Imprint and privacy policy

Imprint and Privacy Policy

Girls Gearing Up International
Leadership Academy e.V.
Inselstrasse 12, 10179 Berlin
Founders: Dr. Christina Limbird,
Chineme Ugbor, Courtney Adams
Email: info@girlsgearingup.org
Phone: +49 (0)30 555 10936
Register court / number: VR 35877 B, Amtsgericht Charlottenburg

Girls Gearing Up International Leadership Academy, e.V. Privacy Policy

Girls Gearing Up International Leadership Academy, e.V. (“GGU”) is committed to protecting your privacy. We safeguard any personal information we collect about you and only use it in accordance with this Privacy Policy and applicable data protection laws.

For the purposes of the GDPR and other applicable data protection laws, the data controller is Girls Gearing Up International Leadership Academy e.V., Inselstrasse 12, 10179 Berlin, Germany. You can contact us about any privacy matter at info@girlsgearingup.org or +49 (0)30 555 10936.

We may update this policy from time to time by posting a new version on this page. You should check this page occasionally to ensure you are happy with any changes. This policy is effective from 22 September 2026 and replaces any earlier versions.

Collecting and Using Your Information

When you ask us for information or sign up for one of our programs, we ask for your name and email address. GGU will never sell, exchange, nor give your information collected online to a third party. In our case, GGU freelance staff are not considered third parties. All freelancers have signed strict confidentiality agreements and go through training on data protection. We do not wish to send you any unwanted email, and have tried to make it easy for you to unsubscribe from any newsletter or email we send. If you are receiving email announcements that you wish to stop receiving, you can click the "unsubscribe" link in the footer of the e-mail.

What Information We Collect

General contact and administrative information

Name, email address, phone address, postal address
For participants: parent/guardian name and contact details, date of birth, nationality, school
Emergency contact details, including name, relationship, contact information
Application materials (written responses to questions)

Academy-specific information (participants)

Passport copy (for international travel components of the program)
Health information: allergies, medications, relevant medical conditions, primary doctor’s contact details, health insurance details
Dietary requirements and preferences
Interests, hobbies, and preferences, used to help match participants with mentors and tailor program activities
Photographs and video/audio recordings taken during in-person or online sessions, where consent has been given

Staff, mentor, and freelancer information

Police background check / conduct records, where required for safeguarding purposes
Bank account details, for payment of freelancers and reimbursements
Work history and resume

Donor and financial contributor information

Name, email address, and payment details provided when making a donation through our website
Processed via FundraisingBox (see “Where Data is Stored” for details)

Website and technical information

Standard technical data, such as IP address and server logs, collected automatically by Webflow, our website hosting provider, as a basic part of serving the website (see “Where Data is Stored” for details)
Browsing behavior, such as session activity, collected via analytics tools like Hotjar, only when you have given consent – see “Third Party Use of Cookies”

The information described above is collected for the purpose of enabling participation in our programs and ensuring the health and safety of our participants. We do not use it for any other purpose. Where we collect information for a different reason – such as processing a donation or an optional newsletter or event sign-up – that purpose is described separately in the relevant section below.

How We Recognize You

In general, you can visit www.girlsgearingup.org without revealing any information about yourself. It is our intent to let you know before we collect any information from you online. Our site is not set up to track, collect, or distribute personal information about you. We cannot, for instance, determine your email address by examining electronic records. We use analytics tools, described in “Third Party Use of Cookies” below, to compile statistics about how visitors interact with our Website. These statistics are used only by GGU staff.

Basis for Processing Your Information

We rely on the following legal grounds to process your personal information:

Performance of a contract. We collect and use your personal information, as applicable, to perform our contractual obligations – for example, administering an Academy participant’s enrollment via the agreement signed by her parent or guardian.
Consent. We collect information that users provide by filling out forms on the Website, newsletter sign-ups, or other freely given consent. Where health information is involved, we rely on your explicit consent (see the section below).
Legal obligation and legitimate interests. Certain records, such as safeguarding checks and financial/accounting records, are processed to meet a legal obligation or our legitimate interest in child safety and sound administration.

