Privacy Policy

1 General information

1.1 Controller

Controller

Gewerkschaft Underdog e.V.
Ehrenbergstraße 16a
Scanbox #12300
10245 Berlin

Telephone

030 75435000

Email

info@gdog.pro

1.2 Your rights

Among other things, you are entitled to

• information, free of charge, about the origin, recipients and purpose of your stored data,
• rectification or erasure,
• withdrawal of consent you have given,
• objection (Art. 21 GDPR),
• restriction of processing,
• a copy of your data,
• data portability,
• lodge a complaint with a competent supervisory authority.

1.3 Our legal bases

We process personal data only for as long as we have a reason to do so and are authorised to do so. We stop when

• the reason no longer applies. Example: the period of a statutory documentation obligation has expired.
• we are no longer authorised. Example: you had consented to the processing and withdraw that consent.

Depending on the case, processing is based on Art. 6(1)(a), (b), (c) or (f) GDPR or, for special categories of data, on Art. 9(2)(a) GDPR. Where data are transferred to third countries with consent, Art. 49(1)(a) GDPR also applies; for cookies or access to terminal equipment, Section 25(1) TDDDG.

We pass personal data on to external bodies only for the performance of a contract, on the basis of a legal obligation, on the basis of a legitimate interest (Art. 6(1)(f) GDPR) or on another legal basis. These are mainly processors with whom we have concluded a data processing agreement for this purpose.

1.3.1 Why are you receiving this privacy policy?

You are using our website (https://www.gewerkschaft.berlin or https://gdog.pro).

1.3.2 How do we obtain personal data?

Personal data are all data with which a person can be personally identified.

Data are collected on the one hand when you provide them, for example via the contact form, and on the other hand automatically by our technical systems when you visit the website, for example browser, operating system and time of the page request.

1.3.3 What do we do with personal data?

We use personal data to provide the website without errors, to document legal declarations, to pass on information reliably, to deal with enquiries, to recruit members and to admit them.

The following sections give an overview of what happens to personal data when you visit this website.

2 How we process personal data

2.1 Hosting

This website is hosted externally. Our host is Hetzner Online GmbH, Gunzenhausen, Germany. The server is located in the provider’s data centre in Falkenstein, Germany. The provider is our processor. We have concluded a data processing agreement with it under Art. 28 GDPR.

2.1.1 Purpose

Secure and efficient provision of the website. We use SSL/TLS encryption to protect confidential transmissions.

2.1.2 Legal basis

Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR); where you consent to cookies or fingerprinting, additionally Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

2.2 Data collected on this website

• When you visit this website, our technical systems automatically collect certain data: browser type and version, operating system, the address of the previously visited page (referrer URL), the host name of the accessing computer, the time of the server request and the IP address. These data are not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in displaying the website without errors.
• We store information from the contact form in order to process your enquiry and any follow-up questions. We do not pass it on without your consent. Depending on the case, the legal basis is Art. 6(1)(b) GDPR where a contract is involved, otherwise point (f) or point (a) GDPR. We store the information until its purpose no longer applies or you request erasure or withdraw your consent; statutory retention periods remain unaffected. The same applies to enquiries by email, telephone or fax.

2.3 Multilingualism

Our website can be used in five languages: German, English, Turkish, Ukrainian and Arabic. Only the German version is binding, and in case of doubt the latest version. The language versions may differ from one another depending on the translation.

You choose the language using the button in the header. The chosen language appears only in the address of the page (for example /de/ or /en/). It is not stored anywhere: not in a session, not in an account, not in a database. We do not evaluate the language setting of your device or browser.

2.4 Login procedure

Certain areas of this website, such as the member profile or internal work areas, require you to log in. Logging in consists of two steps: identification (who you are) and authentication (that it really is you).

For identification, you enter an email address or a telephone number and confirm it with a one-time code that we send to exactly that destination. Alternatively, you can use Google’s single sign-on service.

For the subsequent authentication, we send a further one-time code to your telephone or email, or you use a password you have set yourself.

In addition, you can set up a security key or passkey (FIDO2) or an authenticator app (TOTP) for authentication in your account. For a security key, we store its identifier and public key, never a private key. For an authenticator app, we store the secret from which the app generates its codes.

In doing so, we process: the identifier you have chosen (email address or telephone number); the one-time code, which we store only as a check value, never in plain text, and which becomes invalid after a short time and at the latest after three failed attempts; if you use a password, its check value (Argon2id hash), likewise never the password itself; and the IP address, which we use to protect the sending of one-time codes against misuse.

A telephone number is not always stored as a separate field in our membership database; where it is not, we assign it to the contact found or newly created via an extension field.

We record login, logout and any change in login status in a journal for your contact.

When you complete authentication for the first time, we ask you to take note of this privacy policy and our terms of use; we record your consent, with the time, in your contact.

The purpose of the processing is secure identification and authentication and control of access to protected areas. The legal basis is Art. 6(1)(b) GDPR insofar as the login serves membership or another contractual relationship, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in a secure and functioning login.

2.4.1 Google’s single sign-on service

You do not have to use this service; it is your decision. If you use it, Google learns that you are in contact with us and the time of each of your logins with us.

The personal data arising in this process thereby leave the scope of the GDPR. The level of data protection in the USA is considered to be considerably weaker.

2.4.2 SMS

For some login methods we send you an SMS. Sending is handled for us by sipgate GmbH, Düsseldorf, as our processor. We have concluded a data processing agreement with it under Art. 28 GDPR.

2.4.3 Email

For some login methods we send you an email. We also send you security warnings and other information automatically by email. To send these emails we use Mailjet, Paris, as our processor. We have concluded a data processing agreement with Mailjet under Art. 28 GDPR.

2.5 Replacement scanning

Documents addressed to our postal address, for example if you wish to exercise a data protection right, are processed by our scanning service provider, Dropscan GmbH, Berlin. It is our processor. We have concluded a data processing agreement with it under Art. 28 GDPR.

This procedure is necessary for us in order to obtain scans with the evidential value of originals. Documents that reach us by other means are forwarded to our postal address and treated there in the same way.

2.6 Telephone calls

When we speak on the telephone or you simply call us, metadata arise which the aforementioned sipgate GmbH processes for us. These metadata may become legally relevant.

A service provider may take your call on our behalf, for example if you call us at night. This service provider is StarOffice, Berlin, our processor. We have concluded a data processing agreement with it under Art. 28 GDPR. In this way we want to make ourselves easier to reach.

3 Deletion periods

Our website is in beta. As soon as we leave this stage, we will delete all personal data that has arisen up to then in the operation of the website. This will be the case before 1 December 2026.

This does not apply to the metadata of telephony. For these, the retention period remains three years.