Privacy Policy
Privacy Policy
Last updated: August 2026
Data Controller
The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
E+M People Act Platform FlexCo
Paulinengasse 18/5/17
1180 Vienna
Austria
Email: contact@save-europe-act.com
The controller determines the purposes and means of processing personal data in connection with the website and the "Save Europe Act" campaign.
Data Protection Officer
We have appointed a Data Protection Officer. You can reach our Data Protection Officer at the following email address:
Datenschutz@save-europe-act.com
You can contact our Data Protection Officer at any time with questions, suggestions, or complaints regarding the processing of your personal data as well as to exercise your rights under data protection law.
General Information on Data Processing
The protection of your personal data is an important concern for us. Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, your name, email address, IP address, location data, communication content, and details provided when supporting the campaign.
We process personal data only to the extent permitted by law. This is particularly the case when processing is necessary to provide our website, process your request, carry out an action requested by you, fulfill legal obligations, or safeguard our legitimate interests. Where consent is required, processing takes place only after it has been granted.
Supporting or participating in a political campaign may reveal political opinions or beliefs. Such information may constitute special categories of personal data within the meaning of Art. 9(1) GDPR. Insofar as we process such data, this is generally done on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.
Provision of the Website and Server Log Files
When accessing our website, technically required data is processed. This may include in particular:
IP address;
Date and time of access;
Requested website or file;
Previously visited website, provided your browser transmits this information;
Browser type, browser version, and operating system;
Device information;
Technical log, security, and error data.
Processing is carried out to technically provide the website, ensure its stability and security, analyze technical errors, and detect and prevent attacks or misuse.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, functional, and efficient provision of our online offer.
Hosting and Content Delivery Network
For hosting, content delivery, and technical securing of the website, we use infrastructure services from:
BunnyWay d.o.o.
Dunajska cesta 165
1000 Ljubljana
Slovenia
BunnyWay d.o.o. provides services primarily in the areas of hosting, Content Delivery Network (CDN), data transmission, caching, infrastructure protection, and video streaming. When using the website, IP addresses and technical access data in particular may be processed via the infrastructure of this service provider.
Processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest consists in the fast, stable, and secure delivery of the website.
Since a Content Delivery Network technically operates with globally distributed server locations, processing or routing of technical access data outside the European Union or the European Economic Area cannot be completely excluded. Where personal data is transferred to third countries, this occurs only in compliance with the requirements of Art. 44 et seq. GDPR.
Supporting and Signing the Campaign
When you support or sign the campaign, or register for future participation, we process the data you enter into the respective form. Depending on the specific design of the form, this may include:
First and last name;
Email address;
Country of residence, place of residence, postal code, or other regional details;
Nationality, insofar as required for the respective process;
Details regarding your support or registration;
Consents for communication and other processing purposes;
Timestamp of submission;
Technical data to prevent abuse and duplicate entries;
Proof of granting, modifying, or revoking consent.
The processing serves to receive, manage, and document your support, organize the campaign, prevent abusive or automated entries, and communicate regarding your support.
Insofar as supporting the campaign allows conclusions to be drawn about your political opinions or beliefs, processing takes place on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR.
To the extent that individual processing operations are required to carry out your explicitly requested support, Art. 6(1)(b) GDPR may additionally apply. For technical security measures, defense against abuse, and documentation of consents, we additionally rely on Art. 6(1)(f) GDPR.
You may revoke any consent granted at any time with effect for the future. The lawfulness of processing carried out prior to revocation remains unaffected.
Technical Processing of Form Data
Technical backend service providers may be used for the secure receipt, validation, and forwarding of form inputs. These providers process form data in particular for technical verification, abuse prevention, secure transmission to our systems, and ensuring form functionality.
Where the service provider FastAPI Labs, Inc., 2261 Market Street, STE 10109, San Francisco, CA 94114, USA, is used for this purpose, the form data submitted by you as well as technical data may be processed to verify and secure transmission.
Processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest consists in the secure, reliable, and abuse-protected handling of form submissions. Insofar as special categories of personal data are affected, processing additionally takes place on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.
Where data is transferred to the USA or other third countries, this occurs only under the conditions of Art. 44 et seq. GDPR.
Contacting Us
If you contact us by email or via a contact form, we process the data you communicate to us. This includes, in particular, your name, email address, any additional contact details, and the content of your message.
Processing takes place to manage your request and to communicate with you. The legal basis is Art. 6(1)(b) GDPR, insofar as your request is related to taking steps at your request prior to entering into a contract or executing a request. Otherwise, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate and traceable processing of incoming inquiries.
Email Communication via Alterncloud
For sending and receiving emails as well as managing campaign-related electronic communications, we use the email service Alterncloud.
Through Alterncloud, the following personal data in particular may be processed:
Name and email address;
Content of emails and attachments;
Sender and recipient data;
Dispatch and receipt timestamps;
Technical delivery information;
IP addresses and server log data, insofar as required for technical provision and security;
Delivery status information, such as successful or failed delivery notices.
