Legal

Privacy policy

This privacy policy applies to the website hello-sam.eu (Sections 3 to 9) and to the Sam platform – the web app at app.hello-sam.eu and the apps for iPhone and Android (Sections 10 to 20).

1. Controller

The party responsible for data processing on this website and on the platform is:

SAM – share and manage e.V.
Rehfuesstraße 37, 53115 Bonn, Germany
registered in the register of associations of the Local Court (Amtsgericht) of Cologne under VR 21743
represented by the Executive Board: Hannah Greiner (Chair), Bianca Fischer (Vice Chair), Benedikt Breuer (Treasurer)
Email: mail@hello-sam.eu

2. Your rights as a data subject

You have the right at any time to obtain information regarding your personal data stored by us, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR). You are also entitled to a right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), as well as a right to object to the processing (Art. 21 GDPR). For this purpose, as well as for any further questions, you can contact us at any time at the address stated above. You also have the right to lodge a complaint with a data protection supervisory authority.

3. Hosting and server log files

This website is delivered via Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit the website, general information transmitted by your browser is processed automatically. This typically includes the browser type, operating system, referrer URL, time of the server request and the IP address. This data is used exclusively to ensure trouble-free and secure operation and is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

4. No cookies, cookieless audience measurement

This website does not set cookies and does not store any information on your device – with one exception if you use the chat (section 6). To understand how the website is used, we collect anonymous usage statistics with PostHog (PostHog Inc., data processed in the EU, servers in Frankfurt am Main), such as pages viewed, time on page, referring page, buttons clicked and whether a registration was completed. No profile is created and no identifier is stored in your browser. Repeat visits on the same day are grouped on the server using a hash that is regenerated daily; your IP address is not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our services). You can object to this processing at any time by email.

5. Registration

If you register using the form, we process your first name, last name, email address and password as well as the name, email address and registered seat of your organisation in order to create your account and organisation profile on HelloSAM and to notify you when the platform launches. The password is only stored in encrypted form. We record your acceptance of the Terms & Conditions as described in Section 12. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract).

If you use the form to invite colleagues or other organisations, we use the email address you enter and your optional message solely to send this one invitation (Art. 6(1)(f) GDPR).

The data is stored in Google Firebase (Google Ireland Limited, data centre in Frankfurt am Main); emails are sent via Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg, sent from the data centre in Frankfurt am Main; a transfer to the USA cannot be ruled out, Amazon Web Services is certified under the EU-US Data Privacy Framework). It is deleted when you delete your account or ask us to do so, unless statutory retention obligations apply.

6. Chat with the HelloSAM team

Using the chat button, you can write to us without an account. To reply, we process your name, email address and messages; if the chat is no longer open, we send our reply by email with a link back to the conversation. The legal basis is Art. 6(1)(b) GDPR (handling your enquiry) or your consent when sending.

So that you can find the conversation again on your next visit, we store a random access key in your browser’s local storage (not a cookie) after you send your first message. This is technically necessary for the service you requested (Section 25(2) No. 2 TDDDG). To prevent abuse, we additionally process a shortened, hashed value of your IP address; it is removed after 7 days.

The data is stored in Google Firebase (Google Ireland Limited, data centre in Frankfurt am Main); emails are sent via Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg, sent from the data centre in Frankfurt am Main; a transfer to the USA cannot be ruled out, Amazon Web Services is certified under the EU-US Data Privacy Framework). Conversations are deleted automatically 90 days after the last message. You can delete the conversation and your data yourself at any time – in the chat window or via the link in each of our emails.

7. Video from Vimeo

The home page offers a video from Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). It is only loaded when you click “Play video”. Only then is a connection to Vimeo’s servers established, transmitting your IP address among other data; the player is loaded with the “Do Not Track” parameter. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Further information can be found in Vimeo’s privacy policy: https://vimeo.com/privacy

8. Links to Instagram and betterplace.org

This website links to our Instagram profile (Meta Platforms Ireland Limited) and to our donation page on betterplace.org. These are plain links; no content from these providers is embedded, and data is only transmitted once you follow a link. Processing on the linked pages is governed by the respective provider’s privacy policy.

9. SSL/TLS encryption

For security reasons, this website and the platform use TLS encryption. You can recognise an encrypted connection by the browser’s address bar starting with “https://”.

10. Operation and service providers

The platform runs on Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): sign-in (Firebase Authentication), database (Cloud Firestore), file storage (Cloud Storage), server functions (Cloud Functions, data centre in Frankfurt am Main) and delivery of the web app (Firebase Hosting). We send emails via Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg, sent from Frankfurt am Main), and push notifications in the apps via Firebase Cloud Messaging (Google) and the delivery services of Apple and Google. A transfer to the USA cannot be ruled out; Google and Amazon Web Services are certified under the EU-US Data Privacy Framework.

