Privacy Policy

1. Who is responsible for this website?

The controller responsible for processing personal data on this website within the meaning of Article 4(7) GDPR is:

Represented by its registered spokespersons:

• Sebastian Hahn
• David Guerra Salvador
• Keren Ann Ellie Pietzsch
• Friedrich Mecking

Contact address: Prof.-Dr.-Helmert-Str. 2–3, 14482 Potsdam, Germany

Email: ignite@uni-potsdam.de

Ignite is an officially registered student club (Hochschulklub) at the University of Potsdam. The club is independently responsible for the data processing described in this policy. Neither the University of Potsdam nor the Hasso Plattner Institute acts as the controller of this website.

For any questions about data protection or to exercise your rights, please contact us at the email address above.

2. General information about data processing

We process personal data only to the extent necessary to operate our website, provide information about our club, communicate with interested people, and maintain the security and functionality of our services.

Depending on how you use the website, this may include technical connection information, such as your IP address and browser details, as well as information you voluntarily provide through our contact form.

We do not sell personal data or use it for advertising, behavioral profiling, or automated decision-making.

We use external technical service providers for hosting, email delivery, and the embedded map. These are described below.

3. Website hosting and server logs (Vercel)

Our website is hosted by Vercel Inc., United States, using the free Hobby plan.

When you access our website, your browser connects to Vercel's infrastructure to retrieve and display the requested pages. During this process, Vercel may process technical information including:

• Your IP address
• Date and time of the request
• The requested page or resource
• Browser type, version, and operating system
• HTTP request information, including user-agent and referrer information where transmitted
• Technical request, response, and error information

This information is processed to deliver the website, maintain its availability and performance, diagnose technical problems, and protect against unauthorized access and abuse.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is operating a secure, reliable, and accessible website.

Retention: On Vercel's Hobby plan, standard function runtime logs are retained for approximately one hour. Other operational, security, and infrastructure data may be subject to different retention periods determined by Vercel according to the relevant processing purpose.

International data transfers: Vercel is a US-based provider and may process data in the United States and other countries. Vercel participates in the EU-US Data Privacy Framework and describes additional international transfer safeguards in its privacy notice. Transfers covered by a valid adequacy decision, including transfers to appropriately certified US organizations under the EU-US Data Privacy Framework, are permitted under Article 45 GDPR.

We do not use Vercel Web Analytics, Vercel Speed Insights, or other visitor analytics services on this website.

Further information: Vercel Privacy Notice.

4. Contact form and email communication

If you contact us through the website's contact form, we process the information you submit to receive, understand, and respond to your inquiry.

The contact form collects:

• Name (required)
• Email address (required)
• Area of interest (required)
• Message (required)
• Organization (optional)

The selected area of interest helps us understand the purpose of your inquiry. When the form is submitted, its contents are formatted into an email, including a subject line identifying the inquiry, and sent to our club mailbox at ignite@uni-potsdam.de.

The information is accessible to the club spokespersons and other authorized club members responsible for handling the inquiry.

We use the information exclusively to process your message, respond to you, and conduct any related correspondence. We do not use contact-form submissions for marketing newsletters or unrelated purposes.

Legal basis:

• Article 6(1)(b) GDPR, where processing is necessary to respond to a request concerning a potential contractual relationship or to perform an existing contract.
• Article 6(1)(f) GDPR for other inquiries. Our legitimate interest is communicating with people interested in the club, responding to questions, and organizing club-related activities.

Providing the information is voluntary. However, we require the mandatory fields to understand and respond to your inquiry. Without this information, we may be unable to process your request.

Storage and retention:

We do not maintain a separate database of contact-form submissions. Submitted information is delivered by email and retained in our club mailbox.

We keep correspondence for as long as necessary to process the inquiry and any related follow-up. Once it is no longer needed, we delete it in accordance with our retention practices, unless applicable legal obligations or the establishment, exercise, or defense of legal claims require longer retention.

