Privacy policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The privacy statement applies to all processing of personal data carried out by us, both as part of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

The terms used are not gender-specific.

Status: 30 April 2024

Table of contents

Responsible

Holi Moli GmbH
Eifflerstraße 43
22769 Hamburg, Germany

Person authorised to represent: Piet Mahler

Email address: support@holi.social

Imprint: https://holi.social/imprint

Contact information of the Data Protection Officer

ISiCO Datenschutz GmbH
Am Hamburger Bahnhof 4
10557 Berlin, Germany

Email address: holi.social@isico-datenschutz.de

For all questions on the subject of data protection in connection with our products/services or the use of our website, you can also contact our data protection officer at any time. This person can be contacted at the above postal address and at the email address given above (keyword: "Data Protection Officer"). We expressly point out that if you use this email address, the contents will not be exclusively noted by our data protection officer. If you wish to exchange confidential information, we therefore ask you to first contact us directly via this email address.

Overview of the processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

Categories of persons concerned

Purposes of the processing

Relevant legal bases

Relevant legal bases according to the GDPR: Below you will find an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. These include in particular the Federal Data Protection Act (BDSG). In particular, the BDSG contains special regulations on data processing for employment purposes (Section 26 BDSG), especially with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, entry into, disclosure of, assurance of availability of and segregation of the data. In addition, we have established procedures to ensure that data subjects' rights are respected, that data is erased, and that we are prepared to respond to data threats rapidly. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principle of data protection through technology design and through data protection-friendly default settings.

TLS encryption (https): In order to protect your data transmitted via our online offer, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements that serve to protect your data with the recipients of your data.

International data transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this only takes place in accordance with the legal requirements (see Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en ).

Subject to express consent or contractually or legally required transfer (see Art. 49 of the GDPR), we only process or allow the processing of data in third countries with a recognised level of data protection within the framework of an adequacy decision (Art. 45 GDPR), in the presence of and compliance with contractual obligations through so-called standard protection clauses of the EU Commission (Art. 46 para. 2 lit. b) GDPR), in the presence of certifications (Art. 46 para. 2 lit. f) GDPR) or binding internal data protection regulations (Art. 46 para. 2 lit. b) GDPR).

EU-U.S. Data Privacy Framework (DPF): Within the framework of the so-called "EU-U.S. Data Privacy Framework" (DPF), the EU Commission has also recognised the level of data protection for certified companies from the USA. The list of certified companies as well as further information on the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ . Information in German and other languages can be found on the website of the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en . We also inform you about the companies we use that are certified under the EU-U.S. Data Privacy Framework.

Data deletion

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not required for the purpose). If the data are not deleted because they are required for other and legally permissible purposes, their processing is limited to these purposes. I.e. the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Our privacy notices may also contain further information on the retention and deletion of data, which will take precedence for the respective processing operations.

Rights of the data subjects

Data subjects' rights under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

In order to exercise your rights as described here, you can contact us via the contact details mentioned above at any time. This also applies if you wish to receive copies of guarantees demonstrating an adequate level of data protection. Provided that the respective legal requirements are met, we will comply with your data protection request.

Reading out and storing information on your terminal device - Use of cookies and similar technologies

Technologies used

Tools used by us can use technologies to store information on your device or read information from your device. This serves, for example, to ensure the functionality, the implementation of registration and authentication, the security and convenience of our online offer or to analyse its use. The following technologies may be used, for example:

Most browsers are set by default to accept cookies, run scripts and display graphics. However, you can usually adjust your browser settings to reject all or certain cookies or to block scripts and graphics. If you block the storage of cookies, the display of graphics and the execution of scripts completely, our services are unlikely to function properly or at all.

