Privacy policy
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in our privacy policy set out below this text.
Data collection on our website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the legal notice of this website.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in our sponsorship application.
Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter our website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. We use other data to process your enquiries, your sponsorship application or your newsletter subscription. Your user behaviour is not analysed.
What rights do you have regarding your data?
You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have a right to request the rectification, blocking or erasure of this data. For this purpose, and for any further questions on data protection, you can contact us at any time at the address given in the legal notice. Furthermore, you have a right to lodge a complaint with the competent supervisory authority.
You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Details can be found in the privacy policy under “Right to restriction of processing”.
No analytics tools
We do not evaluate your browsing behaviour: we do not use any analytics, tracking or advertising tools on this website. Fonts and images are stored on our own server. Third-party content such as YouTube videos is only loaded when you click on it.
2. General information and mandatory information
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.
Information on the controller
The controller responsible for data processing on this website is:
Peace Memorial Christian Organisation Uganda e.V. (VR 208703)
Marienburger Str. 42
81929 München
1st Chairman
Thomas Bleile
Phone: 08941151604
Email: info@pmco-uganda.org
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar).
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal notification by email to us is sufficient for this. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of infringements of the GDPR, data subjects have a right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Information, blocking, erasure and rectification
Within the framework of the applicable statutory provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification, blocking or erasure of this data. For this purpose, and for any further questions on personal data, you can contact us at any time at the address given in the legal notice.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. For this purpose, you can contact us at any time at the address given in the legal notice. The right to restriction of processing exists in the following cases:
- If you contest the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
- If we no longer need your personal data, but you need it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
- If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
3. Data collection on our website
Hosting and server log files
Our website is operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. When the website is accessed, the server automatically records information transmitted by your browser: browser type and version, operating system, referrer URL, IP address and the date and time of the request. This data is not merged with other data sources, serves exclusively the secure and error-free operation of the website and is deleted after a short time. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website. A data processing agreement is in place with the hosting provider.
Cookies
We use only technically necessary cookies – no cookies for analytics or advertising purposes. A cookie is only set when you open a password-protected sponsored child page (it remembers the password entered in encrypted form for ten days and, in addition, for one minute whether the entry has just been made) or log in to your sponsor area (for the duration of the session). In addition, the cookie “pll_language” remembers for one year whether you read the website in German or English; it contains no personal data. The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. You can delete or block cookies in your browser at any time; password-protected pages can then, however, not be opened.
Enquiries by email, telephone or fax
If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), will be stored and processed by us for the purpose of dealing with your request. We do not pass on this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on your consent (Art. 6(1)(a) GDPR) and/or on our legitimate interests (Art. 6(1)(f) GDPR), as we have a legitimate interest in the effective handling of the enquiries addressed to us.
The data you send us via contact enquiries remains with us until you request us to erase it, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.
Sponsorship application
If you apply for a sponsorship via our website, we collect the details from the application form: name, address, email address, optionally telephone number, the sponsorships chosen with the desired start date and, where applicable, monthly amount, your wishes regarding the sponsored child and your message, as well as your bank details (account holder, IBAN, BIC where applicable) and your SEPA direct debit mandate. As proof of the application, we also store the date and time and a truncated IP address.
We process this data in order to carry out your sponsorship: to review your application, to match you with a sponsored child, to collect the contributions by SEPA direct debit, to issue donation receipts and to communicate with you about your sponsorship. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures); for the retention of documents relevant to payments and tax, Art. 6(1)(c) GDPR.
To the email address you provide, we send the confirmation of receipt, the access details for your sponsor area and all notices concerning your sponsorship – for example changes, the advance notice (pre-notification) of the direct debit and your donation receipt. These notices are necessary for carrying out the sponsorship and are therefore sent without separate consent.
We store the data for the duration of the sponsorship. After it ends, we erase the data unless statutory retention obligations apply; we retain documents relating to payments and donation receipts for up to ten years in accordance with the provisions of commercial and tax law.
Membership administration with netXP-Verein (data processing on our behalf)
Once your application has been reviewed and approved, we transfer your details to netXP-Verein, our association and membership administration system. The provider is Netxp GmbH, Öttinger Straße 11, 84307 Eggenfelden. There we manage sponsorships, contributions, direct debit collections and donation receipts. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR; it processes your data exclusively in accordance with our instructions. The legal basis is Art. 6(1)(b) GDPR.
Sponsor area (user account)
After approval, we set up a personal, password-protected area on our website for each sponsor. There we show you pictures, letters and news of your sponsored child as well as the data we hold about you, for which you can propose changes there. We review changes and then transfer them to netXP-Verein. For this purpose we store your name, your email address, an encrypted password and the link to your sponsorship. The legal basis is Art. 6(1)(b) GDPR. The account is deleted when the sponsorship ends.
Newsletter
If you subscribe to our newsletter – via the tick box in the sponsorship application or via our newsletter page – we use your email address and, if provided, your first name to send you news about our work in Uganda. The legal basis is your consent (Art. 6(1)(a) GDPR).
We use the so-called double opt-in procedure: after signing up, you receive an email with a confirmation link. Only when you click on this link do we add you to the mailing list. As proof of your consent, we store the time of sign-up and of confirmation as well as a truncated IP address. We delete unconfirmed sign-ups after 30 days.
To send the newsletter we use Brevo, a service of Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin. After your confirmation, we transfer your email address and, if provided, your first name to Brevo. Brevo processes the data on our behalf on servers in the EU; a data processing agreement is in place with Brevo. Brevo can record whether a newsletter has been opened and which links in it have been clicked; we use this evaluation only in aggregated form to improve our newsletter. More on this in Brevo’s privacy policy: brevo.com/de/legal/privacypolicy.
You can unsubscribe from the newsletter at any time – via the unsubscribe link in every issue or by email to info@pmco-uganda.org. We then delete your data from the mailing list; we retain the proof of your earlier consent and of its withdrawal for up to three years in order to be able to meet our accountability obligation (Art. 6(1)(c) in conjunction with Art. 5(2) GDPR).
Sending of emails
We send emails via the services of Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). A data processing agreement is in place with Microsoft; the transfer of data to the USA is based on the adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework).
Protection against spam
To ensure that no automated spam submissions reach us, our forms check on submission how long the form was open and whether a field invisible to humans has been filled in. No cookie is set and no third-party provider is integrated for this purpose.
4. Social media
Links to Facebook and Instagram
On our website we link to our pages on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). These are simple links, not embedded plugins: no data is transferred to Meta when you visit our website. Only when you click on a link does the respective platform open, and Meta’s privacy policy applies.
5. Plugins and tools
YouTube videos
In some posts we show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The videos are not loaded automatically: at first you only see a placeholder from our own server. Only when you click on the video is it loaded via youtube-nocookie.com. In the process, your IP address and technical data are transmitted to Google; Google may also use cookies or similar technologies and also transfer data to the USA. The transfer to the USA is based on the adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework).
The legal basis is your consent given by clicking on the video (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: policies.google.com/privacy.
Donations via PayPal
On some pages you can donate via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). Only when you click on the donate button are you redirected to PayPal; no data is transferred to PayPal before that. PayPal’s privacy policy applies to the processing of your donation: paypal.com/de/legalhub/privacy-full.
Source: e-recht24.de (adapted)
Last updated: October 2026