Privacy Policy

Last updated: 10 September 2026

Green Cloud Nine Community – Verein zur Förderung praktischer Nachhaltigkeitsbildung (“we”, “us”, “our” or the “Association”) takes the protection of your personal data seriously.

This Privacy Policy explains how we process personal data when you visit our website, contact us, subscribe to our communications, participate in our activities, use our downloadable materials or otherwise interact with the Association through our digital services.

The processing of personal data is carried out in accordance with the EU General Data Protection Regulation (“GDPR”), the Austrian Data Protection Act (DSG), the Austrian Telecommunications Act 2021 (TKG 2021) and other applicable data protection legislation.

1. Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Green Cloud Nine Community – Verein zur Förderung praktischer Nachhaltigkeitsbildung
Kienbergstraße 41/8
6200 Jenbach
Austria

ZVR number: 1616015249

Email: hello@greencloudnine.community

The Association is represented by its statutory governing body in accordance with its statutes.

For questions concerning the processing of your personal data or to exercise your data protection rights, you can contact us at the email address above.

2. Scope of this Privacy Policy

This Privacy Policy applies to the Association's website and digital activities, including:

• information and educational content published on the website;
• blog articles and other editorial content;
• contact forms;
• email subscriptions and newsletters;
• downloadable guides, educational materials and children's activities;
• information and registration for workshops, seminars, webinars and other events;
• membership-related communications;
• donation-related communications and administration;
• participation in online activities;
• affiliate links and related tracking technologies;
• our use of analytics, social media and other third-party services.

The website is currently operated using Shopify infrastructure and the Shopify account is presently held by Green Cloud Nine e.U. on behalf of the Association. This technical arrangement does not change the Association's role as the controller of personal data processed for the purposes described in this Privacy Policy.

The website may currently be accessible through the existing greencloudnine.com domain. The Association intends to use greencloudnine.community as its dedicated domain in the future. A change of domain does not by itself change the controller or the purposes of processing described in this Privacy Policy.

3. What personal data we process

Depending on how you interact with us, we may process the following categories of personal data:

3.1 Information you provide directly

This may include:

• name;
• email address;
• telephone number, where provided;
• postal or other contact address, where required;
• information contained in messages submitted through our contact form;
• information provided when registering for activities or events;
• membership-related information;
• information provided in connection with donations;
• preferences and other information voluntarily provided by you.

We ask you not to provide sensitive personal data through general contact forms unless this is specifically necessary and requested by us.

3.2 Technical and usage information

When you visit the website, technical information may be processed, including:

• IP address;
• date and time of access;
• browser type and version;
• operating system;
• device information;
• referring website;
• pages visited and interactions with the website;
• technical log and security information;
• cookie and similar technology information.

Some of this information is generated automatically by the website infrastructure and is necessary for the secure and technically reliable operation of the website.

3.3 Information relating to events and workshops

If you register for a workshop, seminar, webinar or other event, we may process the information necessary to administer your participation, such as your name, contact details, registration details, payment status and event-specific information.

Additional information about photographs, recordings and event-specific processing may be provided during registration or before the relevant event.

4. Legal bases for processing

Depending on the specific processing activity, we rely on one or more of the following legal bases under Article 6 GDPR:

Consent — Article 6(1)(a) GDPR

Where required, we process personal data on the basis of your consent. This includes, for example, certain newsletter subscriptions, non-essential cookies and tracking technologies, and certain photographs or recordings.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Performance of a contract or pre-contractual measures — Article 6(1)(b) GDPR

Where necessary, we process personal data to provide a service or activity requested by you, to administer your registration for a paid or free event, or to take steps at your request before entering into an agreement.

Legal obligation — Article 6(1)(c) GDPR

We process personal data where this is necessary to comply with a legal obligation to which the Association is subject, including applicable accounting, tax, reporting or other statutory requirements.

Legitimate interests — Article 6(1)(f) GDPR

Where permitted by law, we process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your interests or fundamental rights and freedoms.

This may include, for example, website security, prevention of misuse, administration of our activities, maintenance of technical systems, handling enquiries and defending or establishing legal claims.

5. Website hosting and Shopify

Our website is currently operated using Shopify.

Shopify provides the technical infrastructure required to operate the website and may process personal data on our behalf in connection with website hosting, security, technical operation, website functionality and related services.

Depending on the services and features enabled on the website, Shopify may process information such as IP addresses, device and browser information, website usage information and information submitted through website forms.

Shopify provides tools for managing privacy settings, cookie consent and data subject requests and maintains a Data Processing Addendum governing relevant processing activities.

Shopify may process or store personal data outside the European Economic Area where permitted under applicable data protection law and subject to the safeguards required for international data transfers.

Further information is available in Shopify's privacy documentation.

6. Contact form and enquiries

If you contact us using the contact form or by email, we process the information you provide in order to respond to your enquiry and, where necessary, to take steps requested by you.