We collect only the necessary information to help support participants and their families, and to implement our programs. No additional or irrelevant information is ever collected.

Whether You Are Required To Provide Your Data

Providing certain information is necessary for you or your child to take part in our programs. Enrollment information (such as name, contact details, and date of birth) is required to enter into the enrollment agreement with GGU – without it, we cannot register a participant for the Academy or our other programs. Health information is not legally required, but is strongly recommended for safety reasons; without it, our ability to respond appropriately to a medical emergency during a program may be limited (see: “Special Category Data: Health Information” below). Financial information provided by donors is necessary to process and issue a receipt for donation – without it, we cannot complete the transaction. Where information is requested for optional activities, such as a newsletter or an individual event sign-up, providing it is voluntary, and declining only means you will not receive that specific communication or opportunity.

Special Category Data: Health Information

Before each Academy, parents/guardians are asked to complete a release form that includes health information. That form includes the following language:

“The health information you provide here (including allergies, medications, and relevant medical conditions) will be held in strictest confidence in our Academy health binder, accessible only to the Academy’s on-site trained staff on a need-to-know basis, as our first resource in the event of a medical emergency. Because this is our primary emergency reference, please be as specific as possible. This information will be kept securely for the duration of the Academy program and destroyed within one month after it concludes. You may request access to, correction of, or deletion of this information at any time by contacting info@girlsgearingup.org; withdrawing it may limit our ability to respond appropriately to a medical situation.”

‍This is presented as its own explicit consent, separate from our general program terms.

Children and Parental Consent

Academy participants are 13-17 years old. Article 8 GDPR (Germany’s threshold: 16) only applies where the legal basis for processing is the child’s own consent for an online service offered directly to her. Where a different legal basis applies, Article 8 does not govern that processing.

Data collected under the parent/guardian-signed enrollment agreement

Enrollment, health information, and safeguarding records are collected via parent/guardian-signed forms – the legal basis is the performance of that contract, not the child’s own consent, so Article 8 does not apply.

Basic sign-ups for events and opportunities within the program

Where an already-enrolled participant independently signs up for a GGU event or opportunity, and the sign-up collects only basic data (name, contact details, which event) with nothing sensitive involved, GGU relies on legitimate interest as a legal basis – not the participant’s own consent – because it falls within the existing relationship and scope her parent/guardian already agreed to. Article 8 does not apply to this category, and no separate parental consent step is required for each sign-up. This also covers using her photo or video taken at the event on GGU’s own channels (website, social media, printed materials, and funder/partner reports), and sharing it with the ABURY Foundation as GGU’s partner organization, where a blanket photo/video consent has already been obtained at enrollment (see program release form), covering the duration of her active participation and ending automatically when she leaves or ages out of the program. Where that consent is given by her parent/guardian on her behalf, it also ends no later than when she turns 18, since a parent cannot consent on behalf of an adult; where she has given her own separate consent as part of the release form, that consent continues on the same active-participation basis and is not affected by her turning 18. No separate consent is needed for each event.

Sign-ups that need their own parental consent

A sign-up needs its own parental consent, verified as described below, where it goes beyond basic registration within the existing program relationship – for example:

It involves sensitive data (health information, or dietary/medical needs specific to that event)
It shares her information or image with an organization outside GGU (other than the ABURY Foundation, GGU’s partner organization, already covered by the blanket photo/video consent), or involves a use beyond GGU’s own channels (e.g. website, social media, or printed materials)
It is for someone who is not already an enrolled participant, with no prior parent/guardian relation or contract to rely on
It opts her into something ongoing beyond that one event (e.g. additional marketing-style communications)

For these cases, GGU verifies parental consent through one of the following, chosen based on what works best for the family involved:

Blanket authorization at enrollment: a scoped authorization signed as part of the enrollment agreement, e.g. “I authorize my daughter to independently register for GGU-run events and opportunities during the program year, involving only her name, contact details, and the event/opportunity selected. This does not cover sharing her information with organizations outside GGU (other than the ABURY Foundation), uses beyond GGU’s own channels (e.g. website, social media, or printed materials), or activities involving overnight travel or additional health/medical information – GGU will seek my separate consent for any of those.” This covers any future sign-up within its stated scope, without a fresh verification step each time.
Email link to sign (PandaDoc): a form (e.g. a scoped authorization or event consent) is emailed to the parent/guardian via PandaDoc; registration or authorization stays pending until the parent opens the link and electronically signs, which is logged as the consent record.
Phone or SMS confirmation: for families with limited or inconsistent email access, staff confirm by phone or text and log the date, staff member, and what was agreed.
Signed paper form: collected in person or sent home, consistent with GGU’s existing enrollment paperwork.

