The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Coding for Change e.V.
Enzianstr. 3
85748 Garching bei München
Germany
Represented by the board: David Frank (Chair), Jakob Landbrecht (Deputy Chair)
Email: info@codingforchange.com
We process our users' personal data only insofar as this is necessary to provide a functional website and our content and services. Processing is carried out on the basis of the statutory provisions of the GDPR and the German Federal Data Protection Act (BDSG).
This website uses cookies and comparable storage only where they are strictly necessary for operation, or where you have consented. Nothing that is not strictly necessary is stored before you have made a choice in the cookie banner. You can change or withdraw that choice at any time via "Cookie settings" in the footer. Details of every purpose, recipient and storage duration are set out in sections 7 to 11.
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany.
When you access our website, Hetzner automatically collects data in so-called server log files, which your browser transmits automatically. These are:
- IP address of the requesting device
- Date and time of access
- Name and URL of the retrieved file
- Website from which access is made (referrer URL)
- Browser used and, where applicable, the operating system
This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure and stable operation of the website. The log files are deleted automatically after a short time.
We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.
If you send us an enquiry via the contact form, the data you enter (in particular name, email address and message content) is stored in our database to process the enquiry and in case of follow-up questions. We do not share this data without your consent.
Processing is based on Art. 6(1)(b) GDPR insofar as your enquiry relates to the initiation or performance of a contract or membership relationship, and otherwise on Art. 6(1)(f) GDPR. Our legitimate interest lies in the effective handling of the enquiries addressed to us.
The data you enter in the contact form remains with us until you ask us to delete it or the purpose for storing it ceases to apply (e.g. after your enquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.
Via our application form you can apply to contribute to Coding for Change e.V. The data you submit (in particular name, contact details, information on qualifications and motivation, and any uploaded documents) is stored in our database and processed solely to carry out the application process.
Processing is based on Art. 6(1)(b) GDPR (performance of pre-contractual measures or the establishment of a participation relationship). Insofar as you grant us consent, Art. 6(1)(a) GDPR is the legal basis.
If your application is successful, your data is stored for the duration of your involvement in the association. If your application is unsuccessful, we delete your application data at the latest six months after completion of the application process, unless you have consented to longer storage for future opportunities.
While applications are closed, you can add your email address to a waitlist on our join page in order to be notified as soon as the application period reopens. For this purpose we store your email address and your chosen language setting.
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by sending an informal message to info@codingforchange.com; we will then delete your email address without undue delay.
We use your email address solely for this notification and do not share it with third parties. Your data is deleted as soon as the purpose ceases to apply — at the latest once you have applied or declared your withdrawal.
To understand which channels (e.g. posters, QR codes, newsletters, social-media posts, search engines) bring visitors to our website and how the website is used, we operate our own reach measurement. It runs exclusively on our own infrastructure within the EU; the data is not shared with any third party for this purpose.
We collect:
- the campaign label contained in a tagged link (e.g. the "src" parameter or "utm_*" parameters);
- for untagged visits — if your browser transmits it — the domain of the referring website (e.g. google.com), which we assign to a broad channel (search, social media, referral or direct); we do not store the full address of the referring page;
- the pages you view and individual interactions (starting and submitting a form, reaching the booking widget, completing a booking) and the language setting.
No cookies and no storage on your device: this measurement stores nothing at all on your device — no cookie, no local storage. The campaign label and a randomly generated session number exist only in your browser's working memory for as long as the tab is open, so that a sign-up can be related to the link you arrived through. They are gone when you reload the page, open a new tab, or close the tab. There is no way for us to recognise you on a later visit, on another device, or in another tab.
We store no IP address, create no fingerprint, do not track you across other websites, and do not combine this data with any other source. We count events, not people: we can tell that a poster produced 37 visits and 4 sign-ups, but not how many distinct individuals that was.
If you submit a form (contact, application or waitlist form), the campaign label of your visit is stored together with your submission so that we can understand which measure led to it.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in measuring and improving the reach and effectiveness of our non-commercial public-relations work. Because nothing is stored on or read from your device, § 25 TDDDG does not apply and no consent is required.
Your right to object: if your browser sends a "Do Not Track" or "Global Privacy Control" signal, we collect nothing at all. That is the simplest way to exercise your right to object under Art. 21 GDPR. Your other rights under section 15 remain unaffected.
Storage duration: usage events are deleted automatically after 12 months. A campaign label stored with a form submission is deleted together with that submission.
To ask for and record your cookie choice we use Klaro, an open-source consent tool that we run ourselves on our own servers. No data is transmitted to the tool's developers or to any other third party by the banner itself.
