Privacy Policy

1. Controller and contact details

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Jona Foundation – Vision für Uganda e. V.
Elisenstraße 13–15
50667 Cologne
Germany

Represented by the board: Yasemin Kasapoglu (Chair)
Register court: Cologne Local Court, association register no. VR 20965

Email: info@jonafoundation.org
Phone: +49 152 08828655

We have not appointed a data protection officer, as we do not meet the statutory thresholds requiring one. For any questions about data protection, please contact us directly at the email address above. Further details can be found in our legal notice.

2. Access data and hosting

You can visit our website without providing any personal details. Each time a page is requested, the web server automatically records what is known as a server log file. This typically contains the name of the file requested, your IP address, the date and time of the request, the volume of data transferred, the browser you used and your internet provider.

We evaluate this access data solely to keep the site running smoothly and to fend off attacks. The legal basis is our legitimate interest in a secure and functioning website under Art. 6(1)(f) GDPR. We do not keep permanent access logs ourselves; the technical log data is stored briefly by our hosting provider (see below) and deleted automatically, unless it is needed in an individual case to investigate a specific security incident.

Our website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Within the European Union, Cloudflare is represented by Cloudflare Germany GmbH, Rosental 7, 80331 Munich. Cloudflare stores and delivers our pages, distributes them across a global server network, and protects them against malicious traffic and denial-of-service attacks. In doing so, Cloudflare processes the access data described above and may set a technically necessary cookie to distinguish human visitors from automated requests.

Cloudflare acts as our processor; we have concluded an agreement under Art. 28 GDPR. Because your request is answered by whichever data centre is closest to you, processing may also take place outside the European Union. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's Standard Contractual Clauses apply in addition. For details, see Cloudflare's privacy policy.

3. Getting in touch and web forms

When you write to us by email, through a contact form or by any other means, we process the details you provide — usually your name, email address and the content of your message — in order to respond to your enquiry. Mandatory fields are marked as such in our forms; without them we cannot process the enquiry.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries), or Art. 6(1)(b) GDPR where your enquiry relates to a contractual or donation relationship.

We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply. For email correspondence this is generally the case after two years at the latest.

3.1 Form delivery via Formspree

All forms on this website — contact enquiries, ambassador applications, partner and corporate enquiries — are handled technically by the service Formspree, operated by Formspree, Inc., 21750 Hardy Oak Blvd, Ste 104 #26968, San Antonio, Texas 78258, USA. When you submit a form, the data you entered — depending on the form, this may include your name, email address, subject and message — is transmitted to Formspree, stored there temporarily and forwarded to us by email. Formspree also processes your IP address and the time of submission in order to block spam and automated submissions.

Formspree processes this data exclusively on our instructions. We have concluded a data processing agreement with the provider under Art. 28 GDPR. The legal basis for the processing is our legitimate interest in a secure and workable way of being contacted under Art. 6(1)(f) GDPR; where your enquiry concerns a donation or contractual relationship, Art. 6(1)(b) GDPR applies in addition.

As Formspree is based in the United States, this involves a transfer to a third country. The provider is not certified under the EU-US Data Privacy Framework. The transfer is therefore based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which form part of our agreement with Formspree. Despite these safeguards, access by US authorities cannot be entirely ruled out.

We delete incoming messages from the Formspree account once your enquiry has been dealt with conclusively. For more information, see Formspree's privacy policy. If you would rather avoid transmission via a US provider, simply write to us directly at info@jonafoundation.org.

4. Donations and donation receipts

4.1 Processing your donation data

When you donate to us, we process the data required to do so: first and last name, postal address, email address, donation amount, date, payment method and purpose. The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to carry out the donation, together with Art. 6(1)(c) GDPR for the purpose of meeting our tax obligations.

For recurring donations, we additionally store the details needed for the repeat debit until you end the recurring donation. You can cancel at any time, informally, by email.

