Privacy Policy
Status: October 25, 2026 This privacy policy applies to ig-wuerzburg.de (website) including its subpages, as well as our online presences/accounts on Facebook, Instagram, TikTok and for our use of the donation and fundraising platform GoFundMe. (Original German text applies in case of doubt)
Responsible Party
Islamische Gemeinschaft Würzburg e.V. Barbarastraße 31, 97074 Würzburg Representative: Wail Al Ahmad Email: info@ig-wuerzburg.de Legal Notice: https://ig-wuerzburg.de/impressum/
Overview of Processing
The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.
Relevant Legal Bases
Legal bases according to GDPR: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), Membership status (Art. 6 para. 1 sentence 1 lit. b GDPR).
Security Measures
We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. We use TLS/SSL encryption (https).
Transmission of Personal Data
In the course of our processing, personal data may be transmitted to other bodies (e.g. IT service providers).
International Data Transfers
Data processing in third countries takes place in accordance with legal requirements (e.g. EU-US Data Privacy Framework, Standard Contractual Clauses).
General Information on Data Storage and Deletion
We delete data as soon as it is no longer required for the purpose or consent is revoked, unless retention obligations (e.g. 6 or 10 years for tax-relevant documents) apply.
Rights of Data Subjects (Art. 15–20 GDPR)
You have the following rights regarding your personal data: • Art. 15 – Right of access: You may request information about the data we store about you. • Art. 16 – Right to rectification: You may request correction of inaccurate data. • Art. 17 – Right to erasure: You may request deletion of your data, unless legal retention obligations apply. • Art. 18 – Right to restriction: You may request restriction of processing. • Art. 20 – Right to data portability: You may receive your data in a machine-readable format. • Art. 21 – Right to object: You may object to the processing of your data. • Withdrawal: A given consent may be revoked at any time with effect for the future. To exercise your rights, please contact us by email: datenschutz@ig-wuerzburg.de We process requests within 30 days in accordance with Art. 12(3) GDPR. Complaints may be submitted to the supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Provision of the Online Offer and Web Hosting
We process usage data (IP address, log files) for security and provision. Service providers: Hetzner Online GmbH (Germany), Cloudflare (CDN/WAF).
Use of Cookies and Browser Storage
Our website uses cookies and similar storage technologies. On your first visit a banner appears where you can give consent for individual categories. We use the following categories: 1. Necessary (always active): The 'cookie_consent' cookie (storage: 1 year) saves your consent decision. Legal basis: Art. 6(1)(c) and (f) GDPR. 2. Statistics / Analytics (only with consent): Google Analytics 4 and Google Tag Manager (_ga, _gid, _gat). Only loaded when you enable 'Statistics' in the banner. Legal basis: Art. 6(1)(a) GDPR. 3. Marketing (only with consent): Meta Pixel (Facebook) and TikTok Pixel. Only loaded when you enable 'Marketing' in the banner. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time by deleting cookies in your browser.
Contact and Inquiry Management
When you contact us (form, e-mail), we process your details (name, e-mail address, subject, message) to handle your inquiry (Art. 6 para. 1 lit. b or f GDPR). Messages sent via the contact form are stored in our system and viewed only by authorized association staff. We delete inquiries once they have been handled and no retention obligations apply.
Web Analysis, Monitoring and Optimization
We use Google Analytics 4 and Google Tag Manager for range measurement (with IP anonymization). This only takes place after your consent.
Presences in Social Networks
We maintain profiles on Facebook, Instagram, TikTok. The data protection regulations of the respective platforms apply.
External Services (Google Maps, Mawaqit, YouTube)
On our website, we integrate maps from the 'Google Maps' service (provider: Google Ireland Limited), prayer time widgets from the 'Mawaqit' service and a project video from 'YouTube' (provider: Google Ireland Limited). Your IP address is transmitted to the respective provider; Google and YouTube may also set cookies. This is done in the interest of an appealing presentation and easy findability of our locations (Art. 6 para. 1 lit. f GDPR).
Donation and Fundraising Platforms
For online donations we use the payment service providers Stripe (Stripe Payments Europe, Ltd., Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg); we also refer to the GoFundMe platform. Payment is processed directly by the respective provider. We do not receive payment data such as card numbers; we only store the payment reference, amount and status. The data collected by these providers is subject to their privacy policies. Legal basis: Art. 6 para. 1 lit. b GDPR (processing of the donation) and lit. c GDPR (tax and accounting obligations). Transfers to third countries (e.g. USA) are based on the EU-US Data Privacy Framework or standard contractual clauses.
Bot Protection (Cloudflare Turnstile)
To protect against automated access (spam, abuse), we use the Cloudflare Turnstile service in forms (contact, donation, newsletter, login) (Cloudflare, Inc., USA). Data such as IP address, browser and device information and interaction data are transmitted to Cloudflare and analysed in order to determine whether the request comes from a human. Legal basis is our legitimate interest in the security and functionality of our services (Art. 6 para. 1 lit. f GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses.
Newsletter
If you subscribe to our newsletter, we process your e-mail address and chosen language. We use the double opt-in procedure: you first receive a confirmation e-mail and are only added to the mailing list after clicking the confirmation link. To prove your consent we store the time of consent and the IP address used. Unconfirmed subscriptions are deleted automatically once the confirmation link has expired. Legal basis: consent (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time via the unsubscribe link in every newsletter; your address will then be deleted. Newsletters are sent via an e-mail service provider.
Donation Data and Origin Data
For an online donation we process: amount, currency, payment method and status, payment reference, for named donations name and e-mail address (for confirmation and donation receipt), optional messages (e.g. gift donations) and technical details (IP address and browser identifier at the time of the donation, landing and referring page, campaign parameters such as UTM values and advertising click IDs). Purposes: processing and bookkeeping of the donation, issuing donation receipts and evaluating our donation campaigns. Legal bases: Art. 6 para. 1 lit. b, c and f GDPR. Display on the website: for named donations the name provided may appear in the donation ticker or on the honor board; without a name, "Anonymous donor" is shown. We keep donation records in accordance with statutory tax and commercial retention periods (up to 10 years). For the transmission of completed donations to advertising platforms, see the section on the data protection impact assessment (CAPI) below.
Data Protection Impact Assessment: Conversion Tracking (CAPI)
We use Conversion APIs (CAPI) to report donation completions to advertising platforms and to optimise our donation campaigns. We have conducted a Data Protection Impact Assessment (DPIA) in accordance with Art. 35 GDPR: Purpose: Measuring the effectiveness of advertising campaigns (conversion optimisation). Data processed: The donor's email address is hashed with SHA-256 before transmission. No plain text is transmitted. Additional event parameters (amount, currency) may be sent. Recipients: Meta Platforms Ireland Ltd. (Facebook/Instagram CAPI), Google LLC (Google Ads Conversion). Data transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Consent pursuant to Art. 6(1)(a) GDPR (Marketing cookies must be enabled in the banner). Risk mitigation: Email hashing, no transmission of plain data, consent required, opt-out at any time by declining marketing cookies.