Privacy Policy

EPIS Think Tank · Last updated 2 October 2026

This Privacy Policy explains how EPIS Thinktank e.V. processes personal data when you visit epis-thinktank.com, apply for a fellowship or internship, use the member area, or use our mobile apps for iOS and Android. It replaces the previous app privacy policy of 24 May 2026.

1. Controller and data protection contact

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

EPIS Thinktank e.V.
Am Stadtgarten 50
44623 Herne, Germany
Register of associations: Amtsgericht Berlin (Charlottenburg), VR 36912
Represented by the Board of Directors: Theodor Himmel, Johannes Hollunder, Daniel Gerjets
Phone: +49 155 659 754 23
Email: board.directors@epis-thinktank.com

For all questions about data protection and to exercise your rights, please contact our data protection contact:

Daniel Gerjets
Email: board.legal@epis-thinktank.com
Postal address: as above, marked “Data Protection”

2. General information

Legal bases. We process personal data only where a legal basis applies:

• Art. 6(1)(a) GDPR: your consent, which you can withdraw at any time with effect for the future (Art. 7(3) GDPR)
• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual steps, e.g. membership, fellowships, internships
• Art. 6(1)(c) GDPR: compliance with legal obligations, e.g. statutory retention duties
• Art. 6(1)(f) GDPR: our legitimate interests, e.g. the secure and stable operation of our website and apps

Storing information on, or reading it from, your device (e.g. cookies) is based on your consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is not required where the storage is strictly necessary to provide a service you have requested (Section 25(2) no. 2 TDDDG).

Processors. We use service providers that process data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. They are named in the sections below.

Transfers outside the EU/EEA. Some providers are based in the United States or may access data from there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise, we rely on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention. We delete personal data as soon as the purpose of processing no longer applies, unless statutory retention periods require us to keep it longer. Specific retention periods are stated in the sections below.

No obligation, no automated decisions. You are not legally obliged to provide personal data. Some data is required to apply or to use the member area. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Website hosting and server log files

When you visit our website, your browser automatically transmits technical data to our servers. We process:

• IP address
• date and time of the request
• page or file requested and amount of data transferred
• referrer URL (the page you came from)
• browser type and version, operating system

We use this data to deliver the website, to ensure its security and stability, and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Server log files, including records of failed sign-in attempts, are deleted after 30 days at the latest. They are kept longer only where we need them to investigate a specific security incident.

We use the following hosting and infrastructure providers:

We have concluded data processing agreements with all three providers. Transfers to Vercel in the USA, and any access by Upstash, Inc. from the USA, are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses (see Section 2).

Protection against attacks. To protect the website and the member area, failed sign-in attempts are recorded with the IP address and the user name entered. An IP address with repeated failed attempts is blocked automatically for 7 days. The administration area also keeps a log of activity there, such as changes to articles and media, with the last part of the IP address removed; it is deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the security of our systems (Recital 49 GDPR).

Article view counts. We count how often each article is read. To count a visitor only once per article, the IP address is held for one hour and then deleted automatically. No profile is created. The legal basis is Art. 6(1)(f) GDPR.

Website search (Algolia). Our website search is provided by Algolia SAS, 55 rue d’Amsterdam, 75008 Paris, France. When you use the search, your search query, IP address and browser information are transmitted to Algolia to display results. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in offering a fast and functional search. The data is stored in Germany. We do not use Algolia’s analytics features. Algolia stores a technical entry in your browser’s local storage that records which of its servers are reachable; it contains no identifier. Algolia may involve its US affiliate Algolia, Inc. for support; such transfers are based on Standard Contractual Clauses. Search logs are deleted after 90 days at the latest. We have concluded a data processing agreement with Algolia.

4. Cookies, consent and web analytics

Cookies and similar technologies. Cookies and local storage entries are small data sets stored on your device. We use strictly necessary technologies without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). These are: the sign-in cookies (the session cookie expires 8 hours after your last activity; the security cookies used while signing in are deleted when you close your browser), your light or dark theme, which notifications you have seen, your privacy choices (12 months), a technical entry for the site search (Algolia), and hCaptcha on the sign-in and role request forms. All other technologies, in particular for analytics, are used only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Consent banner. On your first visit, a banner asks for your consent. You can accept all, reject all, or choose by category under “Customise”. Strictly necessary technologies are always active; Analytics and External media are used only if you switch them on. You can change or withdraw your choice at any time via “Privacy settings” at the foot of every page. Your choice is stored in your browser for 12 months; after that, we ask you again.

