The German Chemical Society e.V. (GDCh) takes the protection of your personal data very seriously. This privacy policy informs you which data are collected when using our website, for what purpose and on what legal basis they are processed, and what rights you have.
The legal basis for this policy is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR).
Controller within the meaning of the GDPR:
German Chemical Society e.V. (GDCh)
Varrentrappstraße 40–42
60486 Frankfurt am Main
Executive Director: Dr. Tom Kinzel
Commercial Director: Dipl.-Ökonom Volker Kilz
Data Protection Officer:
Dipl.-Wirt.-Ing. (FH) Arnd Bohl
Email: datenschutz@gdch.de
You have the following rights vis-à-vis the GDCh with regard to your personal data:
To exercise your rights, please contact: datenschutz@gdch.de
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
https://datenschutz.hessen.de
Our content management system (Strapi) is operated on a dedicated server of Netcup GmbH, a German hosting provider with a data centre in Nuremberg, Germany. We have concluded a data processing agreement with Netcup in accordance with Art. 28 GDPR.
The CMS does not process traffic or access data such as those generated by a web analytics tool (see section 6). It manages regular personal data of our members collected as part of their GDCh membership, in particular:
These data may be compared or synchronised with the membership database (ZAM).
Purpose: Administration of membership matters and provision of member-related content and functions on the website.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract in the context of the membership relationship).
Access: These data may be accessed exclusively by employees of the GDCh Office who are involved in their administrative or substantive processing.
Storage period: The data are stored for the duration of the membership and deleted after its termination in accordance with statutory retention periods.
The Next.js front end of our website is provided by Vercel Inc. (340 Pine Street, Suite 701, San Francisco, CA 94104, USA). Vercel operates a global edge network; requests may therefore be processed via servers outside the EU.
When the website is accessed, Vercel processes access data (IP address, timestamp, HTTP requests). These data are used exclusively for the technical provision and security of the service.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
Transfer to third countries: Data processing by Vercel may involve the transfer of personal data to the USA. We have accepted Vercel's Data Processing Addendum (DPA), which contains the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR as an annex. No separate data processing agreement exists; processing is carried out exclusively on the basis of this DPA.
Our website does not use tracking or marketing cookies and does not display a cookie consent banner. Only technically necessary cookies are set, in particular:
This cookie is strictly necessary for providing the service and is set without separate consent on the basis of our legitimate interests (Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR for logged-in members).
For embedded third-party content (YouTube, map service), cookies are only set after active interaction — further details are provided in section 7.
We use the open-source web analytics software Matomo on our website, which is self-hosted on a dedicated server of Uberspace GmbH & Co. KG (Germany). Your data are processed exclusively on this server in Germany and are not transferred to third parties. We have concluded a data processing agreement with Uberspace in accordance with Art. 28 GDPR.
Matomo is configured so that:
In this way, only aggregated, non-personal usage statistics are generated (e.g. pages viewed, approximate region, browser/device used) in order to continuously improve our online offering.
Purpose: Analysis of user behaviour to optimise the online offering.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests). As no personal data are stored, consent is not required.
Storage period: Aggregated statistical data are stored for a maximum of 13 months.
Objection: You can object to statistical collection by activating the “Do Not Track” (DNT) function in your browser. Matomo respects this setting.
We use the open-source software LimeSurvey for surveys, available at https://umfrage.gdch.de/. It is self-hosted on a dedicated server of Uberspace GmbH & Co. KG (Germany). Your data are processed exclusively on this server in Germany and are not transferred to third parties. We have concluded a data processing agreement with Uberspace in accordance with Art. 28 GDPR.
As part of participation in a survey, your name and email address, and, where applicable, your IP address, are generally collected. The specific data collected depend on the respective survey.
Purpose: Conducting surveys (e.g. member or event surveys).
Legal basis: Art. 6(1)(a) GDPR (consent), as participation in a survey is voluntary.
Storage period: The data collected are deleted as soon as the purpose of the respective survey has been achieved, unless statutory retention obligations prevent this.
On individual pages of our website, we embed content from third parties (YouTube videos, map displays). To protect your privacy, this content is not loaded automatically when the page is accessed. Instead, a placeholder containing a notice about the respective provider is initially displayed.
The third-party content is loaded only when you actively consent by clicking the placeholder. By clicking, you give your consent (Art. 6(1)(a) GDPR) to the subsequent transfer of data to the respective provider.
Consequences of loading: The third-party provider receives, among other things, your IP address and information about your browser. If you are logged in to the relevant service, the provider may be able to associate your visit with your account. We have no influence over this processing.
Provider: YouTube, LLC (a service provided by Google); responsible within the European Economic Area: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
YouTube videos are loaded only after your active consent (click on the placeholder). Where technically feasible, we use the privacy-friendly embedding option via youtube-nocookie.com.
Legal basis after clicking: Art. 6(1)(a) GDPR (consent).
Google/YouTube privacy policy: https://policies.google.com/privacy?hl=de
Provider: OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The map is technically displayed using the open-source library Leaflet, which loads the map tiles from the servers of the OpenStreetMap Foundation. Leaflet itself is a client-side JavaScript library and does not transmit any additional data to third parties.