Emails sent directly to our club address are handled for the same purposes and according to the same general retention principles. The technical provider operating the mailbox may also process associated email and connection data as necessary to provide the email service.

5. Email delivery through Resend

We use Resend, a service operated by Plus Five Five, Inc. in the United States, to deliver messages submitted through our contact form.

When you submit the form, our website's server-side functionality sends the resulting email through the Resend API.

For this purpose, Resend receives and processes the email's contents and delivery information, including:

• Your name and email address
• Your selected area of interest
• Your organization, if provided
• Your message
• The email subject line and recipient address
• Technical information required for email delivery

Resend processes this information to transmit the message to our club mailbox and to provide delivery, security, and operational functionality.

Legal basis: The legal basis is the same as for the corresponding contact-form inquiry under Article 6(1)(b) or Article 6(1)(f) GDPR. Resend is used as a technical service provider for delivering the email.

Retention: Resend retains email content and related delivery logs for 30 days on its standard Free, Pro, and Scale plans. This may include HTML and plain-text email bodies, recipients, subjects, and delivery metadata. Enterprise plans and exceptional retention circumstances may follow different rules.

After the standard retention period, these email and log records are deleted from Resend's active systems according to its retention policies. This does not delete the email delivered to our club mailbox, which is retained separately as described above.

International data transfers: Resend stores customer data, including email content and logs, in the United States. Resend provides a Data Processing Addendum under Article 28 GDPR, including EU Standard Contractual Clauses for international transfers. Resend also participates in the EU-US Data Privacy Framework.

Further information: Resend GDPR and Data Protection Information and Resend Privacy Policy.

6. Embedded map through Mapbox

The student section of our website contains an interactive map provided by Mapbox, Inc., United States.

We use this map to visualize places where Ignite members have traveled and activities associated with the club.

When the embedded map loads, your browser establishes connections to Mapbox servers to retrieve map tiles, styles, scripts, and related resources. Depending on when the map is initialized, this may occur automatically while visiting the page containing the map, without requiring you to interact with it.

During this process, Mapbox may receive and process technical information including:

• Your IP address
• Browser and device information
• Operating system and user-agent information
• Date and time of map-related requests
• Requested map resources and interaction or usage information
• Technical identifiers used for providing, securing, and accounting for its mapping service

We do not intentionally transmit your name, email address, or contact-form contents to Mapbox. We do not receive an individual visitor profile from Mapbox.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is presenting information about our club's activities and experiences through an interactive geographic visualization.

Retention: According to Mapbox's published privacy and security information, IP addresses in relevant service logs are generally retained for 30 days for operational, billing, and security purposes. Longer retention may apply where necessary for security, fraud prevention, or investigations. Other technical information may be subject to different retention periods.

International data transfers: Mapbox processes information in the United States and may use infrastructure in other countries. Mapbox participates in the EU-US Data Privacy Framework and provides additional contractual transfer safeguards, including Standard Contractual Clauses where applicable.

Mapbox's services may involve browser storage or similar technical mechanisms depending on the integration. The applicable rules for such access are governed by Section 25 of the German Telecommunications-Digital Services Data Protection Act (TDDDG).

The other pages of our website do not intentionally load the Mapbox integration.

Further information: Mapbox Privacy Information and Mapbox Data Processing Information.

7. Cookies, analytics, and locally hosted fonts

We do not use advertising cookies, marketing trackers, or visitor analytics tools.

In particular:

• We do not use Google Analytics or similar analytics platforms.
• We do not use Vercel Web Analytics or Speed Insights.
• Our contact form does not intentionally set tracking cookies.
• Fonts used by the website are hosted locally and are not retrieved from Google Fonts servers when you visit the website.

Ordinary technical functions of the browser and hosting infrastructure may involve caching or other technically necessary storage operations.

