Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Herz- und Seelenstimme e.V.
Hohlgasse 5, 66839 Schmelz, Germany
Authorized representative (Board): Louisa Yalden
Email: herz-und-seelenstimme@tutamail.com

2. General information on data processing

As a matter of principle, we collect and use our users' personal data only to the extent necessary to provide a functional website as well as our content and services. Personal data is collected and used only with the users' consent or where the processing is permitted by law.

3. Contact form & email contact

If you contact us via the contact form or by email, the data you provide (name, email address, message and, where applicable, your interest in particular offerings) will be stored by us in order to process your inquiry and in case of follow-up questions. Name, email address and message are required so that we can reply to you; all other information is voluntary.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). This data is not passed on to third parties. The data will be deleted as soon as it is no longer required for the purpose for which it was collected, and no later than after 3 years.

When you submit the contact form, your entries are forwarded to us by email via the server of our hosting provider (see the “Hosting” section). The data is not stored permanently on the website itself. Exception: if you tick the box saying you would like to be informed about new dates, workshops and offerings, we store your name and email address in a non-public list on this server (see Section 5). A hidden field in the form serves solely to protect against automated spam; no additional data about you is collected through it. Please note that emails may be transmitted unencrypted; therefore, please do not send us any particularly confidential information.

4. Registration for the Christmas Singing (project choir)

If you register for the Schmelz Christmas Singing (Schmelzer Weihnachtssingen) via the registration form, we process the following data: full name, date of birth, email address, postal address (street, postcode, town/city), optionally your phone number, voice type, interest in a solo and comments, as well as your answer regarding consent to photos and videos and whether you would like to be informed about upcoming projects. For participants under 18, we additionally collect the name and consent of the parent or legal guardian, who is also the invoice recipient. Name, date of birth, email address and postal address are required; without them we cannot process the registration or issue an invoice. All other information is voluntary.

The purpose of the processing is the organization and running of the project choir, the calculation of the participation fee (the date of birth is used to classify participants as a child or an adult as of the first rehearsal date and for the protection of minors), the creation and sending of the invoice, the matching of incoming payments, and communication with you.

After submitting the form, you will receive a confirmation by email with the invoice and bank details. The association is notified of the new registration by email; the invoice is also stored in the protected administration area on the hosting provider’s server, as it must be retained. The invoice contains your name or that of the invoice recipient, as well as the postal address. If you pay the fee by bank transfer, your bank processes the payment data; our bank sees your name and the payment reference.

Reduced fee: If you let us know that the fee is difficult for you to afford, we treat this information confidentially and use it exclusively to find a solution together with you. Any different amount agreed upon is stored together with your registration and is not passed on to third parties.

Legal basis: Art. 6(1)(b) GDPR (carrying out your participation or pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations for invoices). Consent to photos and videos is based on Art. 6(1)(a) GDPR. It is voluntary and must be answered with “Yes” or “No” in the form; answering “No” has no disadvantages for participation. For minors, the parents or legal guardians decide. We use recordings in which you (or your child) can be seen only for the association's public relations work, for example on the website or on social media. You can withdraw your consent at any time with effect for the future by emailing herz-und-seelenstimme@tutamail.com; we will then remove recordings from our own channels as far as we are able to.

Storage and recipients: The registration is sent to us by email via the server of our hosting provider (see the “Hosting” section) and is additionally stored in a non-public participant list on this server. Only the Board has access to this list, protected by a password. In the list we also note whether the fee has been paid. The data is not passed on to any other third parties.

Storage period: We delete your registration data no later than three months after the performance. If you cancel your registration, we remove you from the participant list immediately. If you have consented to being informed about upcoming projects, you remain on that list with the information mentioned in Section 5 until you withdraw your consent. After that, only the invoice (name, address, amount) is kept in the association's accounting records, because as an association we are legally required to do so (Art. 6(1)(c) GDPR). As soon as this legal obligation ends, the invoice is deleted as well.

Waiting list: If all places are taken, we will, at your request, put you on a waiting list using the registration form. For this purpose we store your name, date of birth, for children the name of the parent or legal guardian, email address and phone number (if provided), and send you an email as soon as a place becomes available. We do not store the other information from the form for this purpose. If you register, we remove you from the waiting list. Otherwise, we delete the waiting list no later than after the performance. You can ask to be removed from the waiting list at any time by email. The legal basis is Art. 6(1)(b) GDPR (your request to participate).

5. Information about dates & offerings

If you sign up via the newsletter form on the homepage (“Always in the loop”, first name and email address only), tick the box in the contact form saying that you would like to be informed about new dates, workshops and offerings, or ask us to do so by email, we use your name and email address exclusively to inform you about the association's offerings, dates and events. This is voluntary. If you sign up via the newsletter form or tick the box in the contact form, we first send you an email with a confirmation link (double opt-in). Only once you click it do we add you to a non-public list on our hosting provider's server, which only the Board can access with a password. Until then, we keep a note of your name, email address and the time of your request; unconfirmed requests are deleted after 30 days. The data remains stored until you withdraw your consent. At the end of our emails you will also find a link that lets you unsubscribe with a single click.

The same applies if, when registering for the Christmas Singing, you tick the box saying that you would like to be informed about upcoming projects in which you (or your child) can take part. The box is not pre-ticked; leaving it unticked has no disadvantages for your registration. For this purpose we keep a separate list with your name, date of birth, for children the name of the parent or legal guardian, phone number (if provided), email address and the project you had registered for. The date of birth helps us offer you projects suited to your age. We keep this information even after the rest of the registration data has been deleted (see Section 4), until you withdraw your consent or the association no longer offers such projects.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future by sending us an email at herz-und-seelenstimme@tutamail.com.