4.2 Online donations via Donorbox

For online donations we use the donation form provided by Donorbox, operated by Rebel Idealist, Inc., 1520 Belle View Blvd, #4106, Alexandria, VA 22307, USA. The form is loaded on our website as an embedded element. In doing so, your browser establishes a connection to Donorbox servers and transmits your IP address along with technical details about your browser and device.

If you enter data into the donation form, it is transmitted directly to Donorbox and processed there in order to carry out the donation and attribute it to us. Donorbox sets its own cookies for this purpose and passes the payment data on to the relevant payment providers (see 4.3). We receive the donation details from Donorbox, but no complete payment data such as credit card numbers.

The legal basis for processing in the course of the donation is Art. 6(1)(b) GDPR. Where the form is loaded before you enter anything and cookies that are not strictly necessary are set in the process, this only happens on the basis of your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR, which you may withdraw at any time. For further information, see Donorbox's privacy policy.

4.3 Payment providers

Depending on the payment method you choose, we or Donorbox pass on the data required for processing to the relevant payment provider:

• Stripe — Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (privacy policy)
• PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg (privacy policy)
• Bank transfer — here only your own bank and our bank, Sparkasse KölnBonn, process the payment data (IBAN DE45 3705 0198 1936 0514 14).

The payment providers process some of this data under their own responsibility; their privacy policies apply in that respect. The legal basis for passing the data on is Art. 6(1)(b) GDPR.

4.4 Donation receipts and retention

In order to issue donation receipts and meet our obligations as a registered charitable association, we are legally required to retain donation records. Under Section 147 of the German Fiscal Code and Section 50 of the Income Tax Implementing Regulation, the retention period is generally ten years from the end of the calendar year in which the donation was received. The legal basis is Art. 6(1)(c) GDPR. The data is deleted once this period expires.

5. Newsletter

If you sign up for our newsletter, we process your email address and, where provided, your name in order to keep you informed about how our projects are progressing. Registration uses the double opt-in procedure: after signing up, you receive an email containing a confirmation link, and only then do we add you to the mailing list. To document your consent, we store the time of registration and confirmation as well as the IP address used.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future — via the unsubscribe link at the end of every email, or informally at info@jonafoundation.org. Once you unsubscribe, we remove your data from the mailing list. Your email address may then be kept on a suppression list so that you receive no further mailings; the legal basis for this is Art. 6(1)(f) GDPR.

5.1 Delivery provider Brevo

We use Brevo, a service provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to send our newsletter. Your registration data is transmitted to Brevo and stored on servers within the European Union. We have a data processing agreement with Brevo under Art. 28 GDPR. For further information, see Brevo's privacy policy.

5.2 Measuring engagement

Our newsletters contain tracking pixels and individualised links. This lets us see whether and when an email was opened and which links were clicked. We evaluate this purely statistically, in order to tailor our content more closely to the interests of our supporters. This evaluation forms part of your consent under Art. 6(1)(a) GDPR; objecting to it separately is not technically possible, but you may unsubscribe from the newsletter at any time.

6. Ambassador, partner and volunteering enquiries

If you apply to become an ambassador, enquire about a corporate partnership or wish to get involved with us in some other way, we process the details you submit in order to review your enquiry and get in touch with you. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. These enquiries reach us via our website forms, so the notes on Formspree under section 3.1 apply additionally to the technical transmission.

If no collaboration comes about, we delete the data no later than six months after the matter is concluded, unless you have consented to longer storage.

7. Cookies and consent

Cookies are small text files stored on your device. Some are deleted automatically when you close your browser (session cookies), while others remain stored for longer (persistent cookies).

Strictly necessary cookies are used so that basic functions of the website work — for instance, hiding a notice for the duration of a session. The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. No consent is required for these.

Non-essential cookies and technologies — in particular those set by embedded third-party services — are only used if you have expressly agreed via our consent banner. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by opening the cookie settings again or simply sending us a short message.

