Privacy policy

We would like to inform you about the processing of your personal data when you use our website. Any information that identifies you or can be used to identify you, such as your name, address, e-mail address, user behaviour or even your IP address counts as personal data according to the GDPR.

When delivering the content of this website or interacting with you, it is therefore unavoidable that we will be processing and sometimes storing some of your personal data. We might need to share it with third-party entities in order to provide the content of this website and to improve it, but we won’t ever sell it. We store as much of this data on EU servers as is currently feasible and aim to provide you with choices to protect your privacy, without overloading you with these options. We have put in place measures to limit our data collection and to keep your data safe, as described below.

In case of any concerns about the processing of your personal data, please don’t hesitate to contact us or our data protection officer using the contact details below.

Controller and data protection officer

Contact details of the controller

The controller pursuant to art. 4 (7) General Data Protection Regulation (GDPR) is the European Council on Foreign Relations (“ECFR”), an NGO whose main office is located in Berlin, Germany.

Our contact details are:

ECFR Deutschland GmbH
Unter den Linden 17
10117 Berlin

Phone: +49 (0)30 32505100

E-mail: [email protected]

Data Protection Officer

We have appointed a data protection officer (DPO). In case of any queries you may contact the DPO by using our above contact details and adding “attn of The DPO” or via e-mail: [email protected]

Your rights

Data subjects’ rights

You are entitled to the following rights towards us regarding your personal data:

  • Right to information,
  • Right to rectification or deletion,
  • Right to restriction of processing,
  • Right to object to the processing,
  • Right to data portability.

To exercise your rights, you can contact the controller or the Data Protection Officer, using the above contact details.

Right of appeal to a supervisory authority

You also have the right to complain to the data protection supervisory authorities about our    processing of your personal data.

Objection against the processing of your data

Where we base the processing of your personal data on the balancing of interests, you may object to such processing. This is the case if said processing is not required for fulfilling a contract to which you are a party, but for other purposes, details of which we will provide in the description of those processes below. When exercising such an objection, we ask you to specify the reasons arising from your personal situation as to why we should not process your personal data in the manner we intend. In the event of your justified objection, we will examine the situation and either cease to process your data, or adjust data processing, or point out to you our compelling legitimate grounds for continuing to process your data.

Withdrawal of consent

If you have consented to the processing of your data, you may withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Collection of personal data during your visit on our website

Data processed to display our website

We use external suppliers for secure and efficient hosting and delivery of the contents of our website. As a rule, the data is stored on servers within the European Union, our hosting provider, for example, stores all data on servers located in Germany. Where there is an exception to this rule, we will let you know in the respective section below.

When you visit our website for information purposes only, i.e. if you do not register or otherwise provide information to us, we only collect the personal data that your browser transmits to our server. When you visit our website we will collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (the legal basis being art. 6 (1) 1 lit. f GDPR):

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Website transmitting the request
  • Websites accessed by the user’s system via our website
  • Bytes downloaded
  • Browser
  • Operating system and interface
  • Language and version of the browser software.

The above data will be stored in a so-called log file for a duration of one week, after which it will be deleted. In case of any malevolent or criminal access, we reserve the right to store said data for further evaluation for a period of up to one month.

Cloudflare

We use the content delivery network of CloudFlare Inc, 101 Townsend St., San Francisco, CA 94107, US (hereinafter: Cloudflare) for the delivery of the contents on this website. CloudFlare allows us to provide efficient content delivery based on geographical location as well as enhanced cybersecurity, for example from denial-of-service attacks.

To this end, when you visit our website, personal data, such as your IP address or other information about your browser or system, is transmitted to the CloudFlare servers. These servers may be located outside the European Union, for instance in the United States or other countries for which there is no adequacy decision by the European Commission. To mitigate the risk of your personal data being transferred outside of the European Union, CloudFlare has signed so-called standard data protection clauses, which constitute an appropriate safeguard as detailed in art. 46 (2) lit. c GDPR.

The legal basis for the use of CloudFlare is art. 6 (1) 1 lit. f GDPR, our legitimate interest being to provide security for our website and efficient delivery of the contents.

Further information on data protection at CloudFlare can be found here.

Cookies

In addition to the aforementioned data, cookies are stored on your computer when you visit our website. Cookies are small text files that your browser stores on your hard drive which transmit certain information back to the party that has set the cookie (in this case, us). Cookies cannot run programs or transfer viruses to your computer. They are widely used in order to make websites function properly as well as to make them more user-friendly and effective.

