This is a non-binding English translation provided for convenience. The German version is the legally authoritative text.

1. Data controller

The controller responsible for the processing of personal data on this website is:

Thüringer Agentur für Europäische Programme e. V.
Eugen-Richter-Straße 44
99085 Erfurt
Germany

Phone: +49 361 21698333
Email: datenschutz@thaep.de

This privacy policy applies to the use of our publicly accessible website. Where further personal data is processed in connection with our association or project work, separate privacy notices may apply.

2. General information on data processing

We process personal data of visitors to our website only to the extent necessary to provide a functional, secure and user-friendly website and to handle enquiries.

Personal data is any information relating to an identified or identifiable natural person. This may include, in particular, names, contact details, IP addresses and communication content.

Processing is carried out in particular on the basis of the following legal grounds:

Art. 6 (1)(b) GDPR, where processing is necessary for the performance of a contract or pre-contractual measures;
Art. 6 (1)(c) GDPR, where we are legally obliged to carry out the processing;
Art. 6 (1)(f) GDPR, where processing is necessary to protect our legitimate interests or those of a third party, provided these are not overridden by the interests, fundamental rights and freedoms of the data subject;
Art. 6 (1)(a) GDPR, where we expressly obtain consent for a specific processing activity.

3. Hosting and server log files

Our website is hosted by One.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden (hereinafter “one.com”).

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

When you visit our website, the hosting provider automatically processes usage and log data. This includes, in particular, the IP address of the accessing device. According to one.com, IP addresses are shortened by default. However, a temporary processing of complete IP addresses in security-related exceptional cases cannot be ruled out. The hosting provider has not provided us with a definitive list of all data fields contained in the server log files.

Processing is carried out in particular for the following purposes:

technical provision of the website;
establishing the connection to the visitor’s device;
ensuring the stability and functionality of the website;
ensuring the security of the systems;
detecting and defending against misuse, malware and attacks;
technical error analysis.

The legal basis for this processing is Art. 6 (1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our website.

Server log data is stored for a limited period, to the extent necessary for the operation and security of the services. one.com has not informed us of a fixed maximum retention period. The data is deleted or anonymised as soon as it is no longer required for the stated purposes, unless further storage is necessary due to a security incident, to assert or defend legal claims, or due to statutory obligations.

Providing the technical data automatically transmitted when visiting the website is required for using the website. Without this data, the website could not be technically provided.

According to one.com, hosting data of EU-based customers is stored in data centres in Denmark.

one.com uses sub-processors to provide its services. According to the current data processing agreement, this includes, among others, One.com India Pvt. Ltd. in India for system monitoring, for mass hosting. Where personal data is processed outside the European Union or the European Economic Area as a result, the transfer takes place, according to one.com, on the basis of appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR.

Further information is available on the following pages of the hosting provider:

4. Contact by email or telephone

If you contact us by email or telephone, we process the personal data you provide to us. This may include, in particular:

Name;
Email address;
Phone number;
Organisation or institution;
Content and time of the enquiry;
any other information you voluntarily provide.

Processing is carried out for the purpose of handling and responding to your enquiry, as well as for any follow-up questions.

If your enquiry relates to an existing contract or pre-contractual measures, the legal basis is Art. 6 (1)(b) GDPR.

For general enquiries, processing is based on Art. 6 (1)(f) GDPR. Our legitimate interest lies in the proper handling and response to enquiries addressed to us, as well as in communication with interested parties, partners and other organisations.

Where processing is necessary to fulfil a legal obligation, the legal basis is Art. 6 (1)(c) GDPR.

The data transmitted will be deleted once the enquiry has been fully processed, unless statutory retention obligations, contractual requirements or legitimate interests require further storage. Statutory retention periods, in particular for business, tax or grant-related documents, remain unaffected.

Email communication may be processed via the technical systems of our hosting and email service provider, one.com. Where one.com processes data on our behalf, it is contractually bound pursuant to Art. 28 GDPR.

5. Contact form

This website currently does not offer a contact form. You can only get in touch via the email addresses, phone numbers or postal address provided.

Should a contact form be introduced at a later date, this privacy policy will be updated accordingly before it goes live.

6. Cookies and similar storage technologies

Under the current configuration, we do not use any cookies for analytics, statistics, advertising or marketing purposes in the publicly accessible area of our website.

The WordPress content management system we use may use technically necessary cookies, in particular when authorised persons log in to the website’s administration area. These cookies are used for login, session management, security and the proper functioning of the website.

Language selection (Polylang)

To store the language setting determined for the website, our website uses the technically necessary cookie “pll_language”. The cookie contains the respective language code (e.g. “de” or “en”) and is stored for a period of one year. It enables the website to be provided in the selected or most recently used language version.

Setting and reading this cookie is permitted without consent pursuant to Sec. 25 (2) No. 2 TDDDG, as the cookie is required to provide the multilingual digital service you have explicitly requested.

