communications

If you consent, we send information about our programme and projects and measure reach and success using pseudonymous analyses. We may also contact responsible persons at schools or other institutions whose details were obtained from public sources or databases. You may unsubscribe at any time.

(i) Purposes: sending and measuring marketing communications to consenting recipients or identified institutional contacts.

(ii) Data includes name and email address; HTTP opening logs including IP address, browser, operating system, requested and referring pages and access time; opening rates; clicks; and file downloads.

(iii) The legal basis is consent (Article 6(1)(a) GDPR) or our legitimate interest in contacting responsible persons whose details are publicly or commercially available (Article 6(1)(f) GDPR).

(iv) Consenting recipients provide contact details; browsers supply analytics data; institutional-contact data may come from public sources or databases.

(v) Processors provide IT services. Mailchimp, operated by The Rocket Science Group LLC, 675 Ponce de Leon Avenue NE, Suite 5000, Atlanta, GA 30308, USA, handles sending and organisation. EU Standard Contractual Clauses apply, and Mailchimp is certified under the EU–US Data Privacy Framework. If you follow a Calendly booking link, Calendly, Inc., 115 E Main Street, Suite A1B, Buford, GA 30518, USA may set cookies independently; see Calendly’s Privacy Notice.

(vi) Recipient data is deleted upon unsubscribe, subject to legally required suppression records.

(vii) Data is necessary to receive communications. Consent may be withdrawn through the unsubscribe function at any time.

10. Rights of data subjects and further information

(i) We do not use automated individual decision-making procedures.

(ii) We do not intend to change the purposes stated above.

(iii) Access. You may request information at any time about all personal data we process concerning you.

(iv) Rectification. If personal data is inaccurate or incomplete, you have the right to correction and completion.

(v) Erasure. You may request deletion at any time unless we are legally required or permitted to continue processing.

(vi) Restriction. Where the statutory requirements are met, you may request restriction of processing.

(vii) Objection to direct marketing. You may object where processing is for direct marketing or related profiling.

(viii) Objection based on your situation. Where processing relies on a balancing of interests, you may object for reasons arising from your particular situation.

(ix) Data portability. Where processing is based on consent or a contract, you have the right to receive or transfer data you provided, provided this does not adversely affect the rights and freedoms of others.

(x) Withdrawal of consent. Where we process data on the basis of consent, you may withdraw consent at any time with future effect. Processing carried out before withdrawal remains lawful.

(xi) Complaint. You may lodge a complaint with a data-protection supervisory authority if you believe processing infringes applicable law.

Version: March 2025