Privacy policy

Table of Contents

I. Introduction and Terms


With the operation of our website with the URL (hereinafter referred to as “website”), we process personal data. These are treated confidentially by us and processed in accordance with the applicable laws – in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). With these data protection regulations, we want to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if necessary, to whom we disclose it. In addition, we will explain to you what rights you have to protect and enforce your data protection.

  1. TERMS

Our data protection regulations contain technical terms that are in the DSGVO and the BDSG. For your better understanding, we want to explain these terms in simple terms in advance:

    1. Personal Data
      “Personal data” is any information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Details of an identified person can e.g. B. the name or the e-mail address. However, personal data is also data for which the identity is not immediately apparent, but can be determined by combining your own or third-party information and thus finding out who it is. For example, a person will B. identifiable by providing your address or bank details, your date of birth or user name, your IP addresses and/or location data. All information that in any way allows conclusions to be drawn about a person is relevant here.
    2. Processing
      Art. 4 No. 2 GDPR defines “processing” as any process in connection with personal data. This applies in particular to collecting, recording, organizing, arranging, storing, adapting or changing, reading out, querying, using, disclosing, transmitting, distributing or any other form of provision, comparison or linking , the restriction, deletion or destruction of personal data.
    3. Health data
      The term “health data” is defined in Art. 4 No. 15 GDPR as personal data relating to the physical or mental health of a person, including the provision of health services, and from which information about the state of health of this person can be derived.

II. Responsible and data protection officer


Responsible for data processing is:

Association: KJSH – Association for Children, Youth and Social Aid e.V. (“we”)
Legal representative: Frederik Naher, Norbert Wollner (Management Board)
Address: Hammer Steindamm 7, 22089 Hamburg
Telephone: 0431 979 100
Fax: 0431 979 1010


We have appointed an external data protection officer for our association. You can reach him at:

Company: HABEWI GmbH & Co. KG
Legal representative: general partner HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Address: Palmaille 96, 22767 Hamburg
Telephone: 040/ 46008966
Fax: 040/ 46008977

III. Processing frame


Within the framework of the website, we process the personal data of you listed in detail in Section IV. We only process data from you that you actively provide on the website (e.g. by filling out forms) or that you make available automatically when using our offer.

Your data will be processed exclusively by us and will not be sold, loaned or passed on to third parties. If we use the help of external service providers to process your personal data, this is done within the framework of so-called order processing, in which we as the client are authorized to issue instructions to our contractors. To operate our website, we use external service providers for hosting. We host our website with an external provider in the data center location […], […]. If other external service providers are used for individual processing listed in Section IV, they will be named there.

In principle, we do not transfer data to third countries and this is also not planned. We will inform you about exceptions to this principle in the processing described below. Any data transfer to third countries then takes place on the basis of the so-called EU standard contractual clauses.

IV. The processing in detail

    1. Description of processing
      Individual functions and offers on our website are only available to you as a registered user. By registering, you conclude a free user contract with us. By registering, you will receive your own user account on our website. Registration takes place by filling out the registration form on our website and sending it to us electronically. To register, you must enter a freely chosen nickname and a freely chosen password. The following information can also be provided voluntarily for statistical purposes: gender, age, federal state, school and e-mail address. By clicking the “Register” button, you send us the form. As a registered user, the following advisory services are available free of charge: individual chat advice, email advice, topic chat. The various advisory services are intended to help solve problems.
    2. Purpose
      The processing takes place in order to be able to provide you with the functions of our website for registered users.
    3. Legal basis
      The processing is required to conclude and fulfill the free user contract (Art. 6 Para. 1 lit. b GDPR). Without providing your personal data during registration, we cannot provide our contractually owed services.
    4. Storage duration
      The data will be automatically deleted by us upon termination of your user contract. You can terminate the user contract yourself by selecting the “Delete profile” function in the settings of your user account. Alternatively, you can also inform us by post to KJSH – Association for Children, Youth and Social Aid, Hammer Steindamm 7, 22089 Hamburg, by fax to 0431 979 1010 or by e-mail to that you are not a registered user our website want to be more. We will then delete your user account immediately. In addition, as a logged-in user, you can edit and remove your own details and information at any time.
    1. Description of processing
      Our website uses cookies. Cookies are small text files that are stored on the user’s device when a website is visited. Cookies contain information that enables the recognition of an end device and, if necessary, certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. So-called “session cookies” and “persistent cookies” are used on our website. “Session cookies” are automatically deleted when you end your internet session and close your browser. Persistent cookies remain stored on your end device for a longer period of time. In addition to cookies, we also use other tracking technologies, such as pixels or what is known as fingerprinting. If cookies are technically required for the operation of our site, your consent is not required. All other cookies and tracking technologies that are not technically required are only set after you have actively consented to the use of cookies/tracking technologies via our consent tool. We use the “Cookie-Yes” service to obtain and document consent. The consent tool saves your selection itself in a cookie on your end device. As a result, you do not have to make a decision about cookies again on a subsequent visit to our website.

