Privacy Policy

Thank you for your interest in this Privacy Policy. You are about to read more about which Personal Data we collect from you via our website at environment.cosup.eu, what we use it for, when we delete it and how your data is protected. We will also inform you of the respective legal basis that allows us to process your data, and of your rights in connection with that processing.

What is Personal Data?

Personal Data is information that makes it possible to identify a natural person. This includes in particular your name, date of birth, address, telephone number, e-mail address, and your IP address. Anonymous data exists if no personal reference to the user can be made.

What is Processing?

“Processing” means and covers virtually any handling of data.

What law applies?

We will only use your Personal Data in accordance with applicable data protection laws, in particular Germany’s Federal Data Protection Act (“BDSG”) and the EU’s General Data Protection Regulation (“GDPR”), and only as described in this Privacy Policy.

Who is responsible for data processing?

The responsible party within the meaning of the BDSG and the GDPR is the Environmental Department of the Conseil Supérieur des Élèves (“CoSup Environment”, “we”, “us”, “our”). The parent organisation is the Conseil Supérieur des Élèves (CoSup), Wilhelmstr. 62, 75323 Bad Wildbad, Germany.

If you have any questions about this policy or our data protection practices, please contact us at [email protected] or write to us at the above address.

Data collection

All Personal Data that we obtain from you will only be processed for the purposes described below. In particular, we collect Personal Data only if:

• you have given your consent;
• the data is necessary for the fulfilment of a contract or pre-contractual measures;
• the data is necessary for the fulfilment of a legal obligation; or
• the data is necessary to protect the legitimate interests of our organisation.

We process and store your Personal Data only for the period of time required to achieve the respective processing purpose, or for as long as a legal retention period exists (in particular commercial and tax law in accordance with the German Commercial Law (HGB) and Fiscal Code (AO), up to 8 years). Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted.

Data transfers

In certain cases, it is necessary to transmit processed Personal Data in the course of data processing. There are different recipient bodies and categories of recipients.

A. Internal

If necessary, we transfer your Personal Data within CoSup and its departments. We comply with the associated legal framework and ensure that your data is processed properly. Access to your Personal Data is only granted to authorised members who need access due to their role within the organisation.

B. External bodies

Personal Data is transferred to our service providers in the following instances:

• to use communication services and to promote our environmental initiatives and publications online;
• to communicate with you;
• to provide and maintain our website; and
• to state authorities and institutions as far as this is required or necessary.

We usually do not transfer Personal Data to countries outside Germany or the EEA. However, if we do, we ensure that processing is governed by Processing Agreements that include Standard Contractual Clauses to ensure a high level of data protection.

Links to other websites

Please note that if you use a link from our website to a third-party website, that third party may also set new cookies not covered by this policy. In such cases, we recommend that you read the cookie policy on the third-party website itself.

Security of your data

In order to protect the data stored with us in the best possible way against accidental or intentional manipulation, loss, destruction or access by unauthorised persons, we use appropriate technical and organisational security measures. The security levels are continuously reviewed and adapted to new security standards.

Nevertheless, internet-based data transmissions can always have security gaps, so absolute protection cannot be guaranteed. Upon becoming aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised as expeditiously as possible.

Your Rights and Privileges

A. Privacy rights

Under the BDSG and GDPR, you can exercise the following rights:

• The right to access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to object to processing;
• The right to data portability.

B. Updating your information

If you believe that the information we hold about you is inaccurate, or wish to request its rectification, deletion, or object to its processing, please contact us.

C. Withdrawing your consent

You can withdraw consents you have given at any time by contacting us.

D. Access Request

In the event you want to make a Data Subject Access Request, please contact us. We will respond as soon as reasonably possible. Should we not be able to respond within thirty (30) days, we will inform you of the reason and the expected timeline.

E. Complaint to a supervisory authority

You have the right to lodge a complaint about our processing of personal data with a supervisory authority responsible for data protection. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) (www.bfdi.bund.de) is the Federal Commissioner for Data Protection. However, we would appreciate the opportunity to address your concerns before you approach any supervisory authority.

Processing of your Personal Data

A. Log files

The following data is collected anonymously for the purpose of demand-oriented design and optimisation of this website:

• Information on the device used (e.g., operating system, browser, screen resolution, language setting);
• Information on pages viewed during the website visit;
• Information on access data (e.g., entry via links from other websites or online publications).

The scope of the stored and processed data is limited to statistical evaluations. Your IP address is made unrecognisable immediately after receipt, meaning it is not possible to assign usage profiles to IP addresses. The collection of this data is technically necessary to continuously optimise the functions and presentation of our website and is therefore based on legitimate interest.

B. Cookies

As described in our Cookie Policy, we only use so-called essential cookies. As set out in Germany’s TTDSG and the EU’s PECD, we do not need to obtain consent when we do not use non-essential cookies, and this is why you will not encounter a cookie consent pop-up on this site.

C. Hosting of our website

The CoSup Environment website is hosted as part of CoSup’s infrastructure. All data collected on this website is processed on servers operated by or on behalf of the Conseil Supérieur des Élèves. The basis for processing is our legitimate interest and the initiation and/or fulfilment of a contract.

D. Fonts

We may use Google Fonts by Google LLC (1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA) and Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) on our website to display external fonts. To enable this, a connection to a Google server may be established when our website is accessed. This represents a legitimate interest.

E. Contact options

We process and store the Personal Data provided in contact enquiries solely for the purpose of processing and responding to your enquiry. Only the data that we absolutely need to respond to you is collected, typically your name, e-mail address, and message content. In addition, your IP address is processed out of technical necessity and for legal protection. The legal basis for processing is our legitimate interest and your consent.

F. Support and Data Management

For support and data management, we may store data related to our users (names, e-mails) using PocketBase in connection with CoSup’s server infrastructure. This data processing is based on our legitimate interest in providing support and communication services.

G. Downloading our Resources and Publications

When you download resources or publications, your IP address is requested and logged for documentation purposes. This is a technical requirement to make downloads available to your device. The basis for this storage is the provision of a service and our legitimate interest.

Social Media

A. General

We may be present on social media on the basis of our legitimate interest. If you contact or connect with us via social media, we and the relevant social media platform may be jointly responsible for the processing of your data. The Personal Data collected when contacting us is used to handle your request; the bases are your consent and our legitimate interest.

B. When you visit our profiles and interact with us

When you visit our social media profiles, we process your actions and interactions with our profile (e.g., the content of messages, posts or comments you send to us or leave on our profile) as well as your publicly viewable profile data (e.g., your name and profile picture). The legal basis is our legitimate interest and your consent.

Changes

We are constantly developing and improving our website, and as a result some of the information in this Privacy Policy is likely to change over time. We therefore recommend that you read this Privacy Policy periodically to stay informed of the current status.

Do you have any questions?

Please contact us at [email protected] or write to us at the above address if you have any comments or questions about this policy and/or our use of your Personal Data.

Effective Date

This Privacy Policy was last updated on Friday, 12 June 2026.