The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Coding for Change e.V.
Enzianstr. 3
85748 Garching bei München
Germany
Represented by the board: David Frank (Chair), Jakob Landbrecht (Deputy Chair)
Email: info@codingforchange.com
We process our users' personal data only insofar as this is necessary to provide a functional website and our content and services. Processing is carried out on the basis of the statutory provisions of the GDPR and the German Federal Data Protection Act (BDSG).
This website uses cookies and comparable storage only where they are strictly necessary for operation, or where you have consented. Nothing that is not strictly necessary is stored before you have made a choice in the cookie banner. You can change or withdraw that choice at any time via "Cookie settings" in the footer. Details of every purpose, recipient and storage duration are set out in sections 7 to 11.
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany.
When you access our website, Hetzner automatically collects data in so-called server log files, which your browser transmits automatically. These are:
- IP address of the requesting device
- Date and time of access
- Name and URL of the retrieved file
- Website from which access is made (referrer URL)
- Browser used and, where applicable, the operating system
This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure and stable operation of the website. The log files are deleted automatically after a short time.
We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.
Email delivery. Notifications to our team (new contact enquiries, applications, registrations) and emails to you (for example the waitlist notification) are sent through the email service Resend (Resend, Inc., San Francisco, USA), which processes sender and recipient addresses and the email content on our behalf under a data processing agreement (Art. 28 GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (reliable delivery of the emails you or we have requested).
If you send us an enquiry via the contact form, the data you enter (in particular name, email address and message content) is stored in our database to process the enquiry and in case of follow-up questions. We do not share this data without your consent.
Processing is based on Art. 6(1)(b) GDPR insofar as your enquiry relates to the initiation or performance of a contract or membership relationship, and otherwise on Art. 6(1)(f) GDPR. Our legitimate interest lies in the effective handling of the enquiries addressed to us.
The data you enter in the contact form remains with us until you ask us to delete it or the purpose for storing it ceases to apply (e.g. after your enquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.
Via the application form on our page "Join" you can apply to contribute to Coding for Change e.V. It can be combined with the registration for the Munich TechTour: if you tick the box for the other form inside one of them, its additional questions appear and we create two separate records – an application (this section) and a registration (section 5a).
For an application we process your first and last name, email address, where you study, your answers to our questions (for example about your motivation, your experience and where you would like to contribute), your CV (PDF) and your confirmations (for example of the expected time commitment). We also store the time of submission, the language of the page, the wording of every box you ticked together with an identifier of that version of the wording (as proof of what you confirmed), and the channel through which you reached the page (for example a poster QR code), see section 7.
Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures towards a participation relationship). Insofar as you tick the consent box in the form, Art. 6(1)(a) GDPR is the additional legal basis; you can withdraw that consent at any time with effect for the future by emailing info@codingforchange.com.
Your CV is uploaded to our server when you select the file and is never publicly accessible: within the association only logged-in members of our selection team can open it. A file you upload without then submitting the form is deleted automatically within 24 hours.
During the selection process we keep an internal assessment for every application (for example a score from 1 to 10, or "accepted", "unsure", "declined") together with notes. These serve solely to decide on your application, are deleted together with the other data, and are covered by your right of access (Art. 15 GDPR).
The data is stored on our servers in Germany (section 3) and within the association is accessible only to the members entrusted with the selection. Our team is notified of every new application by email; that email contains your answers (not your CV) and is sent through the email service described in section 3.
If your application is successful, your data is stored for the duration of your involvement in the association. If it is unsuccessful, we delete the application including the CV at the latest six months after the application round has closed, unless you have consented to longer storage for future opportunities.
Via the registration form on our page "TechTour" you can register for the evenings of our event series Munich TechTour. Each evening is hosted by a partner company, which selects the participants for its evening. We process your data to organise the TechTour: to receive your registration, to pass it on for selection to the partner companies of the evenings you picked, to let you know their decision, and to hold the evenings.
For this we process your first and last name, your email address, the evenings you picked, your CV (PDF) and your commitment to attend. Nothing else is required. We also store the time of submission, the language of the page and the channel through which you reached the page (for example a poster QR code), see section 7.
Legal basis and proof. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give in the form with two separate boxes: to our processing of your details to handle your registration, and to passing them on to the partner companies (next paragraph). Both are needed to register, because the partner companies select the participants; without them we cannot consider your registration. As proof of your consent (Art. 7(1) GDPR) we store, for every box you tick, its wording, an identifier of that version of the wording and the time, together with the evenings you picked.
Recipients. We pass your details and your CV on only to the partner companies of the evenings you picked – in 2026 Project A (9 November), Lio (10 November), QuantCo (11 November) and QuantumBlack (McKinsey & Company, 12 November). The companies see your registration – your name, your CV and the other details you entered, but not your email address – through a private link that only their named contacts can open after confirming their email address, that expires at the end of the event week at the latest and that we can block at any time; every access is logged. If a company selects you for its evening, it may contact you to register for the evening (for example for access to its premises); we give it your email address for this. No company sees your other evenings, our internal assessment or any membership application. The partner companies decide on your attendance and process the data they receive under their own responsibility (Art. 4(7) GDPR); we ask them to use your data only to select, contact and host you, and to delete any copies they downloaded after the event. We store their decision with your registration in order to let you know.