Depending on the nature of the enquiry, this may include your name, email address, telephone number and the contents of your message.

The legal basis is generally Article 6(1)(b) GDPR where the enquiry relates to a requested service or activity, or Article 6(1)(f) GDPR where we respond to a general enquiry or communication.

We retain enquiry correspondence only for as long as reasonably necessary to handle the enquiry and any resulting matter, or for as long as required by applicable legal obligations.

7. Newsletter and email communications

If you subscribe to our newsletter or other voluntary email communications, we process your email address and, where provided, your name and other subscription information.

We currently use MailerLite as our email marketing service provider.

MailerLite processes subscriber data on our behalf as a data processor. MailerLite states that its GDPR Data Processing Addendum applies to customer data processed through its services and provides mechanisms for international transfers where applicable.

Newsletter subscriptions are based on your consent where consent is legally required.

You can withdraw your consent at any time by using the unsubscribe link included in our emails or by contacting us directly.

MailerLite may use technical information such as email delivery, opening and interaction information in connection with the operation and improvement of its email marketing services. The specific tracking functionality used by our account may change over time.

We intend to move to Sender in the future. If this change takes place, this Privacy Policy will be updated to reflect the new provider and relevant processing arrangements.

8. Analytics and website statistics

We use website analytics to understand how visitors use our website, improve our content and evaluate the performance of our digital activities.

We currently use analytics services associated with our existing website setup, including Google Analytics, where enabled.

Analytics technologies that are not technically necessary are activated only where the required consent has been obtained through our cookie and consent mechanism.

Analytics data may include information about your device, browser, approximate location, pages visited, interactions and website usage.

Where consent is the legal basis, you can withdraw or change your consent through the website's cookie settings.

9. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are technically necessary for the website to function properly, maintain security, remember certain settings or provide services specifically requested by you.

Other cookies and similar technologies may be used for:

• analytics;
• measurement;
• marketing;
• advertising;
• affiliate tracking;
• social media and advertising technologies;
• other optional functionality.

Under Austrian law, technically non-essential cookies and similar access technologies generally require prior consent. Our consent mechanism is intended to ensure that such technologies are not activated before the required consent is obtained.

You can manage your preferences through the cookie settings provided on the website.

Please note that disabling certain cookies may affect some website functions.

10. Meta and TikTok

We may use technologies provided by Meta and TikTok for website measurement, marketing and advertising purposes.

Depending on the technologies enabled, these services may process information such as IP address, device information, browser information, website interactions and information about visits to our website.

Non-essential tracking technologies are activated only where the required consent has been obtained.

Where applicable, these services may process data outside the European Economic Area. Any such transfers are subject to the safeguards required under applicable data protection law.

The Association does not control the processing carried out by Meta or TikTok on their own behalf. Their respective privacy policies apply to processing for which they are independently responsible.

11. Affiliate links and affiliate tracking

Some of our website content may contain affiliate links, including links associated with Awin and the Amazon Associates programme.

Affiliate links allow us to receive a commission when a visitor follows an affiliate link and subsequently completes a qualifying transaction with the relevant third party.

Depending on the affiliate programme and technical implementation, affiliate links may involve the use of cookies, tracking parameters or similar technologies to attribute a transaction to our website.

Where such technologies are not technically necessary, they are used only where the required consent has been obtained.

Clicking an affiliate link takes you to a third-party website. The privacy practices of that third party then apply to your interaction with that website.

Affiliate links are disclosed separately on the website where appropriate.

12. Google services and Google Maps

We may use Google services, including Google Maps, to provide location-related information about the Association, workshops or other activities.

Depending on how Google Maps is technically embedded or accessed, Google may process information such as IP address, device information and usage information.

Where the embedded service requires access to non-essential technologies or personal data beyond what is technically necessary, it will be made available only in accordance with the applicable consent requirements.

The Google Maps service is subject to Google's own privacy practices.

13. Downloadable materials

The website may provide downloadable guides, educational resources, children's activities and similar materials.

Where a download can be accessed directly without registration, we do not intentionally require personal data solely for the purpose of downloading the material.

Technical information may nevertheless be processed by the website infrastructure as part of providing and securing the service.

If a particular resource requires registration or an email address, the relevant processing will be explained at the point of collection.

14. Workshops, seminars, webinars and events

The Association organises free and paid workshops, seminars, webinars and other educational activities.

When you register for an event, we process the information necessary to administer your participation, communicate with you about the event and, where applicable, process payment or cancellation information.

For paid events, payment may be handled through payment methods specified for the individual event. The payment method and the relevant payment provider will be identified in the applicable registration or payment information.

Event-specific information may include:

• registration details;
• attendance information;
• communication concerning the event;
• payment and refund information;
• age or participation requirements where relevant.

