Data protection

1. Introduction

Protecting your personal data is important to us. This privacy policy informs you about the nature, scope and purpose of the processing of personal data on this website. Personal data is always processed in accordance with the General Data Protection Regulation (GDPR) and the applicable data protection provisions.

2. Controller

Volt group on Münster City Council
Chair: Maren Berkenheide
Managing director: Constanze Neugebauer
Berliner Platz 35–37
48143 Münster

Email (general): fraktion@volt-muenster.de
Email (data protection): datenschutz@volt-muenster.de

3. Collection and processing of personal data

3.1 Automatically collected data (server logs)

When you visit this website, the following information is collected automatically: the IP address of the accessing computer, the date and time of access, the name and address of the file accessed, the website from which access is made (referrer), and the browser and operating system used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stable, secure and trouble-free operation of the website). Storage period: server logs are automatically deleted after 30 days at the latest; they are only stored for longer if this is necessary to investigate a specific security incident.

3.2 Contacting the group and the contact form

If you write to the group by email, by post or using the contact form, it processes your details in order to deal with your concern. Your data remains with the group and is not passed on to political parties.

In the contact form, the group processes your name, your email address, the subject (if provided), your message and the address of the page from which you sent the form – solely in order to deal with your concern and reply to you. The legal basis is Art. 6(1)(e) GDPR in conjunction with § 56(1) GO NRW (the group's participation in the work of the council, which includes receiving concerns raised by residents). If your message does not relate to the group's work, the legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form and which you can withdraw at any time with effect for the future.

The website does not store your message; when you submit it, it is transmitted directly as an email to the group's mailbox. There it is read by the group office staff and, where necessary for the reply, by the councillors responsible. The hosting provider and the operator of the email server are involved on a technical level as processors. The group deletes your message and the reply as soon as your concern has been dealt with, unless retention obligations require otherwise. There is no automatic email confirmation of receipt.

To protect against misuse, your browser solves a small computational task (ALTCHA) from the group's own server – without cookies and without third parties. The website also limits the number of messages per internet connection and, for this purpose, stores a non-reversible check value (hash) of your IP address for no more than one hour. When you submit the form, the website sets the technically necessary cookie “csrftoken” to protect against forged requests (§ 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act, TDDDG).

3.3 Job applications

If you apply for a vacancy with the group, the group processes your data in order to decide whether to establish an employment relationship.

Legal bases: Art. 6(1)(b) GDPR (initiation of an employment relationship, pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interests, e.g. legal defence) and, where applicable, Art. 6(1)(a) GDPR (consent). The processing is not based on § 26 of the Federal Data Protection Act (BDSG); according to the judgment of the Court of Justice of the European Union of 30 March 2023 (Case C-34/21), this general clause of German employee data protection law is contrary to EU law and therefore inapplicable.

Data categories: name, contact details, application documents (cover letter, CV, certificates and references) and any information provided voluntarily. Documents you upload via the form are stored without a public address; only the people in the group who are involved in the selection process have access to them. Data is only passed on to third parties where there is a legal basis for doing so or with your consent.

Storage period: applications are deleted 180 days after the procedure has been completed, and unprocessed applications no later than 365 days after receipt. If you are hired, the necessary documents are transferred to your personnel file.

3.4 Event registrations

For group events that require registration, the group processes your name, the number of people and your email address in order to organise the event. The legal basis is Art. 6(1)(b) GDPR.

Your registration only becomes valid once you confirm it via a link in an email (double opt-in). Unconfirmed registrations are deleted after 48 hours, and all others 30 days after the event. The only recipients are the group's event organisers.

4. Purpose of data processing

Your personal data is processed for the following purposes:

• Providing and improving this website
• Answering your enquiries and contacting you
• Organising and holding events (see section 3.4)
• Conducting application procedures (see section 3.3)
• Complying with legal obligations

5. Legal bases for data processing

Depending on the purpose, your personal data is processed on the following legal bases:

• Art. 6(1)(a) GDPR: consent for specific processing purposes
• Art. 6(1)(b) GDPR: performance of a contract, pre-contractual measures or application procedures
• Art. 6(1)(c) GDPR: compliance with legal obligations
• Art. 6(1)(f) GDPR: legitimate interests (e.g. security of the website)

6. Disclosure of data

Your personal data will only be disclosed to third parties if you have expressly consented, if the disclosure is necessary to comply with legal obligations or if it is necessary to enforce legitimate interests.

To operate this website, the group uses topixmedia (sole proprietorship, owner Sven Konopka, Robert-Koch-Straße 44, 48149 Münster) as a processor within the meaning of Art. 28 GDPR. The servers are located in data centres operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany. Both process data exclusively in accordance with the group's instructions and on the basis of a data processing agreement. No data is transferred to countries outside the EU in the course of operating this website.

7. Retention period

Personal data is only processed for as long as is necessary to fulfil the purpose or as required by statutory retention periods. The periods set out in section 3 apply to server logs, applications and registrations.

8. Your rights

You have the right to obtain information about the data stored about you, the right to rectification, erasure and restriction of processing, the right to data portability, the right to object to processing and the right to withdraw any consent you have given. To exercise these rights, please contact datenschutz@volt-muenster.de.

9. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority if you believe that your personal data is not being processed lawfully. The competent authority is, in particular, the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

10. Cookies and local storage

This website does not use tracking or marketing cookies and does not embed any third-party services: fonts, images and scripts are delivered by this website itself, and translations are produced without external services. Only technically necessary mechanisms are used; storing them on your device is permitted without consent under § 25(2) no. 2 TDDDG.

• CSRF protection cookie (csrftoken): security feature against forged form submissions, used only with forms
• Language cookie (django_language): stores the language of the page you last visited, for one year
• Session cookie (sessionid): only for logged-in editors
• Display settings (your browser's local storage): the font size, contrast and colour scheme you choose in the “Display” menu

You can delete or block cookies and local storage in your browser at any time. The website will still remain usable.

11. Social media profiles

For its public relations work, the group uses the public profiles @voltmuenster on Facebook and Instagram (provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). If you visit or interact with these profiles, for example by commenting, sending messages or following them, Meta processes your personal data, including in the USA. The group has no influence over the nature and extent of this processing. This website itself does not embed any content from Meta; the references to the profiles are simple links.

The operators of the profiles and Meta are jointly responsible for the statistics on the profiles (“Page Insights”) (Art. 26 GDPR; CJEU, judgment of 5 June 2018, C-210/16). The details are set out in Meta's Page Insights Controller Addendum; further information can be found in Meta's Privacy Policy. You can exercise your rights against both the group and Meta.

The legal basis for the group's own processing, such as replying to messages, is Art. 6(1)(f) GDPR (legitimate interest in public relations work). The group deletes this data as soon as it is no longer required for the purpose.

12. Changes to this privacy policy

The group reserves the right to adapt this privacy policy to changes in the legal situation or to changes to this website. The current version is always available on this page.

13. Contact

If you have any questions about the processing of your personal data, please contact the Volt group on Münster City Council: datenschutz@volt-muenster.de (data protection) or fraktion@volt-muenster.de (general enquiries).

14. The group's Wi-Fi hotspot

Visitors who use the group's open Wi-Fi hotspot are subject to separate terms of use with additional data protection information.