Privacy Policy

1. Data Controller

2. Data Protection Officer

3. Church Data Protection Law and Legal Bases

The processing of personal data by Provinzialat der Redemptoristen e. V. is governed in particular by the Church Data Protection Regulation for Religious Orders of Pontifical Right (KDR-OG), as amended from time to time.

The KDR-OG applies to the religious order itself and to works and institutions wholly or predominantly operated by it. The processing of personal data is permitted in particular where it is authorised by church, national or European law, where consent has been given, where processing is necessary for the performance of a contract or compliance with a legal obligation, where it is carried out in the ecclesiastical interest, or where it is necessary for the purposes of legitimate interests and those interests are not overridden by the rights and interests of the data subject.

The storage of information on terminal equipment and access to information already stored on such equipment are additionally governed by the applicable national rules, in particular Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

4. Data Protection Supervisory Authority

5. Principles of Data Processing

We process personal data only for specified, explicit and lawful purposes. Processing is limited to what is necessary for the respective purpose.

Personal data is retained only for as long as necessary for the respective purpose or for as long as statutory or ecclesiastical retention obligations apply. We take appropriate technical and organisational measures to protect the confidentiality, integrity and availability of the data.

We do not sell personal data.

6. Hosting by Oxilion B.V.

This website is hosted by Oxilion B.V. in Enschede, the Netherlands. The Netherlands is a member state of the European Union.

When the website is accessed, the server infrastructure processes technically necessary connection data. This may include in particular:

• IP address of the accessing device
• date and time of access
• page or file requested
• amount of data transferred
• browser type and browser version
• operating system
• referrer URL
• status of the respective server request

The purpose of this processing is the technical provision of the website, ensuring secure and stable operation, error analysis, and detecting and preventing abusive or security-threatening access.

The legal basis is Section 6(1)(g) KDR-OG. Our legitimate interest lies in providing this website securely, reliably and without technical errors.

Oxilion B.V. processes the personal data required for hosting as a technical service provider within the framework of the applicable data protection agreements.

Server and security data is retained only for as long as necessary for the purposes stated above. Security-related data may be retained for a longer period where this is necessary to investigate or defend against a specific security incident.

7. Cookies and Consent Management with Complianz

Our website uses technically necessary cookies and – after the required consent has been given – additional technologies and external content.

We use Complianz | GDPR/CCPA Cookie Consent to manage and document consent decisions.

Complianz stores the information required to document the choice made. The purpose is to implement the user's decision, provide evidence of that decision and enable subsequent withdrawal.

Processing is carried out for compliance with data protection obligations on the basis of Section 6(1)(d) KDR-OG. Strictly necessary storage or access operations are carried out on the basis of the applicable statutory exceptions. Non-essential storage or access operations are activated only after consent has been given.

Consent may be changed or withdrawn at any time via the cookie settings. Withdrawal has effect for the future.

8. Audience Measurement with WP Statistics

We use WP Statistics for the statistical evaluation of the use of our website.

In particular, information concerning page views, time of access, technical device and browser characteristics, source of a page view and statistical information on the geographical allocation of an access may be processed.

WP Statistics is configured in a privacy-oriented manner:

• IP addresses are anonymised.
• IP addresses are additionally converted into a hash value that cannot be directly reversed.
• The full user-agent string is not stored.
• Anonymous usage data is not transmitted to the provider of WP Statistics.
• Detailed statistical data is retained for 180 days and then aggregated.

A local MaxMind GeoIP database is used for geographical allocation. Updates to this database may be obtained via technical content delivery services.

The purpose of processing is audience measurement, analysis of the use of our content and improvement of the information provided on our website.

The legal basis is Section 6(1)(g) KDR-OG. Our legitimate interest lies in the statistical evaluation and appropriate further development of our web offering. Anonymisation and hashing limit the processing to what is necessary for this purpose.

9. Jetpack Stats

In addition, we use Jetpack Stats, a service provided by Automattic, for the statistical evaluation of the use of our website.

In particular, the following technical information may be processed:

• IP address
• browser and device information
• user agent
• page visited
• referrer
• time of access
• browser language
• country code

The purpose is audience measurement and statistical evaluation of website usage.

The legal basis for the processing of personal data is Section 6(1)(g) KDR-OG. Our legitimate interest lies in analysing usage and further developing our information offering.