Your details and your CV are stored on our servers in Germany (section 3) and are never publicly accessible: within the association only logged-in members of the team organising the TechTour can access them, and outside it only the partner companies as described above. A file you upload without then submitting the form is deleted automatically within 24 hours. Notifications of new registrations to our team and emails to you are sent through the email service described in section 3; they do not contain your CV. During the selection we may keep an internal assessment and notes on your registration; they serve only to organise the evenings, are not passed on to the partner companies and are deleted with the registration.
Spam protection. The form contains a field that people do not see and that catches automated submissions (a so-called honeypot). It collects no additional data about you and involves no third-party service – in particular no reCAPTCHA. We report a Google Ads conversion for sending this form only if you have agreed to advertising measurement in the cookie banner (section 9).
Retention. We delete your registration, including your CV, the partner companies' decisions and the proof of your consent, automatically on 31 January 2027 (at the latest three months after the event week). The partner companies' private links and their access logs are deleted at the same time.
Withdrawal. You can withdraw your consent at any time with effect for the future, most easily by emailing info@codingforchange.com. If you withdraw your consent to our processing or to passing your data on, we delete your registration including your CV; partner companies then no longer see it, and we ask those that have already seen it to delete any copies. You can then no longer take part in the TechTour. Withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR).
Your rights. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), insofar as we rely on legitimate interests (section 7) the right to object (Art. 21), and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); see sections 15 and 16. An informal email to info@codingforchange.com is enough.
Contact persons of the partner companies. If you open such a link as the contact person of a partner company, we process the email address you sign in with and a log of when the link was used and which CV was opened or what was decided, to protect the registrations (Art. 6(1)(f) GDPR). Signing in sets a cookie that is strictly necessary for it (section 8). Both are deleted together with the link.
While applications are closed, you can add your email address to a waitlist on our join page in order to be notified as soon as the application period reopens. For this purpose we store your email address and your chosen language setting.
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by sending an informal message to info@codingforchange.com; we will then delete your email address without undue delay.
We use your email address solely for this notification and do not share it with third parties. Your data is deleted as soon as the purpose ceases to apply — at the latest once you have applied or declared your withdrawal.
To understand which channels (e.g. posters, QR codes, newsletters, social-media posts, search engines) bring visitors to our website and how the website is used, we operate our own reach measurement. It runs exclusively on our own infrastructure within the EU; the data is not shared with any third party for this purpose.
We collect:
- the campaign label contained in a tagged link (e.g. the "src" parameter or "utm_*" parameters);
- for untagged visits — if your browser transmits it — the domain of the referring website (e.g. google.com), which we assign to a broad channel (search, social media, referral or direct); we do not store the full address of the referring page;
- the pages you view and individual interactions (starting and submitting a form, reaching the booking widget, completing a booking) and the language setting.
No cookies and no storage on your device: this measurement stores nothing at all on your device — no cookie, no local storage. The campaign label and a randomly generated session number exist only in your browser's working memory for as long as the tab is open, so that a sign-up can be related to the link you arrived through. They are gone when you reload the page, open a new tab, or close the tab. There is no way for us to recognise you on a later visit, on another device, or in another tab.
We store no IP address, create no fingerprint, do not track you across other websites, and do not combine this data with any other source. We count events, not people: we can tell that a poster produced 37 visits and 4 sign-ups, but not how many distinct individuals that was.
If you submit a form (contact, application or waitlist form), the campaign label of your visit is stored together with your submission so that we can understand which measure led to it.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in measuring and improving the reach and effectiveness of our non-commercial public-relations work. Because nothing is stored on or read from your device, § 25 TDDDG does not apply and no consent is required.
Your right to object: if your browser sends a "Do Not Track" or "Global Privacy Control" signal, we collect nothing at all. That is the simplest way to exercise your right to object under Art. 21 GDPR. Your other rights under section 15 remain unaffected.
Storage duration: usage events are deleted automatically after 12 months. A campaign label stored with a form submission is deleted together with that submission.
To ask for and record your cookie choice we use Klaro, an open-source consent tool that we run ourselves on our own servers. No data is transmitted to the tool's developers or to any other third party by the banner itself.
Two strictly necessary cookies are set once you make a choice. They exist only so that we can remember your decision and prove that we obtained it (Art. 7(1) GDPR), which is a legal obligation — they are never used to track you. Legal basis: Art. 6(1)(c) and (f) GDPR; storage is permitted without consent under § 25(2) no. 2 TDDDG.
Together with your decision we store a random consent identifier, which purposes you accepted, the version of the banner text you were shown, the language, and the page you were on. We do not store your IP address or your browser's user agent.
Everything stored on your device:
- cfc_consent – remembers your cookie choice. Strictly necessary, 180 days.