The embedded Mapbox integration may involve additional browser-side technologies, as described in the Mapbox section.

We do not use data obtained through these technologies to create advertising profiles of website visitors.

8. Links to external websites

Our website contains links to external services, including LinkedIn and websites operated by partner organizations.

These are ordinary external links. Merely displaying these links does not intentionally establish a connection between your browser and the destination website.

If you click an external link, you leave our website and the destination provider may process your personal data according to its own privacy policy and applicable legal obligations.

We are not responsible for the independent processing activities of external website operators.

9. Recipients and international data transfers

We limit access to personal data to people and service providers who need it for the purposes described in this policy.

Depending on how you use our website, recipients or categories of recipients may include:

• Authorized Ignite spokespersons and club members handling correspondence
• Vercel, for website hosting and technical processing
• Resend, for contact-form email delivery
• The technical provider of our club email mailbox, for email reception and storage
• Mapbox, when the embedded map loads
• Public authorities or other recipients where disclosure is required by applicable law

Some of these providers are based in the United States or use international infrastructure.

Where personal data is transferred outside the European Economic Area, applicable transfer mechanisms may include adequacy decisions under Article 45 GDPR, such as the EU-US Data Privacy Framework for certified recipients, and Standard Contractual Clauses under Article 46 GDPR where contractually applicable.

Specific information about the relevant providers and their published transfer safeguards is provided in the sections above.

10. Data retention

We store personal data only for as long as necessary for the respective processing purpose, subject to applicable legal retention duties.

The main retention principles are:

• Website access and technical data: Retained according to the hosting provider's applicable operational and security periods. Standard Vercel Hobby runtime logs are retained for approximately one hour.
• Contact-form submissions and email correspondence: Retained in the club mailbox while necessary to respond and manage related follow-up, and longer only where a lawful reason requires it.
• Resend email content and delivery logs: Generally retained for 30 days on standard plans.
• Mapbox technical data: Certain IP address logs are generally retained for 30 days, with possible exceptions or different periods for other data categories.

Where a precise retention period cannot be stated, the determining criteria are the continued necessity of the data for its original purpose, applicable legal obligations, and legitimate requirements relating to security or legal claims.

11. Your rights under the GDPR

Subject to the conditions laid down by applicable law, you have the following rights regarding your personal data:

• Right of access (Article 15 GDPR): You may request confirmation of whether we process personal data about you and receive access to that information.
• Right to rectification (Article 16 GDPR): You may request correction of inaccurate or completion of incomplete personal data.
• Right to erasure (Article 17 GDPR): You may request deletion of your personal data where the legal requirements are met.
• Right to restriction of processing (Article 18 GDPR): You may request that processing of your data be restricted in certain circumstances.
• Right to data portability (Article 20 GDPR): Where applicable, you may request to receive personal data you provided in a structured, commonly used, machine-readable format, or have it transferred to another controller where technically feasible.
• Right to object (Article 21 GDPR): Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless compelling legitimate grounds override your interests, rights and freedoms, or the processing is necessary for legal claims.
• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please contact ignite@uni-potsdam.de.

We will handle requests in accordance with the GDPR and may ask for information reasonably necessary to verify your identity before disclosing personal data.

12. Right to lodge a complaint

You have the right under Article 77 GDPR to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed unlawfully.

The supervisory authority responsible for data protection in Brandenburg is:

Website: www.lda.brandenburg.de

You may also lodge a complaint with another competent supervisory authority, including in the EU Member State of your habitual residence, place of work, or the place of an alleged infringement.

13. Automated decision-making and profiling

We do not use personal data collected through this website for automated decision-making within the meaning of Article 22 GDPR.

We do not carry out automated profiling of our website visitors or people contacting the club.

14. Changes to this privacy policy

We may update this privacy policy when our website, technical service providers, or applicable legal requirements change.

The latest version will be available on this website. The date at the beginning of the policy indicates when it was last updated.