PostHog. With your consent, we use PostHog for product analytics on our website, e.g. to measure which functions are used and where users encounter problems. Provider: PostHog Inc., USA. Data is stored in PostHog’s EU cloud. PostHog processes usage events, device and browser information and a pseudonymous identifier; IP addresses are discarded on receipt and not stored. We do not use PostHog’s session replay function. Data is retained for 12 months. Where data is accessed from the USA, the transfer is based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

Vercel Web Analytics and Speed Insights. With your consent, we use Vercel Web Analytics to count page views, referring websites and device and browser types, and Vercel Speed Insights to measure how quickly our pages load. Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Neither sets cookies. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

External media. Our Delegations page shows a Google Calendar, a map of our delegations and a Google Forms application form. The map is provided through Google Apps Script and uses the map library Leaflet from unpkg.com and map images from CARTO. This content loads only if you allow External media, or if you choose to load an item on the page. Loading it connects your browser to these providers, which receive your IP address and may set their own cookies. Providers:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Calendar, Apps Script, Forms); data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework
• unpkg.com, a public content delivery service for code libraries, operated from the USA
• CARTO (CartoDB, Inc., USA), which provides the map images

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Where these providers process data in the USA or other third countries, this happens on the basis of your consent (Art. 49(1)(a) GDPR) unless an adequacy decision or Standard Contractual Clauses apply. In that case, your data may not be protected to the same level as in the EU, and authorities there may be able to access it.

We have concluded data processing agreements with PostHog and Vercel.

5. Contacting us by email or phone

If you contact us by email or phone, we process the data you provide (e.g. name, email address, phone number, content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, membership or application, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. We delete your data once your request has been fully dealt with, unless statutory retention periods apply.

We use Google Workspace for email, file storage and internal collaboration. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. We have concluded a data processing agreement with Google.

Automated emails (Resend). We send automated emails, e.g. confirmations of your application, login and password-reset emails for the member area, confirmation of your email address and notifications from our publishing system, via Resend, provided by Resend, Inc., USA. Resend processes your email address, name where provided, the content of the email and technical delivery data (e.g. time of delivery, delivery status). We do not track whether emails are opened or links are clicked. Emails are sent from Resend’s EU region in Ireland. The legal basis is Art. 6(1)(b) GDPR, as these emails are necessary to handle your application or your membership, and otherwise Art. 6(1)(f) GDPR. Delivery logs are deleted after 30 days at the latest. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. We have concluded a data processing agreement with Resend.

6. Applications for fellowships and internships

You can apply for our fellowship and internship programmes through Google Forms, which we link to from our website and, on the Delegations page, also show on it (see External media in Section 4). We process the data you provide, in particular:

• name and contact details
• university, field of study and academic background
• CV, motivation statement and other documents you upload
• nationality, languages and areas of interest, where requested
• your answers to the questions in the form

We use this data only to review your application, select candidates, arrange interviews and, if you are accepted, to prepare your fellowship or internship. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). For internships that constitute an employment relationship, Art. 88 GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) also applies. Please do not include special categories of data (e.g. health or religious beliefs) unless they are necessary for your application.

Only the members of EPIS responsible for the selection process have access to your application.

Google Forms. Applications submitted via Google Forms are stored in our Google Workspace account (provider: Google Ireland Limited; see Section 5). Data may be transferred to Google LLC in the USA on the basis of the EU-U.S. Data Privacy Framework.

Role requests. Requests for a role in the member area are stored in our database on our servers at Hetzner in Germany.

Spam protection (hCaptcha). To protect the member sign-in and the role request form against spam and automated abuse, we use hCaptcha, provided by Intuition Machines, Inc., USA. hCaptcha checks whether an entry is made by a human. For this purpose, it processes your IP address, browser and device information, and information about your interaction with the page (e.g. mouse movements, time spent). hCaptcha is only loaded when you open a protected form. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting our website against misuse; access to your device is strictly necessary for this security function requested by you (Section 25(2) no. 2 TDDDG). Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. We have concluded a data processing agreement with Intuition Machines, Inc.

Retention. If your application is unsuccessful, we delete your data six months after we notify you of our decision, so that we can respond to any legal claims. With your consent, we keep your application for up to two years to consider you for future programmes. If you are accepted, your data becomes part of your fellowship or internship file.

7. Member area

Our website has a login area for EPIS members, run on our own system. To create and manage your account, we process your name, email address, password (stored only as a hash), membership role and the date of your last login. When you log in, we set a strictly necessary session cookie so that you stay logged in; no consent is required for this (Section 25(2) no. 2 TDDDG).

For each signed-in device we also store the browser and operating system, the country and city of sign-in (worked out at sign-in; the IP address itself is not stored), and when the session started and was last active. A session ends after 8 hours without activity. In the member area you can also save articles, follow fellows, sign up for events and receive notifications; these are stored with your account.

Journals Database search (Gemini API). Searches in the Journals Database are sent, without your name or IP address, to the Gemini API provided by Google to find publications with a related meaning. Google does not use these searches to improve its products, and processes them as our processor under its data processing terms for the Gemini API. Data may be processed in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR, as the search is part of the member area.