      You can find out which cookies are used on our website for which purpose, how long they are stored on your end device and which consents you may have already given in the settings of the consent tool Cookie-Yes. The settings can be found at the bottom of the screen labeled “Manage Consent”.

      1. Purpose
        We use cookies to make our website more user-friendly and to offer the functions described in Section 7.1.
      2. Legal basis
        The processing is necessary with regard to technically required cookies and the use of the consent tool to protect the overriding legitimate interests of the person responsible (Art. 6 Para. 1 lit. f DSGVO). Our legitimate interest lies in the purpose stated in Section 7.2. In the case of processing with regard to all other cookies/tracking technologies that are not technically required, the legal basis is consent (Art. 6 Para. 1 lit. a GDPR). Such consent is voluntary.
      3. Duration of storage, revocation of consent
        Cookies are automatically deleted at the end of a session or at the end of the specified storage period. Since cookies are stored on your end device, you as the user have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted. This can also be done automatically. If cookies are deactivated, deleted or restricted for our website, it may be that individual functions of our website cannot be used or can only be used to a limited extent. You can revoke any consent you have given to the use of cookies at any time in the settings of the consent tool […] with effect for the future.
      4. Recipient
        If third-party cookies are used, data may be transmitted to the relevant providers of these third-party services. Under certain circumstances, data may also be transmitted to third countries outside the European Union or the European Economic Area. We provide information about the recipients of data and third-country transfers in the settings of the consent tool or in the relevant passage for the third-party service in these data protection provisions.
        1. Description of processing
          You can also contact us via the e-mail addresses, telephone numbers or by post given on the website. In this case, the transmitted personal data will be processed by us.
        2.  Purpose
          The data transmitted with and in the contact form or your e-mail will only be used for the purpose of processing and answering your request.
        3. Legal basis
          The processing is necessary to safeguard the overriding legitimate interests of the person responsible (Article 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated in Section 8.2. If the e-mail contact is aimed at concluding or fulfilling a contract, the data will be processed to fulfill the contract (Article 6 (1) (b) GDPR).
        4. Storage duration
          We will delete the data as soon as they are no longer required to achieve the purpose for which they were collected. This is usually the case when the relevant communication with you has ended. The communication ends when it can be inferred from the circumstances that your request has been finally clarified. If legal retention periods prevent deletion, deletion will take place immediately after the statutory retention period has expired.
        1. Description of processing
          Our website does not use so-called social media plugins. The Facebook, Instagram, Twitter and YouTube logos displayed on our website are only linked to the corresponding profiles of our company on the social networks. A data transmission to the social networks does not take place with the integration of the logos. If you click on one of the logos, you will only be forwarded to the external website of the respective social network.

          However, our profiles within the social networks represent data processing. If you are logged in to the respective social network when you visit such a profile, this information will be assigned to your user account there. If you interact with our profile, e.g. comment, “share”, “like” or “retweet” a post, this information will also be stored in your user account. As a rule, we can also view your interactions with our profile.

          On the social networks Facebook and Instagram, we have the opportunity to receive statistical data about the use of our Facebook page or our Instagram profile via the so-called “Insights” function. These statistics are provided by Facebook and Instagram respectively. The “Insights function” is not mandatory. We cannot decide to turn this feature on or off. It is available to all Facebook fan page operators and all operators of an Instagram business account, regardless of whether you use the insights function or not.

          The following data is provided to us via the Facebook Insights for a selectable period of time in an anonymous form with regard to fans, subscribers, people reached and people interacting: Total number of page views, “Like” information including origin, page activities, post interactions, Reach, post reach (divided into organic, viral and paid interactions), comments, shared content, responses and demographic evaluations, i.e. country of origin, gender and age. With the Insights statistics, it is not possible for us to identify subscribers and fans of our site and to view their profiles.

Furthermore, the Instagram Insights provide us with anonymous data on the development and reach of our Instagram profile, as well as the posts, stories and videos we have posted there. In the Instagram Insights, we also receive statistical information on the place of origin, gender and age of the subscribers to our Instagram profile.

The social networks with which you communicate store your data using pseudonyms as usage profiles and use them for advertising purposes and market research. For example, you can be shown advertisements within the social network and on other third-party websites that correspond to your presumed interests. For this purpose, cookies are usually used, which the social network stores on your end device. You have the right to object to the creation of these user profiles, which you must contact the social networks directly to exercise.

