This privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as „data“) within our online offering and the associated websites, functions and content, as well as external online presences, such as our social media profiles. (hereinafter collectively referred to as „online offering“). With regard to the terms used, such as „personal data“ or its „processing“, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
As of: 7 October 2024
Angriff auf die Seele (Attack on the soul) – Association for psychosocial support for members of the German Armed Forces
Frank Eggen (Chairman)
c/o Psychological Trauma Centre of the German Armed Forces
13 Scharnhorst Street
10115 Berlin
No special categories of data are processed unless they are provided by users for processing, e.g. entered in online forms.
Hereinafter, we also refer to the persons concerned collectively as „users“.
In accordance with Art. 13 GDPR, we hereby inform you of the legal basis for our data processing. If the legal basis is not mentioned in the privacy policy, the following applies: The legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR, the legal basis for processing for the performance of our services and the implementation of contractual measures as well as responding to enquiries is Article 6(1)(b) GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6 para. 1 lit. c GDPR, and the legal basis for processing to safeguard our legitimate interests is Art. 6 para. 1 lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
We ask that you regularly review the content of our privacy policy. We will amend the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or other individual notification.
In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the implementation costs and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access, input, transfer, availability and separation. Furthermore, we have established procedures to ensure that data subjects' rights are exercised, data is deleted and responses are made to data breaches. Furthermore, we take the protection of personal data into account during the development and selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and data protection-friendly default settings (Art. 25 GDPR).
The security measures include, in particular, the encrypted transmission of data between your browser and our server.
If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them or otherwise grant them access to the data, this will only be done on the basis of a legal permission (e.g. if the transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract in accordance with Art. 6 para. 1 lit. b GDPR), you have given your consent, a legal obligation requires it, or it is based on our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties to process data on the basis of a so-called „contract processing agreement“, this is done on the basis of Art. 28 GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing or transferring data to third parties, this will only take place if it is necessary for the fulfilment of our (pre)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process or have the data processed in a third country if the special requirements of Art. 44 ff. GDPR are met. This means that processing is carried out, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection equivalent to that of the EU (e.g. for the USA through the „Privacy Shield“) or compliance with officially recognised special contractual obligations (so-called „standard contractual clauses“).
You have the right to request confirmation as to whether the data in question is being processed and to obtain information about this data, as well as further information and a copy of the data in accordance with Article 15 of the GDPR.
In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
In accordance with Article 17 of the GDPR, you have the right to request that the data in question be deleted immediately or, alternatively, in accordance with Article 18 of the GDPR, to request that the processing of the data be restricted.
You have the right to request that the data concerning you that you have provided to us be retained in accordance with Article 20 of the GDPR and to request that it be transferred to other controllers.
You also have the right to lodge a complaint with the competent supervisory authority in accordance with Article 77 of the GDPR.
You have the right to withdraw your consent in accordance with Art. 7(3) GDPR with effect for the future.
You may object to the future processing of data concerning you at any time in accordance with Article 21 of the GDPR. In particular, you may object to processing for direct marketing purposes.
We use temporary and permanent cookies, i.e. small files that are stored on users' devices (for an explanation of the term and function, see the last section of this privacy policy). Some of the cookies serve security purposes or are necessary for the operation of our online offering (e.g. for the display of the website) or to store the user's decision when confirming the cookie banner. In addition, we or our technology partners use cookies for reach measurement and marketing purposes, about which users are informed in the course of the privacy policy.
The data we process will be deleted or restricted in its processing in accordance with Articles 17 and 18 of the GDPR. Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no legal retention obligations that prevent its deletion. If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.
In accordance with legal requirements, records must be retained for six years in particular, pursuant to Section 257 (1) of the German Commercial Code (HGB) (trading books, inventories, opening balance sheets, annual financial statements, commercial correspondence, accounting documents, etc.) and for 10 years in accordance with Section 147 (1) of the German Fiscal Code (Bücher, Aufzeichnungen, Lageberichte, Buchungsbelege, Handels- und Geschäftsbriefe, für Besteuerung relevante Unterlagen, etc.).
We process inventory data (e.g., names and addresses as well as contact details of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services in accordance with Art. 6 para. 1 lit b. GDPR. The entries marked as mandatory in online forms are required for the conclusion of the contract.
During registration, users will be informed of the mandatory information that must be provided. User accounts are not public and cannot be indexed by search engines. When users cancel their user accounts, their data relating to the user account will be deleted, unless it must be retained for commercial or tax reasons in accordance with Art. 6(1)(c) GDPR. It is the responsibility of users to back up their data before the end of the contract upon termination. We are entitled to irretrievably delete all user data stored during the term of the contract.
When registering, logging in again or using our online services, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests, as well as those of users, in protection against misuse and other unauthorised use. This data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 (1) (c) GDPR.
We process usage data (e.g., the web pages visited on our online offering, interest in our products) and content data (e.g., entries in the contact form or user profile) for advertising purposes in a user profile in order to display product information to the user based on the services they have used to date.
Deletion takes place after the expiry of statutory warranty and comparable obligations; the necessity of storing the data is reviewed every three years; in the case of statutory archiving obligations, deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) retention obligations); Information in the customer account remains until it is deleted.
When contacting us (via contact form or email), the user's details will be processed for the purpose of handling the contact request and its processing in accordance with Art. 6 para. 1 lit. b) GDPR.
User information may be stored in our customer relationship management system (“CRM system”) or comparable enquiry organisation system.
We delete requests if they are no longer required. We review the necessity every two years; we store enquiries from customers who have a customer account permanently and refer to the customer account details for deletion. In the case of statutory archiving obligations, deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) retention obligations).
Based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR, we collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, the file, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum period of seven days and then deleted. Data that must be retained for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
Based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR, we maintain online presences within social networks and platforms in order to communicate with customers, interested parties and users who are active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.
Unless otherwise stated in our privacy policy, we process the data of users who communicate with us on social networks and platforms, e.g. by posting on our online presences or sending us messages.
Cookies are pieces of information that are transferred from our web server or third-party web servers to users' web browsers and stored there for later retrieval. Cookies can be small files or other types of information storage.
We use „session cookies“, which are only stored for the duration of your current visit to our website (e.g. to store your login status or shopping basket function and thus enable you to use our online services). A randomly generated unique identification number, known as a session ID, is stored in a session cookie. A cookie also contains information about its origin and storage period. These cookies cannot store any other data. Session cookies are deleted when you have finished using our online offering and, for example, log out or close your browser.
Users are informed about the use of cookies in the context of pseudonymous reach measurement in this privacy policy.
If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may lead to functional restrictions of this online offer.
As part of Umami's reach analysis, the following data is processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR): the browser type and browser version you use, the operating system you use, your country of origin, the date and time of the server request, the number of visits, your length of stay on the website and the external links you have clicked on. The IP address of users is anonymised before it is stored.
Umami does not use cookies.
Based on our legitimate interests (i.e. interest in the economic operation of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR), we participate in the Amazon EU Partner Programme, which was designed to provide a medium for websites through which advertising costs can be earned by placing advertisements and links to Amazon.co.uk. Amazon uses cookies to track the origin of orders. Among other things, Amazon can recognise that you have clicked on the affiliate link on this website.
Further information on data usage by Amazon can be found in the company's privacy policy: http://www.amazon.de/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=3312401.
c/o Psychological Trauma Centre of the German Armed Forces
13 Scharnhorst Street
10115 Berlin
Feel free to follow us: