Data Privacy

Privacy Policy (website)

The One Foundation (hereinafter: ‘we’), as the operator of the website www.one-foundation.de/en, is the controller for the personal data of end users (hereinafter: ‘you’) of this website under the General Data Protection Regulation (GDPR).

Personal data refers to all information related to an identified or identifiable natural person (hereinafter: ‘data subject’). In other words, this encompasses all data that contains information on your personal situation or other circumstances and enables you to be identified, such as your name, email address or contact details. It also includes data that we collect from you when you access or use our website.

We process your data in accordance with this Privacy Policy and the applicable data protection regulations for the purposes listed below.

1 Name and contact details of the controller

The controller pursuant to the GDPR is:

One Foundation

Foundation under civil law

Südliche Münchner Straße 42 b

82031 Grünwald, Germany

Tel.: +49 (89) 66 50 25 - 0

Email: info@one-foundation.de

Website: www.one-foundation.de

2 Contact details of the data protection officer

The controller’s external data protection officer is:

Dr Karsten Kinast, LL.M.

KINAST Rechtsanwaltsgesellschaft mbH

Hohenzollernring 54

50672 Cologne

Tel.: +49 (0)221 – 222 183 – 0

Email: mail@kinast.eu

Website: https://www.kinast.eu/en

3.1 Accessing and using our website

When you access and use our website with an internet browser on your terminal device, your personal data is collected for technical provision of the website and to ensure its functionality and security. Terminal devices include computers or smartphones with internet browsers, for instance.

Your IP address – which is personal data – is collected and stored for this purpose. In conjunction with this, we process the following data which, when paired with your IP address, can be connected to you as an individual:

Terminal device used
Internet browser used
Date and time of the visit
Website from which you visited (known as the referrer URL)

This data processing is based on our legitimate interest under Article 6(1)(f) GDPR in providing you with the functionality and content of our website so you can access and use it with your terminal device and in taking suitable steps to protect our website from potential risks (e.g. hacking).

3.2 Use of cookies

Alongside this, we use cookies, which are stored on your terminal device when you access and use our website. Cookies enable information to be stored, supplemented and managed on users’ devices. When unique identifiers (UIDs) are used, this information can be allocated to a natural person or identify them. UIDs also help us to store information such as your selection preferences, e.g. the rejection of, consent to or a specific selection of technically non-essential cookies, via our cookie banner. In other words, using cookies assists us with adjusting our website to suit our end users’ individual needs.

Depending on the terminal device you use, it may be possible to configure your internet browser so that cookies are rejected by default. As a precaution, we would like to make you aware that it may not be possible to ensure the full functionality of our website in this case.

3.2.1 Declaration on the use and functioning of cookies

In the following, we list the cookies used on our website and their purposes.

3.2.1.1 Technically essential cookies

Technically necessary cookies support the proper functioning of our website. If we did not use technically necessary cookies, it would not be possible for us to provide you with our website when you accessed it in your internet browser.

The following technically essential cookies are deployed when the website is used.

Persistent cookies enable the website to recognise a repeat visitor and adjust their preferred settings or content accordingly.
Counting cookies help manage the server load and prevent the website from being overloaded by efficiently managing the number of user enquiries.
Flash cookies are used to correctly display media content, such as videos or animations, and to ensure a smooth user experience.
Opt-out cookies are necessary to give users the opportunity – at any time – of withdrawing the consent they previously granted to the use of cookies.

3.2.1.2 Technically non-essential cookies

We use functional cookies (technically non-essential cookies) to better tailor our website’s functionality to you.

3.2.2 Declaration of the legal basis for these cookies

The use of technically essential cookies is grounded in our legitimate interest in providing you with the functions and content of our website. In this case, the legal basis is Article 6(1)(f) GDPR.

The purposes of technically non-essential cookies are not strictly necessary for the provision of our website. As a result, your consent is required for the data processing. In these cases, the legal basis is Article 6(1)(a) GDPR.

You give your consent by enabling the relevant cookie category via the corresponding button on our cookie banner. You can also withdraw your consent via the cookie banner at any time by disabling the relevant button. Withdrawing your consent does not affect the lawfulness of the processing carried out based on consent until its withdrawal.

3.3 Use of targeting technologies

Our website includes targeting technologies that also use cookies. These technologies enable us to analyse users’ behaviour when accessing and using our website. In turn, they help us to tailor our website to end users’ individual needs.

3.3.1 Google Analytics

We use the service Google Analytics, provided by the company Google Ireland Limited, for the following purpose(s): tracking and analysing activity on our website. The data collected may be used to improve website performance and optimise the user experience.

Google LLC (USA) is registered within the EU-US Data Privacy Framework; this means that transmission to third countries occurs on the basis of EU Commission’s adequacy decision under Article 45(1) GDPR.

The purposes of the above technologies are not strictly necessary for the provision of our website. As a result, your consent is required for the data processing. In these cases, the legal basis is Article 6(1)(a) GDPR.

