fairEXA

Privacy Policy

The German version is the authoritative and legally binding privacy policy. This page is an English summary for convenience only. Where the two differ, the German text applies.

Controller

fair­EXA Institut gGmbH i. G.
Bergheimer Straße 104
69115 Heidelberg
Germany

Represented by: Dipl.-Inform. Med. Jörn Heid, Dipl.-Inform. Med. Winfried Kurtz

Email: info@fairexa.de

Hosting

This website is hosted externally by:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68
02742 Friedersdorf, Germany
Email: info@all-inkl.com

The site runs in a data centre in Germany. A data processing agreement (Auftragsverarbeitungsvertrag) is in place with the host, as required by the GDPR. Hosting is carried out on the basis of Art. 6(1)(b) and Art. 6(1)(f) GDPR.

Data we process

  • Server log files — browser type and version, operating system, referrer URL, hostname, time of request and IP address. Recorded by the host on the basis of Art. 6(1)(f) GDPR for technically correct delivery of the site. This data is not merged with other sources.

  • Contact enquiries — anything you send us by email, telephone or fax, processed under Art. 6(1)(b) or Art. 6(1)(f) GDPR to handle your enquiry, and kept until the purpose lapses or you ask for deletion.

  • Contact form — name, email address, subject and message are transmitted over an encrypted connection to our web server and forwarded from there to our info@fairexa.de mailbox. No database is involved and nothing is stored permanently on the web server. You also receive a short automatic acknowledgement, which contains none of your message text. Same legal bases as above; we do not ask for your consent to handle your enquiry. Where we rely on Art. 6(1)(f) GDPR you can object under Art. 21 GDPR.

  • Spam protection — to limit automated submissions, and to stop anyone signing up an address that is not theirs, we store a cryptographic hash of your IP address and of your email address on the web server for at most one hour. Neither is stored in the clear and neither is evaluated for any other purpose (Art. 6(1)(f) GDPR). No third-party service such as a captcha is used.

  • Team collaboration — if handling your enquiry requires input from colleagues within our team or from processors we work with, we share your data only for that purpose and on the legal bases described above (Art. 6(1)(b) or Art. 6(1)(f) GDPR).

  • Update channels — on the Updates page you can subscribe to topic-based email channels; we process your address and the channels you chose. The page loads nothing from our sending provider: the form is plain HTML on our own server, and a connection to Brevo is only made when you press subscribe. Double opt-in applies — the subscription is active only after you click the link in the confirmation email. On submission, your address and chosen channels are also sent as an internal notice to our own mailbox (website-abo@fairexa.de, hosted by ALL-INKL); nothing goes to third parties, and the notice is deleted when you unsubscribe, or after 30 days at the latest if you never confirm. Sent issues are kept in our own mailbox (ALL-INKL) so subscribers can read them later. When you request an archive link, we check your address with Brevo to find your channels; the link only goes to subscribed addresses. Our server keeps the link’s hash and your address for at most 24 hours (deleted once opened) and a hash of your address for 10 minutes to limit repeated requests. Legal basis is your consent (Art. 6(1)(a) GDPR), withdrawable at any time via the unsubscribe link in every message. Sending is handled by Brevo, operated by Sendinblue SAS, 9–17 rue Salneuve, 75017 Paris, France, as a processor; the Art. 28 GDPR agreement forms Annex 3 of Brevo’s terms of use. The services are provided within the EEA, with standard contractual clauses in place for any transfer beyond it.

  • Colour scheme — your light/dark preference is stored in your browser’s localStorage under the key fairexa-theme. It is a technical setting with no personal reference, never transmitted to us or anyone else, and is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG), so no consent is required. You can clear it in your browser settings at any time.

Beyond that, this website sets no cookies, runs no analytics or tracking, and loads no resources from third-party servers when you open a page — fonts are served from our own server, and there are no embedded videos, maps or social media widgets. The only JavaScript it ships is the light/dark theme switch. Consequently there is no consent banner, because there is nothing to consent to.

All transmission is TLS-encrypted. We object to the use of contact details published in the imprint for unsolicited advertising.

Your rights

Under the GDPR you have the right to:

  • access the data we hold about you, its origin, recipients and purpose (Art. 15)
  • have inaccurate data corrected (Art. 16)
  • have data erased (Art. 17)
  • restrict processing (Art. 18)
  • data portability (Art. 20)
  • object to processing, including for direct marketing (Art. 21)
  • withdraw consent at any time, with future effect (Art. 7(3))
  • lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these, or for any other privacy question, contact us at the address above.

Full text

The complete policy — including the detailed legal bases, retention periods and recipients — is available in German:

Zur vollständigen Datenschutzerklärung →

Source: e-recht24.de