        1. Purpose
          We maintain profiles on the aforementioned social networks for the purpose of public relations and corporate communication with customers and interested parties. We use the “Insights” function from Facebook and Instagram to evaluate the reach of our posts on the social network and to make them more attractive to our visitors in the future.
        2. Legal basis
          The legal basis for data processing in the context of our profiles on social networks is the protection of our overriding legitimate interests (Art. 6 Para. 1 lit. f GDPR). Our legitimate interest lies in the purpose stated in Section 10.2. If you are asked for your consent by the respective operator of a social network, the legal basis is Article 6(1)(a) GDPR. With regard to our presence on Facebook and Instagram, data processing takes place on the basis of joint responsibility in accordance with Art. 26 GDPR.
        3. Recipients and transmission to third countries
          The respective social networks are operated by the companies listed below. Further information on data protection with regard to our profile on the social networks can be found in the linked data protection regulations.

The social networks also process your personal data in the USA.

      1. MATOMO
        1. Description of processing
          Our website uses “Matomo”, a web analysis service provided by Innocraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo is open source software that we have installed on our server. Matomo uses cookies (see section 7) that enable an analysis of your use of our customer portal. In particular, the statistics compiled by Matomo record how many users visit our website, the country or location from which access is made, which sub-pages are accessed and which links or search terms visitors use to access our website. The information collected is transmitted to our server and stored there. A transfer to third parties – in particular to Innocraft Ltd. – does not occur. Your IP address is only recorded in abbreviated form so that it cannot be assigned (so-called IP masking).
        2. Purpose
          The processing takes place in order to be able to evaluate the use of our customer portal. The information obtained in this way is used to improve and tailor our online presence to needs.
        3. Legal basis
          The processing takes place on the basis of consent in accordance with Article 6 (1) (a) GDPR. This is obtained by us via the “Other” consent tool (see Section 7.1). Such consent is voluntary.
        4. Duration of storage and right of objection, revocation of consent
          We have explained the storage period and your control and setting options for cookies in Section 7. You can revoke the consent you have given with regard to Matomo at any time in the settings of the consent tool with effect for the future. You can also object to data processing by Matomo at any time by removing the following tick and thus activating the opt-out plug-in: Matomo iFrame. The analysis data processed and stored with Matomo will be automatically deleted by us after one year.
      2. YOUTUBE
        1. Description of processing
          Our website uses “YouTube” services, a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA (hereinafter referred to as “Youtube”). YouTube is represented by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform on our website as so-called iFrames so that they can be played directly on our website. The videos are integrated in the “extended data protection mode” offered on YouTube, i. H. no personal data will be transferred from you to Google as long as you do not play the videos. Data is only transmitted to Google when a video is played, over which we have no influence. If you play an embedded video on a subpage of our website, Google will be informed which subpage you have visited and which video you have viewed. If necessary, your IP address will also be transmitted to Google. If you are logged in as a YouTube or Google user, Google assigns this information to your user account. Google saves your data as usage profiles and uses them for advertising purposes, for market research and/or for the needs-based design of Google websites. You have the right to object to the creation of these user profiles, which you must contact Google directly to exercise. Further information on data protection at Google can be found
        2.  Purpose
          The processing takes place in order to be able to show you videos on our website.
        3. Legal basis
          The processing is necessary to safeguard the overriding legitimate interests of the person responsible (Article 6 (1) (f) GDPR). Our legitimate interest lies in the purpose stated in Section 12.2.
        4. Recipients and transmission to third countries
          By integrating YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.
      3. Processing of applicant data

12.1 Description of processing

We process the data that you provide in connection with your application in order to check your suitability for the position (or any other open positions in our association) and to carry out the application process. This is general data about you (such as name, address and contact details), information about your professional qualifications and school education, information about professional training, knowledge and skills, as well as other information that you disclose to us in connection with your application . This is usually done by means of a letter of application, CV, certificates, correspondence, telephone or verbal information from you.

We would only like to evaluate all applicants according to their qualifications and therefore ask you to refrain from reporting “special categories of personal data” in accordance with Art. 9 of the General Data Protection Regulation in the application (e.g. a photo that reveals ethnic origin, information about severely disabled status, etc.). If your application contains such information, we ask that you send us a corresponding declaration of consent, otherwise your application cannot be considered.

If your application is successful, we will transfer your data to your personnel file and use it to implement and terminate your employment relationship.

If we are currently unable to offer you employment, we will continue to process your data even after the rejection has been sent in order to defend ourselves against any legal claims, in particular due to alleged discrimination in the application process.

If you are not selected for the vacant position, we will transfer your data to our pool of applicants, provided we have your consent.

12.2 Purpose

The processing takes place to carry out the application process, to decide on the establishment of an employment relationship with us and to document compliance with legal provisions in the application process.