Legal basis according to § 25 TTDSG

We use tools in accordance with the statutory provisions. Therefore, we obtain prior consent from users in accordance with Section 25 (1) TTDSG, unless this is not required by law in accordance with Section 25 (2) TTDSG. In particular, consent is not required if the storage and reading of the information is absolutely necessary in order to provide the users with a telemedia service (i.e. our online offer) that they have expressly requested. The strictly necessary tools usually include functions that serve the display and operability of the online offer, load balancing, security, the storage of the preferences and choices of the users or similar purposes related to the provision of the main functions of the online offer requested by the users. The revocable consent is clearly communicated to the users and contains the information on the respective tool use.

Necessary data processing

The following necessary information is currently stored on your device, which does not require consent:

Cookies

We only use cookies in the context of user logins and single sign-on for our self-hosted services (session cookies, Oauth cookies, CSRF cookies). CSRF = Cross-Site Request Forgery (a security mechanism used in the context of the login process). These include

Local Storage

The following entries are created in Local Storage:

Optional data processing

To personalise the offer and analyse platform performance, the following information is also stored on your device after you have given your consent. Further information on this can be found below.

Local Storage

Tracking of usage data

With your prior consent, we use various tracking information to record and analyse your usage. The purpose of this is to offer you a personally relevant user experience and to analyse and continuously improve the use of our platform. Below we explain in detail what data is collected and what it is used for.

Legal basis for data processing

The legal basis under data protection law on which we process the personal data of users with the help of tools depends on whether we ask users for consent. If users consent, the legal basis for processing their data is their declared consent (Art. 6 para. 1 sentence 1 lit. a) DSGVO). Otherwise, the data processed with the help of tools is processed on the basis of our legitimate interests (e.g. in the business management of our online offer and improvement of its usability) (Art. 6 para. 1 p. 1 lit. f) DSGVO) or, if this is done in the context of the fulfilment of our contractual obligations, if the use of tools is necessary to fulfil our contractual obligations (Art. 6 para. 1 p. 1 lit. b) DSGVO). We explain the purposes for which the tools process data in the course of this privacy policy or as part of our consent and processing procedures.

General information on revocation and objection (opt-out)

Users can revoke the consent they have given at any time for the future and also object to processing in accordance with the legal requirements in Art. 21 DSGVO. Users can also declare their objection via their browser settings, e.g. by deactivating the use of cookies, JavaScript or images (although this may also limit the functionality of our online services). An objection to the use of tools for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Provision of the online offer and web hosting

We process the users' data in order to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.

Further information on processing operations, procedures and services:

Collaboration and communication tools of our platform

One of the goals of our platform is to make it easier for groups and initiatives to jointly plan and organise projects within the framework of the social and ecological transformation. For this purpose, we provide digital collaboration spaces. Within these spaces, we offer the participants various collaboration and communication tools.

The aim of these offers is in particular to ensure and simplify work organisation measures for the collaborative work of users, groups of people, teams and initiatives as well as communication management.

Further information on processing operations, procedures and services:

Special notes on applications (apps)

We process the data of the users of our application insofar as this is necessary to provide the users with the application and its functionalities, to monitor its security and to develop it further. We may also contact users in compliance with the legal requirements if the communication is necessary for the purposes of administration or use of the application. In addition, we refer to the data protection information in this data protection declaration with regard to the processing of the users' data.

Legal basis: The processing of data required for the provision of the functionalities of the application serves the fulfilment of contractual obligations (Art. 6 para. 1 p. 1 lit. b) DSGVO). This also applies if the provision of the functions requires authorisation of the users (e.g. release of device functions). If the processing of data is not necessary for the provision of the functionalities of the application, but serves the security of the application or our business interests (e.g. collection of data for purposes of optimising the application or security purposes), it is carried out on the basis of our legitimate interests (Art. 6 para. 1 sentence 1 lit. f) DSGVO) or for the fulfilment of legal obligations (Art. 6 para. 1 sentence 1 lit. c) DSGVO). If users are expressly asked for their consent to the processing of their data, the processing of the data covered by the consent is based on the consent (Art. 6 para. 1 p. 1 lit. a) DSGVO).