11. Account and profile

For your account we process your first name, last name, email address and password (stored only in encrypted form) as well as your affiliation with your organisation. You may voluntarily provide further profile details, such as form of address, job title, phone and mobile number, address, profile picture, description, links to social networks, and settings for notifications, availability and appearance. For your organisation we process the details of the organisation profile (including name, contact details, address, registration number, countries of operation, description, logo). Profiles are visible to other signed-in members where the platform provides for this. The legal basis is Art. 6(1)(b) GDPR (user agreement under our Terms & Conditions).

12. Acceptance of the Terms & Conditions

When you register, we record your acceptance of the Terms & Conditions: the name and role of the organisation, your name and email address, the version accepted, and the date and time. We do not store your IP address or browser data for this. The record serves as proof that the contract was concluded (Art. 6(1)(b) and (f) GDPR). It is kept for the duration of the membership and for three years thereafter and then deleted automatically.

13. Content on the platform

When you use the platform, we process the content you post or exchange: listings (offers and requests) with images, requests and the associated chats, direct messages, posts and comments in communities and channels, posts by your organisation, needs lists, annual reports and watchlists. Uploaded images are re-encoded on our servers, which removes embedded metadata (e.g. location). Who can see which content depends on the feature (e.g. all members, only members of a community, only the participants in a chat). The legal basis is Art. 6(1)(b) GDPR.

14. Notifications by email and push

We notify you by email and – in the apps – by push notification about new messages, requests and other events; you choose what you receive in the settings, including whether push notifications show a preview of the content. For sending, we store the recipient address, subject and delivery status of each email for 90 days. Addresses to which emails were permanently undeliverable or which complained about our emails are kept on a suppression list so that we do not write to them again. We do not track opens or clicks. For push notifications we store, per device (at most ten), an identifier for the push service as well as platform, app version, operating system version, language and device model. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the suppression list.

15. Reporting, bug reports and support

If you report a message, we store its text, the accounts involved, the reason and your comment in order to review the report (Art. 6(1)(f) GDPR; Art. 16 DSA). If you send us a bug report via “Feedback / Bugs”, we process your description, attached images and technical details that help us find the error: the page visited, browser or device and operating system, screen size, language, time zone, connection type, the most recent console messages and – if you have consented to usage analytics – the identifier of the analytics session. We delete images from bug reports after 12 months and the reports after 24 months. If a technical error occurs in the app, we store an error message with the time, the function affected and – if you are signed in – your user ID; we delete it once it is no longer needed to fix the error. The legal basis is Art. 6(1)(b) and (f) GDPR.

16. Usage analytics and session recording (only with consent)

Only if you consent do we use PostHog (PostHog Inc., data processing in the EU, server location Frankfurt am Main) in the web app and the apps to understand how the platform is used and to find errors. We record pages or screens viewed, selected actions on the platform and a recording of the session; input in form fields is masked, while in the apps images on the screen are included in the recording. The data is linked to your account (user ID, name, email address) and your organisation. Without your consent, PostHog is not loaded in the web app and nothing is transmitted in the apps. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the settings.

17. Third-party services on the platform

• Postcode lookup: When you enter a postcode, the platform looks up the corresponding town at zippopotam.us; the postcode, country and your IP address are transmitted.
• Addresses and maps: To show addresses on a map, the address is looked up at Nominatim and map tiles are loaded from OpenStreetMap (OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom); your IP address is transmitted. In the iPhone app, maps are shown with Apple Maps (Apple Distribution International Ltd., Cork, Ireland).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in address entry and map display). An adequacy decision of the European Commission exists for the United Kingdom; for zippopotam.us a transfer to the USA cannot be ruled out.

18. Storage on your device

The platform stores on your device what it needs to work: your sign-in (in the browser in IndexedDB), your language choice (cookie “sam_lang”, one year), your decision on usage analytics, interface settings, drafts of unsent messages and bug reports, and which notices you have already seen (e.g. “What’s new”, introduction). This storage is strictly necessary for the service you use (Section 25(2) no. 2 TDDDG). Section 16 applies to usage analytics.

19. Server logs

When you use the platform, our servers log the time, type and address of the request; Google’s infrastructure also processes your IP address. The logs serve secure operation and troubleshooting (Art. 6(1)(f) GDPR) and are deleted after 30 days under Google Cloud’s default settings. For our own usage statistics we also record, per day, whether and on which platform (web, iPhone, Android) you were active; we delete these entries after 35 days.

20. Deleting your account

You can delete your account at any time in the settings. We then remove your name, contact details, profile, devices and sign-in; your messages in direct chats are shown as “Deleted account”. Content you posted for your organisation (e.g. listings or posts) remains with the organisation. So that other people’s conversation histories remain readable, we keep an identifier without personal details. The record of your acceptance of the Terms & Conditions is kept as described in Section 12.

21. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will then apply to your subsequent visit.

As of October 2026