What are you looking for?

Privacy Policy

The wannseeFORUM Foundation processes your personal data in various situations.
The legal basis for this is derived in particular from the General Data Protection Regulation (GDPR), the Telecommunications and Digital Services Data Protection Act (TDDDG), and the Federal Data Protection Act (BDSG).

This privacy notice informs you, in accordance with Articles 12 to 14 of the GDPR, about how we process your personal data, insofar as we act as the controller pursuant to Article 4 No. 7 of the GDPR.
It explains in particular what data we collect, for what purposes we use it, and on what legal basis the processing takes place – especially for the following data processing activities:

  • Visit our website www.wannseeforum.de (see sections 2.1 and 2.2),
  • Contact via the website contact form (see section 2.3),
  • Sending newsletters (see section 2.4),
  • Appearances on social networks and integration of external content (e.g. Instagram, Vimeo, Flickr – see section 2.5),
  • Participation in our educational programs, use of the conference center, conclusion and execution of contracts and other business relationships (see section 2.6),
  • Use of other digital services and tools from third parties (see section 2.7).

Furthermore, this privacy notice contains information about the categories of recipients of personal data (see section 3), data transfers to third countries (see section 4), the duration of data processing (see section 5), your rights as a data subject (see sections 6 and 7), the obligation to provide personal data (see section 8) and about automated decision-making (see section 9).

1. Responsible:

Wannsee Forum Foundation,
Hohenzollernstraße 14, 14109 Berlin, Germany.
Telephone: +49 30 806 80 0.
Email: info@wannseeforum.de
. Website: www.wannseeforum.de

Should you have any questions about our privacy policy, you can contact our data protection officer :

Wannsee Forum Foundation
Data Protection Officer
Hohenzollernstraße 14, 14109 Berlin
Email: datenschutz@wannseeforum.de

2. Purposes and legal bases for data processing

2.1 Visiting our website

When you visit our website, various personal data are processed depending on the type and extent of your use. Personal data is information relating to an identified or identifiable natural person; a natural person is considered identifiable if they can be identified directly or indirectly (e.g., by reference to an online identifier).

For the purpose of technically providing the website, it is necessary for us to process certain information automatically transmitted by your browser so that our website can be displayed in your browser and you can use the website. This information (the "access data") is automatically collected each time you access our website and automatically stored in so-called server log files. Access data may include, among other things:

  • Browser type and browser version
  • Device identifier and operating system used
  • IP address of the requesting device
  • Website from which access is made (origin or referrer URL)
  • Date, time and duration of access

The processing of access data is technically necessary for providing a functional website and for system security. Beyond the purposes mentioned above, we use server log files solely for the needs-based design and optimization of our website, purely for statistical purposes and without drawing any conclusions about your identity. This data is not combined with other data sources, nor is it used for marketing purposes, unless you have given your explicit consent (see section 2.2).

Insofar as you visit our website to find out about our educational offerings, events or the conference center, or to use offers on a contractual basis, the basis for the temporary storage of access data is Art. 6 para. 1 lit. b) GDPR, which permits the processing of data for the performance of a contract or for the implementation of pre-contractual measures.

Furthermore, Article 6(1)(f) GDPR serves as the legal basis for the temporary processing of access data. Our legitimate interests here are to provide you with a technically functional and user-friendly website and to ensure the security of our systems. You have the right to object to this processing for the purposes of legitimate interests (see section 7).

The storage period and deletion of your access data are governed by section 5 of this privacy policy. Your IP address will be stored for a maximum of 7 days for IT security purposes.

2.2 Use of cookies and similar tracking technologies

We use cookies and similar tracking technologies, such as tracking pixels or fingerprinting technologies (collectively referred to as "tracking"), on some parts of our website. Depending on the purpose, tracking serves to make our services more user-friendly, effective, and secure, as well as to personalize content and advertising – where applicable. Tracking allows us to analyze how and, if applicable, which visitors use our website. This enables us to tailor website content to individual needs, for example, by measuring the effectiveness of specific content.