Processing takes place to process contact requests, communicate regarding your support, send organizational notices, and dispatch requested confirmation and administrative emails.
The legal basis for required confirmation and administrative emails is Art. 6(1)(b) GDPR, insofar as these are necessary to carry out an action requested by you. Otherwise, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest consists in secure, efficient, and traceable communication.
Where Alterncloud processes personal data on our behalf, this is done on the basis of a Data Processing Agreement pursuant to Art. 28 GDPR. If data processing takes place outside the European Union or the European Economic Area, it occurs only under the conditions of Art. 44 et seq. GDPR.
Confirmation Emails and Double Opt-In
If you provide your email address in connection with a support action, registration, or information request, we may send you confirmation, verification, and administrative emails. This serves in particular to prove that the email address is actually used by you and to prevent fraudulent registrations.
Where the service Resend / Plus Five Five, Inc. is used for this purpose, processing takes place via:
Plus Five Five, Inc. / Resend
2261 Market Street #5039
San Francisco, CA 94114
USA
In doing so, your email address, dispatch timestamp, message content, and technical dispatch data are processed in particular.
Processing takes place on the basis of Art. 6(1)(b) GDPR, insofar as the message is necessary to carry out your requested action, and additionally on the basis of Art. 6(1)(f) GDPR to secure and document the registration.
Where data is transferred to the USA, this occurs only in the presence of appropriate safeguards pursuant to Art. 44 et seq. GDPR.
Newsletters and Campaign Updates
If you subscribe separately for updates or give explicit consent within a form, we use your email address and any other voluntarily provided contact data to send you information regarding:
Campaign progress and results;
Opportunities for participation and support;
Events and actions;
Organizational notices;
Information on donation and funding options;
Information on content-related follow-up projects, provided this is covered by your consent.
The dispatch of newsletters, political campaign information, or donation appeals takes place exclusively on the basis of your prior explicit consent pursuant to Art. 6(1)(a) GDPR. Insofar as communication may allow conclusions regarding political opinions or beliefs, processing additionally takes place on the basis of Art. 9(2)(a) GDPR.
You can revoke your consent at any time with effect for the future. You may use the unsubscribe link in any email or contact us at contact@save-europe-act.com or Datenschutz@save-europe-act.com.
Following a revocation or unsubscription, we may store your email address in a blocklist. This serves to ensure that you do not receive any further unsolicited emails. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in complying with your revocation and legally securing the suppression of further mailings.
Donations via Donorbox
For receiving and technically processing donations, we link to the external donation platform Donorbox. When you click the donation link, you leave our website and are redirected to a Donorbox website.
In the context of a donation, the following personal data in particular may be processed:
Name;
Email address;
Billing and contact data;
Donation amount and currency;
Payment method;
Payment and transaction data;
Details on recurring donations;
Information required for tax or accounting purposes, if applicable.
The processing of your payment data is generally carried out by Donorbox and the payment service providers selected by you under their own privacy policies. Depending on the chosen payment method, additional providers (e.g., credit card companies or payment processors) may process personal data on their own responsibility.
Insofar as we receive or process donor data ourselves, we use it to confirm and manage your donation, for accounting, to fulfill statutory tax and commercial retention obligations, and to establish, exercise, or defend legal claims.
Legal bases are Art. 6(1)(b) GDPR (where processing is necessary to process the donation), Art. 6(1)(c) GDPR (to fulfill statutory retention obligations), and Art. 6(1)(f) GDPR (based on our legitimate interest in proper donation administration).
Use of donor data for newsletters, political communications, or further donation requests takes place only if separate explicit consent has been given. Insofar as processing may reveal political beliefs, explicit consent under Art. 9(2)(a) GDPR is additionally required.
When using Donorbox and connected payment service providers, data may be processed outside the European Union or European Economic Area. The privacy policies of the respective providers apply to these independent processing activities.
Volunteering and National Coordination
If you offer your help as a volunteer, local contact person, or for national coordination, we process the information you submit. This may include:
Name and contact details;
Location or area of operation;
Language skills;
Availability;
Organizational skills and responsibilities;
Details on the desired type of involvement.
Processing serves the organization, coordination, and execution of campaign activities, making contact, arranging participation opportunities, and establishing local or national structures.
Insofar as details allow conclusions regarding political opinions or beliefs, processing is based on your explicit consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.
Data is passed on to national coordinators, local teams, or partner organizations only to the extent necessary for your intended participation, if you have consented, or if another legal basis exists.
hCaptcha for Automated Input Prevention
To protect our forms and technical infrastructure against spam, abuse, fraudulent entries, and automated attacks, we use hCaptcha.
Provider:
Intuition Machines, Inc.