Independently of this, you can manage or delete cookies through your browser settings. Instructions here: Microsoft Edge · Safari · Chrome · Firefox · Opera

Web analytics: We currently use no analytics or tracking services such as Google Analytics. Should this change, we will inform you here in advance and obtain your consent beforehand.

8. Embedded third-party services

Our website embeds content that is loaded from third-party servers. Your IP address is transmitted to the relevant provider in the process, as it is technically required to deliver the content to your browser.

8.1 Fonts

We use the typefaces Gabarito, Instrument Sans and Spline Sans Mono. These are loaded from the servers of Google Fonts, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address is transmitted to Google in the process and may be forwarded to servers in the United States. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For details, see Google's privacy policy.

8.2 Donorbox donation form

Full information on the donation function embedded via Donorbox and the associated data transfers can be found under section 4.2.

8.3 Images and seals from external providers

Individual graphics on this website — such as the seal of the Transparent Civil Society Initiative — are loaded from an external content delivery network (Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland). Your IP address is transmitted to this provider as well. The legal basis is our legitimate interest in fast and reliable delivery of our content under Art. 6(1)(f) GDPR.

9. Our social media presence

9.1 Links on our website

The social media icons on our website are plain HTML links. Simply opening our page does not establish any connection to the providers' servers. Only when you click a link does the relevant platform open, at which point its own privacy terms apply.

9.2 Instagram and Facebook

We maintain online profiles on Instagram and Facebook, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you visit our profiles, Meta processes your data for its own purposes, in particular for market research and advertising, and creates pseudonymous usage profiles from it. We have no influence over this.

From Meta we receive only aggregated, anonymised statistics on how our pages are used ("Insights"). For this processing we are joint controllers with Meta within the meaning of Art. 26 GDPR; the essential content of that arrangement can be found in the Page Insights information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in effective public outreach for our projects.

Further information: Meta's privacy policy · Instagram notes

9.3 LinkedIn

We also run a company page on LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The same applies here: we receive only aggregated statistics, while LinkedIn processes visitors' data further under its own responsibility. The legal basis is Art. 6(1)(f) GDPR. For details, see LinkedIn's privacy policy.

10. Transfers to third countries

Some of the services named above process data in the United States or transfer it there. In July 2023, the European Commission determined through the EU-US Data Privacy Framework that certified US companies offer an adequate level of data protection. Where a provider is not certified — this applies in particular to Formspree — we base the transfer on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Please note that, despite these safeguards, access by US authorities cannot be entirely ruled out in the case of transfers to the United States, and that you may not have the same legal remedies available to you as you would within the EU.

11. Your rights

As a data subject, you have the following rights in relation to us:

• Access (Art. 15 GDPR) — you can find out what data we process about you.
• Rectification (Art. 16 GDPR) — we must correct inaccurate data without delay and complete incomplete data.
• Erasure (Art. 17 GDPR) — we delete your data unless a statutory retention obligation or another of the grounds set out there applies.
• Restriction of processing (Art. 18 GDPR) — under the conditions set out there.
• Data portability (Art. 20 GDPR) — you receive the data you provided to us in a common, machine-readable format, or have it transmitted to another controller.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future, without this affecting the lawfulness of processing carried out beforehand.
• Complaint to a supervisory authority (Art. 77 GDPR) — see below.

Right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Where processing is for direct marketing purposes, you may object at any time without giving reasons. We will then stop processing for that purpose immediately.

Competent supervisory authority

The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf (ldi.nrw.de). You may also contact the supervisory authority where you live or work.

How to reach us

For access requests, corrections, erasure, withdrawals and objections, an informal message to info@jonafoundation.org or to the postal address given under section 1 is enough. We usually respond within one month.

12. Changes to this privacy policy

We update this policy when our website, our activities or the legal requirements change. The version published here is the one that applies.

Last updated: August 2026