Notes on functions of the application:

Further information on processing operations, procedures and services:

Purchase of applications via app stores

Our app is obtained via special online platforms operated by other service providers (so-called "app stores"). In this context, the data protection notices of the respective app stores apply. This applies in particular with regard to the procedures used on the platforms for range measurement and interest-based marketing, as well as any obligation to pay costs. The processing is the sole responsibility of the operators of the app stores. The specific data processed, the purposes of the processing and the legal basis can be found in the corresponding data protection notices of the respective app stores.

Further guidance on processing operations, procedures and services:

Registration, login and user account

Users can create a user account. As part of the registration process, users are provided with the required mandatory information and this information is processed for the purpose of providing the user account on the basis of contractual obligations. The processed data includes in particular the login information (user name, password and email address).

Within the scope of the use of our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective act of use. The storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed by email about events relevant to their user account, such as technical changes.

Further information on processing operations, procedures and services:

Community functions

The community functions provided by us allow users to enter into conversations or otherwise engage and exchange with each other.

For example, they can publish their own contributions (text, images, link posts), submit reactions and comments on posts or articles or publish video contributions on social and ecological challenges.

Please note that the use of the community functions is only permitted in compliance with the applicable legal situation, our terms and conditions and guidelines as well as the rights of other users and third parties.

Further information on processing operations, procedures and services:

Processing of Image Information, calendar access

Users can upload personal data in the form of image information, such as pictures, photos and videos from their devices, if users activate the following functions: displaying their avatar on their profile, setting an avatar or cover image for their Space, posting, or managing tasks and appointments. It's worth noting that activating the functions mentioned as well as supplying personal data when activating the functions is completely up to the user. Nevertheless, doing so improves the user experience and enables them to gain more advantages from our services, such as better visibility for making connections, sharing posts, joining events, and finding volunteers and partners to their projects. The usage of these features and the provision of personal data is thus in the users' own interest.

Additionally, the app requests access to read and write users' calendars, but only if the user chooses to activate the apps' function to save an appointment to their calendar.

Notifications (push, in-app, email)

Users of our platform are notified or informed about content and news relevant to them personally via various channels. Different channels can be used depending on the urgency of the notification. While most information is shared via the notification centre contained in the app (and website), information that is urgent or requires a reaction from the user, is also transmitted by email.

With prior consent, we can also send users so-called "push notifications" to draw their attention to particularly important information. These are messages that are displayed on users' screens, devices or browsers, even if our online service is not being actively used at the time.

In order to sign up for the push messages, users must confirm the query of their browser or mobile device to receive the push messages. This consent process is documented and stored. The storage is necessary to recognise whether users have consented to receive the push messages, to be able to send the push messages and to be able to prove consent. For these purposes, a pseudonymous identifier (so-called "push token" or "push key"), the app installation ID and/or the device ID of an end device are used and stored. These help us to assign the push messages to your device and your app and to play them out to the correct device. The service providers mentioned below are used to send the notifications.

On the one hand, the push messages may be necessary for the fulfilment of contractual obligations (e.g. technical and organisational information relevant to the use of our online offer) and are otherwise sent on the basis of user consent, unless specifically mentioned below. Users can change the receipt of push messages at any time using the notification settings of their respective browsers or end devices.

Contents:

Users are only informed about personally important content via push messages. This currently relates to notifications for receiving chat messages, personal mentions in comments or posts and notifications relating to collaboration in Spaces.

Push messages are currently only sent to the iOS and Android apps, browser-based push messages are currently not sent.

Receiving push notifications is voluntary and can be deactivated in the settings of the end device used.

Further guidance on processing operations, procedures and services:

Embedded partner content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the user, as without the IP address they would not be able to send the content to their browser. The IP address is thus required for the display of this content or function. We endeavour to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The pixel tags can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our website, as well as being linked to such information from other sources.

Further information on processing operations, procedures and services:

Contact and enquiry management

When contacting us (e.g. by post, contact form, email, telephone or via social media) as well as in the context of existing usage and business relationships, the details of the enquiring persons are processed to the extent that this is necessary to respond to the contact enquiries and any measures requested.