Cookies managed via a consent management tool (e.g., Borlabs Cookie).

a) Functional tracking

The legal basis for accessing your device, collecting information, and further processing any personal data in these cases is Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TDDG) and Article 6 Paragraph 1 Letter f) or b) of the GDPR. This essential tracking helps us to make the website technically usable and secure by enabling basic functions such as page navigation, login data, watchlists, and access to protected areas of the website. This also includes storing your preferences in the consent management system, in particular whether and to what extent you wish to allow consent-based tracking. Without this type of tracking, the website cannot function properly. It is therefore necessary to implement the functions you have selected or to protect our legitimate interests in the functionality, security, and efficiency of our website.

b) Tracking for marketing, personalization or analytics purposes

For all other purposes mentioned, your voluntary consent is required. The legal basis for this is Section 25 Paragraph 1 of the German Telemedia Act (TDDG) and Article 6 Paragraph 1 Letter a) of the GDPR. You can grant your consent for all purposes at once by selecting "Accept all". In the consent management section, you can also individually specify for which purposes tracking is permitted by selecting each category. You can consent to tracking, for example, to automatically apply your preferences on future visits (personalization) and/or to understand your user behavior in order to optimize our website (analytics).

Once you have given your consent, you can withdraw it at any time with effect for the future. To do so, click on the relevant cookie /privacy settings at the bottom of the website and select either "Reject all" or deactivate individual categories. You can also reject tracking from the outset using the same selection, so that only functional tracking takes place.

c) List of individual tracking technologies

Borlabs Cookie

  • Provider: Borlabs GmbH, Germany
  • Purpose: To store cookie consent and selected cookie settings
  • Storage period: 12 months

MailPoet (Newsletter)

  • Provider: MailPoet Inc., USA
  • Purpose: Sending newsletters, managing subscribers, and verifying consent (double opt-in)
  • Storage period: Until you unsubscribe from the newsletter or withdraw your consent.

WPForms

  • Provider: WPForms LLC, USA
  • Purpose: Processing of contact and inquiry forms
  • Storage period: Until the request is fully processed, then deleted.

Padlet (only when integrated)

  • Provider: Wallwisher, Inc., USA
  • Purpose: Displaying external interactive content
  • Storage period: As long as the Padlet exists or until it is deleted by the provider.

WordPress (user account) (only upon login)

  • Provider: Self-hosted WordPress
  • Purpose: User account management and authentication
  • Storage period: As long as the user account exists, then deleted.
  • WordPress does not process any personal data for visitors without a user account.

External media embedding (Vimeo, YouTube, Instagram, Flickr) requires two-factor consent.

  • Provider: Vimeo Inc.; Google Ireland Ltd.; Meta Platforms Ireland Ltd.; SmugMug, Inc.
  • Purpose: Integration of videos and images from external providers
  • Storage period: Data transfer only after two-factor authentication has been granted; storage period according to the provider.

Two-factor consent for external content :
External content from Vimeo, YouTube, Instagram, and Flickr not loaded on this website . A connection to the servers of the respective provider is only established after the user has actively consented via a two-factor authentication process (e.g., via the cookie banner and an additional confirmation when accessing the content). In this process, personal data (e.g., IP address) may be transmitted to the respective provider.

2.3 Contact via website contact form

Our website includes contact forms that we offer for easy and quick electronic communication with us. When you send us inquiries via a contact form, your inquiries, including the contact details you provide (e.g., name, email address, telephone number, message), will be stored and processed by us for the purpose of handling and responding to your inquiry and for any follow-up questions. This also applies to your IP address and the date and time you sent your message to us. We will not share this data with third parties unless this is necessary for processing and responding to your inquiry or you have given us your consent (Art. 6 para. 1 lit. a) GDPR).

If you contact us within the framework of an existing or pending contractual relationship (e.g. seminar registration, booking of our conference center, cooperation request), the data and information you provide will be processed for the purpose of processing and responding to your contact request on the basis of Art. 6 para. 1 lit. b) GDPR.

Otherwise, the processing is carried out by us to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR in providing a contact form and in properly answering inquiries.

You are under no obligation to contact us via the contact form or to provide personal data. If you do not provide your personal data, we may not be able to process your request. Otherwise, there will be no consequences for you.

The storage period and deletion of your corresponding data are governed by section 5 of this privacy policy.

2.4 Sending newsletters

a) Newsletter subscription

If you have given your consent, we will use your email address to send you our newsletter regularly. Providing an email address is the only requirement for receiving the newsletter; any further information is voluntary. We use the double opt-in procedure: After registering, you will receive an email asking you to confirm your newsletter subscription. Without this confirmation, your registration will not be completed, and your request will be automatically deleted. If you wish to receive our newsletter at a later date, you will need to register and confirm your subscription again. To verify your registration and to investigate potential cases of misuse, we store your IP address, the times of registration and confirmation, and the respective status. The legal basis for this is Article 6(1)(a) GDPR.