Where staff are unsure which category a sign-up falls into, GGU defaults to treating it as needing its own parental consent, verified by one of the methods above.

Where Data is Stored

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. All data is stored in GDPR compliant software.

Some of our service providers (e.g., Google, PandaDoc) are based outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the EU‑U.S. Data Privacy Framework (where the provider is certified) and/or the European Commission’s Standard Contractual Clauses, together with written data processing agreements.

The following GDPR-compliant software and programs are currently used by GGU:

Webflow, Inc. (San Francisco, USA) – hosts our website and processes basic technical data (such as IP address and server logs) needed to serve pages securely and reliably, under our legitimate interest in the correct and secure operation of our website (Art.6(1)(f) GDPR). Webflow is certified under the EU-U.S. Data Privacy Framework (DPF).
Google (Workspace) – for email exchange and internal record keeping. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). Information about Google’s GDPR privacy policy: https://cloud.google.com/security/gdpr/
Brevo – used for newsletters and mailings. Brevo is an EU-based provider (France).
PandaDoc – used to send participants and parents/guardians links to review and sign forms (e.g. enrollment agreements, consent forms) electronically. PandaDoc is certified under the EU-U.S. Data Privacy Framework (DPF) and provides a GDPR-compliant data processing agreement.
Usercentrics – consent management platform used to obtain and record cookie consent on our website. EU-based provider.
Hotjar – analytics and session-recording tool used to understand how visitors use our website. Only activated for visitors who give consent.
FundraisingBox (provided by Wikando GmbH, Germany) – processes online donations made through our website; covered by a signed data processing agreement.
Social media platforms and widgets – Our Website includes social media features, such as the Facebook Like button. These features may collect information about your IP address and which page you are visiting on our Website, and they may set a cookie to make sure the feature functions properly. We also maintain presences on social media platforms including Facebook and Instagram. Your interactions with those features and platforms are governed by the privacy policies of the companies that provide them.

In addition to the software and programs above, we share data with the following organizations as part of our program partnership:

ABURY Foundation – GGU’s partner organization. Participant photos and video may be shared with and used by the ABURY Foundation, as covered by the blanket photo/video consent obtained at enrollment (see program release form).

We do not disclose your information to Linden Global Learning, whose address appears on our materials for administrative purposes only – Linden Global Learning does not have access to participant or program data.

How And Why We Collect Information

GGU collects your information in order to record and support your participation in the activities you select. If you register to download a resource, sign up for our newsletter, and/or participate in one of our programs, we collect your information. We use this information to track your preferences and to keep you informed about the programs and services you have selected to receive and any related programs and/or services. As a visitor to this Website, you can engage in most activities without providing any personal information. It is only when you seek to download resources and/or register for services that you are required to provide information.

How Do We Use the Information That You Provide to Us?

We use personal information for purposes of presenting our Website and its contents to you, providing you with information, providing you with offers for programs and services, providing you with information about your subscriptions and programs, carrying out any contract between you and GGU, administering our business activities, providing customer service, and making available other items and services to our participants and prospective participants.

Third Party Use of Cookies

The following third-party tools may set cookies or process data when you use our website. We do not control these third parties’ tracking technologies beyond what is described here.

We use Usercentrics as our consent management platform (CMP). Non-essential cookies, such as analytics, are only set with your prior opt-in consent, given through the Usercentrics cookie banner when you first visit our site. You can withdraw or change this consent at any time via the cookie settings link in the site footer.