This website uses the following types of cookies; the scope and functionality of which are explained below:

  • Transient cookies
  • Persistent cookies

Transient cookies are automatically deleted when you close your browser. They include, in particular, session cookies. They store a so-called session ID, which allows separate requests of your browser to be assigned to the same session. This will enable us to recognise your computer when you return to our website. Session cookies also include the cookies that we use to ensure the correct display of our website on the device used by you. Session cookies will be deleted when you log out or close the browser.

Persistent cookies will automatically be deleted after a specified period of time, which may vary depending on the cookie. You may delete cookies at any time in the security settings of your browser.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. However, if you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

More details on the processing of your personal data in connection with the services using the cookies and the legal basis can be found in the relevant sections below.

You can see a list of cookies which may be set during your visit on our website on our page on cookies.

Contacting us by e-mail

When you contact us by e-mail, we will store the data you provide (your e-mail address and – where applicable – your name, telephone number and your message) in order to answer your query.

We process this data to respond to your request or queries. Said processing takes place for the purposes of our legitimate interests (art. 6 (1) 1 lit. f GDPR), as it enables us to communicate with you in a satisfactory manner.

Newsletter

If you consent to receiving one of our newsletters, we will keep you posted about our activities, recent analysis and other content on our website.

The following newsletters are available:

  • Weekly general ECFR newsletter
  • National language newsletters from one of our offices in Berlin, London, Madrid, Paris, Rome, Sofia and Warsaw
  • Programme newsletters with specific content about one of our programmes

We use the so-called double opt-in procedure for our newsletter subscription. This means that we will send you a confirmation e-mail after receiving your registration. In this e-mail we will ask you to confirm that you do in fact want to receive our newsletter. If you do not confirm your subscription, your e-mail address will not be added to our list.

After receiving confirmation from you, we will store your e-mail address for the purpose of sending you the newsletter. The legal basis is art. 6 (1) 1 lit. a GDPR.

We might track your user behaviour in relation to our newsletter. This means that we can track whether you open the newsletter e-mails we send and how often and on which links you have clicked in the newsletter e-mails we send. We do this to optimize the content of the newsletter and to provide you with information which may be of interest to you. This is a legitimate interest, the legal basis is art. 6 (1) 1 lit. f GDPR.

You may withdraw your consent and cancel your subscription of our newsletter at any time. Simply click on the link provided in every newsletter e-mail, or write to us at [email protected].

We use a service provider based in the UK to administer and send our newsletter.

Analytics and optimization

Matomo

We have integrated Matomo on this website. Matomo is an open source software tool for web analysis and allows us to collect and evaluate data about the behaviour of visitors on our website.  Among other things, this may tell us about the website you came from (so-called referrer), which subpages of the website you accessed or how often and for how long you viewed a subpage, as well as data about your device, browser or the region you are visiting from. We use this data to optimise our website and the contents provided.

Matomo is operated exclusively on our servers in Germany, where all personal data collected by Matomo as part of the web analysis is stored. All data collected by Matomo is deleted after 14 months. None of this data is shared with third parties.

We use Matomo without cookies, unless you have consented to the use of Matomo cookies in the cookie settings, where you may also revoke your consent at any time. The use of Matomo with cookies enables us to collect more accurate data about visits on our website, for example enabling us to distinguish between new and recurring visitors on our website. You may also disable cookies in your browser, as described in the section on cookies above, however this may limit the functionality of our site.

You can opt-out unchecking this button:

You can also activate the “Do not track” setting in your browser to prevent the collection of data generated by Matomo relating to the use of this website altogether.

The legal basis for the use of Matomo is art. 6 (1) 1 lit. f  GDPR, our legitimate interest being the optimisation of the website and its contents. If you consent to the version or Matomo using cookies, the legal basis for the storage of those cookies on your device and the processing of your personal data as part of the analysis is art. 6 (1) 1 lit. a GDPR.

More information on Matomo and privacy for its users can be found here.

Google Analytics

We use Google Analytics to analyse and continually improve the use of our website. The resulting insights and statistics help us to provide you with better and more interesting content. Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

We have set Google Analytics so your IP is anonymised, no cookies are set and your data is not used for remarketing purposes, unless you consent accordingly to cookies and the processing of your personal data for analytics and marketing purposes in the cookie settings.

