Purpose of this statement
This is a description of the privacy policy of Vipassana-Vereinigung e.V., Alte Straße 6, 08606 Triebel. In this policy, we explain who we are, why we collect your data, what we do with it, and how we help you exercise your rights in relation to your data. In view of the trust you place in us, we feel obliged to treat your data with the utmost care and to fulfill your rights with equal care, in accordance with national and international rules and regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
Who is responsible for processing your data
When you register for a Vipassana course, your data goes through an online application process called CALM (Course Application and Letters Management). Associated Vipassana organizations also use this system to organize courses. The CALM Foundation (Robert Owenstraat 21, 3045 PT te Rotterdam, Netherlands) manages this system and has its own privacy policy, the CALM Privacy Policy. CALM operates the central course platform and is responsible for IT security, system operation, technical logging, platformaccess rights, and deletion/retention policies on the platform. Together with the CALM Foundation, we decide on the purposes and essential means of processing and are therefore joint controllers within the meaning of § 63 BDSG. You can therefore assert your rights against both controllers in this respect. However, the Vipassana Association e. V. is solely responsible for the further processing of the data on site.
Participant communication & local organization: Vipassana Vereinigung e. V. is the primary contact for applicants/participants, handles organizational communication, takes care of local course organization and implementation, and handles local deletion/retention processes outside the platform.
Why we store your data
Your data is used to process your registration, provide you with a place on the course, accommodation, and a place to meditate, and, if necessary, to make individual arrangements for you.
We use the information you provide to assess whether you are mentally and physically capable of participating in a course. A Vipassana course can be very demanding.
We also use your data to
- plan accommodation, meals, or transportation
- provide financial information for tax purposes or to maintain other personal data required by law
- provide you with appropriate advice and support on course content during the course
- to offer additional services to participants after the course has ended, such as a post-course newsletter
- to inform you about opportunities to get involved or provide services, or to provide other information relevant to meditation.
Wherever legally possible, we will not do any of this if you tell us that you do not want us to, unless we are required to do so by law.
There are cases where we must store personal data because someone could harm themselves, others, or the organization by participating in a course.
Automated decision-making does not take place.
What information we store
We process, among other things, master data, communication data, course/application data, organizational information on accommodation/meals/emergency contacts, and – where necessary and provided by you – health data for aptitude/participation tests.
We store your name, date of birth, gender, occupation, course-relevant information about your medical and/or mental health, the names of your partner or friends who areparticipating in the same course as you, your emergency contact, general contact information, course history, native language, and other languages spoken.
For the duration of the course, we may also store your vehicle’s license plate number in case we need to remove it in an emergency.
If a teacher has objective reasons for not allowing you to participate in a course for the time being, we will also store this information as well as the reasons for the exclusion. The decision to store this information may be made based on the data you have provided to us, but also based on incidents or observations made by an instructor. Only Vipassana instructors who were involved in this decision or who are involved in deciding on your possible future participation in Vipassana courses or services have regular access to this information.
Required information without which participation in our courses is not possible
In order to participate in a course, it is essential that you provide data that clearly identifies you and your health suitability. Without this data, we cannot admit you to any course.
Data sources and data categories
The data we process about you comes from you (application form, communication) or from a teacher with whom you have been in contact.
How long we store the information
For legal reasons, we are required to store some of the data we hold about you, such as data relating to your donations, for at least 8 years. Unless specific time limits are stipulated by law, the following applies:
In CALM, all sensitive information and all communication is deleted three months after the course has ended. Only basic information is stored on an ongoing basis, such as your name and whether you have previously completed a course. The data you provided whenyou registered, as well as any correspondence relating to important communication about CALM, is archived offline and deleted no later than four years after the end of the course.
An assessment that you will not be able to participate in a course in the future, or only under certain conditions, will be kept for a maximum of 8 years. This period may be extended appropriately after reassessment.
The paper form that you fill out upon arrival at a course location or center in Germany will also be destroyed after four years at the latest.
When you participate in a course, the Vipassana Association is responsible for storing your data in accordance with national and international regulations. However, we destroy all data that we no longer need.
To find out exactly how long information is stored and where the paper forms from courses outside a center are kept, please contact the relevant Data Protection Officer (DPO) or Privacy Contact Person (PCP) as indicated below.
When you contact us by email, we store the data you provide (your email address, your name and telephone number, if applicable) in order to answer your questions. We delete the data collected in this context after a maximum of three years.
How we process your personal data
When we process your personal data, we observe the following principles:
- Your data will only be used and stored to the extent and for as long as we really need it
- we have an overview of all types of information that is stored
- we will delete your data when we no longer need it
- we will provide you with information about the data we have stored about you upon request
- we keep your data adequately protected using state-of-the-art security systems
Transfer of data to third parties
We use external service providers to fulfill our tasks (e.g., IT hosting, document destruction, member administration). These providers process personal data exclusively on our behalf and on the basis of Art. 28 GDPR.