Further information on processing operations, procedures and services:

Newsletter and electronic Communication

We only send newsletters, emails and other electronic notifications (hereinafter referred to as "newsletters") with the consent of the recipients or with legal permission. If the contents of the newsletter are specifically described in the course of registration, they are decisive for the consent of the user. In addition, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for the purpose of a personal address in the newsletter, or further details if these are required for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter is always carried out in a so-called double opt-in process. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with other people's email addresses. The registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Changes to your data stored with the dispatch service provider are also logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove consent formerly given. The processing of this data will be limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe revocations, we reserve the right to store the email address in a block list (so-called "block list") for this purpose alone.

The logging of the registration process is carried out on the basis of our legitimate interests for the purpose of proving that it has been carried out properly. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents: By means of our newsletter we inform about innovations of the web platform/the apps, our services, campaigns, events and offers.

Further information on processing operations, procedures and services:

Surveys and polls

We occasionally conduct surveys and interviews to collect information for the respective communicated survey or interview purpose. The surveys and questionnaires we conduct (hereinafter "surveys") are evaluated anonymously. Personal data is only processed insofar as this is necessary for the provision and technical implementation of the surveys (e.g. processing of the IP address in order to display the survey in the user's browser or to enable the survey to be resumed with the aid of a cookie).

Further guidance on processing operations, procedures and services:

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us. We would like to point out that user data may be processed by the operators of the social networks outside the European Union. This may result in risks for the users, because it could, for example, make it more difficult to enforce the rights of the users.

Access to aggregated statistics:

As part of the operation of our online presences, it is possible that we may access information such as statistics on the use of our online presences provided by the social networks. These statistics are aggregated and may include, in particular, demographic information (e.g. age, gender, region, country) as well as data on interaction with our online presences (e.g. likes, subscriptions, sharing, viewing of images and videos) and the posts and content distributed via them. This can also provide information about the interests of users and which content and topics are particularly relevant to them. This information may also be used by us to adapt the design and our activities and content on the online presence and to optimise it for our audience. Please see the list below for details and links to the social network data that we, as operators of the online presences, can access. The collection and use of these statistics is usually subject to joint responsibility. Where applicable, the relevant agreement is listed below.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f) DSGVO, based on our legitimate interest in effective information and communication with users, or Art. 6 para. 1 sentence 1 lit. b) DSGVO, in order to stay in contact with our customers and to inform them, as well as to carry out pre-contractual measures with interested parties.

Communication via the social network:

Where you have an account with the social network, it is possible that we may see your publicly available information and media when we access your profile. In addition, the social network may allow us to contact you. This may be, for example, via direct messages or via posted articles. The content communication via the social network and the processing of the content data is thereby subject to the responsibility of the social network as a messenger and platform service. The latter is then the telecommunications provider. As soon as we transfer or process personal data from you into our own systems, we are independently responsible for this and this is done to carry out pre-contractual measures and to fulfil a contract in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO.

Processing for market research and advertising purposes:

Furthermore, the data of users within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on the usage behaviour and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, information is usually also read or stored in the user's terminal device. Furthermore, data may also be stored in the usage profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

The processing for market research and advertising purposes is carried out by the social networks under their own responsibility. You can find the legal basis for this in the data protection information for the respective social network. For a detailed description of the respective forms of processing and the opt-out options, please refer to the data protection declarations and information provided by the operators of the respective networks.

Exercise your rights as a data subject:

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. You can also contact us with your request. In this case, we will process your request and forward it to the provider of the social network.

Further guidance on processing operations, procedures and services:

Amendment and update of the privacy policy

We ask you to regularly inform yourself about the content of our data protection declaration. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact details of companies and organisations in this privacy statement, please note that the addresses may change over time and please check the details before contacting us.

Terminology and Definitions

This section provides you with an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined above all in Art. 4 of the GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to help you understand them. The terms are sorted alphabetically.