Privacy Policy of Masterpiece for Good gUG (haftungsbeschränkt)
Last updated: 28 August 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation is:
Masterpiece for Good gUG (haftungsbeschränkt)
Saarbrücker Straße 24, Haus C
c/o Werketage e.V.
10405 Berlin
Germany
Represented by the managing directors:
Bogna Grazyna Jaroslawski
Aurélie Maestre
For questions regarding data protection, you can contact us at:
office@masterpieceforgood.org
2. Overview of the processing of personal data
Depending on the type and scope of your use of our website, we process in particular the following data:
Server and access data when visiting the website
Data from contact enquiries
Data from volunteer and application forms
Newsletter data
Usage data for the statistical evaluation of the website
Consent and cookie information
Data in connection with embedded external content and the use of external services
Data in connection with donations, crowdfunding campaigns and payment services, where you use corresponding external offers
3. Legal bases for processing
We process personal data on the basis of the following legal bases:
Art. 6 para. 1 lit. a GDPR, where you have given us your consent
Art. 6 para. 1 lit. b GDPR, where processing is necessary for the performance of a contract or for steps prior to entering into a contract
Art. 6 para. 1 lit. c GDPR, where we are legally obliged to process data
Art. 6 para. 1 lit. f GDPR, where processing is necessary for the purposes of our legitimate interests and where no overriding interests or rights of the data subjects prevail
For the storage of information on your device or access to information on your device, the provisions of § 25 TDDDG also apply. Technically necessary storage is carried out on the basis of § 25 para. 2 TDDDG. Optional cookies and comparable technologies are generally used only on the basis of your consent pursuant to § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.
4. Hosting and server log files
Our website is hosted by Strato. When you visit our website, certain data is processed for technical reasons in order to provide the website content, ensure the stability of the website and protect the security of the systems.
In particular, the following data may be processed:
IP address
Date and time of access
Content accessed
Referrer information
Information about the browser and operating system used
Status codes
The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and technically reliable provision of our website.
The storage period depends on the technical requirements of the hosting provider as well as security requirements and is usually limited to a short period.
5. Security, cache and technical protection measures
We use technical and organisational measures to protect our website and the data processed through it. These include, in particular, encrypted transmission via HTTPS, access restrictions in the backend, regular updates, backups and security measures within the scope of our technical and organisational possibilities.
We use a security plugin on our WordPress website, currently WP Security, as well as a cache plugin to improve the loading times and stability of the website. In this context, technically necessary data may be processed, for example to detect attacks, avoid technical errors or deliver pages more quickly.
The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable and efficient operation of the website.
6. Cookies, consents and CookieYes
We use CookieYes to manage consents and to provide information about cookies and comparable technologies.
Through the cookie banner, visitors can reject or allow optional services. Technically necessary cookies and comparable technologies may be required to provide the website or to store your consent decisions.
The current Cookie Policy is publicly available at:
https://masterpieceforgood.org/cookie-policy/
The legal basis for technically necessary cookies and comparable technologies is § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR.
The legal basis for optional cookies and comparable technologies is your consent pursuant to § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.
You can change or withdraw your consent at any time via the cookie settings on our website.
7. Contact form
We use Contact Form 7. If you contact us via the contact form, we process the data you enter, in particular your name, your email address and, where applicable, any further content you provide.
The processing takes place in order to handle your enquiry and reply to it.
Contact Form 7 does not permanently store the submitted form data in the website database. The data is sent to us by email and processed there in order to handle your enquiry.
The legal basis is Art. 6 para. 1 lit. b GDPR, where the communication concerns pre contractual or contractual matters. In all other cases, the processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.
We store contact enquiries for 24 months or for as long as this is necessary to process and document the enquiry.
8. Volunteer and application form
If you contact us via a volunteer or application form, we process the data you enter. This includes in particular your name and your email address.
The processing takes place in order to review your enquiry, contact you and prepare a possible collaboration as a volunteer or supporter.
The legal basis is Art. 6 para. 1 lit. b GDPR, where the enquiry is aimed at a collaboration or a pre contractual relationship. In all other cases, the processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR.
The data is stored for as long as this is necessary for processing, coordination and documentation. If no collaboration takes place, we delete the data as soon as it is no longer needed for this purpose, unless statutory retention obligations apply.
9. Newsletter and Brevo
If you subscribe to our newsletter, we process the data you provide. This includes in particular:
Email address
First name
Last name
Language or selected language list
Consent and Double Opt In record
Time of registration and confirmation
Where applicable, technical information for documenting the registration
We use Brevo for sending the newsletter, managing our contact lists and carrying out the Double Opt In procedure. Our newsletter lists are separated by language and currently include a German, an English and a French list.
Registration takes place via a Double Opt In procedure. After registration, you will receive an email in which you must confirm your subscription. Only after this confirmation is the registration completed.
The legal basis for sending the newsletter is your consent pursuant to Art. 6 para. 1 lit. a GDPR.
You can withdraw your consent at any time with effect for the future by using the unsubscribe link in the respective newsletter or by contacting us.
We store your newsletter data until you unsubscribe from the newsletter. Records of consent are stored for as long as this is necessary for documentation purposes.
10. Newsletter analytics
Brevo enables us to statistically evaluate newsletter dispatch. In particular, openings and clicks may be recorded. This evaluation helps us understand whether newsletters are delivered, opened and which content is clicked.
The processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR, insofar as such evaluation requires consent.
You can withdraw your consent at any time with effect for the future by unsubscribing from the newsletter or by contacting us.