The legal basis for the member area is Art. 6(1)(b) GDPR in conjunction with your membership. The data is stored on the infrastructure described in Section 3. You can download a copy of your data and delete your account yourself under “Security” in your account. Articles you have published stay online under your name after your account is deleted; the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in keeping our publications complete, and you can ask us to remove or anonymise your name. We delete your account when your membership ends, unless statutory retention periods apply (e.g. for membership fee records under tax law, up to ten years).

8. Mobile apps (iOS and Android)

Download. Our apps are distributed through the Apple App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google Ireland Limited). When you download an app, these stores process data such as your account details and device information under their own responsibility. We receive no personal data from this process beyond anonymous statistics.

Content delivery. To show you our public content (publications, PDFs, cover images, profiles and delegation maps), the apps fetch data from the EPIS backend and asset services. For this, our servers process the request time, the requested content path, the HTTP status code, the app platform (iOS or Android), the app version and build, the operating system version, the device model and user-agent information, in order to deliver the content securely, keep the apps fast and protect our servers. The legal basis is Art. 6(1)(f) GDPR. We use Google Cloud and Firebase (Google Ireland Limited; transfers to Google LLC in the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses). These server logs are deleted after 14 days at the latest.

Offline reading. Publications and media you download are stored locally on your device so you can read them offline. They stay on your device until they are replaced by newer content, cleared by the app, or deleted by you, for example by uninstalling the app.

Usage analytics. We use analytics to understand how the apps are used and to improve our content. We do not use your data for advertising, do not pass it to data brokers and do not track you across other apps.

• First-party telemetry: the apps send basic events directly to the EPIS backend: app opens, publication views, publication identifiers and the app platform.
• Matomo: the apps send screen views and selected interaction events to a Matomo instance operated for us by EsperoTech (matomo.espero.tech). Matomo processes the screen path, event names, app version and build, screen resolution, user-agent information, request time and a randomly generated app visitor ID stored on your device. IP addresses are anonymised immediately on receipt by masking two bytes; no full IP addresses are stored.

Where consent is required by law, we ask for it in the app (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); otherwise the legal basis is Art. 6(1)(f) GDPR. Aggregated or anonymised statistics may be kept for historical reporting.

Crash reports. In production builds we use Sentry (Functional Software, Inc., USA) to detect and fix errors. In the event of a crash, Sentry processes crash logs, stack traces, the app version and build, the deployment environment, device context (e.g. manufacturer and model), the operating system status and error details defined by the app. The legal basis is Art. 6(1)(f) GDPR, our interest in stable apps. Raw diagnostic data is deleted after 90 days at the latest. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

App development and distribution.EsperoTech GmbH & Co. KG, Ludwigstr. 17, 82110 Germering, Germany, provides technical development and operational support for the EPIS apps on our behalf and operates the Matomo instance used by the apps. It acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.

9. External links, newsletter, social media and public profiles

Links to other platforms. Our website links to our profiles on LinkedIn, Instagram, YouTube, Reddit and Medium. These are plain links: no content from these platforms is embedded, and no data is transmitted to them until you click a link. Once you visit a platform, its operator is responsible for data processing under its own privacy policy.

Newsletter. Our newsletter is published on Substack (Substack, Inc., USA). You subscribe directly on Substack, which processes your email address and usage data under its own privacy policy. We have access to the subscriber list to manage our newsletter; the legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every newsletter.

WhatsApp community group. We offer a link to a WhatsApp group. Joining is voluntary. WhatsApp is operated by WhatsApp Ireland Limited (Meta group). Other group members can see your phone number and profile name, and WhatsApp processes your data under its own privacy policy. If you prefer not to share your phone number, please follow our other channels instead.

Our own social media pages. When you interact with our pages on social networks, we may see your public profile and your interactions (e.g. comments, likes). For page statistics, we are jointly responsible with the platform operator where required by law (Art. 26 GDPR). The legal basis is Art. 6(1)(f) GDPR, our interest in communicating with the public.

Public profiles of EPIS members. On our website and in our apps, we publish profiles of board members, fellows and authors (e.g. name, photo, role, short biography). We publish these profiles only with the consent of the person concerned (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time by contacting board.legal@epis-thinktank.com.

10. Data security

We use technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website and apps use TLS encryption for all data transmission. Access to personal data is limited to the members of EPIS who need it for their tasks.

11. Children

Our website and apps are aimed at students and young professionals. They are not directed at children under 16. We do not knowingly process personal data of children under 16 without the consent of their parents or guardians.

12. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, please email board.legal@epis-thinktank.com.

Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

13. Changes to this Privacy Policy

We update this Privacy Policy when our services or the legal requirements change. The current version is always available at epis-thinktank.com/privacy-policy and in our apps.

Last updated: 2 October 2026