Privacy Policy

As of: July 2026

We take the protection of your personal data very seriously. Your data is processed exclusively on the basis of the legal provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications and Telemedia Data Protection Act (TDDDG).

This Privacy Policy informs you about what personal data we collect, how we use it, and what rights you have.

1. Data Controller

Thoma Stiftung
c/o Mr Ralf Thoma
Münchner Str. 38, 83607 Holzkirchen, Germany
Email: info@thoma-stiftung.de

No data protection officer has been appointed, as there is no statutory obligation to do so.

2. Data Collection On Our Website

When you open the website, technical data is processed so the page can be delivered and kept secure. This can include your IP address, date and time of access, requested URL, referrer, browser, operating system, response status, and transferred data volume.

Purpose
Delivering the website, maintaining stability and security, debugging, and preventing abuse.

Legal basis
Art. 6(1)(f) GDPR: legitimate interest in operating a secure and reliable website.

Processor
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, provides hosting and content delivery for this website.

Transfer safeguards
Cloudflare, Inc. participates in the EU-U.S. Data Privacy Framework and also relies on standard contractual clauses where required for transfers to the United States.

Retention
Insofar as Cloudflare processes security and log data, the retention period is governed by the respective Cloudflare settings and processing terms. We do not keep our own server log files beyond this, unless expressly stated otherwise.

If you contact Thoma Stiftung by email or telephone, the information you provide is processed to respond to your enquiry and, where relevant, to prepare or perform a contract. Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries; otherwise Art. 6(1)(f) GDPR.

3. Cookies And Consent Management

The cookie banner and cookie settings modal store your choice in your browser so the site can remember whether analytics may load. The value is stored only after you click "Accept", "Decline", or "Save Choices". You can change your choice at any time: Cookie Settings.

The legal basis for storing the consent choice and display preferences is Art. 6(1)(f) GDPR: legitimate interest in respecting your selected settings. Analytics cookies are set only with your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Cookie Overview

4. Third-Party Services And Tools

If you accept analytics cookies, this site loads Google Analytics 4. Google Analytics helps understand which pages are visited and how the site is used. Analytics is optional and is not loaded before consent.

Provider
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA may also process data.

Data
Pseudonymous analytics identifiers, device and browser data, referrer, pages viewed, events, and approximate location data. According to Google, the IP addresses of EU users are not logged or stored but are used only briefly to derive approximate location.

Legal basis
Art. 6(1)(a) GDPR: consent. Device storage/access also requires consent under ePrivacy rules, including Section 25(1) TDDDG in Germany.

Transfer safeguards
Google states that Google LLC participates in the EU-U.S. Data Privacy Framework. Google may also use standard contractual clauses where required.

You can withdraw consent at any time through Cookie Settings, browser controls, or Google's Analytics opt-out add-on. Google's privacy information: policies.google.com/privacy.

5. Newsletter

You can subscribe to our newsletter on our website. We use the double opt-in procedure: after you sign up, you receive an email with a confirmation link. Your subscription only becomes active once you click this link. This ensures that the subscription was actually made by you.

Data
Your email address is mandatory. You may optionally provide a salutation, title, and your first and last name so we can address you personally. To document your consent, we also store the time of sign-up and confirmation and your IP address.

Purpose
Sending our newsletter with information about our projects, activities, and news.

Legal basis
Art. 6(1)(a) GDPR: your consent.

Processor
We use Brevo to send the newsletter, a service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your data on our behalf under a data processing agreement.

Retention and withdrawal
We store your data for as long as you are subscribed. You can unsubscribe at any time and withdraw your consent with future effect — via the unsubscribe link in every newsletter email or by contacting us. After you unsubscribe, your data is removed from the distribution list; records of consent may be retained for legal defence.

6. Contact And Sponsorship Form (Lions Club)

On the "Sponsorships" page we provide a form you can use to contact us and express your interest in a sponsorship (Patenschaft). The sponsorships are carried out in cooperation with the Lions Club Am Tegernsee.

Data
Through the form we collect your first and last name, your email address, the subject, and your message. This information is required to identify and respond to your enquiry.

Purpose
Processing your enquiry, contacting you, and initiating and organising a sponsorship.

Legal basis
Art. 6(1)(b) GDPR insofar as it concerns initiating or performing a sponsorship; otherwise Art. 6(1)(a) and (f) GDPR (handling your enquiry).

Recipients / transfer
To carry out the sponsorship, we forward the necessary information to the cooperating Lions Club Am Tegernsee. The Lions Club Am Tegernsee processes the transmitted data as its own controller insofar as it organises or manages the sponsorship independently. No further disclosure to third parties takes place without your consent.

Retention
We store your information for as long as necessary to process your enquiry or carry out the sponsorship, and beyond that within the scope of statutory retention obligations.

7. Donations And Donation Receipts

On our website we ask for donations and provide our bank details for this purpose. You make the payment itself through your bank; the website does not collect any payment data in the process. When you donate, however, we receive the data transmitted by you or your bank with the incoming payment.

Data
The account holder's name, IBAN/BIC, amount, and date that we receive with the incoming payment. So that we can allocate your donation, thank you, and — on request — issue a donation receipt, we ask you to enter your address in the payment reference (Verwendungszweck). Beyond that, please do not include any special categories of personal data or other sensitive information in the payment reference — the text you enter is stored together with the transaction.

Purpose
Allocating and recording your donation, meeting tax obligations, and — on request — issuing a donation receipt (Zuwendungsbestätigung).

Legal basis
Art. 6(1)(b) GDPR (performing the donation relationship), Art. 6(1)(c) GDPR in conjunction with tax and commercial-law obligations (e.g. § 147 AO, § 50 EStDV), and Art. 6(1)(f) GDPR (proper administration of donations).

Retention
We retain donation and accounting data within the statutory retention periods, which under tax and commercial law are generally up to ten years.

8. Your Rights

Where the GDPR applies, you may have the right to request access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw that consent at any time without affecting processing that happened before withdrawal.

You can contact Thoma Stiftung at info@thoma-stiftung.de. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority of your habitual residence, place of work, or the place of the alleged infringement. For non-public bodies established in Bavaria, the competent authority is generally the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach (email: poststelle@lda.bayern.de, website: www.lda.bayern.de).

9. Provision Of Your Data And Automated Decision-Making

Providing personal data is not legally or contractually required for merely visiting the website. Certain details are required to use specific functions, such as newsletter sign-up, the contact form, a sponsorship enquiry, or issuing a donation receipt. Without these details, we cannot provide the respective function or service.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

10. Security

We use appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The website is delivered over HTTPS, and access to data is restricted to authorised purposes. Security measures are reviewed and updated in line with technological developments.

11. Changes To This Privacy Policy

We reserve the right to amend this Privacy Policy to reflect legal requirements or changes to our services. The current version is always available on our website.