Data Privacy Notice
Information concerning the use and processing of personal data
In accordance with the legal provisions (Articles 13 and 14 GDPR), we are informing you below that we process personal data as part of our work. This information relates primarily to our donors, supporters, sponsors, website users, recipients of our email newsletter, recipients of our postal correspondence, applicants and the general public interested in our work.
What is personal data?
Personal data is information that can be associated with you as an individual. As part of our work, we process personal data for different purposes. If, for example, you wish to support our work by making a donation, send us a request or query, sign up to our email newsletter, receive informational materials about our work or are applying for a position, we will require personal data from you based on the relevant purpose.
For instance, you must provide your name and bank details to make a donation in order to comply with the provisions of tax law and the anti-money laundering regulations.
If you would like your donations to be taken into account as a special expenditure in your employee tax assessment, you must provide your name and date of birth. To find out more about whether your donation is tax-deductible, see
We also collect and use specific data if you e.g. use our website and the functions offered on the website.
For information on data processing on our website, see
For information on data processing as part of our donation advertising and administration, see
1. Our contact details
If you have any questions or queries about the collection of your personal data, please feel free to contact us:
“Menschen für Menschen”, Karlheinz Böhms Äthiopienhilfe (Karlheinz Böhm’s Ethiopia Aid), association for providing aid to people in developing countries
Capistrangasse 8/10, 1060 Vienna
Tel.: +43 (0)1/58 66 950
If you have any queries regarding data privacy, please feel free to contact us via the following email address: firstname.lastname@example.org
2. Data processing on our website
Contact form and email
If you contact us using the contact form on our website or by email, we save and process the data provided (title, name, email address and your query) in order to be able to process and respond to your request.
Online donation and donations shop
In order for you to be able to make an online donation using the online donations form or via the online store, and for us to be able to manage your donation in accordance with the order, we need certain data from you (name, title, email address, bank details or credit card information). Direct debits are processed directly by Menschen für Menschen together with Raiffeisenlandesbank Lower Austria – Vienna; therefore, we are also processing your bank details directly. Additional online donations are processed directly by our agents. Currently, these are: the fund raising box of Wikando GmbH and the company Micropayment AG for donations by credit card (we do not save your credit card number). At the donations shop, you have the option to open a customer account. Your payment and bank details will not be saved.
You can subscribe to our email newsletter using the newsletter contact form on our website and when making an online donation. For this, we require your title, your name and a valid email address. In this case, the legal basis for processing your data is your consent, which you may of course revoke at any time. The email newsletter is sent out via MailChimp, a company of the “Rocket Science Group LLC” which has its headquarters in the USA. MailChimp saves and processes your data for the purpose of sending our the email newsletter on our behalf. As a company registered in the USA, MailChimp is subject to the US-EU Privacy Shield Treaty and can demonstrate a data privacy level appropriate for Europe.
For more information, see Item 16 of the MailChimp Data Privacy Notice.
We collect user data in order to optimize and tailor our website to you as a user, taking into account Article 6 (1) lit f GDPR (legitimate interest), e.g. IP address, duration, period of use, pages, browser type, etc.. We also create pseudonymized user profiles. Cookies may also be used for this purpose, which allow the Internet browser to be recognized. The users’ IP addresses – which are considered personal data – are anonymized immediately upon receipt so that it is not possible to allocate IP addressed to user profiles.
What is a cookie?
How do I reject and delete cookies?
You can find the options of disabling cookies for the most common browsers under the following links:
Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
For more information about cookies, including information how cookies are set up, organized, blocked or deleted, please see e.g. www.allaboutcookies.org. The website www.allaboutcookies.org offers a detailed instruction on how to set and delete cookies independently of the browser type.
This website also uses the function anonymizeIP, which shortens IP addresses before processing them further, so that it is not possible to identify the users. Please visit http://www.google.com/analytics/ for more information on Google Analytics.
You can also prevent the disclosure to Google and processing by Google of the data generated by cookies about your use of the website (incl. your IP address), by downloading and installing the browser plugin available via the following link: http://tools.google.com/dlpage/gaoptout
Facebook: Visitor action pixel
We use the “visitor action pixel” of Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA (“Facebook”) on our website. With its help, we can track users’ actions after they’ve seen or clicked on a Facebook ad. This allows us to track the effectiveness of Facebook ads for statistical purposes. The data collected in this way is anonymous for us, that is, we do not see the personal data of individual users. However, this data is stored and processed by Facebook, and we will we inform you about this according to our knowledge. Facebook can connect this data with their Facebook account and also for their own advertising purposes, according to Facebook’s data usage policy (https://www.facebook.com/privacy/). You can enable Facebook as well as its partners to switch advertising ads to and from Facebook. You can also store a cookie on your terminal device for these purposes.