6. Hosting

This website is hosted by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and IP address.

This data is not combined with other data sources. The processing is based on Art. 6(1)(f) GDPR (legitimate interest in the stable and secure operation of the website). The hosting provider is based in Germany; to that extent, no data is transferred to a third country. The data submitted via the contact and registration forms and the participant list (see Sections 3 and 4) are also stored on the hosting provider's server. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. For further information, please see checkdomain's privacy policy at checkdomain.de/agb/datenschutz.

7. Cookies & audience measurement

Our public pages do not set any cookies and do not use any third-party services for audience measurement or advertising. To see how many people visit our pages, we count page views ourselves on our server. So that the same visitor is only counted once per day, we create a shortened checksum from the IP address and browser identifier together with a random value that is newly generated every day. The IP address itself is not stored, and the checksum is only used for the day in question and deleted afterwards. We also count where visitors come from: only the name of the website on which you clicked a link to us is recorded (for example “google.de”, without the exact address), or a keyword contained in the link you opened (for example “?von=flyer” for a QR code). All that remains are daily figures (page views and visitors per area of the website, per language version and per source); it is not possible to identify you from them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how our website is used). In the password-protected internal area, which is used only by the Board, a technically necessary session cookie is set. It keeps you logged in for the duration of the visit and is deleted when you close the browser. In addition, a cookie is set there that remembers that visits from this device are not counted; it contains no personal data and expires after two years. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act).

8. External services & links

Fonts (Playfair Display, Outfit) and icons (Lucide) are stored on our own server and loaded from there. No connection to third-party servers (e.g. Google or content delivery networks) is established for this purpose when you visit the website, and no data is transmitted to such providers.

This website also contains links to external services (Instagram, Facebook, WhatsApp, Telegram, YouTube and Google). When you click these links, you leave our website. We are not responsible for the content and data protection practices of these external providers. Please refer to the respective providers' privacy policies.

9. Our presence on social networks and online platforms

We are present on several platforms in order to provide information about our association, our offerings and performances and to get in touch with interested people. The legal basis is our legitimate interest in public relations (Art. 6(1)(f) GDPR).

When you visit our profiles, the respective providers process personal data about you, for example your IP address, information about your device and your usage behaviour. This may also happen if you do not have an account with the platform or are not logged in. We have no influence on this. Which data the providers process and for what purposes is set out in their privacy policies (see below). Some providers also transfer data to the USA; in doing so, they rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

If you send us a message or comment on a post via a platform, we see your name or user name and your message. We use this information only to reply to you.

You can exercise your rights (access, rectification, erasure, restriction, objection, complaint to a supervisory authority) both against the respective provider and against us. The most effective way is to contact the provider directly, as only the provider has access to the data. If you contact us (herz-und-seelenstimme@tutamail.com), we will forward your request.

Responsible for our profiles: Herz- und Seelenstimme e.V., Hohlgasse 5, 66839 Schmelz, Germany.

Instagram and Facebook

Profile on Instagram: instagram.com/herzundseelenstimme
Page on Facebook: facebook.com/HerzundSeelenstimme

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). Privacy policies: privacycenter.instagram.com/policy (Instagram) and facebook.com/privacy/policy (Facebook).

Meta provides us with statistics about our profiles (for example, how many people have seen our posts). We only receive these in aggregated form, without being able to identify individual persons. We are jointly responsible with Meta for processing these statistics (Art. 26 GDPR). You can find the agreement on this here. Under this agreement, Meta assumes primary responsibility and handles the fulfilment of your rights.

WhatsApp channel

Our channel: whatsapp.com/channel/…

Provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: whatsapp.com/legal/privacy-policy-eea

Our WhatsApp channel is purely an information channel. Followers cannot see our phone number, and we cannot see the phone numbers of followers. We only see how many people follow the channel and how often people have reacted to posts.

Telegram

Channel on Telegram: t.me/HerzundSeelenstimme

Provider: Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates. EU representative under Art. 27 GDPR: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium. Privacy policy: telegram.org/privacy

Only we publish posts in our Telegram channel, and comments under the posts are not possible. You can, however, write to us using the channel’s “Direct Messages” feature. When you do, we see your Telegram name, your profile picture and the content of your message, but not your phone number, and we reply on behalf of the channel. We use your message only to answer your enquiry (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for questions about taking part in our activities) and delete the conversation once the enquiry has been dealt with, unless we are legally required to keep it. Direct messages in channels are not end-to-end encrypted on Telegram, so please do not send us any sensitive data this way.

If you subscribe to the channel, we as the operator can see your Telegram name and profile picture in the subscriber list, but not your phone number. Other subscribers cannot see who has subscribed. Reactions to posts are visible to us only as a number. Telegram also provides us with aggregated statistics (for example, how often a post has been viewed) that do not allow us to identify individual people. According to Telegram, data of users from the EU is stored in data centres in the Netherlands. Telegram is based outside the EU; there is no adequacy decision of the European Commission for the United Arab Emirates.

Google Business Profile and YouTube

Our Google profile: share.google/MYWfINzIdbyqMDexn

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy

Google provides us with aggregated statistics about our Business Profile and our YouTube channel (for example views and search queries), without us being able to identify individual persons. Reviews you write on Google are public and visible with your Google name.

10. Your rights

You have the following rights with respect to us regarding the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, please contact: herz-und-seelenstimme@tutamail.com

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent supervisory authority in Saarland is the Unabhängiges Datenschutzzentrum Saarland (UDS) (Independent Data Protection Center of Saarland).

11. Currency of this privacy policy

This privacy policy is currently valid and was last updated in November 2026. As our website evolves, or due to changes in legal requirements, it may become necessary to amend this privacy policy.