For Customers, Other Contractual Partners, and Interested Parties

Dear customers, suppliers, and interested parties

In order to deal with your enquiry, it is necessary for us to process some personal data about you. We have compiled the following information for you in order to ensure maximum transparency regarding our processing operations in connection with your personal data and to fulfill our information obligations under Article 12 et seq. GDPR:

1. Responsible party as per data protection regulations

The responsible party (hereafter referred to as “Wikando” or “we”) within the scope of the General Data Protection Regulation and other national data protection laws of the EU member states, as well as other data protection provisions concerning your data, is:

Wikando GmbH
represented by Peter Kral
Schießgrabenstraße 32
86150 Augsburg
Germany

Phone: +49 (0)821 66609000
Email: info@fundraisingbox.com

You can find more information about our company, our authorized representatives, and further contact details in the legal notice on our website at https://fundraisingbox.com/en/legal-notice/.

2. Contact details of our data protection officer

Our company has appointed a data protection officer.

Andreas Mundanjohl
Zeller Straße 30
73101 Aichelberg
Germany

Phone: +49 (0)821 90782120
Email: datenschutz@wikando.de

3. Purposes and legal bases of processing

We process your personal data under the provisions of the General Data Protection Regulation (GDPR) of the European Union and the German Federal Data Protection Act (BDSG) to the extent necessary to establish, execute, and fulfill a contract and to take necessary steps before entering into a contract. As far as personal data is required to initiate or perform a contractual relationship or to take steps before entering into a contract, processing is lawful under Article 6(1)(b) GDPR.

Upon your consent to the processing of personal data for specific purposes (e.g., disclosure to third parties, evaluation for marketing purposes, or advertising by email), this processing is lawful under Article 6(1)(a) GDPR based on that consent. You can revoke your consent at any time with prospective effect (see section 10 of this data protection information).

Where necessary and legally permissible, we process your data beyond the actual contractual purposes to fulfill legal obligations under Article 6(1)(c) GDPR. In addition, processing may be carried out to protect our legitimate interests or those of third parties and to defend and assert legal claims in line with Article 6(1)(f) GDPR. Where applicable, we will inform you about the legitimate interest separately if required by law.

We process your personal data to fulfill the following purposes related to initiating and performing a contractual relationship or other activities in the interests of the company:

• contract processing
• communication with business partners about products, services, and projects, as well as answering inquiries, customer service
• advertising to existing customers and use as a selection criterion for direct marketing to tailor our service to your needs
• the management of our customer relations
• improving and developing intelligent and innovative services
• Customer analysis for market research and opinion polling
• compliance with legal or contractual requirements
• information on updates to our platform
• for the settlement of legal disputes, enforcement of contracts and assertion, defense, and exercise of legal claims, detection and prosecution of fraudulent and other unlawful acts

4. Categories of personal data

We process personal data required to initiate and conduct our business relationships, handle inquiries, and register for and hold webinars. Depending on the circumstances, this includes in particular:

• Contact and organisation data: name, email address, postal address, telephone number and organisational affiliation.
• Inquiry and registration data: information about your request and your registration for and participation in our webinars.
• Technical data: IP address and technical connection data, where these arise in the relevant process.
• Identification/payment data: account number, VAT identification number.
• Order data: revenue.
• Other data: other information required for the business relationship or provided voluntarily, as well as information from publicly available sources.

5. Data sources

Information provided directly and technical data

We receive personal data primarily directly from you, for example through contact forms, webinar registrations, communication by email or telephone, and in the course of our business relationship. Technical connection data may arise when you use our online services.

Publicly available sources

Where we receive data from publicly available sources, we inform you in accordance with Article 14 GDPR, in particular about the specific source and the categories of data concerned.

6. Data recipients

Within our company

Within our company, only those departments and individuals who need your personal data to fulfil our contractual or legal obligations or to protect our legitimate interests have access to it.

External recipients and service providers

We use service providers in particular for communication, customer management, appointment scheduling, billing, data integration and technical operations. Where they process personal data on our behalf, this is based on a data processing agreement in accordance with Article 28 GDPR.