We use the newsletter service MailPoet , which processes the data on our behalf (see section 3).

b) Newsletter after participation in our offers

If you provide your email address in connection with our services (e.g., seminars, events, use of the conference center), we may use it – even without separate consent – ​​to send you our newsletter, unless you have objected to receiving it. This newsletter contains exclusively direct marketing and information for similar or related services offered by the wannseeFORUM Foundation. The legal basis for sending the newsletter in this case is Section 7 Paragraph 3 of the German Unfair Competition Act (UWG) in conjunction with Article 6 Paragraph 1 Letter f) of the GDPR. We have a legitimate interest in informing you about similar and comparable services as direct marketing, unless you have objected to receiving them.

c) Unsubscribing from the newsletter: Revocation of consent or objection

You can unsubscribe from the newsletter at any time – regardless of whether you received it based on consent or legitimate interests. To do so, use the unsubscribe link at the end of each newsletter or send us your unsubscribe request to the contact details listed in section 1. No costs other than the standard transmission costs charged by your communication provider will be incurred.

The storage period and deletion of your newsletter data are governed by section 5 of this privacy policy. After unsubscribing, the data stored for the newsletter will be deleted unless other legal grounds require further storage. Data stored by us for other purposes remains unaffected.

2.5 Social media presence and embedded content

We maintain a presence on various social media platforms (e.g., Instagram, and possibly others) and integrate content from external services such as YouTube, Vimeo, and Flickr into our website. We use these platforms to present our work, explain and promote events and educational programs, and enhance your user experience. Furthermore, you can contact us directly through the respective network and learn more about our offerings.

a) Purposes and legal basis of processing by us

We process data from the use of our social media presence and embedded content for the following purposes:

  • Communication: When you interact with us via a social network or embedded content (e.g., through comments, messages, "likes" or following our page), we process your personal data to respond to your requests and provide information.
  • Statistical evaluations: To the extent that the networks provide us with aggregated usage statistics, we use these to improve our content and to target our audiences more effectively.

Your personal data is processed on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR, namely to communicate with interested parties and participants, to analyze and optimize our online presence and our educational offerings, and in connection with inquiries about our offers pursuant to Art. 6 para. 1 lit. b) GDPR.

When loading embedded content (e.g., YouTube or Vimeo videos, Instagram feeds, Flickr images), the necessary data (in particular IP address, browser information, and possibly cookie information) is transmitted directly to the respective provider. This only occurs after you have given your consent via the cookie /consent banner (Art. 6 para. 1 lit. a GDPR); see the detailed information at www.wannseeforum.de/datenschutz.

For further information on data processing by the respective platforms, please refer to their privacy policies (e.g. Google/YouTube, Vimeo, Yahoo/Flickr, Meta/Instagram).

2.6 Participation in educational programs, use of the conference center and handling of business relationships

Within the scope of our existing or future business and sponsorship relationships, we process personal data that is either collected directly from you or transmitted to us by your employer or other organizations (e.g., schools, youth welfare agencies, cooperation partners). This applies in particular to:

  • Participants in our seminars, projects and events,
  • requesting organizations (e.g. for group bookings of the conference center),
  • Employees of business partners (e.g. suppliers, service providers, sponsors, cooperation partners) or other persons involved in the fulfillment of the contract.

The provision of certain personal data may be required by law or contract, or necessary for entering into a contract. If there is an obligation to provide such data, we will inform you separately. In this case, failure to provide the data may result in the requested service (e.g., seminar participation, room booking) not being able to be provided.

We primarily process personal data that you provide to us yourself within the context of our relationship or that we receive from business partners (e.g., from colleagues with whom we are already in contact, for example, in connection with an inquiry or order). In addition, we process information from publicly accessible sources (e.g., association registers, press, internet) or data transmitted to us by third parties (e.g., other project partners). The scope of the data processed depends on your role and the nature of the relationship.

