Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Simon Maximilian Heistermann
Mutter-Teresa-Weg 6
46325 Borken
Germany
Email: hello@daretogether.net

2. Data Protection Officer

We are not legally required to appoint a data protection officer pursuant to § 38 of the German Federal Data Protection Act (BDSG). For any data protection inquiries, please contact us directly at hello@daretogether.net.

3. Data We Collect

We process personal data that you provide to us or that is automatically collected when you use our website and services.

3.1 Waitlist Data

When you join one of our waitlists (the Cape Town trip or the general community list), we process:

• First name and email address
• Which lists you are on (Cape Town waitlist, community list or both)
• Age bracket (a range, not a date of birth)
• Occupation as a selection (self-employed, employed with remote option, studying, other) plus an optional free-text field if you choose “other”
• Budget bracket as a range, never a specific amount
• The website language at the time you signed up
• Where your visit came from: UTM parameters in the URL you opened and the referring page
• As proof of your consent: the consent text exactly as it was shown to you, plus the status and timestamp of your confirmation (double opt-in)

Your entry only becomes active once you confirm it via the link in the confirmation email. We do not collect a postal address, phone number or payment details.

A Cape Town sign-up creates two entries: one on the Cape Town waitlist and one on the community list. Both purposes are named explicitly in the consent text under the form and are given with one consent. You can withdraw them separately: the unsubscribe link in a community email ends the community emails only, the unsubscribe link in a Cape Town email stops all emails for both lists.

3.2 Internal Handling of Your Entry

For each waitlist entry we keep an internal status (new, contacted, place confirmed, withdrawn) and a notes field. In it we record what is relevant for planning the trip, for example the outcome of the personal call. These notes are accessible only to us, and you can request access to them at any time (see section 9).

3.3 Technical Data

When you visit our website, our hosting provider automatically processes server log data: IP address, browser type and version, operating system, date and time of access, referring URL and pages visited. We do not store this data in our own database.

To protect against automated mass sign-ups we apply rate limiting. This briefly processes your IP address in order to count requests per time window.

3.4 Usage Measurement

We measure how our website is used, to understand which content gets read and where visitors drop off. We use PostHog on servers within the European Union. This processes page views, click events, approximate location at country level, and device and browser details. The measurement runs without cookies: no data is stored on your device, and the association ends when you close the browser tab.

3.5 Email Log and Suppression List

We log the emails we send you (confirmation email, welcome email, broadcasts). Recorded are the recipient address, the type of email, an identifier from the sending provider, and the timestamp.

If you unsubscribe, we store your email address together with the reason and the timestamp on a suppression list. This is necessary so that your unsubscribe is respected permanently - without that list you would be contacted again on the next send.

4. Purposes and Legal Basis

We process your personal data for the following purposes and on the following legal bases:

5. Third-Party Processors

We use the following third-party service providers to run our website and our emails. Each processor has entered into a Data Processing Agreement (DPA) with us in accordance with Art. 28 GDPR.

6. International Data Transfers

Our third-party processors are based in the United States. Data transfers to the US are conducted on the following legal bases:

• EU-US Data Privacy Framework (DPF): The European Commission has adopted an adequacy decision for the EU-US Data Privacy Framework (Commission Implementing Decision of 10 July 2023). Our processors are certified under the DPF, which ensures an adequate level of data protection.
• Standard Contractual Clauses (SCCs): As an additional safeguard, we have entered into Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR with our processors.

7. Cookies and Similar Technologies

On the public pages we set no cookies at all. The usage measurement (section 3.4) works without them: it is set up so that nothing is stored on your device. No consent under § 25 TDDDG is required for this, because we do not access your terminal equipment.

You can object to usage measurement at any time by writing to us at the address given above.

The internal area (login for managing the waitlist) additionally sets technically necessary session cookies. These are strictly required for signing in and are exempt from the consent requirement under § 25(2) TDDDG. The internal area is not accessible to visitors of the website.

8. Retention Periods

We store your personal data only for as long as it is necessary for the purposes it was collected for, or as long as the law requires.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You may request confirmation of whether we process your personal data and, if so, obtain a copy of that data.
• Right to rectification (Art. 16 GDPR) — You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR) — You may request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18 GDPR) — You may request restriction of processing in certain circumstances.
• Right to data portability (Art. 20 GDPR) — You may request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) — You may object to processing based on legitimate interests (Art. 6(1)(f) GDPR) at any time, for reasons related to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on your consent (e.g., your waitlist entry), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@daretogether.net. We will respond within one month of receiving your request.

10. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44
40102 Düsseldorf
Germany
Website: www.ldi.nrw.de

11. Automated Decision-Making

We do not use fully automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Who gets a place on the trip is decided after a personal call, not by an algorithm.

12. Obligation to Provide Data

Waitlist: We need your first name and email address to add you to the list and to reach you. Occupation, budget bracket and age bracket help us plan; without them we cannot judge whether the trip is a fit for you.

Community list: First name and email address are enough.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons.

For material changes (e.g., new data processing purposes, new processors, changes to retention periods), we will notify everyone on our lists via email at least 30 days before the changes take effect and update the “Last updated” date below.

You have the right to object to new processing activities by contacting us at hello@daretogether.net. If you do not wish to accept changes to our data processing, you may request deletion of your data without penalty.

Minor corrections, clarifications, or formatting changes that do not expand the scope of our data processing may take effect immediately.

14. Severability

Should any provision of this privacy policy be held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Any invalid provision shall be replaced by a valid provision that comes closest to the intent of the original.