In addition, we disclose personal data only where this is legally permitted or required, necessary to fulfil a contract or to carry out pre-contractual measures at your request, or where you have given your consent. Recipients may include in particular:

• Public bodies and authorities, such as tax offices, supervisory authorities, the police or public prosecutors, where there is a legal or official obligation.
• Recipients whose involvement is necessary to establish or fulfil a contract.
• Other recipients whose involvement you have consented to.

We use the service providers listed below for the purposes described in each case. Information about transfers to third countries can be found in section 8.

Freshworks

Purpose: Ticket system, help widget, contact form inquiries, customer data, softphone.

Provider: Freshworks, Neue Grünstraße 17, 10179 Berlin, Germany 

Website: https://www.freshworks.com/de/ 

Privacy policy: https://www.freshworks.com/privacy/ 

Caya

Purpose: Digital processing of addressed postal mail.

Provider: Caya GmbH Ritterstraße 24-27, 10969 Berlin 

Website: https://www.caya.com/

Privacy policy: https://www.caya.com/legals/datenschutzerklarung

Calendly

Purpose: Online appointment scheduling.

Provider: Calendly LLC., 271 17th St NW, Ste 1000, Atlanta, Georgia, 30363, USA

Website: https://calendly.com/de 

Privacy policy: https://calendly.com/pages/privacy 

Google Workspace

Purpose: Document storage, email backup, holding and scheduling meetings.

Provider: Google Cloud EMEA Ltd., 70 Sir John Rogerson’s Quay, D02 R296, Dublin 2, Ireland 

Website: https://google.de 

Privacy policy: https://policies.google.com/privacy?hl=de&gl=de 

Security information: https://cloud.google.com/security/privacy/

Asana

Purpose: Project management, organisation and management of teams, groups, workflows, projects and processes.

Provider: Asana, Inc, 1550 Bryant Street, Suite 200, San Francisco, CA 94103, USA

Website: https://asana.com

Privacy policy: https://asana.com/de/terms#privacy-policy 

easybill

Purpose: Creating and finalising offers, and invoicing.

Provider: easybill GmbH, Düsselstr. 21, 41564 Kaarst 

Website: https://www.easybill.de 

Privacy policy: https://www.easybill.de/datenschutz 

Elastic.co

Purpose: Storage and processing of log data, automated detection of errors and anomalies.

Provider: elasticsearch B.V., Keizersgracht 281, 1016 ED Amsterdam, Netherlands

Website: https://www.elastic.co/de/ 

Privacy policy: https://www.elastic.co/de/legal/privacy-statement 

Beamer

Purpose: Information about updates to our platform.

Provider: Joincube, Inc., 3800 South Dupont, Dover, DE 19901, USA

Website: https://www.getbeamer.com/ 

Privacy policy: https://www.getbeamer.com/privacy-policy/ 

n8n

Purpose: Automated transfer and synchronisation of our contact, prospect and webinar registration data between the systems used for these purposes.

Provider: n8n GmbH, Novalisstr. 10, 10115 Berlin, Germany.

Processing is carried out on our behalf under a data processing agreement in accordance with Article 28 GDPR. Our n8n Cloud instance is hosted within the EU.

Website: https://n8n.io/

Privacy policy: https://n8n.io/legal/privacy/

Fivetran

Purpose: Automated transfer of internal CRM and business data from the systems we use to our Snowflake data warehouse. The personal data required for the respective transfers is processed in this context. We have configured a processing region within the EU for these transfers.

Provider: Fivetran Inc., 1221 Broadway Street, Suite 2400 Oakland, CA 94612, USA

Website: https://www.fivetran.com/de

Privacy policy: https://www.fivetran.com/de/legal#privacy-policy

Snowflake

Purpose: Storage and analysis of our internal CRM and business data in a central data warehouse. The data is stored on servers within the EU.

Provider: Snowflake Computing Netherlands BV, FOZ Building, Gustav Mahlerlaan 300-314, 1082 ME Amsterdam, Netherlands

Website: https://www.snowflake.com/de/ 

Privacy policy: https://www.snowflake.com/privacy-policy/ 

Gmail connection

Purpose: You can connect your Gmail account to FundraisingBox via Google OAuth to send emails from FundraisingBox through that account.

Data and permissions: We process your name, email address and the permissions granted for authentication and to provide this feature. This includes sending emails on your behalf and retrieving your primary Gmail address to identify the account unambiguously. We store this information and these permissions in FundraisingBox. The connection and email delivery are handled through Google.