As part of the processing, we process in particular the following personal data:

  • Name and, if applicable, function/organization
  • Address (e.g. billing address)
  • Contact details (phone numbers, email address)
  • Booking and contract details (e.g. seminar, period, room occupancy, catering requirements, participation fees)
  • Payment details (e.g. bank details or payment methods)

The processing of personal data serves the purpose of preparing, executing and processing contracts (e.g. participation and usage contracts, service and work contracts, funding agreements) as well as the general support of our participants, guests and business partners.

Your personal data is processed for the performance of a contract or for taking steps prior to entering into a contract, based on Article 6(1)(b) GDPR, and for the purposes of legitimate interests, based on Article 6(1)(f) GDPR. These legitimate interests include, in particular: processing inquiries, ensuring compliance with the law (e.g., asserting and defending against legal claims, internal and external compliance measures), ensuring the availability, operation and security of technical systems, and technical data management.

The storage period and deletion of your contract data are governed by section 5 of this privacy policy.

2.7 Use of other digital services and tools from third parties

Insofar as we use digital tools and services from third-party providers in the context of our educational work or for the organization of our offerings (e.g., online forms, translation services, spam protection services, newsletter software, translation plugins, video conferencing systems), this is done either:

  • as the independent responsible party of the respective provider (e.g., for embedded content or external platforms), or
  • within the framework of commissioned data processing, when the service provider processes data exclusively on our behalf.

Specific tools used on our website (e.g. WPForms, hCaptcha, Linguise, MailPoet) and any associated transfers to third countries are described in detail at www.wannseeforum.de/datenschutz in the section “WordPress Plugins and external services”.

If a third-party provider is independently responsible, its privacy policy also applies. In this case, we will inform you separately, if necessary.

2.8 Compliance with legal regulations

In connection with all the aforementioned processes, we also process your personal data to fulfill legal obligations that apply to us in connection with our activities as a foundation and educational institution. These include, in particular, information obligations and retention periods under commercial, non-profit, trade, or tax law.

We process your personal data in accordance with Art. 6 para. 1 lit. c) GDPR to fulfill a legal obligation to which we are subject.

2.9 Enforcement of rights

In connection with all the aforementioned processes, we also process your personal data to assert our rights and enforce our legal claims or defend against legal claims. Finally, we process your personal data to the extent necessary for the prevention or prosecution of criminal offenses.

We process your personal data in this context to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or we need to prevent or clarify the infringement of our property or similar legal positions.

3. Categories of recipients

3.1 General Categories

To provide our services and to make our business and educational processes efficient, we work with external service providers who may have varying degrees of access to personal data. These providers fall into two categories:

  • Data processors pursuant to Art. 28 GDPR, who act exclusively on our behalf and according to our instructions;
  • Companies or entities acting independently that decide on the processing and use of the data themselves.

3.2 Data processors

Some service providers are contractually bound to strictly adhere to our instructions and process personal data exclusively for the agreed purposes on our behalf. We have concluded a data processing agreement with these recipients (Art. 28 para. 3 GDPR). The following categories of recipients are included in particular:

  • Hosting and IT service providers (provision of the technical infrastructure and protection of the IT systems),
  • Service providers for sending emails and newsletters (e.g. MailPoet),
  • Service providers for form and spam protection functions (e.g. WPForms, hCaptcha),
  • Service providers for translation and speech output (e.g., Linguise).

3.3 Self-responsible recipients :

In certain cases, we collaborate with companies that decide independently on the processing of personal data. In some instances, the recipients act independently under their own data protection responsibility and are also obligated to comply with the requirements of the GDPR and other data protection regulations. The following categories of recipients are included in this category:

  • Providers of embedded media content and social networks (e.g. YouTube/Google, Vimeo, Flickr/Yahoo, Instagram/Meta),
  • Payment service providers and banks for processing payments,
  • Shipping and logistics service providers (e.g. for postal correspondence),
  • Authorities and public bodies, insofar as there is a legal obligation to transmit data or the transmission is necessary for the enforcement of rights.

3.4 Consultants

Finally, in individual cases we transmit personal data to our consultants in legal, tax or audit-related matters, whereby these recipients are generally already bound to special confidentiality and secrecy due to their professional position.

4. Data transfer to third countries

4.1 Where necessary for our purposes, we may also transfer your data to recipients outside the European Economic Area (“third countries”), for example when using certain services (e.g. hCaptcha, YouTube, Vimeo, Flickr, Instagram) with headquarters or server locations outside the EU/EEA.