Two strictly necessary cookies are set once you make a choice. They exist only so that we can remember your decision and prove that we obtained it (Art. 7(1) GDPR), which is a legal obligation — they are never used to track you. Legal basis: Art. 6(1)(c) and (f) GDPR; storage is permitted without consent under § 25(2) no. 2 TDDDG.
Together with your decision we store a random consent identifier, which purposes you accepted, the version of the banner text you were shown, the language, and the page you were on. We do not store your IP address or your browser's user agent.
Everything stored on your device:
- cfc_consent – remembers your cookie choice. Strictly necessary, 180 days.
- cfc_consent_id – random id linking your choice to our consent record. Strictly necessary, 180 days.
- cfc-locale – remembers the language you selected. Strictly necessary, 12 months.
- _gcl_aw and _gcl_dc – Google Ads conversion measurement (section 9). Consent, up to 90 days.
- _ga, _ga_* – Google Analytics (section 10). Consent, up to 14 months.
You can withdraw or change your consent at any time via "Cookie settings" in the footer of every page. Withdrawal takes effect immediately, deletes the relevant cookies and stored identifiers, and does not affect the lawfulness of processing carried out beforehand.
As a non-profit association we take part in the Google Ad Grants programme, which provides us with free search advertising. The programme requires us to measure and report which advertisements lead to an actual result. We therefore use Google Ads conversion tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
What happens: if you consent, Google's tag records when you complete one of four actions — joining the waitlist, submitting a membership application, sending a contact enquiry, or booking an appointment — and links it to the advertisement you clicked. For this purpose Google sets the cookies _gcl_aw and _gcl_dc and processes the click identifier contained in the ad link.
Ads personalisation: Google may use this data not only to measure advertising performance but also for the personalisation of advertising. Information on how Google handles data it receives from us is available at https://business.safety.google/privacy/
Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the cookies. Without consent no cookie is set and no identifier is transmitted; the tag then sends Google only aggregated, cookie-free information containing no identifiers.
Transfer to a third country: data may be processed by Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework, so the European Commission's adequacy decision of 10 July 2023 applies. In addition we have concluded the standard contractual clauses with Google.
You can withdraw your consent at any time via "Cookie settings" in the footer.
With your consent we use Google Analytics 4, a service of Google Ireland Limited, to understand how this website is used in aggregate. Google Analytics sets the cookie _ga and a cookie whose name begins with _ga_, and processes a randomly generated identifier, the pages you view, approximate location derived from a shortened IP address, and technical details of your device and browser.
We have configured the service restrictively: "Google signals" is switched off, so no cross-device reporting or data from signed-in Google accounts is added to our reports, and the retention period for event data is set to 14 months. Whether any data reaches Google Ads for advertising purposes is controlled solely by your consent decision (see section 9): without your consent for advertising measurement, no advertising identifiers are set or transmitted.
Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG.
Third country: as described in section 9 — Google LLC, USA, under the EU–US Data Privacy Framework, plus standard contractual clauses.
You can withdraw your consent at any time via "Cookie settings" in the footer.
On our contact page we embed the booking calendar of Cal.com, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, so that you can arrange a meeting with us directly.
The calendar is loaded in an iframe from Cal.com. When it loads, your IP address and technical details of your browser are transmitted to Cal.com. If you complete a booking, the data you enter there (in particular your name and email address) is processed by Cal.com on our behalf in order to schedule the appointment.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in offering a simple way to arrange a meeting — and, once you actively make a booking, Art. 6(1)(b) GDPR for carrying out the appointment.
Third country: Cal.com processes data in the USA. We have concluded a data processing agreement including the EU standard contractual clauses.
If you would rather not use the calendar, you can simply email us at info@codingforchange.com to arrange a meeting instead.
Cal.com's privacy policy: https://cal.com/privacy
This website uses so-called Google Fonts to display fonts consistently. The fonts are installed locally on our server. No connection to Google's servers is established, and no data is transferred to Google.
Our website contains links to our profiles on social networks. These are pure links, not embedded plugins. Therefore, no data is transferred to the operators of the social networks when you visit our website. Only when you click a link are you redirected to the respective platform. From that point on, the privacy policy of the respective provider applies.
For security reasons and to protect the transmission of confidential content, such as enquiries and applications that you send to us, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar begins with "https://" and by the lock symbol in your browser bar.
You have the following rights vis-à-vis us regarding the personal data concerning you:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out up to the withdrawal remains unaffected.
To exercise your rights, an informal message by email to info@codingforchange.com is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
https://www.lda.bayern.de
This privacy policy is dated July 2026. Due to the further development of our website or as a result of changed legal requirements, it may become necessary to amend this privacy policy. You will always find the current version on this page.