This website uses YouTube plug-ins. YouTube is owned by Google. If you visit one of our pages which feature a YouTube plugin, a connection is established to the YouTube servers. The YouTube server is informed which special page of our internet presence you have visited. If you are logged into your YouTube account, you allow YouTube to associate your surfing habits with your personal profile directly. You can prevent this association by first logging out of your account. For more information on YouTube’s collection and use of your data, please see YouTube’s information on data protection at www.youtube.com
Google Maps plug-in
Social media sharing links
This website does not use so-called social plug-ins by social networks. However, we do link to the social networks Facebook, Twitter and Instagram as well as YouTube. In addition, you can view the contents of our pages on the social media platforms Facebook, Twitter, Google+ and Pinterest via social media sharing links. This is only possible if you are logged onto the services and actively click on the sharing link.
You can find out more about use of your data by the mentioned services:
3. Processing purposes as part of our work
Donation advertising and awareness-raising
We send existing donors postal correspondence in which we ask for donations to meet our association’s purpose in accordance with the statutes. We do this in accordance with Article 6 (1) lit. f GDPR (legitimate interest).
In order to build and maintain as broad as possible a group of donors to finance our development work long-term, we send information to potential new donors and advertise for donations in order to meet our association’s purpose in accordance with the statutes. A list broker provides us with the names and addresses in this context in accordance with Section 151 of the Industrial Code (this sets out the legal framework conditions for list brokers and direct marketing companies).
In addition, information materials are sent out by post to donors and also to disseminators in order to ensure that our association’s purposes in accordance with the statutes can be met in terms of raising awareness about the need of people in countries in which the association carries out its project work. This also includes sending out invitations and references to internal and external events aimed at benefiting the association to donors and disseminators by post. We do this in accordance with Article 6 (1) lit. f GDPR (legitimate interest).
In order to be able to implement our work as cost-efficiently as possible, we also advertise for sponsorship services at specific occasions and inform current and potential sponsors of the work that our association carries out. We do this in accordance with Article 6 (1) lit. f GDPR (legitimate interest).
Donation management and assistance of donors and interested parties
As part of donation management, we record, allocate, confirm and thank donors for donations. We do this in accordance with Article 6 lit. b GDPR (contract performance).
If you would like to deduct your interest from tax, we meet the required obligations for deductibility from tax for your donations in accordance with Article 6 (1) lit c GDPR in conjunction with Section 18 (8) of the Income Tax Act. For additional information on whether your donation is tax-deductible, please see: Deductibility of donations
It is important to us to assist our donors, supporters and interested parties as well as possible. To this end, we process and answer your requests and queries received by post, email, phone or in person, and send information about our work.
In order to ensure that the personal data processed by us are correct to the best of our knowledge, and thus to comply with the wishes and rights of the data subjects as far as possible, we adapt the data stored with us and processing of such data based on feedback from the data subjects. This also includes processing of postal returns. We do this in accordance with Article 16 GDPR (right to rectification) and with Article 6 (1) lit. f GDPR (legitimate interest).
On request, we also save and process the personal data of individuals who do not wish to receive correspondence from us by blocking specific addresses for individual or all correspondence. This is the only way to ensure that we really do not send out any unsolicited correspondence. We do this in accordance with Article 19 GDPR (right to restriction of processing).
In order to manage and update our members, we process personal data in accordance with Article 6 (1) lit. b GDPR (contract performance).
Job advertisements and applicant management
When we advertise a job, we save and process the information and documents provided by the applicants in accordance with Article 6 (1) lit. b GDPR (steps taken prior to entering into a contract). After the application process has ended and the statutory retention period (normally 6 months) has expired, we delete the personal data again. We also delete personal data which are sent to us as part of proactive applications which do not result in employment.
4. External sources of personal data
As an association financed primarily by private donations, a wide group of donors is key for us. This is the only way for us to plan our development projects long-term while ensuring minimum risk. In order to maintain our existing group of donors, in addition to the information provided by donors and interested parties, we also use the address data of potential new donors with whom we have not yet been in touch, in order to contact them once by post to inform them about our work and to ask for a donation. If we do not receive a donation in response to our initial letter, we do not process the data further and delete the data.
The address data are made available to us by the authorized address service providers. Currently, we receive address data from the company Herold (HEROLD Business Data GmbH: HEROLD Business Data GmbH: Guntramsdorfer Straße 105, 2340 Mödling, www.herold.at) and from the company ProfileAddress (ProfileAddress Direktmarketing GmbH, Altmannsdorfer Str. 311, 1230 Vienna).
