Privacy notice – 3. November 2026
Controller and contact
The controller for this website is Charity-Hiker e. V., Markelfinger Str. 4a, 78476 Allensbach, Germany. Email: contact@charity-hiker.com. You may contact us there about data protection. Whether the association is legally required to appoint a data protection officer still needs to be assessed.
Legal bases
Depending on the purpose, personal data are processed to take pre-contractual steps or fulfil a contract (Article 6(1)(b) GDPR), comply with a legal obligation (c), pursue legitimate interests in security and answering enquiries (f), or on the basis of your consent (a). Consent may be withdrawn at any time for the future.
Hosting and server logs
Our website and association-related email services are hosted by Host Europe. When pages are accessed, technical information such as IP addresses, access times and request details may be processed for delivery, troubleshooting and security (Art. 6(1)(f) GDPR). Host Europe states that archived Apache access logs in cPanel hosting are retained for 14 days. AWStats and Webalizer may also collect technical visitor statistics; Host Europe does not automatically delete these statistics, which remain until separately removed. We are reviewing an appropriate deletion procedure.
Cookies and essential storage
Your cookie preferences are stored in your browser under ch_cookie_consent until you change them or delete the relevant browser data. Essential functions may use session data, shopping-cart information and a secure cookie for resuming an open order. The order-resumption cookie is intended to remain valid for no more than 48 hours and may be invalidated earlier. Essential device access is governed by section 25(2) TDDDG, and the processing of personal data is based on Art. 6(1)(b) or (f) GDPR, as applicable.
Optional PayPal content
The “External content (PayPal)” category is optional. If enabled, PayPal content, including a pixel in the donation area, may be loaded, transferring technical information such as IP address to PayPal. Its optional loading is based on consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. It is different from opening PayPal to complete a payment you explicitly request.
Changing or withdrawing consent
You may change your settings using “Cookie settings” in the footer. “Necessary only” refuses optional content. Closing the settings dialog without saving does not create consent. Withdrawal takes effect for the future and cannot recall information already lawfully transmitted to a third party.
Contact enquiries
If you contact us by form, email or telephone, we use your contact details and message to respond. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, or generally Article 6(1)(f) for other enquiries. We delete the information when no longer required, unless retention duties apply.
Membership applications
We use our own online membership application form and process the submitted identity, contact and application data to assess and decide on admission (Art. 6(1)(b) GDPR). Submitting an application does not automatically create membership. Pending applications are kept while a decision is being made. After admission, data necessary for membership administration is retained for the duration of membership; application-only data that is no longer needed is deleted. If an application is declined or withdrawn, data is deleted once processing is complete unless outstanding questions, legal claims or statutory duties require continued retention. After membership ends, data is removed or restricted once administrative requirements, outstanding claims and legal recordkeeping duties permit. Accounting records for membership fees may need to be kept longer.
Fan shop and orders
For shop orders we process identity, contact and shipping details, products, shipping method, order number, payment method and order status to fulfil purchases (Art. 6(1)(b) GDPR). An unfinished order may be resumed within an intended period of up to 48 hours. Cancelling an unpaid order ends that order, but payment references and technical verification records may be retained for longer to prevent late payment confirmations from being incorrectly processed. After payment and delivery, operational data is removed or restricted when no longer needed, subject to legal claims and recordkeeping duties. Tax-relevant accounting vouchers generally require eight years' retention; certain business correspondence six years; and books and annual accounts ten years under section 147 of the German Fiscal Code (AO). These periods do not automatically apply to all personal data in the active shop administration.
PayPal and bank transfer
For PayPal payments, necessary order and transaction details are exchanged with PayPal. For prepayment, incoming bank transfers are matched to the order reference (Article 6(1)(b) and, where required, (c) GDPR). PayPal is responsible for its own processing; see PayPal privacy notice.
Donations and community activities
For donations, enquiries and voluntary community activities, we process the details required for handling the activity, such as names, contact details, donation amounts or reported distances (Art. 6(1)(b) and, where legally required, (c) GDPR). Separate consent is obtained for voluntary publication of names or images where necessary (Art. 6(1)(a) GDPR). Information no longer needed for an activity is removed unless other legitimate retention grounds apply. Donation and membership fee vouchers may fall under the generally eight-year statutory retention of accounting vouchers under section 147 AO.
Recipients and international transfers
Information may be shared with hosting, email, payment, delivery and other service providers where necessary. Some external services may involve transfers outside the European Economic Area; the relevant contractual and legal safeguards must be verified for the actual services used.
Retention
We determine retention according to purpose and applicable legal duties. Host Europe states a 14-day retention period for archived Apache logs; AWStats/Webalizer statistics are not automatically deleted. Browser consent choices remain until changed or browser data is removed. The cookie for resuming an open order is intended for a maximum of 48 hours. Membership applications are kept until a decision is taken; rejected or withdrawn applications only for as long as completion, outstanding claims or legal obligations require. Member details are kept during membership and subsequently only as long as required for administration, claims or recordkeeping. Under section 147 AO, relevant records are generally kept for six years (certain business correspondence), eight years (accounting vouchers) or ten years (books and annual accounts). The period generally starts at the end of the relevant calendar year; proceedings and claims can extend it. Enquiries and technical logs are removed or minimised when no longer required. Backup retention depends on the actual backup cycles and is still being verified.
Your rights
Subject to the applicable legal conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20), and objection (21 GDPR). You may withdraw consent for the future and complain to a data protection authority, particularly the Baden-Württemberg supervisory authority.
Security and external links
We use HTTPS to encrypt communications with the website. External social media links lead to third-party websites with their own policies. This notice reflects the intended website status as of 3 November 2026 and must be reviewed when services or data flows change.