Strictly necessary cookies (e.g., for the donation form and consent management) are set on the basis of our legitimate interest in providing a functional website. Non‑essential cookies (e.g., analytics via Hotjar) are only set after you have given your explicit consent via the cookie banner.

Our website currently uses the following cookies and similar technologies:

Usercentrics – consent management platform; Essential
Hotjar – analytics and session-recording tool that helps us understand how visitors use the site; Non-essential, only activated after you give consent.
FundraisingBox (provided by Wikando GmbH) – processes online donations made through our campaign page; Essential, as it is required to complete a donation you have chosen to make.

Notice of Breach of Security

If a personal data breach occurs that is likely to result in a risk to individuals’ rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required by law, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to those affected, we will also notify the affected individuals without undue delay.

Liability for Content

We make every effort to keep the information on our Website current, but accept no liability whatsoever for the content provided. Pursuant to §7 par. 1 of TMG (German Tele-Media Act), the law limits our responsibility as a service provider to our own content on these Web pages. According to §§8 to 10 of TMG, we are not obligated to monitor third party information provided or stored on our Website. However, we shall promptly remove any content upon becoming aware that it violates the law. Our liability in such an instance shall commence at the time we become aware of the respective violation.

Copyrights

The content and works provided on these Web pages are governed by the copyright laws of Germany. Duplication, processing, distribution, or any form of commercialization of such material beyond the scope of the copyright law shall require the prior written consent of its respective author or creator.

How Long We Keep Your Data

Data Type

Retention Period

Finanial and donation records

10 years, as required by German commercial and tax law (HGB/AO)

General participant program records

Retained until the data is no longer necessary for administering the program or supporting alumni engagement, whichever is applicable. Reviewed at the end of each program year.

Background checks / safeguarding records

Retained in accordance with GGU’s internal safeguarding and data retention procedures, and for no longer than necessary to protect the children in our programs and meet our legal obligations.

Alumni contact database

Retained until you withdraw your consent to be contacted as a GGU alum.

Access to Your Data, and Your Choices

If you are within the European Union, you are entitled to certain information and have certain rights under the General Data Protection Regulation.

If you would like to access the data that we received from you, or make corrections to it, you may contact us at info@girlsgearingup.org. If you registered to receive communications from us and later change your mind, you may ask that your name and contact information be edited or removed from our distribution list at any time.

You have the following rights:

Right of access: You may at any time request access to information that we hold about you.
Right to rectification: You may request that we correct or amend information we hold about you.
Right to erasure (“right to be forgotten”): you may request that we delete your information.
Right to restriction of processing: you may request that we restrict how your data is used
Right to object: you may object to processing based on legitimate interest, or opt out of newsletter subscriptions by simply unsubscribing
Right to data portability: Where processing is based on your consent or a contract and is carried out by automated means, you may request your data in a structured, commonly used, machine-readable format (e.g., CSV) and, where technically feasible, ask us to transmit it directly to another controller.
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal
Right to lodge a complaint with a supervisory authority – see contact details below.

Unless it is prohibited by law, we will remove any personal information about you from our database at your request. Unless a request is manifestly unfounded or excessive (for example, because of its repetitive character), we will fulfill your request free of charge. If we consider a request to be manifestly unfounded or excessive, we may either charge a reasonable fee taking into account administrative costs or refuse to act. We will inform you of any such fee before proceeding.

You can also lodge a complaint with our supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
‍Alt-Moabit 59-61, 10555 Berlin, Germany
Phone: +49 (0)30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

Automated Decision-Making

GGU does not use automated decision-making or profiling, as defined under Article 22 GDPR, in connection with the personal data described in this policy. All decisions about program participation, communications, and services are made by GGU staff.

Data Protection Officer/Contact

GGU has not appointed a formal Data Protection Officer under Article 37 GDPR. For questions about this policy or how we handle your data, please contact our data protection contact: Courtney Adams, at info@girlsgearingup.org.

Contact Us

GGU welcomes your questions or comments regarding the Privacy Policy:

Girls Gearing Up International Leadership Academy e.V.
Inselstrasse 12, 10179 Berlin, Germany
Email Address: info@girlsgearingup.org
‍Phone: +49 (0)30 555 10936