Privacy Policy Of Stepto.Support Website
Introduction
Thank you for visiting the Stepto.Support Website (the Website). Our purpose is to provide information on support services for people with sexual interest in children, to prevent corresponding offences. We achieve this using different channels – such as a map of available services in the EU and a contact form. Note that the contact form follows the informative goal exclusively; it is not established to e.g., provide therapeutic advice, but rather to navigate people to places where they can obtain it. We also seek to obtain information on how the website is used, in order to improve it and obtain aggregated, anonymous or anonymised research insights. Your privacy is paramount to us. In achieving our goals, we seek to process as little personal data as possible. Personal data flows on our platform were carefully designed to prevent identification of users. We do not sell or share your data, nor do we use it for marketing or advertising. In this privacy policy, you will find information on:
- Who is legally responsible for the data processing (data controller).
- The data collection and processing that we carry out when you visit
our website and use its different components. - Your rights as a data subject.
This website does not place cookies on your device, for details please see our Cookies policy.
This document can be printed for reference by using the print command
in the settings of any browser.
Data Controller
| Name | Charité – Universitätsmedizin Berlin (CUB) |
|---|---|
| Role and tasks on the platform |
|
| Contact details of the lead representative for the platform | Isabel Schilg – isabel.schilg@charite.de |
| Contact details of the data protection officer (email) | datenschutzbeauftragte@charite.de |
| Organisation’s address | Charitépl. 1, 10117 Berlin, Germany |
| Organisation’s website | https://www.charite.de/en/ |
What data do we collect, for what purpose, and on what legal basis?
Purposes and bases for processing
| ID | Processing purpose | Description & legal basis for processing |
|---|---|---|
| A. | Addressing the inquiry submitted via the contact form. | The user of the platform can ask general questions through the contact form. The processing of personal data is based on the legitimate interest in addressing inquiries submitted via the contact form. |
| B. | Operating the platform (passive provision of information) | Personal data is utilized to deliver informative services. The processing of personal data is based on the legitimate interest in providing the informative service through the platform. |
| C. | Enhancing the quality of the platform | To continuously enhance the quality of the platform, personal data of the users of the platform is collected and processed. Personal data is utilized to offer comprehensive information about the performance of the platform and the behaviour of the user of the platform. The processing of personal data is based on the legitimate interest in enhancing the quality on the platform. |
| D. | Ensuring the safety and security of the services on the platform | To ensure that the services on the platform are used in a manner that complies with applicable laws and regulations and to prevent abuse and fraud, certain information is tracked from the users of the platform. The processing of personal data is based on the legitimate interest in ensuring the safety and security of the services on the platform. |
Data Collected
We collect the following types of personal data, depending on which part of the platform you’re using.
Website
- Masked IP addresses
- Processing purpose – B.
- Upon visiting the website, your IP address is collected and automatically pseudonymised by removal of two latter octets of information (e.g., 192.168.12.23 à 192.168.xxx.xxx). This means that it is impossible for us to identify you; at most, we can tell which country you are connecting from.
- This masked IP address is processed in order to demonstrate location of relevant services and resources. It is also used to produce aggregated, anonymous findings on the use of the website.
- Stored by CUB; deleted until aggregated findings are extracted (max 2 years after the end of the project – September 2027).
- User behaviour on the platform
- Processing purpose – C
- We analyse user behaviour on the platform, without setting any cookies – such as date and time of the visit, which pages are visited, how long users stay on a page, and what interactions they perform (e.g., clicking buttons or filling out forms).
- § Important – This information is not connected to your full IP address or any identifier tied to your person. Instead, every time you connect, a randomly generated ID is generated by the system; we do not seek to track you across sessions.
- Stored by CUB; deleted until aggregated findings are extracted (max 2 years after the end of the project – September 2027).
Contact form
- Email address
- Processing purpose – A.
- The e-mail address is requested from the user of the platform when completing the contact form on the platform. This is to enable a response to the inquiry.
- Stored by CUB; it will be deleted after max. 21 days from last interaction.
- Message content
- Processing purpose – A.
- We make it clear that personal data should not be conveyed through the contact form; however, we consider that it might happen nonetheless.
- Stored by CUB; it will be deleted after max. 21 days from last interaction.
Third country data transfers
No personal data is transferred to countries outside the European Union. The website and its analytics run on servers of Charité – Universitätsmedizin Berlin in Germany. The platform uses no third-party analytics service and no third-party chat service.
User personal rights
Users may exercise certain rights regarding their data processed within the platform.
| ID | Data subject right | In place? | Explanation if not in place |
|---|---|---|---|
| 1. | Right of access Data subjects have the right to learn if data is being processed by the owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the data undergoing processing. (Article 15 GDPR) | YES | N/A |
| 2. | Right to rectification Users have the right to verify the accuracy of their data and ask for it to be updated or corrected. (Article 16 GDPR) | YES | N/A |
| 3. | Right to erasure Users have the right to obtain the erasure of their data from the owner. (Article 17 GDPR) | YES | N/A |
| 4. | Right to restriction of processing Users have the right to restrict the processing of their data. In this case, the owner will not process their data for any purpose other than storing it. (Article 18 GDPR) | YES | N/A |
| 5. | Right to data portability Users have the right to receive their data in a structured, commonly used and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. (Article 20 GDPR) | NO | The right does not apply, as all processing activities rely on legitimate interest only. There would be a very limited scope in any case, as data subjects are actively discouraged from providing any personal data in any of the activities covered by this DPIA. |
| 6. | Right to object Data subjects have the right to object to the processing of their data if the processing is carried out on a legal basis other than consent. (Article 21 GDPR) | YES | N/A |
| 7. | Right not to be subject to automated individual decision-making No automated individual decision-making on the platform. (Article 22 GDPR) | NO | This is not applicable as there is no automated individual decision-making on the platform. |
| 8. | Right to withdraw consent Data subjects have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data. (Article 7(3) GDPR) | NO | All processing of personal data relies on the legal basis of legitimate interest. |
| 9. | Right to lodge a complaint Data subjects have the right to bring a claim before their competent data protection authority. (Article 77 GDPR) | YES | N/A |
These data subject rights apply to StS platform’s datasets in the following manner:
| Dataset | Data subject rights from arts. 15, 16, 17, 18 and 21? | Data controller responsible | Explanation of limitation on the exercise of data subject rights (if applicable) |
|---|---|---|---|
| Website – Masked IP addresses (pre-masking) | No | CUB | The pre-masked IP addresses are immediately pseudonymised after collection, there isn’t a time window during which the data subject rights could be meaningfully exercised. |
| Website – Masked IP addresses | No | CUB | Following pseudonymisation, it is impossible to identify the IP address of the data subject and distinguish it from other IP addresses. For example, if two data subjects have IP addresses of 192.168.1.20 and 192.168.44.528, the stored IP address in the form of 192.168.xxx.xxx could pertain to both of them. |
| Website – User behaviour on the platform | No | CUB | User behaviour data are collected per session, and in such a way that makes identifying the data subject practically impossible. |
| Contact form – email address | Yes | CUB | N/A |
| Contact form – message content | Yes | CUB | N/A |
Additional considerations
This Website does not support “Do Not Track” requests. To determine whether any of the third-party services it uses honour the “Do Not Track” requests, please read their privacy policies.
Changes To This Privacy Policy
We reserve the right to make changes to this privacy policy at any time by notifying the website’s users on this page and/or – as far as technically and legally feasible – sending a notice to users via any contact information available to us. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.
Legal information
This privacy statement has been prepared primarily on the basis of Arts. 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation). This document relates solely to this website, if not stated otherwise within this document.
