Privacy Policy — Flutgraben e.V.

§ 1 Controller and contact

The controller in the sense of the GDPR is:

Flutgraben e.V., Am Flutgraben 3, 12435 Berlin, Germany

Data protection and general enquiries: kontakt@flutgraben.org

Flutgraben e.V. is not required to appoint a Data Protection Officer under § 38 BDSG, as it regularly has fewer than 20 persons continuously engaged in the automated processing of personal data. Responsibility for compliance with data protection law lies with the board.

§ 2 What data we process and why

Flutgraben processes the following categories of personal data:

• Master data (name, address, email, telephone, date of birth where contractually required, tax number/VAT ID for traders) — for association administration, tenancy relationships, and project execution.

• Contract data (rental agreements, sub-tenancy agreements, use agreements, data-protection commitments (Verpflichtungserklärungen), utility consumption data for electricity, heat, and water billing) — for contract initiation, performance, and termination.

• Financial data (bank details, rent payments, accounting entries, invoices, receipts) — for bookkeeping, VAT determination, and tax filings.

• Donation data (donor identification, tax ID where required for donation receipts, donation amounts) — for issuing donation receipts under § 50 EStDV.

• Employment data (salary, tax class, social security number, time records) — for payroll and compliance with employment-law obligations.

• Communication data (email correspondence, calendar entries, telephone notes) — for communication with tenants, staff, authorities, and business partners.

• Membership data (membership number, joining/leaving date, contribution status) — for membership administration, board activity, and general meetings.

• Platform usage data (login timestamps, audit logs, signature metadata such as IP address and user agent at the time of contract signing) — for IT security and evidentiary purposes for electronic contract execution.

• Synchronised contact data: staff and board members may opt in via the platform settings to synchronise their personal Google Contacts with the shared association address book. Activation requires an explicit user action in the dashboard; deactivation is possible at any time.

§ 3 Legal bases

Processing is based, depending on purpose, on the following legal grounds:

• Art. 6(1)(b) GDPR — performance of a contract (rental agreements, use agreements, processor contracts).

• Art. 6(1)(c) GDPR — legal obligation (tax retention obligations, GoBD compliance, German Associations Act).

• Art. 6(1)(f) GDPR — legitimate interest (internal administration, IT security, evidentiary preservation of contract execution, address-book synchronisation).

• Art. 6(1)(a) GDPR — consent (e.g. newsletter dispatch, publication in member directory).

• § 26 BDSG — employment data.

§ 4 Categories of recipients

We pass personal data to processors within the meaning of Art. 28 GDPR, with whom processor agreements are in place. The categories are:

• Cloud platform for database, authentication, and file storage (EU region).

• Cloud office for email, calendar, drive, and contacts (EU with US parent).

• AI processing services for text, email, and receipt handling (USA with adequacy decision or Standard Contractual Clauses).

• Monitoring and error analysis (EU and USA).

• Task and project management (USA, Standard Contractual Clauses).

• Cryptographic timestamping (RFC 3161, no personal-data reference — not a processor relationship).

A list of the specific providers by name, with processor-agreement references, is maintained internally in our Article 30 GDPR record of processing activities. It is disclosed on request to kontakt@flutgraben.org.

§ 5 Third-country transfers

Where data is transferred to processors outside the EEA, this takes place on the basis of an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

§ 6 Retention periods

Personal data is stored only as long as required for the relevant processing purpose or for statutory retention obligations. The Wachstumschancengesetz (in force since 1 January 2025) shortened the retention period for accounting receipts from ten to eight years; the periods below reflect that change.

• Contract documents (rental, sub-tenancy, use agreements, data-protection commitments (Verpflichtungserklärungen)): 6 years after the end of the contract under § 257(1) no. 2-3 in conjunction with § 257(4) HGB.

• Accounting and tax records (receipts, invoices, accounting entries): 8 years after the end of the calendar year of their creation under § 257(1) no. 4 HGB and § 147(3) AO.

• Commercial books, balance sheets, annual financial statements: 10 years under § 257(1) no. 1 HGB.

• Donation receipts: 10 years under § 50(7) EStDV / § 63 AO.

• Membership data: during active membership plus 6 years after departure for evidentiary purposes.

• Application documents of unsuccessful applicants: 6 months after rejection.

• Server logs and audit logs: 30 days, unless extended for security reasons.

• Personal data without statutory retention obligation: up to 12 months after the processing purpose lapses.

Right to erasure (Art. 17 GDPR): requests are reviewed. Where there is a conflict with a statutory retention obligation, the latter prevails; the erasure right is fulfilled after the statutory period expires. During the retention period, data is restricted (blocked) under Art. 18 GDPR.

§ 7 Your rights

Data subjects have the following rights vis-à-vis Flutgraben:

• Right of access (Art. 15 GDPR).

• Right to rectification (Art. 16 GDPR).

• Right to erasure (Art. 17 GDPR) — subject to statutory retention obligations (see § 6).

• Right to restriction of processing (Art. 18 GDPR).

• Right to data portability (Art. 20 GDPR).

• Right to object (Art. 21 GDPR) where processing is based on legitimate interest.

• Right to withdraw consent (Art. 7(3) GDPR) with effect for the future.

These rights apply to the extent provided for the relevant processing under the GDPR. In particular, the right to data portability (Art. 20) requires processing based on consent or contract; data we process under a statutory obligation (e.g. accounting and tax records, utility cost settlements) is not covered.

§ 8 Data protection enquiries and right to lodge a complaint

Requests to exercise the rights under § 7 should be sent to kontakt@flutgraben.org. We respond without undue delay, at the latest within one month of receipt.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

§ 9 Security

Flutgraben implements technical and organisational measures under Art. 32 GDPR to protect personal data, in particular: encryption of data transmission (TLS) and database backups, role-based access control with multi-factor authentication for board members, complete audit logs of security-relevant operations, GoBD-compliant immutability of posted accounting entries, and a documented process for handling data breaches with a 72-hour notification chain under Art. 33 GDPR.

§ 10 Changes to this policy

Flutgraben reserves the right to adapt this privacy policy to changed legal or organisational circumstances. Versioning is handled via the internal platform; each new version supersedes the previous one and is documented with its effective date.

The currently valid version is available via the dashboard and in the association's Shared Drive (Richtlinien folder).