If an event is held online, the relevant video-conferencing or webinar provider may process additional technical information. The provider and any additional privacy information will be communicated where appropriate.

If a webinar or other event is recorded, participants will be informed in advance. Where an identifiable participant is included in a recording, the Association will obtain consent where required.

15. Photography and video recordings at events

Photographs and, occasionally, video or audio recordings may be made at Association events for purposes such as documenting activities, communicating the Association's work and publishing information about events.

Participants will be informed about photography or recording at the relevant event and, where required, an appropriate consent mechanism will be provided during registration or at the event.

Where consent is required, participation in photography or recording is voluntary and consent can be withdrawn for future use.

Special care will be taken when photographing or recording children. Where required, consent will be obtained from the relevant parent or legal representative.

Further event-specific information may be provided in the registration process or at the event itself.

16. Membership

Membership of the Association is open to persons who support the purposes of the Association and meet the requirements set out in its statutes.

If you apply for or hold membership, we may process information necessary to administer the membership relationship, including identification and contact details, membership status, correspondence and payment information where applicable.

The legal basis will generally be Article 6(1)(b) GDPR for the administration of the membership relationship and Article 6(1)(c) GDPR where processing is required by law.

Membership fees and specific membership benefits are determined in accordance with the Association's statutes and decisions of the General Assembly.

17. Donations

The Association accepts voluntary donations to support its activities and charitable purposes.

Where you provide personal information in connection with a donation, we may process information such as your name, contact details, donation amount and payment-related information, depending on the payment method used.

Payment providers may process payment information independently or on our behalf. The applicable payment provider will be identified where relevant.

Donation-related information may be retained where necessary for accounting, tax or other legal obligations.

We do not publish the names of individual donors unless this is based on an appropriate legal basis, including consent where required.

18. Social media and external links

Our website may contain links to social media platforms, third-party websites, educational resources, retailers, organisations and other external services.

Unless a third-party service is technically integrated into our website, simply providing a link does not normally transmit personal data to the linked website merely because the link is displayed.

Once you leave our website and access a third-party service, that third party's privacy policy applies.

We have no control over the processing of personal data carried out independently by external websites.

19. No public blog comments

Comments on our blog articles are currently disabled.

If comments are introduced in the future, this Privacy Policy will be updated to describe the relevant processing before the feature is activated.

20. Data recipients and service providers

Depending on the particular processing activity, personal data may be disclosed to or processed by service providers that support the operation of the Association and its website.

These may currently include:

• Shopify;
• MailerLite;
• Google and Google-related services;
• Meta;
• TikTok;
• Awin;
• Amazon and Amazon Associates-related services;
• payment providers, where applicable;
• website, IT and technical service providers;
• professional advisers, where necessary;
• public authorities and other bodies where required by law.

Where a service provider processes personal data on our behalf, we take appropriate steps to ensure that the processing is governed by the requirements of applicable data protection law.

21. International data transfers

Some of the service providers we use may process personal data outside the European Economic Area.

Where personal data is transferred to a third country, we ensure that an applicable legal mechanism under Chapter V GDPR is used, such as an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard, where required.

The exact location and transfer mechanism may depend on the services and configurations active at the relevant time.

22. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law or is necessary for the establishment, exercise or defence of legal claims.

Different categories of information are therefore retained for different periods.

Examples include:

• contact enquiries: generally until the enquiry has been resolved and for a reasonable period thereafter;
• newsletter data: until you unsubscribe or the relevant processing otherwise ends;
• event registration data: for the administration of the event and, where necessary, for applicable legal or accounting purposes;
• accounting and donation records: for the legally required retention period;
• consent records: for as long as necessary to demonstrate and manage the relevant consent;
• technical and security logs: for periods appropriate to the relevant security and technical purposes.

We do not retain personal data indefinitely merely because it was once collected.

23. Your rights under the GDPR

Subject to the applicable legal conditions, you have the following rights:

• Right of access to your personal data;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure of your personal data;
• Right to restriction of processing;
• Right to data portability, where applicable;
• Right to object to processing based on legitimate interests;
• Right to withdraw consent at any time where processing is based on consent.

You may exercise your rights by contacting:

Green Cloud Nine Community – Verein zur Förderung praktischer Nachhaltigkeitsbildung
Email: hello@greencloudnine.community

We may need to verify your identity before processing a request where this is necessary to protect personal data against unauthorised disclosure.

24. Right to lodge a complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Austria, this is:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at

The Austrian Data Protection Authority confirms that data subjects may lodge complaints where they consider that their rights under data protection law have been infringed.

25. Data security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No transmission or storage system can be guaranteed to be completely secure. We therefore continuously review and, where appropriate, improve our technical and organisational security measures.

26. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, services, technology, legal requirements or the service providers we use.

The current version will always be published on our website with the date of the most recent update.

If a change materially affects your rights or the way we process your personal data, we will provide additional information where required by law.