Maps are loaded only after your active consent (click on the placeholder). After clicking, your IP address and browser information are transmitted to the servers of the OpenStreetMap Foundation.
Legal basis after clicking: Art. 6(1)(a) GDPR (consent).
Transfer to third countries: The servers of the OpenStreetMap Foundation are located in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom pursuant to Art. 45 GDPR, so no additional safeguards (e.g. SCCs) are required.
Provider's privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy
When you subscribe to our newsletter, we collect the following data:
| Date | Required? | Purpose |
|---|---|---|
| Email address | Yes | Sending the newsletter |
| First name | Yes | Personalised address |
| Surname | Yes | Personalised address |
We use the so-called double opt-in procedure: after registering, you will receive a confirmation email. Your subscription is activated only when you click the confirmation link contained in it. The date and time of registration and confirmation are logged.
Purpose: Sending the GDCh newsletter (information about GDCh events, publications and offers).
Legal basis: Art. 6(1)(a) GDPR (consent).
Storage period: Your data are stored for as long as the subscription is active. After unsubscribing, the data required to demonstrate consent are retained for up to 3 years (Art. 6(1)(f) GDPR).
Withdrawal: You may withdraw your consent at any time by using the unsubscribe link at the end of each newsletter or by sending us an email to datenschutz@gdch.de.
We use the service Brevo (Brevo SA, 7 rue de Madrid, 75008 Paris, France) to send the newsletter. Your data are processed on Brevo's servers in the EU. We have concluded a data processing agreement with Brevo in accordance with Art. 28 GDPR.
Brevo's privacy policy: https://www.brevo.com/de/legal/privacypolicy/
We use the authentication service Auth0 (a product of Okta, Inc.) to log in to the members' area (MyGDCh). Our Auth0 tenant is hosted in the EU region, meaning that login and authentication data are processed within the European Union.
Transfer to third countries: If the operation of Auth0 (Okta, Inc., USA) involves the transfer of personal data to third countries, we have agreed Standard Contractual Clauses (SCCs) with Auth0/Okta in accordance with Art. 46(2)(c) GDPR.
The following personal data are processed during registration and login:
| Date | Purpose |
|---|---|
| Email address | Account identification, login |
| Password (stored in encrypted form) | Authentication |
| First name, surname | Personalisation of the members' area |
| GDCh membership number | Linking with the membership record |
| IP address, timestamp of logins/logouts | Security, detection of misuse |
Purpose: Provision of a secure, personalised members' area.
Legal basis:
Storage period: Login data are stored for as long as the membership account is active. After the membership ends, the data are deleted in accordance with statutory retention periods.
Okta/Auth0 privacy policy: https://www.okta.com/privacy-policy/
GDCh conferences and events can be booked via the booking platform https://veranstaltungen.gdch.de. It is operated using Ventari software provided by up2date solutions GmbH, Prinzregentenufer 3, 90489 Nuremberg. We have concluded a data processing agreement with up2date solutions in accordance with Art. 28 GDPR.
As part of the booking process, your registration and participant data (e.g. name, address, email address and, where applicable, billing data) are processed in order to receive and process your registration for the relevant event.
Purpose: Processing registrations for GDCh conferences and events, managing participant data and issuing invoices.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract in the context of participation in the event).
up2date solutions (Ventari) privacy policy: https://u2d.de/datenschutz/
Payment for booked conferences and events is made via the booking platform, either by PayPal or through Novalnet AG.
Novalnet AG, payment institution (ZAG), Gutenbergstraße 7, 85748 Garching bei München, is a regulated payment institution supervised by the Federal Financial Supervisory Authority (BaFin) and licensed under the German Payment Services Supervision Act (ZAG).
Purpose: Processing payment for the booked event.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract in the context of participation in the event).
PayPal privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Novalnet privacy policy: https://www.novalnet.de/datenschutz
We use the video conferencing service Zoom to conduct online lectures and webinars, provided by Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.
When you participate in an online lecture or webinar, your name, email address and IP address, among other data, are processed. If you activate your microphone or camera during the event or use the chat, the corresponding audio, video and text data are also processed.
Purpose: Conducting GDCh online lectures and webinars.
Legal basis: Art. 6(1)(a) GDPR (consent through participation) or Art. 6(1)(b) GDPR if participation takes place in the context of a contractual relationship.
Transfer to third countries: Processing by Zoom may involve the transfer of personal data to the USA. We have agreed Standard Contractual Clauses (SCCs) with Zoom in accordance with Art. 46(2)(c) GDPR.
Zoom privacy policy: https://explore.zoom.us/de/privacy/
We take technical and organisational measures to protect your data against unauthorised access, loss or misuse. Data transmission between your browser and our servers takes place exclusively via an encrypted HTTPS connection (TLS). All passwords are stored exclusively in hashed form.
Our website may contain links to external websites. This privacy policy applies exclusively to our website. The respective operators of the linked external pages are responsible for data processing on those pages.
We reserve the right to update this privacy policy where necessary in order to adapt it to changes in the law or changes to our services. The current version is always available on this page. Registered members will be informed separately of significant changes.
Last updated: 11 August 2026