Jetpack is integrated into our consent management system. Where individual Jetpack functions require consent for storing or accessing information on a user's terminal equipment, such functions are activated only after the required consent has been given.

Data may be transferred to companies within the Automattic group, in particular Automattic Inc. in the United States, and processed there. Transfers to third countries are subject to the requirements of Sections 39 et seq. KDR-OG. Automattic describes the data protection and transfer mechanisms it uses in its privacy information.

10. Security with Wordfence

We use Wordfence Security to protect the WordPress installation against unauthorised access, malware, automated attacks and other security risks.

In this context, IP addresses, requested URLs, access times, browser information and information concerning failed or suspicious access attempts may in particular be processed.

The purpose is to ensure the confidentiality, integrity, availability and security of our IT systems.

The legal basis is Section 6(1)(g) KDR-OG. Our legitimate interest lies in protecting the website and the data processed on it against attacks and misuse.

Individual security functions may involve communication with services operated by Wordfence or Defiant Inc. Where personal data is transferred to a third country in this context, the requirements of Sections 39 et seq. KDR-OG apply.

11. Google Maps

We use Google Maps on individual pages.

Google Maps is not loaded immediately when a page is opened. External map content is initially blocked by our consent management system.

A connection to Google is established only after you have given the required consent or expressly activated the map content. In this context, your IP address, device and browser information and information about the page visited may in particular be transmitted to Google.

The legal basis is your consent pursuant to Section 6(1)(b) KDR-OG. Where information is stored on or read from your terminal equipment, this likewise takes place only after the required consent has been given.

Google LLC may process data in the United States. Google states that it relies on the EU-U.S. Data Privacy Framework for corresponding data transfers.

12. OpenStreetMap and Leaflet

Individual pages may additionally use maps based on OpenStreetMap and the Leaflet map library.

External map content is initially blocked by Complianz. A connection to the respective map server is established only after you have given the required consent or expressly activated the map content.

When the map is loaded, the IP address of the device used is in particular transmitted to the respective map server for technical reasons.

The legal basis is your consent pursuant to Section 6(1)(b) KDR-OG. Where additional information is stored on or read from your terminal equipment, this likewise takes place only after the required consent has been given.

13. YouTube

Individual pages may contain embedded videos from YouTube.

YouTube content is initially blocked by our consent management system. A connection to YouTube or Google is established only after you have given the required consent or expressly activated embedded content.

In this context, IP address, browser and device information, the page visited and the time of access may in particular be processed.

The legal basis is your consent pursuant to Section 6(1)(b) KDR-OG. Where YouTube stores information on or reads information from your terminal equipment, this likewise takes place only after the required consent has been given.

Google LLC may process data in the United States. Google states that it relies on the EU-U.S. Data Privacy Framework for corresponding data transfers.

14. Fonts

The Google fonts used for the visual presentation of the website are served locally through our server infrastructure. As a result, simply opening a page does not require a connection to Google Fonts for the display of these fonts.

Other font files used on the website may likewise be stored locally within the WordPress installation.

15. No Public User Registration and No Comment Function

Visitors cannot create a public user account on stclemens.org.

Existing WordPress user accounts are used exclusively for internal administration and editorial work.

No regular public comment function is currently offered.

16. Contact by Email and Telephone

You may contact us in particular by email or telephone.

In doing so, we process the data you provide, in particular your name, email address, telephone number, the content of your message and any other information you provide voluntarily.

The purpose of processing is to deal with and respond to your enquiry and, where necessary, to conduct further correspondence.

Where your enquiry relates to entering into or performing a contract, processing is carried out on the basis of Section 6(1)(c) KDR-OG. In all other cases, processing is carried out on the basis of Section 6(1)(g) KDR-OG. Our legitimate interest lies in the proper handling of incoming enquiries.

The data will be deleted once the enquiry has been conclusively dealt with and there are no statutory, ecclesiastical or other legitimate reasons requiring further retention.

Please transmit particularly sensitive or confidential information only through communication channels expressly intended for such information.

17. Donations

Our website provides information on ways to support the work of the Redemptorists through donations.

The website itself does not process online payments. Bank details are published for donations. The actual payment is processed by the financial institutions involved.

In the case of a bank transfer, we receive payment information transmitted by the banks. This may include in particular the name or account holder, IBAN, amount, booking date and payment reference.