- cfc_consent_id – random id linking your choice to our consent record. Strictly necessary, 180 days.
- cfc-locale – remembers the language you selected. Strictly necessary, 12 months.
- cfc-techtour-intro – remembers that you have already watched the opening animation of the TechTour page, so it is not shown again (browser storage, not a cookie). Strictly necessary, until you clear your site data.
- cfc-share – keeps the contact person of a TechTour partner company signed in to the private registration link after they confirmed their email address with a code (cookie, only on that link and only for them). Strictly necessary, for up to 12 hours.
- cfc-techtour-draft – keeps the answers you have typed into the TechTour registration when you press "save and finish later", in this browser only (browser storage, not a cookie; no ticked boxes, no CV). Strictly necessary, until you send the form or delete the saved answers, at most 30 days.
- cfc-application-draft – keeps the answers you have typed into the membership application as you type, in this browser only (browser storage, not a cookie; no ticked boxes, no CV). Strictly necessary, until you send the form or delete the saved answers, at most 30 days.
- _gcl_aw and _gcl_dc – Google Ads conversion measurement (section 9). Consent, up to 90 days.
- _ga, _ga_* – Google Analytics (section 10). Consent, up to 14 months.
You can withdraw or change your consent at any time via "Cookie settings" in the footer of every page. Withdrawal takes effect immediately, deletes the relevant cookies and stored identifiers, and does not affect the lawfulness of processing carried out beforehand.
As a non-profit association we take part in the Google Ad Grants programme, which provides us with free search advertising. The programme requires us to measure and report which advertisements lead to an actual result. We therefore use Google Ads conversion tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
What happens: if you consent, Google's tag records when you complete one of five actions – joining the waitlist, submitting a membership application, registering for the Munich TechTour, sending a contact enquiry, or booking an appointment – and links it to the advertisement you clicked. For this purpose Google sets the cookies _gcl_aw and _gcl_dc and processes the click identifier contained in the ad link.
Ads personalisation: Google may use this data not only to measure advertising performance but also for the personalisation of advertising. Information on how Google handles data it receives from us is available at https://business.safety.google/privacy/
Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the cookies. Without consent no cookie is set and no identifier is transmitted; the tag then sends Google only aggregated, cookie-free information containing no identifiers.
Transfer to a third country: data may be processed by Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework, so the European Commission's adequacy decision of 10 July 2023 applies. In addition we have concluded the standard contractual clauses with Google.
You can withdraw your consent at any time via "Cookie settings" in the footer.
With your consent we use Google Analytics 4, a service of Google Ireland Limited, to understand how this website is used in aggregate. Google Analytics sets the cookie _ga and a cookie whose name begins with _ga_, and processes a randomly generated identifier, the pages you view, approximate location derived from a shortened IP address, and technical details of your device and browser.
We have configured the service restrictively: "Google signals" is switched off, so no cross-device reporting or data from signed-in Google accounts is added to our reports, and the retention period for event data is set to 14 months. Whether any data reaches Google Ads for advertising purposes is controlled solely by your consent decision (see section 9): without your consent for advertising measurement, no advertising identifiers are set or transmitted.
Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG.
Third country: as described in section 9 — Google LLC, USA, under the EU–US Data Privacy Framework, plus standard contractual clauses.
You can withdraw your consent at any time via "Cookie settings" in the footer.
On our contact page we embed the booking calendar of Cal.com, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, so that you can arrange a meeting with us directly.
The calendar is loaded in an iframe from Cal.com. When it loads, your IP address and technical details of your browser are transmitted to Cal.com. If you complete a booking, the data you enter there (in particular your name and email address) is processed by Cal.com on our behalf in order to schedule the appointment.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in offering a simple way to arrange a meeting — and, once you actively make a booking, Art. 6(1)(b) GDPR for carrying out the appointment.
Third country: Cal.com processes data in the USA. We have concluded a data processing agreement including the EU standard contractual clauses.
If you would rather not use the calendar, you can simply email us at info@codingforchange.com to arrange a meeting instead.
Cal.com's privacy policy: https://cal.com/privacy
This website uses so-called Google Fonts to display fonts consistently. The fonts are installed locally on our server. No connection to Google's servers is established, and no data is transferred to Google.
Our website contains links to our profiles on social networks. These are pure links, not embedded plugins. Therefore, no data is transferred to the operators of the social networks when you visit our website. Only when you click a link are you redirected to the respective platform. From that point on, the privacy policy of the respective provider applies.
For security reasons and to protect the transmission of confidential content, such as enquiries and applications that you send to us, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar begins with "https://" and by the lock symbol in your browser bar.
You have the following rights vis-à-vis us regarding the personal data concerning you:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out up to the withdrawal remains unaffected.
To exercise your rights, an informal message by email to info@codingforchange.com is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
This privacy policy is dated October 2026. Due to the further development of our website or as a result of changed legal requirements, it may become necessary to amend this privacy policy. You will always find the current version on this page.