Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

OpenWay, operated by Leander
Email: contact@openway.charity

Our Legal Notice has further information about this website. We have not appointed a data protection officer, because we are not legally required to.

2. The short version

• We do not use cookies, and we store nothing on your device.
• We do not use analytics, advertising, tracking pixels or social media plug-ins.
• Our fonts, scripts and styles are served from our own domain. Your browser does not contact any other third party when you open our pages.
• Our website is hosted by Vercel. Like every web host, it processes technical connection data to deliver the pages (section 3).
• If you email us, we process what you send us to reply (section 5).
• We do not sell personal data, and we do not make automated decisions about you.

3. Hosting and server logs

Our website is a static website hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). Vercel delivers our pages from a global network of servers. Each request is answered by a server close to you, so your request may be handled in a country other than your own.

What is processed

When you open a page, your browser sends technical data to the server, and the server records it in log files. This includes:

• your IP address,
• date and time of the request,
• the requested page or file, the HTTP status and the amount of data sent,
• the page you came from (referrer), if your browser sends it,
• browser type, operating system and similar information from the user agent,
• an approximate location (city and country level) derived from the IP address, used for routing.

Why, and on what legal basis

The processing is necessary to deliver the website to you, to keep it stable and secure, and to defend against attacks and abuse. Our legitimate interest in a secure and reliably running website is the legal basis (Art. 6(1)(f) GDPR). We do not use this data to identify you, and we do not combine it with other data.

Vercel as our processor

Vercel processes this data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Vercel keeps such technical logs only for a short period. We do not evaluate the logs ourselves and we have not enabled any analytics or logging add-ons. Further information is in Vercel’s privacy notice.

Vercel Inc. is based in the United States. For the associated data transfer, see section 8.

4. Fonts

This website uses the typefaces Bricolage Grotesque, Instrument Sans and IBM Plex Mono. They are hosted on our own server and loaded from our own domain. Your browser does not connect to Google or any other font service, and no data about your visit is passed on for this purpose. The fonts are licensed under the SIL Open Font License 1.1; the license texts are available in our fonts folder.

5. Contacting us

If you write to us by email, we process your email address, the content of your message and any other details you give us. We use them to answer your inquiry and, if it leads to cooperation, to prepare and carry it out.

Legal basis is Art. 6(1)(b) GDPR if your message relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR, based on our interest in answering inquiries effectively.

Our mailbox is hosted by Proton AG, Switzerland (Proton Mail). Proton processes messages on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Messages between Proton accounts are end-to-end encrypted; ordinary email from other providers can be read on the way between servers, so please do not send sensitive information by unencrypted email. Further information is in Proton’s privacy policy.

The “Copy address” button on our home page only copies our email address to your clipboard in your browser. It does not send any data to us or to anyone else. The “Send an email” link opens your own email program.

We do not use a contact form, newsletter or user accounts.

6. Cookies and local storage

We do not set cookies and we do not read or write anything in your browser’s local storage, session storage or similar technologies. Because we do not access information on your device, no consent is needed under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), and there is no cookie banner. Whether the page appears in light or dark colors depends solely on your device setting, which is evaluated in your browser and not transmitted to us.

7. External links

Our pages may contain links to other websites, such as Vercel’s privacy notice. If you click one, you leave our website and the privacy policy of the other site applies. We have no influence over their processing. No data is sent to those sites until you click.

8. Transfers to third countries

Vercel Inc. is a US company and may process data in the United States and in other countries where its network operates. Vercel is certified under the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. Data Privacy Framework). The European Commission has found that certified companies ensure an adequate level of protection, which is the legal basis for the transfer under Art. 45 GDPR. In addition, our agreement with Vercel includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for the United Kingdom, the UK Addendum.

Our email provider, Proton AG, is based in Switzerland. The European Commission has decided that Switzerland ensures an adequate level of protection (Art. 45 GDPR), so no further safeguards are needed for this transfer.

You can request a copy of the safeguards using the contact details in section 1.

9. How long we keep data

Technical connection data is kept by our host only as long as needed for the purposes in section 3, which is a short period, and is then deleted or anonymized automatically. Emails are deleted when your inquiry is settled and no statutory retention duty applies. If an email is relevant for commercial or tax purposes, we keep it for the retention period of up to six or ten years under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO). If data is needed to establish, exercise or defend legal claims, we keep it until the claim is time-barred.

10. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15): to know what data we process about you.
• Rectification (Art. 16): to have incorrect data corrected.
• Erasure (Art. 17): to have your data deleted where the legal requirements are met.
• Restriction (Art. 18): to have processing restricted in certain cases.
• Data portability (Art. 20): to receive data you provided in a common, machine-readable format.
• Objection (Art. 21): to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR). We will then stop the processing unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims.

To exercise your rights, write to contact@openway.charity. We do not rely on consent for any processing described here, so there is no consent to withdraw.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide personal data to us; if you do not, we simply cannot answer your message. Access to the website itself does not require you to provide anything beyond the technical data in section 3.

11. Security

Our website is delivered exclusively over an encrypted HTTPS connection (TLS). You can recognize this by the lock symbol in your browser. We also send security headers that, among other things, prevent the pages from loading content from other sources.

12. Changes

We will update this policy when our website or the legal situation changes, for example if we add a contact form, analytics or another service. The current version is always available at this address. The date at the top shows when it was last updated.