Privacy Policy

The organisation responsible for the data described here — the "controller" under Art. 4(7) GDPR — is:

Financial Health Initiative e.V.
c/o Professur für Digital Finance
Arcisstraße 21
80333 München, Germany
Board: Emanuel Renkl, Moritz Nardini, Andreas Wittmann
Register of associations: VR 210115
Email: info@financial-health-initiative.org
Phone: +49 151 50495732
Imprint: https://financial-health-initiative.org/imprint

If you have any questions about your data or want to exercise your rights, just email us at info@financial-health-initiative.org.

When you fill in a form on this website, we use what you enter to deal with your request, and we save it in our database. Giving us the information is your choice, but we can't handle your request without it.

Newsletter: we use your email address — and, if you give them, your name, language and the page you signed up from — to send you our newsletter. We do this with your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time: use the link at the bottom of any newsletter email, visit our unsubscribe page, or simply email us. Unsubscribing doesn't make the emails we already sent unlawful.

Research requests and report downloads: we use your name, email address, organisation and whatever else you tell us to answer you, send you the report you asked for, and follow up where it makes sense. We do this because we have a legitimate interest in responding to you (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR).

Donation enquiries: we use what you send us to answer your enquiry, again on the basis of our legitimate interest (Art. 6(1)(f) GDPR). If you ask for a donation receipt (Zuwendungsbestätigung), we also use the postal address you give us to issue it. Once you have actually donated and we have issued a receipt, German tax law requires us to keep the related records for several years (Art. 6(1)(c) GDPR).

Whenever a form comes in, our email provider sends a short notification to our team so we can get back to you. You can see who runs our database and email under "Hosting and Service Providers".

If you email or call us instead of using a form, we use the details you give us — such as your name, email address or phone number and the content of your message — only to handle your request. The legal basis is our legitimate interest in responding to you, or taking steps towards an agreement where relevant (Art. 6(1)(f) and (b) GDPR). We delete this correspondence once it is no longer needed and no retention period requires us to keep it. Please remember that ordinary email is not encrypted while in transit.

We keep the technical side of this website deliberately simple:

• No tracking or marketing cookies. We don't use cookies to advertise to you or to follow you across other websites. Your language preference lives in the page address, not in a cookie.
• Privacy-friendly statistics only. Our usage statistics are cookieless and anonymous (see "Website Statistics" below).
• No third-party embeds. We don't embed YouTube videos, Google Maps, social-media widgets, reCAPTCHA or similar tools that would load content from other companies and share your IP address with them.
• Self-hosted fonts. The fonts you see are stored on our own hosting and loaded from there, so displaying this page sends no request to Google Fonts.

Because of this, no cookie banner is needed.

To understand how our website is used and to keep it fast, we use two privacy-friendly services from Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA): Vercel Web Analytics and Vercel Speed Insights. Web Analytics counts page views and visitors; Speed Insights measures loading performance, together with rough information such as device type, browser, operating system and country. Both work without cookies, store no IP addresses and don't identify you personally — so the figures we see are aggregated and anonymous. The legal basis is our legitimate interest in running and improving our website (Art. 6(1)(f) GDPR). More details: https://vercel.com/legal/privacy-policy.

To run this website we rely on a few service providers, each bound by a data processing agreement (Art. 28 GDPR):

• Supabase runs our database. Your data is stored on servers in Frankfurt, Germany, so it stays in the EU. Because Supabase is a US company, we cannot completely rule out access from the US; if that happens, it is covered by EU-approved standard contractual clauses.
• Resend sends our emails — both the notification to our team about your enquiry and our internal reports — so your name, email address and message pass through it. Resend is a US company; transfers to the US are covered by the EU-US Data Privacy Framework and, in addition, EU standard contractual clauses.
• Vercel hosts the website and delivers it through servers in Europe. Vercel is also a US company and is likewise covered by the EU-US Data Privacy Framework and EU standard contractual clauses.

These providers handle your data only to keep this website running securely and reliably, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

On our team page we link to the personal LinkedIn profiles of some of our board members. These are ordinary links (a plain "<a href>"): nothing from LinkedIn is embedded in our pages, and no LinkedIn buttons, plug-ins or trackers run on this website. We only learn that you clicked a link; what happens after you arrive on LinkedIn is governed by LinkedIn's own privacy policy.

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, in line with Art. 32 GDPR. This website is served over an encrypted HTTPS connection, access to our database is restricted, and the providers we rely on (see "Hosting and Service Providers") are bound by data processing agreements and maintain their own security measures. No system can be perfectly secure, but we keep our setup deliberately small to limit the risk.

We keep your personal data only for as long as we actually need it, and then we delete it. Where the law requires us to keep something longer, we lock it away and stop using it until we are allowed to delete it (the "storage limitation" principle, Art. 5(1)(e) GDPR). In short:

• Newsletter: we keep your details until you unsubscribe. After that we delete your subscriber profile and keep only a small record that you once subscribed and then unsubscribed — your email address and the dates — for up to three years, so we can show that your consent was handled properly.
• Research requests, report downloads and donation enquiries that do not lead to a donation: deleted within 12 months of us finishing your request, unless we are still in contact with you.
• Records of actual donations and donation receipts (Zuwendungsbestätigungen): German tax law requires us to keep these for up to ten years after the year of the donation; we delete them once that period ends.

We regularly and automatically find data that has reached the end of its retention period and remove it.

Under the GDPR you have the following rights regarding your personal data. To use any of them, just email us at info@financial-health-initiative.org — it's free, and we'll respond as quickly as we can.

• Access: ask whether we hold data about you and get a copy of it (Art. 15 GDPR).
• Rectification: have inaccurate data corrected or incomplete data completed (Art. 16 GDPR).
• Erasure: have your data deleted where there is no longer a reason to keep it (Art. 17 GDPR).
• Restriction: ask us to pause processing while a question about your data is being sorted out (Art. 18 GDPR).
• Portability: receive the data you gave us in a common, machine-readable format, or have it sent to another organisation (Art. 20 GDPR).
• Objection: object to processing we base on our legitimate interest, including any direct marketing (Art. 21 GDPR).
• Withdraw consent: where we rely on your consent (for example, for the newsletter), you can withdraw it at any time with effect for the future. This doesn't affect anything we did lawfully before you withdrew it (Art. 7(3) GDPR).

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
https://www.lda.bayern.de

We may update this policy from time to time, for example when we add a feature or when the law changes. The current version always lives on this page; the date below tells you when we last revised it. If we make a significant change to how we handle your data, we'll flag it clearly.

This policy is written to be clear and accurate about what our website actually does. It reflects our best effort and good-practice drafting, not formal legal advice.

Last updated: June 2026.