Youth of Peace e.V.Privacy Policy
Last updated: November 2026
This is a translation. The German version is legally binding; in case of any discrepancy, the German text prevails.
1. Controller
The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Youth of Peace e.V.
Georg-Krauß-Straße 8
91056 Erlangen
Germany
Represented by the board: Anwar Dehaq, Awad Alwan
E-mail: info@yop-ye.org
Phone: +49 171 2334967 · +49 163 1029001
Further details can be found in our legal notice.
2. Data protection contact
For questions about data protection and to exercise your rights, you can reach us at info@yop-ye.org or at the postal address given above.
We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR, § 38 BDSG) are not met.
3. General information
We process personal data only to the extent necessary to provide this website, to handle your enquiries and applications, and to fulfil the purposes set out in our statutes. We state the legal basis for each processing activity.
We do not sell personal data. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
You are not legally or contractually required to provide your data. However, without the information marked as required, we cannot process your enquiry or application.
4. Hosting
This website is hosted by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Azure). The server is located in a data centre in Germany (region "Germany West Central", Frankfurt am Main). The host processes the data generated when you visit the website (see section 5) and the website's content on our behalf. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and efficient provision of our website.
As the host belongs to a group headquartered in the USA, access to data from the USA cannot be completely ruled out. Any such transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which the parent company is certified, and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).
5. Server log files and visitor statistics
Each time this website is accessed, our web server logs the request. The following is stored:
- your IP address in shortened form: before storage, the last byte of IPv4 addresses and everything after the first 48 bits of IPv6 addresses is removed
- date and time of access
- the page or file requested, without any appended parameters
- the previously visited page (referrer URL)
- browser and operating system, as transmitted by your browser
- HTTP status code, amount of data transferred and response time
Full IP addresses, cookies and login data are not logged.
This data is processed to deliver the website, ensure its stability and security, defend against attacks and analyse errors. The legal basis is Art. 6(1)(f) GDPR.
The log files remain on our server and are automatically deleted after 7 days. Data whose further retention is necessary to investigate a specific security incident is deleted only once the investigation is complete.
Visitor statistics: From the log files, our server automatically counts how our website is used, for example page views and visits per hour, views per page and language version, error pages, and the domain of the referring website (without path). Only these totals are stored: no IP addresses, no browser details, no cookies and no profiles of individuals. We keep these totals for 13 months. We do not use any external analytics services. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving our website and in accounting for our work to members and funders.
6. Cookies and similar technologies
This website does not set any cookies for visitors. We do not use tracking or advertising technologies and do not embed content from external platforms.
Only people who sign in to the password-protected administration area (admin.yop-ye.org) receive two technically necessary cookies:
- a session cookie that keeps the sign-in active and expires after two hours of inactivity
- a device cookie with a lifetime of 400 days, which lets us recognise sign-ins from a new device and inform the person concerned
Both are permitted without consent, as they are strictly necessary to securely provide the service expressly requested by the signed-in person (§ 25(2) no. 2 TDDDG). The processing is based on Art. 6(1)(f) GDPR.
7. Fonts
The fonts used on this website are hosted locally on our server. No connection to third-party servers is established when you visit the website.
8. Contacting us
When you write to us using the contact form, we store your name, your e-mail address, the selected topic and your message in this website's database on our server (see section 4). Only the people in the association who handle enquiries have access. We are notified of new messages by an e-mail containing only a link; your details and your message are not included in it. We do not store your IP address or browser details with your message.
To prevent misuse, we limit how often the form can be submitted from the same address. For this purpose, a check value is derived from your IP address that cannot be traced back to the address, is kept only in memory and is deleted after one day at the latest.
If you contact us by e-mail or telephone, we process the data you provide in order to handle your enquiry.
The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns membership, participation or cooperation. In all other cases, the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being to respond to enquiries addressed to us.
Messages sent via the contact form are automatically deleted six months after they arrive. We delete enquiries received by e-mail once they have been fully dealt with, unless statutory retention obligations apply.
For e-mail communication we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR. The information in section 4 applies accordingly to any transfer to the USA.
Please do not send us particularly sensitive information via the contact form or by e-mail, such as information about health, religion or residence status.
9. Volunteering and events
If you would like to volunteer with us, please write to us using the contact form (topic "Volunteering") or by e-mail; section 8 applies. To organise your involvement, we process the necessary data on the basis of Art. 6(1)(b) GDPR.
An event page may contain a link to register with an external provider. Our website does not transmit any data to that provider; only when you follow the link does that provider's privacy policy apply. The calendar file (.ics) for an event is generated by our website itself, without contacting any calendar or map service.
Where funding bodies require proof of participation, we process the data needed for this on the basis of Art. 6(1)(c) or (f) GDPR. Our legitimate interest then lies in the proper accounting of funded projects. We delete the data once it is no longer needed for these purposes and no retention obligations apply.
10. Membership
When you apply for membership via our website, we process: first and last name, e-mail address, postal address, type of membership (ordinary or supporting), your information on age (at least 16, under 18) and your declarations regarding the statutes and membership fees. We do not ask for your date of birth, phone number, bank details, or information about your origin or religion.
For applicants under 18, we additionally process the name and e-mail address of a parent or guardian in order to obtain their consent; the date of consent is recorded. An application is not accepted without this consent.
Applications are stored in this website's database. Only the board and the people entrusted with membership administration have access. The purpose is to review the application and, after admission, to administer your membership in accordance with our statutes. The legal basis is Art. 6(1)(b) GDPR.
Rejected applications are automatically deleted six months after the decision. When your membership ends, we delete your data unless statutory retention obligations apply, in particular under § 147 of the German Fiscal Code (Abgabenordnung). In that case, processing is restricted until the retention period expires.
11. Photos on this website
On our project pages we publish photos of our association's work in which people may be recognisable. The legal basis is the consent of the people shown (Art. 6(1)(a) GDPR) or, where legally permitted, our legitimate interest in documenting our charitable work (Art. 6(1)(f) GDPR).
If you appear in a photo and would like it removed, please contact info@yop-ye.org. We will review your request promptly.
12. Recipients
Within our association, only the people who need your data to carry out the relevant task have access to it. The only external recipients are the processors named in sections 4 and 8. We pass data on to authorities only where we are legally obliged to do so.
13. Data security and backups
For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. Access to the administration area is protected by a two-factor sign-in.
To prevent data loss in the event of a technical failure, we create daily backup copies of the database and the uploaded images. They are encrypted before they leave our server and are stored in our host's storage service (section 4); only the association holds the key. Data that we delete on the website remains in these backups until the respective backup expires, at most about seven months, after which it is permanently deleted. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR.
14. Your rights
Subject to the legal requirements, you have the right to:
- access the data we hold about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.
Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, a message to info@yop-ye.org is sufficient.
15. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
16. Changes to this privacy policy
We update this privacy policy when our data processing or the legal situation changes. The version published on this website applies.