11. Web analytics and Independent Analytics
We use Independent Analytics for the statistical evaluation and improvement of our website. The analysis is carried out without cookies. IP addresses are stored in anonymised form.
Web analytics are carried out only on the basis of your consent.
The legal basis is Art. 6 para. 1 lit. a GDPR.
The storage period is 24 months.
You can change or withdraw your consent at any time via the cookie settings on our website.
12. Google Fonts
Fonts on our website are currently partly loaded externally from Google servers. When these fonts are loaded, a connection to Google may be established. In this context, technical data, in particular your IP address and information about the browser used, may be transmitted to Google.
The legal basis, where consent is obtained, is Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG.
Our aim is to fully host the fonts used locally in order to avoid external connections to Google when loading the website.
13. Google Maps
Google Maps is currently not actively embedded on our website.
If Google Maps is embedded in the future, we will update this Privacy Policy accordingly and, where necessary, obtain consent via our consent tool or alternatively link only to Google Maps.
14. Embedded content and social media
Our website may contain embedded content from third party providers or link to external platforms. These include in particular YouTube, Instagram, TikTok, LinkedIn and Facebook.
We link to our social media profiles. Simply visiting our website does not transmit data to these platforms through plain links. Only when you click on such a link do you leave our website. The respective provider is responsible for the subsequent processing of personal data.
Content from our own YouTube channel is also embedded or linked on the website. When embedded content is loaded, a connection to the servers of the respective provider may be established. In this context, in particular your IP address, technical usage data and information about the page visited may be transmitted. This may also involve transfers of data to third countries.
Where embedded content or comparable external services are not technically strictly necessary, processing is generally carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG.
Currently, individual external contents may still be loaded directly when the respective page is opened. We are working on consistently controlling external content via the consent tool or alternatively embedding it only as external links.
15. PayPal, Startnext and donations
We currently use PayPal as an external service to enable donations. If you click on a PayPal donation link, you leave our website. PayPal is responsible for the subsequent processing of personal data.
We may also link to external crowdfunding campaigns, in particular via Startnext. If you click on such a link, you leave our website. The respective provider is responsible for the subsequent processing of personal data.
For donations by direct bank transfer, we process the data required in connection with the transfer and donation administration. This may include in particular name, bank details, payment reference, amount and date of payment.
The legal basis for providing external donation links is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in enabling donations and support for our non profit work.
Where we manage donations or must fulfil legal documentation and retention obligations, processing is carried out on the basis of Art. 6 para. 1 lit. c GDPR and, where necessary, Art. 6 para. 1 lit. b GDPR.
A dedicated donation form on the website is currently planned but not yet active. As soon as such a form is used, we will update this Privacy Policy accordingly.
16. Recipients of personal data
We disclose personal data only insofar as this is necessary for providing the website, communication, newsletter dispatch, donation processing or the use of the functions described.
This concerns in particular:
Strato as hosting provider
CookieYes as consent management provider
Brevo as service provider for newsletter forms, contact list management, Double Opt In and newsletter dispatch
Contact Form 7 in the context of form transmission
Independent Analytics for web analytics
Google, insofar as Google Fonts or other Google services are loaded
YouTube, insofar as embedded or linked content is used
Meta, insofar as Instagram or Facebook links or content is used
TikTok, insofar as TikTok links or content is used
LinkedIn, insofar as LinkedIn links or content is used
PayPal, if you use a PayPal donation link
Startnext, if you access a crowdfunding campaign via Startnext
Banks and payment service providers, insofar as this is necessary for direct transfers or donations
17. Data transfers to third countries
Some of the services we use or link to may transfer personal data to countries outside the European Union or the European Economic Area. This applies in particular to services provided by Google, Meta, TikTok, LinkedIn and PayPal.
A transfer of data to third countries may involve risks, especially where there is no level of data protection equivalent to that of the European Union.
Where we ourselves embed or use such services, we pay attention to appropriate legal bases and safeguards, such as adequacy decisions, standard contractual clauses or your consent pursuant to Art. 6 para. 1 lit. a GDPR. For external links, the data protection information of the respective provider applies.
Brevo may also process data outside the European Union or the European Economic Area in connection with its infrastructure or subprocessors. Processing is carried out within the framework of the contractual and data protection bases provided by Brevo.
18. Storage period
Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as this is necessary for the respective purposes.
In particular, the following periods apply:
Server log files: short term according to the specifications of the hosting provider
Contact enquiries: 24 months or for as long as this is necessary for processing and documentation
Volunteer and application data: for as long as this is necessary for processing and coordination
Newsletter data: until you unsubscribe
Records of newsletter consents: for as long as this is necessary for documentation purposes
Analytics data: 24 months
Cookie and consent data: according to the storage periods stated in the Cookie Policy
Donation and payment data: according to statutory retention and documentation obligations
19. Your rights
Within the scope of the statutory requirements, you have the following rights:
Right of access to the personal data processed by us
Right to rectification of inaccurate data
Right to erasure of personal data
Right to restriction of processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent given with effect for the future
You also have the right to lodge a complaint with a data protection supervisory authority.
To exercise your rights, you can contact us at:
20. Measures in the event of data protection incidents
If we become aware of a personal data breach, we review the incident, secure the affected systems, document the facts and, where applicable, fulfil existing statutory notification obligations.
We inform affected persons if there is a high risk to their rights and freedoms.
21. Automated decision making and profiling
We do not use automated decision making or profiling within the meaning of Art. 22 GDPR.
22. Changes to this Privacy Policy
We adapt this Privacy Policy if the functions of the website, the services used or legal requirements change. This applies in particular if new forms, new donation functions, new analytics services or new embedded external content are used.