5. Changes to the purposes
We also use the personal data of donors which are processed based on a contractual agreement (as part of a donation or sponsorship) to send out donor advertising and awareness-raising correspondence by post to meet the purpose of our association on the legal basis of our legitimate interest.
Your data are not passed on to third parties!
Description of legitimate interest
According to Recital 47 GDPR, processing of personal data for the purpose of donation advertising, informing donors and raising awareness constitutes a legitimate interest if the processing is required to perform the purpose and corresponds to the reasonable expectations of the data subject.
The association Menschen für Menschen finances its works primarily from private donations. Long-term financial planning is key particularly with regard to the sustainability, efficiency and effectiveness of the development projects carried out by our association. Therefore, our association is dependent on receiving ongoing donations.
We require as large a group of donors as possible in order to keep the risk of unexpected reductions in donations as low as possible, and thus to ensure that the sustainable development projects to help the people that we support, which are designed to be carried out over several years, can be implemented to the best of our ability.
At the same time, it is also in the interests of our association’s donors and supporters to keep donation advertising as targeted and efficient as possible, as this is a prerequisite for ensuring that the largest possible proportion of donations received can be used to carry out the development projects. Therefore, the resources used to advertise for donations must be used as efficiently as possible and spreading losses must be prevented where possible. It is thus in the legitimate interest of the association, its donors and its supporters to advertise for donations among the group of persons who have already shown their interest in the work carried out by the association through their donation.
Moreover, the work carried out by our association and donation advertising to perform the purpose of the association are also in the public interest, not least because the Federal Fiscal Code (BAO) specifies a tax reduction for donations (donations to MfM are tax-deductible in accordance with Section 4a of the Income Tax Act (EstG) and Sections 34 ff. BAO).
Processed data categories
The following personal data are processed based on our legitimate interest in accordance with Article 6 lit. f GDPR.
- Name data (including title)
- Contact data
- Donation history and interest in donations
- Communication history
- Pseudonymized profiles for website users
6. Transfers of personal data
We send personal data to the following categories of recipients for the above-mentioned purpose:
- To service providers to produce postal correspondence
- To the Austrian tax authorities in relation to the tax deductibility of donations
- To service providers to process online donations
- To our web host to administer the donation shop
- To a service provider to send out and administer the email newsletter
Transfer of data to countries outside the EU
FThe following data are transferred to countries outside the EU for data processing:
Application: Google Analytics
- Country: USA (subject to the EU-US Privacy Shield)
- Types of data: anonymized IP address, website title, browser-specific information, information regarding website use.
- Country: USA (subject to the EU-US Privacy Shield)
- Types of data: Pixel: IP address, website title, browser-specific information regarding website use.
Application: MailChimp to send out email newsletter
- Country. USA (EU-US Privacy Shield)
- Data types: name, title, email address with opt-in
Google, Facebook and MailChimp are subject to the US-EU Privacy Shield Treaty. The data privacy level of the mentioned institutions is equivalent to the EU data privacy level in accordance with the US-EU Privacy Shield Treaty and a data privacy level appropriate for Europe applies.
7. Storage time
We only store your personal data for the time required to achieve the mentioned purposes and as permissible based on applicable law. We also save your personal data for the duration of the statutory retention periods or until the limitation periods of potential legal claims have expired.
8. Your rights
- You generally have the rights to information, rectification, erasure, restriction, data transferability, revocation and objection. This means:
- You have the right to ascertain whether and if so, which personal data concerning you we save and to receive copies of such data.
- You have the right to demand restriction of processing of your personal data so that we do not contact you in future.
- You have the right to demand the rectification, supplementation, to erasure of your personal data where these are incorrect or are not processed in accordance with the law. Your data can only be deleted after the statutory retention periods have passed. If we delete your data, we cannot wholly prevent the possibility that we might contact you again in future.
- You also have the right to object to the processing for purposing of donation advertising and to raise awareness at any time. Where processing is based on your consent, you may withdraw this consent at any time.
- In addition, you have the right to receive the data that you have provided for the purpose of data transferability in a structured, commonly used, machine-readable format or, where technically possible, to demand a transfer to a different controller.
Only the relevant data subjects are entitled to the rights mentioned above. This means that we are not allowed to provide information about you to third parties and that we must verify the identity of the person requesting the information by reasonable means (Recital 64 GDPR).
If you are of the opinion that your data are processed illegally, you of course have the right to launch an objection with the competent supervisory authority.
The contact details of the Austrian supervisory authorities:
Austrian Data Protection Authority
Updated on 24/05/2018