Unifest

Privacy policy

1. Controller

The controller for the processing of your data in this volunteer portal is:

[Name of the organisation]
[Postal address]
E-mail: [e-mail address]

2. Data protection officer

We are not required to appoint a data protection officer. For questions about data protection, write to the address above.

3. What this is about

We use this portal to organise volunteering at Unifest: sign-up, shift planning, coordination with leads, attendance, and points and thank-you gifts ("goodies"). We process your data only for this. We do not sell data, show no advertising and use no analytics or tracking services.

4. Visiting the website and server logs

When you open a page, the server processes technically necessary data: IP address, date and time, requested address, status code, amount of data transferred and browser identification. The application itself logs requests without IP address and without query parameters (method, path, status code, duration) to be able to find errors.

The purpose is delivering the pages and secure, stable operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in exactly this purpose.

[Please complete: how long does your web server or reverse proxy keep access logs? For example: "Web server logs are deleted after 14 days."]

5. Cookies

We only use cookies needed for operation:

  • `wichtel_session` keeps you signed in. It is deleted when you sign out and expires after 30 days without use at the latest.
  • `wichtel_locale` remembers the language you chose.
  • `wichtel_admin_edition` remembers, for leads, which edition they are working on in the admin area.

Under § 25(2) no. 2 TDDDG, these cookies need no consent. Further processing is based on Art. 6(1)(b) GDPR.

6. Account and sign-up

For your account we store first and last name, e-mail address, mobile number, your password (only as a secure hash, never in plain text) and your language.

The purpose is your volunteering and coordination around your shifts. The legal basis is Art. 6(1)(b) GDPR (carrying out the agreed volunteering, or steps at your request). We need your name, e-mail address and mobile number to reach you about short-notice changes; without them, volunteering is not possible. You can change or delete voluntary answers in your profile at any time.

If we ask for details that allow conclusions about your health (for example allergies for catering), they are voluntary. We process them only with your explicit consent (Art. 9(2)(a) GDPR), which you give by filling them in and can withdraw at any time by deleting the answer. Only the leads who need them for their task can see them.

7. Shifts, attendance, points and goodies

We store which shifts you sign up for, request or wait for, whether you attended, your points and which goodies you choose or receive. This includes handovers, swap offers and groups you form with others.

The leads of an area see the names and mobile numbers of the people in their shifts so they can reach them. Members of your group see which shifts the group is signed up for. At the volunteer desk your personal QR code is scanned to check you in or hand out goodies.

The legal basis is Art. 6(1)(b) GDPR.

8. E-mails

We send you e-mails about your account (confirming your address, resetting your password) and your shifts (confirmations, changes, reminders). Leads can also send messages to volunteers of their area about volunteering at the festival. The legal basis is Art. 6(1)(b) GDPR.

[Please complete once a mail server is set up: provider (name, location) as processor under Art. 28 GDPR.]

Copies of sent e-mails are deleted after 30 days, undeliverable ones after 90 days.

9. Calendar subscription

You can add your shifts to your calendar with a personal link. Anyone who knows this link sees your shifts, so do not share it; in your profile you can create a new link at any time, and the old one stops working.

10. Maps

We can show places on a map. The map images come from an external provider (tile.openstreetmap.org). They are only loaded when you tap "Load map". Your browser then sends your IP address and the requested map tiles to this provider. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by loading the map. Without that tap, no data goes there.

11. Change log

We log important changes (for example bookings by leads, decisions on requests, points, settings) with time, acting person and IP address, so that it stays traceable who changed what and misuse can be detected. The legal basis is Art. 6(1)(f) GDPR. IP addresses are deleted after 90 days.

12. Who receives your data

  • Leads and the organising team, each only as far as they need it for their task.
  • Our hosting provider: [Please complete: name and location; processing on our behalf under Art. 28 GDPR].
  • The e-mail provider (see above).

We do not pass data to other third parties unless required by law.

13. How long we keep data

Your account exists until you delete it. If you have neither used Wichtel nor had a shift for 24 months, we anonymise your account automatically. We e-mail you two weeks before; if you sign in, your account stays.

When you delete your account or it is anonymised, we remove your name, contact details, profile answers, qualifications and proofs. Upcoming shifts are cancelled. Past shifts, attendance and points remain without any link to you, so that statistics and points stay correct. Statutory retention obligations remain unaffected.

14. Your rights

You have the right to:

  • Access your data (Art. 15 GDPR). Under "My data" in your profile you can download everything we store about you at any time.
  • Rectification (Art. 16 GDPR). You can change most details directly in your profile.
  • Erasure (Art. 17 GDPR). You can delete your account yourself in your profile.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR). The download is a machine-readable JSON file.
  • Withdraw consent with effect for the future (Art. 7(3) GDPR).
  • Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). [Please complete: your competent state authority with address]. An overview of all authorities is available from the Federal Commissioner for Data Protection.

For anything else, just write to the address above.

15. Right to object

Where we process data based on Art. 6(1)(f) GDPR (server logs, change log), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

16. Automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR. Points are calculated by fixed rules that are the same for everyone; waiting lists move up in the order people joined.

17. Security

The connection is encrypted (HTTPS). We store passwords only as a hash (Argon2), and sign-in and access keys only hashed as well. Only people with a matching role can access other people’s data, and only for their area.

Last updated: 8 October 2026