3.4 Use of plugins

Our website contains ‘plugins’, which connect external service providers. These plugins allow us to make the user experience on our website more dynamic and offer you needs-based options for interacting on social media and experiencing multimedia content without leaving our website.

3.4.1 Naming and purpose of plugins

Below are the plugins we use on our website and their purposes.

3.4.1.1 YouTube

The website contains at least one plugin from YouTube, which is part of Google Inc., based in San Bruno, California, USA.

We use the YouTube ‘No Cookies’ function, i.e. we have enabled enhanced data protection and videos are accessed via youtube-nocookie.com rather than youtube.com.

YouTube itself provides this service, thereby ensuring that YouTube does not first disclose any data to third parties. When accessing the relevant sites, however, both the IP address and other data specified in Google’s privacy policy are transmitted, thereby disclosing which of our websites you have visited, in particular. The information stored by Google is managed in your Google account, for example, where you can also delete the data yourself.

As soon as you click on an embedded video to start playing it, YouTube stores cookies, which may contain personal data, on your device using enhanced data protection mode. We obtain your consent to this via our cookie banner. These cookies can also be prevented by using the appropriate browser settings and extensions.

Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – privacy policy: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

3.4.2 Clarification of the legal basis for these plugins

The purposes of the above plugins are not strictly necessary for the provision of our website. As a result, your consent is required for the data processing. In these cases, the legal basis is Article 6(1)(a) GDPR.

You give your consent to the use of plugins by enabling the relevant cookie category via the relevant button on our cookie banner. You can also withdraw your consent via the cookie banner at any time by disabling the relevant button. Withdrawing your consent does not affect the lawfulness of the processing carried out based on consent until its withdrawal.

3.5 Contact

3.5.1 Contact via email

You can contact us via email. We process the following personal data concerning you for this purpose:

Email address [mandatory]
Information provided voluntarily (e.g. your name, phone number) with your enquiry

This data processing is based on our legitimate interest in responding to your enquiry via email as per Article 6(1)(f) GDPR.

You can also contact us via email to initiate, perform, process or terminate a contractual relationship, e.g. to request a quote or if you are already our customer. In these cases, the legal basis is Article 6(1)(b) GDPR.

3.5.2 Contact via our contact form

You can use the contact form on our website to make contact with us. We need to collect your email address so we can satisfy your request for contact, but you can also provide us with further information on a voluntary basis.

We process the following personal data concerning you for this purpose:

First name (mandatory)
Surname (optional)
Email address (mandatory)
Phone number (optional)
Any other personal data included in the message

Additionally, the following personal data will be stored when the message is sent:

IP address
Date and time of the message

Your consent is required for this data processing. In this case, the legal basis is Article 6(1)(a) GDPR. You grant your consent by clicking the ‘Submit’ button on the contact form.

You can withdraw your consent at any time by sending an email stating your withdrawal to info@one-foundation.de. Withdrawing your consent does not affect the lawfulness of the processing carried out based on consent until its withdrawal.

Declaration of consent for making contact via the contact form on our website:

I consent to the One Foundation processing my information from this contact form for the purpose of making contact via email and/or phone.

My consent applies until I withdraw it. I can withdraw my consent at any time with future effect by emailing info@one-foundation.de.

Further information on the processing of my personal data and my rights as a data subject can be found via the following link: https://www.one-foundation.de/en/data-privacy/ [Tick-box to confirm awareness]

Button: ‘Submit’

4 Disclosure of your personal data

We disclose your personal data to recipients if you have consented to this disclosure or if we are entitled or obliged to disclose it on the basis of legal provisions or official or judicial orders.

5 Transmission to third countries

Our website uses cookies provided by Google. These cookies can process users’ personal data and transmit it to servers in third countries. Note that this data is only transmitted if the conditions set out in Article 44 et seqq. of the General Data Protection Regulation (GDPR) are met.

Legal basis: your personal data is processed on the basis of your consent under Article 6(1)(a) GDPR, which was granted via your consent to our cookie banner.

Adequacy decision: the existence of an adequacy decision by the European Commission is checked when your personal data is transmitted to third countries. If this is not the case, we ensure that suitable safeguards are in place, as per Article 46 GDPR, to ensure an appropriate level of protection for your data.

Risks: please note that it is possible that the level of protection provided when data is transmitted to third countries is not the same as within the EU. In particular, it may be the case that your rights to the protection of your personal data are not ensured to the same extent.

Consent and withdrawal: you have the right to withdraw your consent at any time. You can do this by changing your cookie settings or by adjusting the relevant browser settings.

6 Duration of data retention

6.1 General

In principle, we only store your personal data for as long as the purpose in question requires it. If you have consented to a purpose and you withdraw your consent with future effect, your personal data which is affected by your withdrawal will be deleted.

6.2 Storage duration after accessing and using our website

We store the personal data that we collect together with your IP address when you access and use our website for seven days. After this point, it is deleted once we have ensured that no technical errors or security risks have occurred e.g. once any error logs from the website have been read.