Apart from that, we only share your personal data within our organization, i. e., with Vipassana organizations of the same tradition with the same goals and only under appropriate security measures, see below. The purpose of the transfer may only be to ensure the proper conduct of Vipassana courses.
Contact person for your data protection inquiries
The CALM Foundation, which is responsible for the international online registrationsystem, has a data protection officer (DPO). You can contact them at: [email protected]. In addition, the meditation centers that use this system, such as the Vipassana Association e. V., are responsible for the further processing of the data. For this reason, the Vipassana Association e.V. also has a data protection contact person (PCP). You can contact them at [email protected] to direct your inquiries to them.
Data Protection Officer of the Vipassana Association e. V.
You can contact the data protection officer of the Vipassana Association e. V. at: [email protected]
Special rules for children’s courses
As children are particularly vulnerable, there is a specific privacy policy for children’s courses.
Processing of personal data when visiting our website
When you use the website for informational purposes, i. e., simply viewing it without registering or otherwise providing us with information, we process the personal data that your browser transmits to our server. The data described below is technically necessary for us to display our website to you and to ensure stability and security, and must therefore be processed by us. The legal basis is Art. 6 (1) (f) GDPR:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (page visited)–Access status/HTTP status code
- Amount of data transferred in each case
- Previously visited page
- Browser
- Operating system
- Language and version of browser software.
Fonts and external content
Our website does not use external Google fonts. All required fonts are provided exclusively by our own servers (https://design-standards.dhamma.org). This means that no connection is made to Google servers or other third-party providers to load fonts.
For optimization and security, the site uses Cloudflare (cdn-cgi scripts), which is technically necessary to provide the website reliably and securely. In addition, we embed a static image icon from Google Play. This is used exclusively for the display of the app store logo and does not transfer any personal data to Google except for the technically necessary request to load the image.
No cookies are set for marketing or tracking purposes when you visit our website.
YouTube videos are integrated into our website using a so-called 2-click solution. This means that only a static preview image is initially displayed. Only when you actively click on “Load video” is a connection to YouTube established and data transferred to Google/YouTube.
Legal basis
Personal data is only stored if we have a legitimate reason to store it and if this is permitted by law, e.g. your consent, a contract, another legitimate interest such as the vital interests of a participant, or because a specific law requires it. We can inform you of the legal reason why we store your data at any time upon request.
| Purpose / Process | Data Categories (Examples) | Legal Basis (GDPR / TDDDG) | Joint Controllers / Recipients (Categories) | Retention / Deletion | Necessity / Consequences of Non-provision | Source |
| Course Application & Administration (Acceptance, waiting list, allocation of places, communication) | Master data, contact details, course preferences, organizational details (room/diet), emergency contact | Art. 6 (1) (b) (pre-contractual/contract), Art. 6 (1) (f) (IT operations/security) | Vipassana e. V. & CALM; Recipients: Course organization / Course management; Hosting/IT operations, email/communication services | General rule: until end of application/participation + 3 months | Required for participation/administration; no application/allocation possible without basic data | Generally from the data subject |
| Aptitude / Participation Test (Art. 9 Data) | Master data, contact details, health data (resilience, medication, diets), if applicable philosophical/religious references in the context of practice | Art. 9 (2) (d) (non-profit organization for participants) | Vipassana e.V. and CALM; Recipients: Course organization / Course management / local first aiders; Hosting/IT as processors | Generally deleted after 4 years; continuous storage only if necessary | Without this information, participation may not be possible (duty of care/safety) | Generally from the data subject or course instructors |
| Billing / Accounting / Donation Receipts | Invoice/payment data, donation details | Art. 6 (1) (c) (legal obligations under AO/HGB), Art. 6 (1) (b) | Vipassana e.V. and CALM; Recipients: Payment services, tax consultants/accounting, banks | At least 8 years (AO/HGB – German Tax/Commercial Code) | No billing/receipt possible without data | From the data subject / payment service |
| Post-Course Communication (e.g., feedback, schedule updates) | Contact details, course reference | Art. 6 (1) (b) (contract-related) or Art. 6 (1) (f) (legitimate interest in quality management) | Vipassana e.V.; Email/communication services | Until request for deletion / withdrawal of consent | No post-course communication without details; participation in the course remains unaffected | From the data subject |
| Newsletter / Further Information (not required for course) | Email address, opt-in logs | Art. 6 (1) (a) (consent); Double-Opt-In; withdrawal at any time | Vipassana e.V.; Recipients: Newsletter service (processor), email provider | Until withdrawal; opt-in logs up to 3 years after withdrawal (for evidence) | Voluntary; no newsletter without consent | From the data subject |
| Inquiries / Communication (Email, Form, Phone) | Sender details, content, metadata | Art. 6 (1) (b) (if contract-related), otherwise Art. 6 (1) (f) (communication/IT security) | Vipassana e.V.; Email/IT service providers (processors) | 12 months after completion (unless retention obligations apply) | No response possible without basic information | From the data subject |
