Data Privacy Policy

1. Who we are and who is responsible

The responsible body (controller) for this website and all ISAK activities is:

Indian Students Association Koblenz (ISAK)
Verein in Gründung — association in founding, not yet registered
c/o Anchal Gera
Universitätsstraße 1, 56070 Koblenz-Metternich, Germany
Email: info@isakoblenz.com

Because ISAK is not yet an entered association (e.V.), it has no legal personality of its own. Until the Gründungsversammlung and the registration with the Vereinsregister are complete, the founders named in our Impressum act as the controller. There is no paid staff — ISAK is entirely volunteer-run. After registration, this section will be updated with the registered association's details.

We process personal data in compliance with the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

2. Your data, your responsibility

Everything you send us is voluntary. You can browse this entire website without giving us a single piece of personal data. No account is needed, nothing is required to read any page. We only ever hold what you personally decide to type into a form or write to us.

• You decide whether to share data with us at all — membership, the newsletter, the pre-arrival guide and every event are optional.
• You decide how much to share. Only your name and email address are required on our forms; study programme, semester, campus, hometown and message text are optional and entirely at your discretion.
• You are responsible for the accuracy of what you submit. We do not verify it, and we act on it as given.
• Anything you write into a free-text field beyond what we asked for — documents, ID numbers, health information, immigration details, religious or political information — is sent at your own responsibility. Please do not send us sensitive information; we do not need it and do not ask for it.
• Do not submit other people's personal data (a friend's email address, a group list, a photo of others) unless they have agreed. If you do, that is your responsibility, not ours.
• The same applies outside this website: messages you send to our WhatsApp community, replies to our emails, and information you give us at events are all shared voluntarily and on your own initiative.

This does not remove our own duties under the GDPR — we still protect, limit and delete what we hold, and Section 8 lists the rights you keep at all times. It means simply: nothing reaches us that you did not choose to send. If you want anything removed, write to info@isakoblenz.com and we will delete it.

As an unregistered, volunteer-run association in founding, ISAK's liability is limited to intent and gross negligence, as far as the law permits.

3. What personal data we collect

When you visit our website

Our hosting provider (Vercel) records standard server access data for security and operation: IP address, browser type and version, operating system, referring URL, pages requested and timestamp. We do not merge this with any other data and do not use it to identify individuals.

When you submit a membership or contact form

We collect what you provide: first and last name, email address, study programme, semester, campus, hometown, and any message text you choose to write. Only the name and email address are required; everything else is optional.

When you subscribe to our newsletter

We collect your email address only, in order to send you the ISAK digest. Every email includes a way to unsubscribe, and you can also ask us to remove you at any time by writing to info@isakoblenz.com.

When you request the pre-arrival guide

We collect your name and email address so we can send you the guide and follow up if you asked us to.

When you attend an ISAK event

For events that need registration, we collect your name and email address for attendance planning. Where we intend to take photos, we say so in advance and you can ask not to be photographed.

4. How and why we use your data

We use your data only for the purpose for which you gave it:

• Membership sign-ups: to send your welcome email and WhatsApp invite, and to keep track of who is part of the community (Art. 6(1)(b) and (f) GDPR).
• Contact enquiries: to answer your question (Art. 6(1)(b) and (f) GDPR).
• Newsletter and pre-arrival guide: to send you what you asked for, on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Event registration: to confirm your place and share event logistics.
• Server logs: to keep the site available and secure (Art. 6(1)(f) GDPR).

We do not use your data for automated decision-making or profiling. We do not sell, rent, or share your data with third parties for their own marketing purposes.

5. Data retention periods

• Membership records are kept while you are part of the community and for up to 12 months after you leave or ask to be removed.
• Newsletter subscriptions are kept until you unsubscribe or ask us to delete them.
• Contact enquiries are kept for up to 24 months.
• Event registration records are kept for up to 12 months.
• Server access logs are kept by our hosting provider for a short operational period and then deleted.

Whenever you ask us to delete your data earlier, we do — see Section 8.

6. Cookies and analytics

This website sets no tracking cookies, uses no web analytics, and runs no advertising pixels. There is no Google Analytics, no Facebook Pixel, and no marketing tracker of any kind. That is also why you see no cookie consent banner: we do not use any technology that would require your consent under § 25 TTDSG.

What does happen is ordinary web loading: pages on this site pull fonts, scripts and an Instagram widget from the third parties listed in Section 7. Loading those files transmits your IP address and browser information to those providers, as it would on any website that embeds external content. If you would rather avoid that entirely, a content blocker in your browser will prevent those requests — the site remains readable.

7. Third-party services we actually use

These are all of them:

• Vercel (Vercel Inc.) — hosting for this website and the small server functions that receive our forms. Server logs and every form submission pass through Vercel.
• Supabase — the database where membership sign-ups, contact enquiries, newsletter subscriptions and event data are stored. Our project is hosted in the EU region.
• Resend — the service that sends our transactional emails (welcome mails, admin notifications). Your email address and the content of that message are processed by Resend to deliver it.
• Google Fonts (Google Ireland Ltd.) — font files are loaded from Google servers, which transmits your IP address to Google when a page loads.
• jsDelivr — a public CDN from which we load the Supabase browser library on some pages; loading it transmits your IP address to the CDN.
• Elfsight — the widget that displays our Instagram feed on the home page. It loads from Elfsight's servers and receives your IP address and browser data when the home page is opened.
• Unsplash — some placeholder photographs are sourced from Unsplash.
• WhatsApp (Meta) — our community group chats run on WhatsApp. Joining is entirely voluntary and is governed by WhatsApp's own privacy policy; we can see the phone number and profile name of anyone in the group.
• Instagram and LinkedIn — we link out to our profiles. Clicking a link takes you to that platform, where its own privacy policy applies.

Some of these providers are based in the United States or process data there. Such transfers are made on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

8. Your rights under GDPR

Under Articles 15–22 GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate or incomplete data (Art. 16)
• Erasure ("right to be forgotten") of your data where no legal obligation to retain it exists (Art. 17)
• Restriction of processing while a dispute is resolved (Art. 18)
• Data portability in a structured, machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time for processing based on consent, without affecting prior lawful processing (Art. 7)

To exercise any of these rights, email info@isakoblenz.com with the subject line "GDPR Request – [your name]". We will respond within 30 calendar days. We may ask you to verify your identity before acting on a request.

You also have the right to lodge a complaint with the supervisory authority in Rhineland-Palatinate: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz.

9. Data security

This website is served over HTTPS. Form submissions are stored in our Supabase database, and access to that data is limited to the small number of ISAK volunteers who need it, each with their own account. We keep the amount of data we hold deliberately small.

No system is perfectly secure, and we are a volunteer initiative rather than a professional data operation — which is another reason we ask you not to send us sensitive information. If you believe your data has been exposed, contact us immediately at info@isakoblenz.com.

10. Contact for data protection

ISAK has not appointed a Data Protection Officer. As a small volunteer initiative, we are not required to have one under Art. 37 GDPR / § 38 BDSG. All data protection questions and requests go to the founders at the address below:

Indian Students Association Koblenz (ISAK) — Verein in Gründung
Email: info@isakoblenz.com
Universitätsstraße 1, 56070 Koblenz-Metternich, Germany

11. Changes to this policy

We will update this policy when something actually changes — most notably once ISAK is registered as an e.V., and whenever we add or remove one of the services in Section 7. The current version is always available at this URL.

Last updated: August 2026 · Impressum