Privacy Policy

Last updated: 24 September 2026

1. Controller

The controller responsible for data processing on this website is:
Youth of Golden Age e.V.
c/o Daya Henzler
Albert-Mays-Str. 2
69115 Heidelberg, Germany
Email: info@youthofgoldenage.de

The association is represented by its board (see Legal notice). If you have questions about data protection, please write to the email address above.

2. General information

We process personal data only where this is necessary to run this website, to communicate with you and to organise our events, or where you have given your consent.

Legal bases. We base our processing on the following provisions of the General Data Protection Regulation (GDPR): your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual steps, e.g. registering for a retreat (Art. 6(1)(b) GDPR), legal obligations, e.g. retention duties under tax law (Art. 6(1)(c) GDPR), and our legitimate interests (Art. 6(1)(f) GDPR). The sections below name the legal basis for each processing activity.

Storage period. We delete personal data as soon as the purpose of processing no longer applies, unless statutory retention periods require us to keep it. We usually keep payment records for six to ten years, as required by German tax law.

Transfers to third countries. Some of the services listed below also process data in the USA. If a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise it is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

3. Hosting and server log files

This website is hosted by One.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden (“one.com”). The servers are located in Denmark. one.com delivers images and other files through its own content delivery network (usercontent.one) so that pages load faster. one.com also keeps a cached copy of the pages.

Each time a page is requested, the server automatically stores information sent by your browser in server log files: IP address, date and time of access, the page requested, the previously visited page (referrer), browser type and version, and operating system. This data is technically required to deliver the website and helps keep it secure and stable. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

4. Encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

5. Security: Wordfence

To protect the website against attacks, we use the security plugin Wordfence by Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. The firewall checks incoming requests and processes in particular IP addresses, requested addresses and browser information in order to detect and block attacks. This data is stored on our server. Wordfence may exchange data such as IP addresses with Defiant’s servers, e.g. to compare them with known sources of attacks. When checking whether a password is known from a data breach, the password itself is not transmitted, only part of a hash value calculated from it. The legal basis is our legitimate interest in a secure website (Art. 6(1)(f) GDPR). Wordfence privacy policy: https://www.wordfence.com/privacy-policy/

6. Visitor statistics: Koko Analytics

For privacy-friendly visitor statistics we use the WordPress plugin Koko Analytics. It runs exclusively on our own server. No data is passed to third parties and no cookies are set. To recognise repeat page views by the same visitor, Koko Analytics creates a one-way hash from the IP address, the browser identifier and a secret value that changes daily. IP addresses are not stored. We evaluate the number of visitors and page views, the pages viewed and the referring websites. The legal basis is our legitimate interest in understanding and improving how our website is used (Art. 6(1)(f) GDPR).

7. Cookies

Cookies are small text files stored by your browser. This website sets only the following cookies:

Your choice in the consent banner: privacy_embeds. Stores whether you agreed or declined to load YouTube videos and Google Maps, so that we don’t ask you again on every visit. Storage period: 365 days.
Cart and order (WooCommerce): woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_… These cookies are only set when you add something to the cart. They store the contents of the cart for up to two days.
Login to the admin area (WordPress, Wordfence): only for logged-in editors of this website.

All of these cookies are strictly necessary for the functions you request (Section 25(2) No. 2 TDDDG; Art. 6(1)(b), (c) and (f) GDPR). We do not set cookies for advertising or analytics. You can delete or block cookies in your browser at any time. Without the necessary cookies, however, the cart will not work.

8. Newsletter (Mailchimp)

You can subscribe to our newsletter on the home page and the contact page. We send it using Mailchimp, a service of The Rocket Science Group LLC, 405 N Angier Ave. NE, Atlanta, GA 30308, USA, an Intuit Inc. company.

Data: Your email address is required. You may also give your first name, last name, city (country) and phone number. Mailchimp also stores the time and IP address of your sign-up and confirmation.