Where personal data is processed in connection with this cookie, such processing is carried out on the basis of Art. 6 (1)(f) GDPR. Our legitimate interest lies in providing the website in the respective language version in a user-friendly and functional manner.

Further cookies for analytics, statistics, advertising or marketing purposes are not used under the current configuration. Consent is therefore not required for this.

7. Web analytics, audience measurement and tracking

We currently do not use any web analytics, audience measurement or user-tracking services on this website.

In particular, no Google Analytics account is linked to the website or to the SEO system used, and no Google Analytics tracking code is embedded on the website.

No profiling and no evaluation of individual website visitors’ behaviour for advertising or marketing purposes takes place.

Should an analytics or tracking service be used in future, this will only happen after this privacy policy has been updated accordingly and, where legally required, after obtaining consent.

8. Fonts

The fonts used on this website are hosted locally on our own web server.

When you visit our website, no connection is therefore made to Google Fonts servers or other external font providers. As a result, no personal data, in particular no IP addresses, is transmitted to Google or other external font providers.

9. WordPress, theme and plugins

Our website uses the WordPress content management system as well as locally installed components, in particular the Blocksy theme and additional WordPress plugins.

The components used run on our web server. Under the current configuration, no analytics or tracking services are activated via Rank Math SEO, and no external analytics account is connected.

Where individual components serve exclusively for design, search engine optimisation, technical administration or local delivery of content, this generally does not involve any independent transmission of visitors’ personal data to the manufacturers of these components.

10. External links

Our website may contain links to websites of other providers. Simply displaying our website does not, in itself, transmit any data to the operator of a linked site through a normal external link.

Only when you actually click on an external link do you leave our website. The operator of the linked site may then process personal data, in particular your IP address.

The respective operator is responsible for the processing of personal data on external websites. The privacy notices of the respective external website apply.

11. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption.

You can recognise an encrypted connection by the fact that the browser’s address bar begins with “https://”.

Encryption generally prevents data transmitted between your browser and our web server from being easily read by third parties. However, absolute protection for internet-based data transmission cannot be guaranteed.

12. Recipients of personal data

Within Thüringer Agentur für Europäische Programme e. V., only those persons who need the data to perform their tasks have access to personal data.

In addition, personal data may be transmitted in particular to the following categories of recipients:

hosting and email service providers;
technical service providers and processors;
sub-processors engaged by our service providers;
authorities or other public bodies, where there is a legal obligation to disclose data;
courts, lawyers or other professional advisors, where necessary to assert, exercise or defend legal claims.

Personal data is not passed on for advertising or marketing purposes.

13. Retention period

Unless a specific retention period is stated in this privacy policy, we only store personal data for as long as necessary for the respective processing purpose.

The data is then deleted or anonymised, unless statutory retention obligations, contractual obligations or legitimate interests require further storage.

Further storage may be necessary in particular:

to fulfil retention obligations under commercial, tax, association or grant law;
to document business transactions and project measures;
to assert, exercise or defend legal claims;
to investigate security incidents.

14. Rights of data subjects

If we process your personal data, you have, subject to the statutory requirements, in particular the following rights:

Right of access

Pursuant to Art. 15 GDPR, you have the right to request information about whether, and which, personal data we process about you.

Right to rectification

Pursuant to Art. 16 GDPR, you have the right to request the correction of inaccurate or the completion of incomplete personal data.

Right to erasure

Pursuant to Art. 17 GDPR, you have the right to request the erasure of your personal data, provided there are no statutory or other permissible grounds for further storage.

Right to restriction of processing

Pursuant to Art. 18 GDPR, you have the right, under the statutory requirements, to request the restriction of the processing of your personal data.

Right to data portability

Where processing is based on consent or a contract and is carried out using automated means, you have the right pursuant to Art. 20 GDPR to receive the personal data you provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.

Right to object

Pursuant to Art. 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data where the processing is based on Art. 6 (1)(e) or (f) GDPR.

We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future, pursuant to Art. 7 (3) GDPR.

The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, you can contact the following address:

Thüringer Agentur für Europäische Programme e. V.
Eugen-Richter-Straße 44
99085 Erfurt
Email: datenschutz@thaep.de

15. Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

The supervisory authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit
Häßlerstraße 8
99096 Erfurt

Postal address:
Postfach 90 04 55
99107 Erfurt

Phone: +49 361 57-3112900
Email: poststelle@datenschutz.thueringen.de
Website: https://www.tlfdi.de/

You may also contact any other data protection supervisory authority responsible under Art. 77 GDPR.

16. Automated decision-making and profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place in connection with the use of this website.

17. Changes to this privacy policy

We reserve the right to adapt this privacy policy if the legal situation, the technical systems used, the functionality of the website or the nature of the data processing changes.

The version published on this website at any given time applies.

Last updated: August 2026