1. Use of PayPal as a payment method for online donations
a) Description and scope of data processing
If you choose to make a payment using the online payment service provider PayPal as part of a payment transaction on our website, your personal data such as first and last name, address, email address, donation amount details, IP address, payment notes details, device information and geographical information will be transmitted to PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Depending on the payment method selected via PayPal, e.g. invoice or direct debit, the personal data transmitted to PayPal will be transmitted by PayPal to credit agencies.
Your personal data may also be disclosed by PayPal to service providers, subcontractors or other affiliated companies, insofar as this is necessary for the fulfillment of contractual obligations arising from your donation or the personal data is to be processed on behalf of PayPal.
An overview of these third parties can be found at the following link: https://www.paypal.com/webapps/mpp/ua/privacy-full
b) Legal basis for data processing
The legal basis for the processing of personal data is Art. 6 para. 1 sentence 1 lit. b GDPR.
c) Purpose of the data processing
The processing of your personal data is necessary for the handling of your donation with the payment method “PayPal”, in particular for the confirmation of your identity as well as for the administration of your payment.
Depending on which payment method you select with PayPal, your personal data will be processed by credit agencies for identity and credit checks. You can find out which credit agencies are involved and which data is processed by PayPal in general, as well as further information on the purposes and scope of data processing, in PayPal’s privacy policy at https://www.paypal.com/webapps/mpp/ua/privacy-full
d) Duration of storage
According to PayPal, your personal data used for the ongoing relationship between you and PayPal will be stored for the duration of the relationship plus a period of ten years to enable PayPal to comply with its tax obligations.
Please refer to PayPal’s privacy policy at https://www.paypal.com/webapps/mpp/ua/privacy-full for details on individual retention period requirements.
e) Consequences of not providing your personal data
You are not obliged to provide your data for the purposes described above. However, if you refrain from providing it, we cannot guarantee that we will be able to offer you the benefits associated with the donation.
2. Possibility of donating by bank transfer or credit card.
a) Description and scope of data processing
We also allow you to donate to us by bank transfer or credit card.
Personal data processed when you make a donation are your first and last name, e-mail address, address, postal code, city and country of residence. In addition, we need your bank data (name of the account holder, IBAN as well as BIC) or credit card data (name of the card holder, card number, verification number and expiry date) to carry out your donation. Optionally, you can indicate your wish for a donation receipt. Your data will not be passed on to third parties.
With the online donation on our website, we will also store your IP address and the date and time of submission of the donation form.
b) Legal basis for data processing
The processing of the aforementioned personal data is necessary for the initiation and fulfillment of the donation contract. The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR.
The legal basis for the collection and storage of your IP address, which we process in the case of donation by credit card, is based on Art. 6 (1) sentence 1 lit. f GDPR.
c) Purpose of the data processing
The personal data collected when entering the online form are necessary for the execution of the donation contract, within the scope of which the user commits to the payment of a membership fee chosen by himself. If desired, we process the data collected during the donation process to issue a donation receipt.
We process your IP address for our security in case a third party registers on our website without your knowledge or misuses your personal data. This is also our legitimate interest for processing your personal data.
d) Duration of storage
As soon as we no longer need your personal data for the aforementioned purpose, it will be deleted immediately. This is usually the case after the expiration of the three-year statute of limitations, beginning with the end of the year in which you donated to us.
Since we are also subject to statutory retention obligations, your personal data will be blocked after the statute of limitations has expired and deleted after a total of ten years, beginning with the end of the calendar year in which the donation was made. This follows from our tax retention obligation.
e) Possibility of objection and removal according to Art. 21 GDPR
There is no possibility to object to the processing of your IP address, as the processing of the data is mandatory for abuse prevention and tracking.
f) Consequences of not providing your personal data
You are not obliged to provide your data for the purposes described above. However, if you refrain from providing it, we cannot guarantee that we will be able to offer you the benefits associated with the donation.