Privacy Policy

1 · Controller

2 · General

We take the protection of your personal data seriously and treat your data confidentially, in accordance with applicable data-protection law (GDPR · Regulation (EU) 2016/679, Liechtenstein Data Protection Act, where applicable Swiss DSG) and this privacy policy.

The use of our website is generally possible without providing personal data. Where personal data is collected on our pages, this is always done on a voluntary basis.

3 · Hosting · Server log files

We host our website with Red Baron Marketing GmbH & Co. KG. We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. This ensures that the processing of server log files is strictly bound by instructions and compliant with the GDPR.

We automatically collect and store information that your browser transmits to us (server log files): browser type and version, operating system, referrer URL, host name, time of the server request, IP address (truncated after 7 days). This data is not assignable to specific persons and is used solely for security and statistical evaluation in aggregated form.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in providing a secure website).

4 · Cookies & Consent Management

Our website uses the Usercentrics consent management platform to obtain your consent for the storage of certain cookies and to document this in a privacy-compliant manner. When you enter our website, the following log data is transferred to Usercentrics: your IP address, date and time of consent, browser information, and your consent status.

Usercentrics stores a cookie in your browser to be able to allocate the consents given or their revocation to you. The data is stored until you request us to delete it, delete the Usercentrics cookie yourself, or the purpose for data storage no longer applies.

Legal basis: Art. 6 (1)(c) GDPR (compliance with the legal obligation to obtain consent).

5 · Contacting us

If you contact us by e-mail or contact form, your information will be stored for the purpose of processing the inquiry and for follow-up questions. We do not pass on this data without your consent.

Legal basis: Art. 6 (1)(b) GDPR (contractual / pre-contractual measures) or Art. 6 (1)(f) GDPR (legitimate interest in responding).

6 · Plugins, Tools, and Social Media

Functions of the Instagram service are integrated on our website. These functions are offered by Meta Platforms Ireland Limited. We only use the Instagram plugin after your explicit consent (two-click solution / consent banner).

If the social media element is active, a direct connection is established between your device and the Instagram server. Instagram thereby receives information about your visit to this website. If you are logged into your Instagram account, you can link the contents of this website to your Instagram profile by clicking the Instagram button.

Data transfer to the US is based on the Standard Contractual Clauses (SCC) of the European Commission.

Legal basis: Art. 6 (1)(a) GDPR (consent).

External Web Fonts

We use external web fonts (Google Fonts) for consistent presentation. When loading the fonts, your browser establishes a connection to Google servers. We do not use tracking scripts from advertising partners (no Facebook pixel, no Google Tags, no LinkedIn pixel, no TikTok pixel).

Note: If you have privacy concerns regarding Google Fonts, a local embedding is in preparation.

7 · Audio and Video Conferencing

We use Zoom for communicating with donors, partners, and the foundation board. If you communicate with us via Zoom, your data will be collected by us and the provider.

The conferencing tools collect all data that you provide to use the tools (e.g. e-mail address and/or your telephone number). Furthermore, the conferencing tools process the duration of the conference, start and end, number of participants, and other "contextual information" in connection with the communication process (metadata).

We have concluded a Data Processing Agreement (DPA) with Zoom. Data transfer to the US is safeguarded by the Standard Contractual Clauses (SCC) of the European Commission and the Data Privacy Framework.

Legal basis: Art. 6 (1)(b) GDPR (contractual performance or pre-contractual measures) or Art. 6 (1)(f) GDPR (legitimate interest in effective communication).

8 · Your rights

You have the following rights vis-à-vis the controller:

• Access to your processed data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, at any time, without giving reasons
• Lodge a complaint with a supervisory authority — in Liechtenstein with the Datenschutzstelle (Vaduz), or with your local supervisory authority

Please send inquiries to privacy@trudyederlefoundation.org.

9 · Storage period

We store your personal data only as long as required for the respective processing or as legal retention obligations require. After the purpose ceases or retention periods expire, the data is deleted or blocked.

10 · TEF Letters & Updates Under development

The TEF Letters & Updates are four segmented interest lists — T-R-U-D-Y Letter, Find Your Water Updates, TEF Impact Brief, Learning Archive Notes plus optional Press / Research Updates. Sending will begin only once privacy notice, double opt-in, and editorial calendar are fully in place.

(1) Purpose of processing

We use your e-mail address and your selection to send you the letters you have subscribed to. The optional fields name, organization, country, and role help us tailor the content meaningfully — they are voluntary.

(2) Legal basis

Your consent under Art. 6 (1)(a) GDPR. Confirmation occurs via double opt-in: only after clicking the confirmation link in the confirmation e-mail will you be added to the list.

(3) Storage period

• Active sign-ups: until withdrawal or until the relevant letter format is discontinued.
• Inactive sign-ups (no engagement for 24 months): re-permission inquiry; without reply, deletion after 6 further months.
• Unsubscribed addresses are stored in hashed form for suppression purposes (plaintext deleted).
• Logs (date, time, confirmation click): 12 months, then pseudonymized.

(4) Recipients

We use a newsletter-tool provider as a data processor (DPA). Data is not shared with advertising third parties, not with sponsors, not with partners. Tool servers preferably in the EEA or Switzerland.

(5) What we do NOT collect

• Health status, psychological crisis, medical diagnosis, injury details
• Date of birth for minors — TEF does not address children directly
• Sensitive biographical data, financial hardship
• Religion, sexual orientation, political opinion

(6) Tracking

We use no open / click tracking without separate cookie consent. The sign-up page contains no marketing pixels (no Facebook, no Google, no LinkedIn).

(7) Your rights regarding the letters

You can unsubscribe at any time via one-click unsubscribe in every dispatch. In the preference center, you can deactivate individual letters without leaving entirely. Inquiries to privacy@trudyederlefoundation.org.

11 · Safety Notice

12 · Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always meets current legal requirements or reflects changes to our services. The version in force at the time applies to future inquiries or sign-ups.

As of: May 2026 · v1.0 · Trudy Ederle Foundation, Schaan, Liechtenstein.