Legal basis: Your consent under Article 6(1)(a) GDPR, which you give when connecting the account through Google’s consent page.

The use and transfer of information received through Google OAuth comply with the Google API Services User Data Policy, including the Limited Use requirements.

7. Email and Contact Form

We use the ticket system “Freshdesk” for handling customer inquiries and the Customer Relationship Management system (“CRM system”) “FreshSales” for handling general questions. The service provider of both systems is Freshworks Inc., 1250 Bayhill Drive, Suite 315, San Bruno, CA 94066 USA (hereinafter referred to as Freshworks). For the European region, the company Freshworks, Neue Grünstraße 17, 10179 Berlin, Germany, is responsible.

All support inquiries directed to us are converted into support tickets within Freshdesk, and the data you enter is transmitted to Freshdesk. The legal basis for processing the data is Article 6(1)(a) of the GDPR if user consent is given. If the registration is for the fulfillment of a contract to which the user is a party or for the implementation of pre-contractual measures, an additional legal basis for data processing is Article 6(1)(b) of the GDPR. Our legitimate economic interest lies in optimizing the management of contact inquiries and improving customer support to provide our services.

The following personal data may be transmitted to and stored in FreshSales and Freshdesk: inventory data (e.g., names, phone numbers, email addresses) and content data.

Freshdesk supports us in processing customer inquiries with the help of cookies. By integrating cookies, Freshdesk receives information about your browser, operating system, internet service provider, and IP address, which can also be transmitted to the USA. Freshdesk uses this information to offer us the services described above. The legal basis for processing personal data using cookies is Article 6(1)(f) of the GDPR.

Freshworks transmits this data to external service providers to offer their services.

Additionally, we have entered into a contract with Freshworks (Data Processing Agreement for EU Customers), in which Freshworks commits to processing user data only according to our instructions and complying with the EU data protection standards. Through this contract, Freshworks assures that they process the data in accordance with the General Data Protection Regulation and guarantee the protection of the rights of the data subject. Freshworks, Inc. is certified under the EU–US Data Privacy Framework. Where personal data is transferred to Freshworks in the USA within the scope of this certification, the transfer is based on the European Commission’s adequacy decision under Article 45 GDPR.

We only use your data to process your request and may contact you for this purpose using the provided contact information. This data will only be used for advertising purposes or shared with third parties if you have explicitly consented to such processing; in this case, the legal basis is your consent, Article 6(1)(a) of the GDPR. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

For more information on Freshworks and data protection, please refer to Freshworks’ Privacy Policy.

9. Duration of data storage

Where necessary, we process and store your personal data for the duration of our business relationship or contractual fulfillment, including the initiation and execution of a contract. In addition, we are subject to various retention and documentation obligations, including those arising from the German Commercial Code (HGB) and the German Fiscal Code (AO). The prescribed retention and documentation periods span two to ten years. The retention period is also governed by the statutory limitation periods, which, e.g., according to Sections 195 et seq. of the German Civil Code (BGB), are generally three years but, in certain cases, up to thirty years.

10. Your rights

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to notification under Article 19 GDPR, and the right to data portability under Article 20 GDPR.

You also have the right to complain to a data protection supervisory authority under Article 77 GDPR if you believe your personal data is being processed unlawfully. The right of complaint exists without prejudice to any other administrative or judicial remedy.

While the data processing is carried out based on your consent, you are entitled to withdraw your consent to the use of your personal data at any time under Article 7 GDPR. Please note that your revocation will only take effect in the future; it does not affect the processing that took place before the revocation. Please also note that we may have to keep specific data for a certain period to comply with legal requirements (see section 8 of this data protection information).

11. Right to object

To the extent that your personal data is processed under Article 6(1)(f) GDPR to protect legitimate interests, you have the right under Article 21 GDPR to object to this data being processed at any time for reasons arising from your particular situation. We will no longer process this personal data unless we prove overriding legitimate grounds for such processing. Such legitimate grounds must override your interests, rights, and freedoms, or such processing must establish, exercise, or defend legal claims. In individual cases, we process your personal data for direct marketing purposes. You have the right to object to processing for such advertising at any time. This also applies to profiling insofar as it is associated with direct advertising. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

For any concerns about your rights, contact us using the contact details provided in section 1.