Double opt-in: After signing up, you receive an email with a confirmation link. You are only added to the mailing list after confirming. This ensures that nobody can sign up someone else’s email address. To protect against automated sign-ups, Mailchimp uses Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA uses browser and usage data to check whether a sign-up comes from a human.

Performance tracking: Our newsletters contain Mailchimp tracking technology. This shows us whether a newsletter was opened and which links were clicked. This analysis is part of your consent to the newsletter.

Sign-up form: The style and validation files of the form are stored on our own server. Opening a page with the form sends no data to Mailchimp. Your details go to Mailchimp only when you submit the form.

Legal basis and unsubscribing: The legal basis for the newsletter is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter or by email to us. After you unsubscribe, we remove your data from the mailing list. Your email address may remain on a suppression list so that you receive no further newsletters. Mailchimp privacy policy: https://mailchimp.com/legal/privacy/, Google privacy policy: https://policies.google.com/privacy

9. Payments and orders

You can pay retreat fees through our online shop (WooCommerce). We process the information from the order form (e.g. name, email address and billing address), the service ordered and the payment status. No customer account is created. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention duties (Art. 6(1)(c) GDPR).

PayPal: The “Payments” page contains a link to PayPal (paypal.me). If you use it, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, processes your data under its own responsibility. PayPal privacy policy: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

Bank transfer: If you pay by bank transfer, our bank passes on your name, your account details, the amount and the payment reference to us.

10. Event registration

For registrations for our retreats we use online forms from Tally, a service of Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium. The forms are linked from the event pages. We process the information you enter (e.g. name, contact details and details on accommodation, meals and travel) to organise the event. Tally stores the data on servers in the EU. The legal basis is Art. 6(1)(b) GDPR. Where you voluntarily provide information that reveals details about your health (e.g. allergies or intolerances), the legal basis is your explicit consent (Art. 9(2)(a) GDPR). We delete registration data once it is no longer needed after the event, unless retention duties apply. Tally privacy policy: https://tally.so/help/privacy-policy

For earlier events we used registration forms from Google Forms (Google Ireland Limited). The links are still shown on older event pages.

11. Contact by email and contact form

If you email us, e.g. at info@youthofgoldenage.de, new-years-retreat@youthofgoldenage.de or treasurer@youthofgoldenage.de, we process your information to answer your request. The same applies to messages sent through the contact form on the “Contact” page. The form sends your name, email address and message by email to info@youthofgoldenage.de. The website itself does not store these details. The legal basis is Art. 6(1)(b) GDPR if your request relates to an event or a membership, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR). We delete your message once it is no longer needed.

12. Embedded content (YouTube, Google Maps)

Some pages contain content from external providers: a map from Google Maps (membership page “Mitglied werden”) and a video from YouTube (post “Dokumentation über Mt. Washington”). The provider of both is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We only load this content after you agree: via “Accept all” in the banner at the bottom of the screen, or via the “Accept” button in the placeholder shown in place of the content. Before that, no data is transmitted to Google.

Once you agree, your browser loads the content from Google’s servers. In particular, your IP address and browser data are transmitted to Google, including to the USA. YouTube may set cookies and link the visit to your Google account if you are logged in. The legal basis is your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). You can withdraw it at any time with effect for the future, using the Cookie settings link at the bottom of every page. The choice will then appear again. Google privacy policy: https://policies.google.com/privacy

13. Fonts

The fonts used on this website are stored on our own server. No connection to Google or other font providers is made when pages load.

14. Links to other websites and social networks

Our pages contain links to other services, e.g. to our Facebook page, Google Maps, Google Docs and Google Sheets, SBB or SoundCloud. We do not embed social media plugins. Data is only transmitted to the respective provider when you click a link. That provider is responsible for the processing on its side.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To exercise these rights, write to info@youthofgoldenage.de.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

16. Changes

We update this privacy policy when our website or the legal situation changes. The version published here applies.