The purpose of processing is to receive, allocate and account for the donation. The legal basis is Section 6(1)(c) KDR-OG. Where tax-related or other statutory retention obligations apply, further processing is carried out on the basis of Section 6(1)(d) KDR-OG.

18. Links to Social Networks and External Websites

Our website contains links to external websites and social networks.

Merely visiting our website does not establish a connection to the provider of an ordinary external link. Only when you open the link do you leave stclemens.org and establish a direct connection to the respective provider.

The respective external provider is generally responsible for the subsequent processing of personal data.

19. Recipients of Personal Data

Within the Provincialate, access to personal data is limited to those persons and units that require it for the performance of their duties.

In addition, technical service providers may process data where this is necessary for the operation, maintenance, security or provision of the website.

These include in particular:

• Oxilion B.V. as hosting provider
• Automattic in connection with Jetpack
• Defiant Inc. in connection with Wordfence
• Google in connection with Google Maps and YouTube content loaded after consent
• where applicable, the respective map servers used for OpenStreetMap

Data is disclosed only where there is a valid data protection basis for doing so.

20. Transfers of Data to Third Countries

The hosting provider Oxilion B.V. is based in the Netherlands. The hosting of this website therefore does not involve a transfer to a third country outside the European Economic Area.

Individual international services may, however, process personal data in countries outside the European Economic Area, in particular in the United States.

Any such transfer takes place only in accordance with Sections 39 to 41 KDR-OG. Where an adequacy decision of the European Commission applies to the respective recipient, the transfer may be based on that decision. Otherwise, appropriate safeguards are used or one of the statutory exceptions applies.

Google LLC states that it participates in the EU-U.S. Data Privacy Framework. For other international service providers, the specific transfer mechanism used depends on their applicable contractual and data protection arrangements.

21. Retention Period

We generally retain personal data only for as long as necessary for the respective processing purpose.

Where specific retention periods have been established for individual processing operations, these are stated in the relevant sections of this Privacy Policy.

Data may also be retained for a longer period where statutory or ecclesiastical retention obligations apply, where it is required for the establishment, exercise or defence of legal claims, or where further retention is necessary for security or documentation purposes.

Once the purpose no longer applies and any applicable retention periods have expired, the data is deleted or, where possible and appropriate, anonymised.

22. Rights of Data Subjects

Under the KDR-OG, data subjects have in particular the following rights:

• right of access pursuant to Section 17 KDR-OG
• right to rectification pursuant to Section 18 KDR-OG
• right to erasure pursuant to Section 19 KDR-OG
• right to restriction of processing pursuant to Section 20 KDR-OG
• right to data portability pursuant to Section 22 KDR-OG
• right to object pursuant to Section 23 KDR-OG
• rights relating to automated decision-making pursuant to Section 24 KDR-OG

Where processing is based on consent, that consent may be withdrawn at any time with effect for the future.

To exercise your rights, you may contact us at:

23. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the KDR-OG or other applicable data protection rules, you have the right under Section 48 KDR-OG to lodge a complaint with the competent church data protection supervisory authority.

The contact details of the competent supervisory authority are set out in Section 4 of this Privacy Policy.

24. Withdrawal of Consent

Consent that has been given may be withdrawn at any time with effect for the future.

Consent relating to cookies, external maps, videos or other external services can be changed or withdrawn through the cookie settings on stclemens.org.

The lawfulness of processing carried out prior to withdrawal remains unaffected.

25. Data Security

We use technical and organisational measures to protect personal data against unauthorised processing, loss, alteration, disclosure and other security risks.

Data transmitted between your browser and our website is encrypted using HTTPS.

Wordfence Security and server-side security measures are used, among other things, to protect the WordPress installation.

Security measures are reviewed and adapted in accordance with the state of the art and the respective level of protection required.

26. Journalistic and Editorial Processing

stclemens.org publishes journalistic and editorial content concerning the life, work and institutions of the Redemptorists.

Where personal data is processed exclusively for our own journalistic, editorial or literary purposes, the special provisions of Section 55 KDR-OG apply.

In particular, the obligation to maintain data confidentiality, the requirements concerning appropriate technical and organisational measures, and the statutory provisions on liability and personality rights remain applicable.

27. Changes to this Privacy Policy

Technical functions, legal requirements and the content of our website may change. This Privacy Policy will be amended where such changes make this necessary.

The current version published on stclemens.org applies.