6.3 Storage duration for cookies

We store technically necessary cookies as ‘session cookies’. Session cookies are only processed for the duration of the usage of our website and are subsequently deleted (e.g. when you have closed your internet browser).

We store technically non-essential cookies, including targeting technologies, as ‘persistent cookies’. Persistent cookies are stored on your terminal device until a set point in time. If you have consented to the use of technically non-essential cookies and/or targeting technologies, the applicable storage durations are listed below:

Cookie/targeting technology	Duration of the storage
Usercentrics consent management platform	Your personal data is erased or blocked as soon as the purpose for which it was stored has been achieved. Data can only be stored beyond this point if provided for by European or national laws, regulations or other ordinance. The data collected is erased after 12 months.
Google Analytics	Your personal data is erased or blocked as soon as the purpose for which it was stored has been achieved. Data can only be stored beyond this point if provided for by European or national laws, regulations or other ordinance. The data collected is erased after 12 months.
YouTube	Your personal data is erased or blocked as soon as the purpose for which it was stored has been achieved. Data can only be stored beyond this point if provided for by European or national laws, regulations or other ordinance. The information stored by Google is managed in your Google account, for example, where you can also delete the YouTube data yourself.

6.4 Storage duration after making contact

If you have contacted us via email, we will store your personal data for the time it takes to conclude your enquiry; this occurs on the basis of our legitimate interest.

If you have made contact with respect to pre-contractual measures or to initiate, perform, process or terminate a contractual relationship, we store your personal data for the time it takes to fulfil these purposes.

If you contact us via the contact form on our website, we store your personal data for the time it takes to conclude your enquiry. This occurs on the basis of the consent you granted. We store the evidence of your original consent via our contact form for 14 days so we can prove the legality of the data processing that occurred until your withdrawal to a supervisory authority or in another respect if necessary.

Your correspondence with us may be subject to statutory retention obligations under certain circumstances. Under section 257(1) German Commercial Code (Handelsgesetzbuch, HGB) and Article 147(1) Fiscal Code (Abgabenordnung, AO), certain business-related documents must be stored for a period of six or ten years. In these cases, the processing of your personal data is restricted and it is only processed for the fulfilment of legal obligations.

7 Rights of data subjects

As a data subject, you have the following rights vis-à-vis the controller under section 1:

Right of access: under Article 15 GDPR, you have the right to obtain information on your personal data at any time.
Right to rectification: under Article 16 GDPR, you can request that the controller rectify incorrect personal data concerning you without delay.
Right to erasure (‘right to be forgotten’): under Article 17 GDPR, you can request that the controller erase personal data concerning you without delay, for instance if your data is no longer required for the purposes for which it was processed.
Right to restrict processing: under Article 18 GDPR, you have the right to request that the controller restrict processing. Your personal data is made inaccessible for any form of processing for the duration of the restriction, e.g. to safeguard rectification or erasure, your objection under Article 21(1) GDPR or your own interests relating to legal protection.
Right to data portability: under Article 20 GDPR, you have the right to receive the personal data concerning you, which you provided to the controller, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, in the event that the data processing occurred on the basis of your consent or the performance of a contract with you.
Right to withdraw your consent: if you have granted the controller consent to data processing, you have the right to withdraw this at any time under Article 7(3) GDPR. Withdrawing your consent does not affect the lawfulness of the processing carried out based on consent until its withdrawal.
Right to object: under Article 21(1) GDPR, you can object to the data processing at any time for reasons arising from your particular situation, provided this data processing is undertaken in the public interest or in the exercise of official authority. This also applies if it was undertaken on the basis of the controller’s legitimate interest and it is not possible to assert a compelling, legitimate interest for the subsequent data processing. Your objection to data processing for the purposes of direct advertising or profiling is not tied to the requirement for a justification or an appraisal of interests; it can be exercised vis-à-vis the controller at any time.
Right to lodge a complaint with a supervisory authority: under Article 77 GDPR and without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority – particularly in the member state of your habitual residence, your place of work or place of the alleged infringement – against the data processing.

8 Profiling

‘Profiling’ refers to any form of the automated processing of personal data combined with the assessment of a natural person’s personal characteristics. When we process your personal data, we do not make automated decisions – including profiling – in individual cases.

9 Right to object

Please note that, as a data subject, you have the right to object, based on grounds arising from your particular situation, to the processing of your personal data undertaken in the public interest, in the exercise of official authority, or due to our legitimate interest at any time. This also applies to profiling based on these provisions. If you object, we will then no longer process your personal data unless we can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms or the processing serves to enforce, exercise or defend legal claims.

Furthermore, we hereby inform you that you can object to the processing of your personal data for the purpose of direct advertising at any time. This also applies to profiling in conjunction with direct advertising. If you object, we will restrict the processing of your personal data and make it unavailable for direct advertising purposes.

10 Amendments and update status

We reserve the right to amend this Privacy Policy at any time with future effect. You can access the current version of this Privacy Policy on our website at https://www.one-foundation.de/en/data-privacy/

This Privacy Policy was last updated on 12 December 2024.