4.2 We only transfer your data to recipients in third countries in accordance with the provisions in Chapter V of the GDPR, i.e., if it is ensured that the EU Commission has determined an adequate level of data protection within the meaning of Art. 45 para. 1 GDPR or appropriate safeguards within the meaning of Art. 46 para. 2 and para. 3 GDPR have been implemented or an exception under Art. 49 GDPR applies and there are no overriding legitimate interests against the transfer of the personal data.

4.3 To ensure an adequate level of protection at the recipient of the data, we primarily use the EU Commission's Standard Contractual Clauses for the transfer of personal data to third countries (SCCs) or rely on an adequacy decision. We will provide you with further information on this upon request.

5. Duration of data processing and deletion

5.1 We initially process your personal data for the duration that the respective processing purpose – see above – requires such processing.

5.2 Insofar as the processing is carried out for the performance of a contract, the processing period also includes the periods of initiating a contract (pre-contractual legal relationship) and the execution of a contract (including any subsequent claims).

5.3 Insofar as the processing is carried out to protect our legitimate interests, the processing period covers the period until the pursued processing purposes are achieved.

5.4 Insofar as the processing is based on your consent, it will take place for the period between the granting and the withdrawal of the consent or until the processing covered by the consent has been completed.

5.5 Even in the event of withdrawal of consent, further processing may be possible on the basis of other legal grounds (Art. 17 para. 1 lit. b) GDPR).

5.6 Even after the primary processing purposes have been achieved, your personal data may be processed further, in particular if this is necessary to comply with legal obligations and/or to protect our rights. This includes, in particular:

  • Compliance with statutory retention obligations, which arise, for example, from the German Commercial Code (Sections 238, 257 Paragraph 4 HGB) and the German Fiscal Code (Section 147 Paragraphs 3 and 4 AO). The retention and documentation periods stipulated therein are up to ten years.
  • Preservation of evidence in accordance with the statute of limitations. According to Sections 194 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the standard limitation period being three years.

6. Data subject rights

You can assert the following rights at any time using the contact details listed under point 1:

6.1 Right of access: You have the right to request confirmation from us as to whether personal data concerning you is being processed; if this is the case, you have the right to access this data and the information pursuant to Article 15(1)(a)–(h) GDPR. If personal data concerning you is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. Under the conditions set out in Article 15 GDPR, you also have the right to obtain a copy of the personal data concerning you.

6.2 Right to rectification: You have the right to request that we immediately rectify any inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3 Right to erasure: You have the right to request that we erase your personal data without undue delay if one of the conditions set out in Article 17 GDPR applies.

6.4 Right to restriction of processing: Under the conditions set out in Article 18 GDPR, you have the right to request that we restrict the processing of your personal data.

6.5 Right to data portability: Under the conditions set out in Article 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us on the basis of consent or for the performance of a contract, in a structured, commonly used and machine-readable format and to transmit this data to another controller. Where technically feasible, you have the right to have the data transmitted directly from us to another controller.

6.6 Right to withdraw consent: If data processing is based on consent pursuant to Art. 6 para. 1 lit. a), Art. 9 para. 2 lit. a) or Art. 49 para. 1 lit. a) GDPR, you may withdraw your consent at any time with effect for the future. The lawfulness of the processing up to the point of withdrawal remains unaffected.

6.7 Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (e.g. the Berlin Commissioner for Data Protection and Freedom of Information).

7. Right to object

7.1 Under the conditions set out in Article 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

7.2 If your personal data is processed for direct marketing purposes, you also have the right, pursuant to Article 21(2) GDPR, to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

8. Obligation to provide data

8.1 In principle, you are not obliged to provide us with your personal data. However, if you do not do so, we may not be able to provide you with full access to our website or process your inquiries and registrations (e.g., for seminars or bookings).

8.2 Personal data that we do not necessarily need for the processing purposes mentioned above are marked accordingly as voluntary information.

9. Automated decision-making

We do not use automated decision-making as defined in Article 22(1) and (4) of the GDPR.

10. Safety measures

We take appropriate technical and organizational measures to ensure a level of protection for personal data appropriate to the risk (e.g. encryption, access controls, data backup).

11. Changes and updates to this privacy policy

This privacy policy is dated December 18, 2025.

Due to the ongoing development of our website, offers and services, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. In this case, we will update this privacy policy accordingly on our website.