2211 Selig Drive
Los Angeles, CA 90026
USA
hCaptcha may process technical data required to distinguish human users from automated systems. This may include IP address, browser and device information, operating system, interaction data, timestamps, and other technical characteristics.
Processing serves to ensure IT security, protect forms, and prevent automated or abusive submissions.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in system security and the integrity of submitted form data. Insofar as access to information on your end device is necessary and strictly required for the form function requested by the user, processing occurs pursuant to § 25(2) TDDDG.
Where data is transferred to the USA, this occurs only under the conditions of Art. 44 et seq. GDPR.
Web Analytics with Fathom Analytics
We use Fathom Analytics to statistically analyze website usage and to further develop our offering technically and contextually. The evaluation serves to create aggregated usage statistics.
Analysis is activated only if you have consented via our consent banner. The legal basis is Art. 6(1)(a) GDPR. Insofar as information is stored on or read from your end device, this additionally occurs on the basis of § 25(1) TDDDG.
You can revoke or modify your consent at any time with effect for the future via the cookie settings on this website.
Video Integration via Bunny.net Stream
A video may be embedded on our website via Bunny.net Stream. The video is not loaded automatically. A connection to Bunny.net's servers is established only when you actively start playback and consent to the integration.
During playback, your IP address, technical browser and device information, timestamps, and cookies or similar technologies may be processed. This processing is required to technically deliver video content to your device.
Processing occurs exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Insofar as information is stored on or read from your end device, this additionally occurs on the basis of § 25(1) TDDDG.
You can revoke your consent at any time via this website's cookie settings with effect for the future.
Cookies and Consent Management
Our website uses cookies and similar technologies. Cookies are small text files that can be saved on your device. Some cookies are technically required to operate the website safely and functionally. We use additional technologies—especially for reach measurement or external media integration—only with your consent.
Technically Required Cookies and Technologies
Technically required cookies and similar technologies are necessary to provide essential website functions, save your settings, ensure website security, or protect forms against abuse.
Processing occurs on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of our online offer.
Optional Media Content
External video content via Bunny.net Stream is loaded only after your active consent. You can revoke consent at any time via cookie settings. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR.
Statistics and Reach Measurement
Statistical analysis tools, particularly Fathom Analytics, are used only after your consent. Consent can be revoked or changed in cookie settings at any time. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR.
Social Media Links and External Websites
Our website contains links to external platforms and social networks, specifically X, Instagram, Telegram, WhatsApp, or similar services. These are integrated strictly as external links.
Personal data is transferred to these providers only when you actively click on such a link. Once clicked, the privacy policies of the respective platform operator apply. We have no influence over the processing of personal data by these external providers.
Recipients of Personal Data
In the scope of our operations, personal data may be transferred to the following categories of recipients:
Hosting, content delivery, and technical infrastructure service providers;
Service providers for form processing, validation, and abuse prevention;
Email service providers, specifically Alterncloud;
Providers for confirmation and transactional emails, specifically Resend;
Web analytics providers, specifically Fathom Analytics;
Video hosting and delivery providers, specifically Bunny.net;
Donation platforms, payment service providers, and accounting providers, specifically Donorbox and integrated payment processors;
National coordinators, local teams, or partner organizations, insofar as required for your requested participation;
Authorities, courts, legal advisors, or other bodies, insofar as we are legally obligated or required to do so to enforce or defend against legal claims.
We do not sell or rent personal data.
Data Transfers to Third Countries
Some of the service providers we use are located outside the European Union or the European Economic Area, or process data there. Transfer of personal data to a third country occurs only if the special conditions of Art. 44 et seq. GDPR are met.
This may occur via an adequacy decision of the European Commission, recipient certification under the EU-U.S. Data Privacy Framework, entering into EU Standard Contractual Clauses, or other suitable safeguards.
Where necessary, we implement supplementary technical and organizational measures to guarantee an adequate level of data protection.
Retention Period
We store personal data only as long as necessary for the respective purpose. Extended storage occurs only if statutory retention duties exist or data is required for the establishment, exercise, or defense of legal claims.
Support, consent, and registration data: Retained generally for the duration of the campaign and beyond, as needed to document consent, fulfill legal proof/retention duties, or protect legitimate interests.
Contact inquiries: Deleted once processing is complete and no statutory retention duties or legitimate interests oppose deletion.
Donation and accounting data: Retained for the duration of applicable tax and commercial retention periods.
Your Rights
Under statutory provisions, you have the following rights:
Right of access to your personal data pursuant to Art. 15 GDPR;
Right to rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR;
Right to erasure of your personal data pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to object to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21 GDPR;
Right to revoke granted consent at any time pursuant to Art. 7(3) GDPR;
Right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.
To exercise your rights, you can contact us at contact@save-europe-act.com or reach our Data Protection Officer at Datenschutz@save-europe-act.com.
Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.
For the controller in Austria, the competent authority is:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at/