| IT Operations / Platform Security (Logs, access protection) | Technical log data, IP, timestamp, account IDs | Art. 6 (1) (f) (operations/security); no profiling for other purposes | CALM.; Hosting/CDN/Monitoring (processors); if applicable support access (also third countries) with SCC | 12 months; longer retention only in case of security incidents | No secure operation without logs; data subject rights remain unaffected | Collected by the system |
| Website / Hoster (without tracking) | Server log files (IP, date/time, request), essence of page views | Art. 6 (1) (f) (operations/security); TDDDG § 25 (2) No. 2 (only “strictly necessary”) | Web hoster/CDN (processor; e.g., Cloudflare), domain provider | 30 days, longer only in case of incidents | No information required; use of website possible without data provision | Collected by the system |
| External Content (2-Click Solution, e.g., YouTube) | IP address, device/usage data after activation | Before activation: no data transfer; after click: TDDDG § 25 (1) + Art. 6 (1) (a) (consent) | Third-party platforms (YouTube/Google etc.) | No further loading processes after withdrawal/re-blocking; logic handled in consent tool | Voluntary; no external embedding without consent | From the end device after consent |
| Photos / Videos at Events | Visual/audio recordings | General rule: Art. 6 (1) (f) (documentation/public relations) with right to object; portraits/close-ups: Art. 6 (1) (a) (consent) | Vipassana e.V.; photo/video service providers (processors); if applicable publishing platforms | Publications according to purpose or until withdrawal/objection | Participation possible without consent; if applicable marked zones/opt-out option | From the data subject |
| Complaints, Exercise of Rights | Identification data, communication/evidence data | Art. 6 (1) (c) (legal obligations), Art. 6 (1) (f) (legal defense), Art. 9 (2) (f) if necessary | Vipassana e.V. and CALM; if applicable legal counsel, supervisory authorities, courts | Until completion + 3 years, longer for ongoing proceedings | No fulfillment possible without identifying information | From the data subject |
Security of your data
Employees and volunteers who process data for the Vipassana Association are trained in data protection and sign a confidentiality agreement. Only Vipassana teachers involved in the assessment have access to highly sensitive information (they have also signed a confidentiality agreement). Your personal data will be kept secure and will not be shared with any third party under any circumstances, unless they are expressly authorized by law or by us to receive this information in the course of our activities on your behalf.
Personal data is protected in particular with the aid of the following technical and organizational measures:
- in a lockable room with controlled access; and/orin a key-secured container in locked rooms and/or
- if it is computer-based, password-protected and additionally protected in accordance with standardized security requirements and/or
- stored on digital removable media that are encrypted and, where feasible, contain only pseudonymized data. PC screens and terminals used to process personal data may only be viewed by authorized employees.
- Paper records must not be left where they are accessible to unauthorized persons and must not be removed from the workplace without permission. Once handwritten records are no longer needed, they are deleted.
Your rights
We respect your rights. Specifically, we ensure the following:
• Upon request, we can provide you with an overview of all the information we have stored about you.
• We will ensure that your details are always correct.
• Upon your request, we will correct any incorrect information.
• We will also delete or remove the information at your request, unless there is a legal reason to process it without your consent. In this case, you have the right to object to our decision. In this case, a separate appeals committee (the Special Cases Committee) will decide on your objection.
• The same applies if you seek to restrict further processing or object to further processing altogether. Further processing will then only take place if we can demonstrate compelling legitimate grounds for the processing.
• At your request, we will forward your inquiries to the responsible data protection officer (DPO) or the contact person for data protection (PCP).
• You also have the right to data portability. We respect your right to lodge a complaint with the data protection authority.
Access to information and objection to its processing
If you would like to know what information we hold about you, or if you disagree with the data we hold about you, you can fill out this form and submit your request by sending it to [email protected].
Data breaches
If there has been a data breach that could significantly affect you, we would inform you and the Data Protection Authority. We are legally obliged to do both.
To report a data breach, see: https://www.privacy-eu.dhamma.org/report-a-data-breach/
International security measures / third country transfers
Whenever we share your personal data with a Vipassana organization outside the European Union, we will apply additional security measures. If your data is transferred to a third country, i. e., a country where the GDPR does not apply directly (such as the US, UK, or Australia), this will be done either on the basis of an adequacy decision by the European Union or on the basis of appropriate safeguards in accordance with Art. 46 GDPR. In appropriate cases, a data transfer impact assessment will also be carried out.
To learn more about the security measures we have applied in your specific case, please contact us.
Contact
If you have any questions or would like to contact us: [email protected] or [email protected] or https://www.privacy-eu.dhamma.org.
Data Protection Officer
You can reach our data protection officer at [email protected].
Data protection supervisory authority
The Saxon Data Protection and Transparency Officer is responsible for the Vipassana Association e. V.
Maternistraße 17
01067 Dresden
| Phone | +49 351 85471-101 |
| Fax | +49 351 85471-109 |
| [email protected] | |
| Website | https://www.datenschutz.sachsen.de/index.html |