Privacy policy

Your privacy matters to us. On this page we explain which data we collect, why we process it and what rights you have. If you have any questions, you can reach us at any time at info@baeumefuermorgen.at.

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Bäume für Morgen, non-profit association
Sonnenweg 12
5751 Maishofen
Austria

Phone: +43 660 6891289
Email: info@baeumefuermorgen.at

ZVR number: 1944271770
VAT ID: ATU80095308

We have not appointed a data protection officer, as the legal requirements for doing so are not met. Please send all data protection matters to info@baeumefuermorgen.at.

2. Principles

  • We only process the data we actually need for our work.
  • We do not store data for longer than the purpose or a statutory retention obligation requires.
  • Data is transmitted in encrypted form (TLS/HTTPS).
  • We do not sell data and do not pass it on to third parties, except to the service providers named here, with your consent or where we are legally obliged to do so.

3. Visiting the website and server log files

When you visit our website, technical access data transmitted by your browser is processed automatically: IP address, date and time of access, page visited, amount of data transferred, browser type and version, operating system and, where applicable, the referring page.

Purpose: technical operation, stability and security of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Storage period: this data is kept only briefly for error analysis and to prevent misuse, and is then deleted.

The website is operated by our hosting provider, which processes this data on our behalf. Where data is processed outside the EU in this context, this is done on the basis of the European Commission's standard contractual clauses.

4. Cookies and local storage

We do not use analytics, tracking or marketing cookies. No advertising pixels and no audience measurement run on this website.

We only use technically necessary cookies and local storage entries that are required for operation, in particular to keep you logged in to the partner area. Without them, the login does not work.

Legal basis: Art. 6(1)(f) GDPR and § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) (technically necessary storage).

You can delete or block cookies at any time in your browser settings. In that case, logged-in areas may not be available to you.

5. Contacting us and forms

If you contact us via a form on this website or by email, we process the information you provide: usually name, email address, optionally phone number, type of enquiry and your message. Depending on the form, further details are added, such as company or hotel name, team size or details of a site being offered.

Purpose: handling and answering your enquiry.
Legal basis: Art. 6(1)(b) GDPR if the enquiry is aimed at a contract or partnership, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Storage period: until your enquiry has been fully dealt with. If it leads to a collaboration, the periods set out in section 9 apply. Otherwise we delete the enquiry after three years at the latest.

6. User account and partner area

You can create an account for the partner and impact area. In doing so, we process your email address, password (stored in encrypted form only), name and the details of your account, such as hotel or company name, address and contact person. In addition, there is the data generated during ongoing use: monthly reports, trees planted, contributions, invoices, certificates and login times.

Purpose: providing the account, managing the partnership, documenting the plantings carried out.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract or partnership).
Storage period: for as long as the account exists. Once the account is deleted, the data is removed unless a statutory retention obligation applies (see section 9).

This data is stored in a database operated by our service provider Supabase. The server is located in the European Union (Frankfurt, Germany). Supabase acts as our processor.

7. Donations and payments

For donations, contributions and invoices, we process name, email address, billing address, amount, time of payment and payment reference.

Payments are processed via Stripe, PayPal and EPS. Full payment details such as credit card or account numbers are entered directly with the respective payment service provider and are not stored by us. The providers' privacy policies also apply to this processing:

Purpose: processing the payment, accounting, issuing confirmations.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention obligations).
Storage period: seven years in accordance with § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung).

8. Land offers (Protected Forests)

If you offer us a plot of land, we process your contact details and the details of the land: location, size, condition, where applicable photos and proof of ownership, and later on the contract and purchase processing data.

Purpose: reviewing and assessing the land, negotiating and completing a purchase.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).
Storage period: until the review is completed. If a purchase goes ahead, the statutory retention period of seven years applies; beyond that, we keep documents relating to the acquisition of the property for as long as they are needed as proof of ownership.

9. Photos at planting days

At plantings, team days and events, photos and videos are taken, which we use for reports, our website and our social media channels.

Legal basis: Art. 6(1)(a) GDPR (consent); for general shots without identifiable individuals, Art. 6(1)(f) GDPR (legitimate interest in documenting our work).

You can object to publication or withdraw any consent you have given at any time, informally, by writing to info@baeumefuermorgen.at. We will then remove the images concerned from our own channels.

10. Recipients of your data

We only pass on data where this is necessary for the purposes stated. Recipients are:

  • our hosting provider for operating the website,
  • Supabase as operator of the database (server location EU),
  • the payment service providers Stripe, PayPal and EPS,
  • our tax advisers and accountants in the context of statutory obligations,
  • authorities, where we are legally obliged to provide information.

Agreements pursuant to Art. 28 GDPR are in place with all processors. Partner businesses do not receive any personal data of other users.

11. Your rights

At any time, you have the following rights:

  • access to the data stored about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR), unless a retention obligation prevents this,
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • objection to processing based on legitimate interest (Art. 21 GDPR),
  • withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR).

To exercise these rights, simply send an informal message to info@baeumefuermorgen.at. We will reply within one month.

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
dsb@dsb.gv.at

12. Data security

The website is encrypted throughout via TLS/HTTPS. Access to account and partner data is restricted by authentication and permission rules at database level. Passwords are stored as hashes only. Only those people in the association who need access to personal data for their tasks have it.

13. Changes to this privacy policy

We update this policy when our processing activities or the legal requirements change. The current version is always available at baeumefuermorgen.at/datenschutz .

Last updated: 16 September 2026. This English version is provided for convenience; only the German version is legally binding.