12.3 Legal basis

Data processing in connection with the application process has its legal basis in Article 26 Paragraph 1 Clause 1 BDSG and Article 6 Paragraph 1 Paragraph 1 Letter b GDPR. If your application is successful, further data processing will take place in accordance with Article 6 Paragraph 1 Clause 1 Letter b GDPR in conjunction with Article 88 Paragraph 1 GDPR in conjunction with Section 26 Paragraph 1 BDSG for the purpose of establishing, implementing and ending the application employment relationship. If you have given your consent, e.g. to include your data in our pool of applicants, the data will be processed on the basis of Article 6 (1) (1) (a) GDPR. The legal basis for data processing after a rejection is Art. 6 (1) (1) (f) GDPR. Our legitimate interest consists in defending against legal claims.

12.4 Storage duration

If your application is successful, your data will be transferred to your personnel file and will be deleted in accordance with the regulations applicable to personnel files. If we are currently unable to offer you employment, we will continue to process your data for up to six months after the rejection has been sent. If we transfer your data to our pool of applicants after the application process has been completed, we will delete them from the pool of applicants if an employment relationship is established at a later date or otherwise two years after admission.

12.5 Recipients of your data, transfer of data to third parties and transmission to third countries

Your applicant data will be viewed by the HR department after your application has been received. Suitable applications are then forwarded internally to the department heads for the open position. Then the further process is coordinated. In principle, only those people in the company who need it for our application process to run properly have access to your data. A transmission of the data to third parties does not take place. There is also no data transfer to third countries, nor is this planned.


13. Betterplace

Auf dieser Webseite haben wir iFrames (z.B. integriertes Spendenformular,  Projekt-Widget, Overlay-Spendenbutton) der gAG, Schlesische Straße 26, 10977 Berlin (Betreiberin der Online-Spendenplattform, nachfolgend “” genannt) eingebunden. In diesen iFrames nutzt Dienste Dritter. Einzelheiten zu den im Zusammenhang mit den Diensten erfolgenden Datenverarbeitungen kannst du in der Datenschutzerklärung von nachlesen. Die Rechtsgrundlage für die Einbindung der iFrames ist Art. 6 Abs. 1 lit. f DSGVO. In der Optimierung der Nutzerfreundlichkeit der Webseite und der Ermöglichung einer nutzerfreundlichen Verknüpfung unserer Webseite mit der Online-Spendenplattform von liegt unser berechtigtes Interesse.

V. Safety measures

      1. Safety measures

In order to protect your personal data from unauthorized access, we have provided our website with an SSL or TLS certificate. SSL stands for “Secure Sockets Layer” and TLS for “Transport Layer Security” and encrypts the communication of data between a website and the end device of the user. You can recognize active SSL or TLS encryption by a small lock logo that is displayed on the far left in the browser’s address line.

VI. Your rights

      1. Data subject rights

With regard to the data processing described above by our association, you are entitled to the following rights:

        1. Information (Article 15 GDPR)
          You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have a right to information about this personal data and to the information listed in Art. 15 GDPR under the conditions specified in Art. 15 GDPR.
        2. Correction (Article 16 GDPR)
          You have the right to demand that we immediately correct incorrect personal data concerning you and, if necessary, complete incomplete personal data.
        3. Deletion (Article 17 GDPR)
          You have the right to demand that personal data relating to you be deleted immediately if one of the reasons listed in Art. 17 GDPR applies, e.g. B. if your data is no longer required for the purposes we are pursuing.
        4. Restriction of data processing (Article 18 GDPR)
          You have the right to request us to restrict processing if one of the conditions listed in Art. 18 GDPR is met, e.g. B. if you dispute the accuracy of your personal data, data processing will be restricted for the period that enables us to verify the accuracy of your data.
        5. Data portability (Art. 20 GDPR)
          You have the right, under the conditions listed in Art. 20 GDPR, to request the surrender of the data concerning you in a structured, common and machine-readable format.
        6. Revocation of consent (Art. 7 Para. 3 GDPR)
          You have the right to withdraw your consent at any time from processing based on consent. The revocation applies from the time it is asserted. In other words, it works for the future. The processing does not become unlawful retrospectively as a result of the withdrawal of consent.
        7. Complaint (Article 77 GDPR)
          If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. You can assert this right with a supervisory authority in the EU member state of your place of residence, your place of work or the place of the alleged infringement.
        8. Ban on automated decisions/profiling (Art. 22 GDPR)
          Decisions that have legal consequences for you or significantly affect you must not be based solely on automated processing of personal data, including profiling. We inform you that we do not use automated decision-making, including profiling, with regard to your personal data.
        9. Right to object (Art. 21 GDPR)
          If we process your personal data on the basis of Art. 6 Para. 1 lit. f GDPR (to protect overriding legitimate interests), you have the right to object to this under the conditions listed in Art. 21 GDPR. However, this only applies if there are reasons that arise from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms. We also do not have to stop processing if it serves to assert, exercise or defend legal claims. In any case – regardless of a particular situation – you have the right to object at any time to the processing of your personal data for direct advertising.

Status: October 2021