The information generated by the Google Analytics script about your use of this website is generally transferred to a Google server in the US and stored there. However, we have enabled IP anonymization on this website, which means your IP address will first be truncated by Google within European Union member states and other signatories to the Treaty on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the US and truncated there. Google will use this information on our behalf to evaluate your usage of our website, to compile reports on website activity and to provide us with other services relating to website and internet usage.

The IP address supplied by your browser within the scope of Google Analytics will not be combined with any other Google data.

When you consent to the usage of analytics or marketing cookies on the cookie settings, Google Analytics will set such cookies, i.e. text files that are stored on your computer, to help analyse how users use the website.

You can also prevent Google from collecting and processing data relating to your use of our website (including your IP address) by downloading and installing this browser plug-in.

The data collected by Google Analytics will be deleted after 14 months.

For those cases where personal data is transmitted to the US, Google has agreed so-called Standard Data Protection Clauses with us as part of the data processing agreement (DPA). Please note, though, that the US is regarded by the European Commission as an unsafe country, as it does not offer a standard of data protection that is equivalent to that in the European Union. The processing of your personal data by Google within the US may therefore imply risks to your personal rights and freedom.

Third party information: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

For more information about how Google may process your personal data, please refer to the following links.

Hotjar

Furthermore, we have integrated Hotjar, a tool for user-testing, on this website. Hotjar is a service provided by Hotjar Limited, Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta. We have signed a data processing agreement with Hotjar for the processing of your personal data, which takes place on servers based within the European Union.

Hotjar is disabled unless you consent to the usage of analytics cookies in the cookie settings. All data collected by Hotjar is deleted after 12 months. None of this data is shared with third parties.

Hotjar provides session recordings, heatmaps and surveys. We have enabled on-page suppression of numeric text and email addresses so they are never tracked. Recordings contain a “Hotjar user ID”, country, hardware info (device, OS, browser) and referral info. All surveys are anonymized.

Using Hotjar allows us to draw extensive conclusions about the way our website is being used as well as identifying problems people have with accessing the content of our website, both of which enable us to optimize our website for user interaction. It does not enable us to identify you as a visitor on our website, neither does Hotjar provide IP addresses.

The legal basis for the storage of cookies on your device and the processing of your personal data as part of the analysis by Hotjar is art. 6 (1) 1 lit. a GDPR.

External resources

Google Fonts

This website uses Google Fonts in order to integrate fonts. Google Fonts is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin D04 E5W5, Ireland. To display our site, Google servers are called up, namely fonts.googleapis.com and fonts.gstatic.com. In order to display those fonts on our site as quickly and efficiently as possible, such requests are stored by Google resulting in fonts and preferences being cached by your browser. The use of Google Web Fonts follows from our interest in a uniform and appealing online presentation of our services. This represents a legitimate interest within the scope of art.  6 (1) 1 lit. f GDPR. More information about Google Fonts and privacy

Adobe Typekit

This website uses Adobe Typekit web fonts. Typekit is a service provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, and provides fonts that are displayed in the user’s web browser after a server call from Adobe (in the USA). At least the IP address of the browser of the end device of the user of this website is stored by Adobe. Adobe Typekit Web Fonts are used in the interest of a uniform and attractive presentation of our online offers. This represents a legitimate interest within the meaning of art. 6 (1) 1 lit. f GDPR. Further information can be found in the Typekit data protection information.

Google Tag Manager

Our website uses the Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin D04 E5W5, Ireland. Google Tag Manager is a solution that allows marketers to manage website tags through a single interface. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect any personal information. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. Google does, however, receive your IP address, which is required to run the Google Tag Manager.

Cookiebot

To enable us to block scripts and cookies until you have consented to them, we use Cookiebot, an online consent management tool. Cookiebot is a cloud service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark.

Cookiebot remembers the user’s choice for 12 months after which the banner will automatically pop up to renew the user’s consent. All user consents are automatically logged in an anonymized form and using an encrypted key.

The legal basis for the integration of Cookiebot on our website is art. 6 (1) 1 lit. f GDPR, as it allows for our legitimate interest in obtaining your consent for the extended functionalities provided by this website.

Embedded third-party content

Some entries in our website might have video and audio players, among other kinds of content, embedded from third-party services and servers. We initially block most of this third-party content, and it will only be loaded when you choose to.

To enable you to conveniently navigate the website, your setting for that specific third-party service will be stored in a cookie. If you prefer to be asked every time, simply opt out of this by disabling the checkbox or delete the cookie in your browser. When you re-enter/reload the website, you will be asked again about integrating the third-party content.

YouTube videos

We have embedded YouTube videos within our website. YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are stored on https://www.youtube.com and can be viewed directly from our website. The videos have been embedded using the so-called extended date protection mode (no cookie mode). This means none of your user data will be transmitted unless you play these videos. Data specified under paragraph 2 will be transmitted only upon playback of one of these videos. We have no influence on the scope of data collected by YouTube in this manner.

Upon playback of these videos YouTube will receive information about your visit on the corresponding subpage of our website. Furthermore, the following data will be transferred

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Website transmitting the request
  • Websites accessed by the user’s system via our website
  • bytes downloaded
  • Browser
  • Operating system and interface
  • Language and version of the browser software.

This takes place regardless of whether YouTube provides a user account that you are logged in with or whether no such user account exists. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated with your profile on YouTube, you must log out before activating the function. YouTube will store your data within a usage profile and will use it for purposes of advertising, market research and/or demand-oriented design of its website. Your data will thus be evaluated (even that of users who are not logged in), notably to provide demand-oriented advertising and to inform other users of Google’s social network about your activities on our website. You have the right to object to the creation of such user profiles, however you must contact YouTube to exercise this right.

The integration of these videos allows us to provide these videos to you, whereby this provision is deemed to be in our legitimate interest. The legal basis for the provision of these videos is art. 6 (1) 1 lit. f GDPR.

Google may process your personal data on servers in the US. Please note that the US is regarded by the European Commission as an unsafe country, as it does not offer a standard of data protection that is equivalent to that in the European Union. The processing of your personal data by Google within the US may therefore imply risks to your personal rights and freedom.

Regarding the purpose and scope of said data collection and further processing and use of this data by YouTube, as well as your rights and optional settings with regard to the protection of your privacy, please consult the Google privacy policy.

Tableau

We use a software called Tableau to visualize certain contents and display the results as charts, diagrams or other visualized formats. Using Tableau’s embed functionality, we integrate these visualisations into our website.

As a result of this, your IP address and other technical device-related information such as screen resolution, browser and operating system used are transferred to Tableau’s servers. In principle, Tableau cannot draw any conclusions about your person from this data, but will know, for example, where you are (geographically).

It is a legitimate interest of ours to provide these visualisations to you. The legal basis for the provision of these visualisations is art. 6 (1) 1 lit. f GDPR.

Please refer to the privacy policy of Tableau for more information.

Twitter

We have embedded Twitter content (“tweets”) on our website, displaying content such as images, videos, text or buttons. Twitter is a social media network provided by the Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland.

If you decide to load this embedded content, your IP address and, potentially, other technical device-related information such as screen resolution, browser and operating system used are transferred to Twitter’s servers. If you are logged in to Twitter while displaying this content, Twitter may be able to associate this information with your account.

We have embedded tweets so that we may enable you to access and share the contents of those tweets, this is a legitimate interest, the legal basis therefore being art. 6 (1) 1 lit. f GDPR.

Twitter may process your personal data on servers in the US. Please note that the US is regarded by the European Commission as an unsafe country, as it does not offer a standard of data protection that is equivalent to that in the European Union. The processing of your personal data by Twitter within the US may therefore imply risks to your personal rights and freedom.

Please refer to the Twitter privacy policy for more information.

Facebook

We have embedded Facebook content on our website, displaying content such as images, videos, text or buttons. Facebook is a social media network provided by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you decide to load this embedded content, your IP address and, potentially, other technical device-related information such as screen resolution, browser and operating system used are transferred to Facebook servers. If you are logged in to Facebook while displaying this content, Facebook may be able to associate this information with your account.

We have embedded Facebook content so that we may enable you to access and share this content, this is a legitimate interest, the legal basis therefore being art. 6 (1) 1 lit. f GDPR.

Facebook may process your personal data on servers in the US. Please note that the US is regarded by the European Commission as an unsafe country, as it does not offer a standard of data protection that is equivalent to that in the European Union. The processing of your personal data by Facebook within the US may therefore imply risks to your personal rights and freedom.

Please refer to the Facebook privacy policy for more information.

Soundcloud

We use embedded content provided by Soundcloud to let you stream, download or share audio content (podcasts). Soundcloud is a service provided by SoundCloud Limited, Rheinsberger Str. 76/77, 10115 Berlin, Germany.

If you decide to load this embedded content, at least your IP address and, potentially, other technical device-related information will be transferred to Soundcloud servers. If you are logged in to Soundcloud while displaying this content, Soundcloud may be able to associate this information with your account.

We have embedded Soundcloud content so that we may enable you to access and share this content, this is a legitimate interest, the legal basis therefore being art. 6 (1) 1 lit. f GDPR.

Please refer to the Soundcloud privacy policy for more information.

Mixcloud

We use embedded content provided by Mixcloud to let you stream, download or share audio content (podcasts). Mixcloud is a service provided by Mixcloud Ltd., 447-453 Hackney Rd, London E2 9ED, United Kingdom.

If you decide to load this embedded content, at least your IP address and, potentially, other technical device-related information will be transferred to Mixcloud servers. If you are logged in to Mixcloud while displaying this content, Mixcloud may be able to associate this information with your account.

We have embedded Mixcloud content so that we may enable you to access and share this content, this is a legitimate interest, the legal basis therefore being art. 6 (1) 1 lit. f GDPR.

Please refer to the Mixcloud privacy policy for more information

Google Maps

Some pages of this website use Google Maps to depict interactive maps and generate directions.  This allows us to provide you with these maps directly on our website and with a convenient way to use the map function. Google Maps is a map service of Google Ireland Limited, Gordon House, Barrow Street, Dublin D04 E5W5, Ireland. The use of Google Maps follows from our interest in providing you with convenient usage of the map function and represents a legitimate interest within the scope of art. 6 (1) 1 lit. f GDPR.

If you decide to load this embedded content, your browser establishes a direct connection with Google’s servers. Google thus receives information about your visit of the corresponding subpage of our website. Additionally, the data mentioned above on Google Analytics will be transmitted. This takes place regardless of whether Google provides a user account that you are logged in with or whether no such user account exists. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated with your profile on Google, you must log out before activating the function. Google will store your data within a usage profile and use it for purposes of advertising, market research and/or demand-oriented design of its website. Your data will thus be evaluated (even that of users who are not logged in), notably to provide demand-oriented advertising and to inform other users of Google’s social network about your activities on our website. You have the right to object to the creation of such user profiles, however you must contact Google to exercise this right.

Regarding the purpose and scope of this data collection and the further processing and use of this data by Google as well as your rights in this regard and any option settings to protect your private sphere, please consult the Google privacy policy.  

Social media profiles

We maintain a company profile on some social networks as detailed below in order to facilitate communication with users and interested parties and to provide further information or content.

Please note that user personal data may be processed outside the European Union. This can result in risks for the users, for instance enforcing the users’ rights might be more difficult.

If you leave us messages or comment on these profiles, we process your personal data to communicate with you. This represents a legitimate interest; the legal basis is art. 6 (1) 1 lit f GDPR. No further storage of communication data takes place outside these networks on our part.

The terms and conditions of the operators of these platforms apply. Be aware that we cannot provide further information as to any personal data processed by these operators during your visit to the above networks. We kindly ask you to refer directly to the information provided by these platforms and have included links to privacy policies or other relevant information below.

Also, should you have any requests for information or would like to assert your data subject rights, we would like to point out that these can most effectively be asserted with the providers. Only they have access to their users’ data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, you may of course contact us.

Facebook page

Details of the provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

We are jointly responsible with Facebook for the collection of the personal data of visitors to our Facebook page – but not for any further processing by Facebook. We have concluded a joint control agreement with Facebook.

Facebook has agreed to take care of data subjects’ rights. Users may, for example, send information or deletion requests directly to Facebook. However, your rights as data subjects (especially to information, deletion, objection and complaints to the competent supervisory authority) are not restricted in any way by our agreements with Facebook.

See “Things you and others do and provide” in the Facebook Data Policy Statement to find out more about the personal data included, such as information about the types of content users view or interact with, or the actions they take.

As for information collected about user’s devices, see “Device Information” – this may include IP addresses, operating system, browser type, language settings or cookie information.

Facebook also collects and uses information to provide analytics services, called “page insights”, to page operators to help them understand how people interact with their pages and with content associated with them. Information by Facebook on the “Insights” pages.

Twitter

Details of the provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland.

Privacy policy

Soundcloud

Details of the provider: SoundCloud Limited, Rheinsberger Str. 76/77, 10115 Berlin, Germany.

Privacy policy

LinkedIn

Details of the provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Privacy policy

YouTube

Details of the provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Privacy policy