Privacy Policy

1. Controller

The controller within the meaning of the GDPR and Art. 5 XIV LGPD is:

Action Cooperation GmbH
Josefstraße 6, 47638 Straelen, Germany
Managing director: Andy Mangelmann
Email: info@insidefavela.com

Further details can be found in the imprint.

2. Definitions

We use terms within the meaning of Art. 4 GDPR and Art. 5 LGPD (e.g. "personal data", "processing", "controller", "processor", "consent").

3. Rights of data subjects

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to withdraw a given consent with effect for the future (Art. 7 (3)).

Under the LGPD (Art. 18) you have corresponding rights, in particular confirmation of processing, access, rectification, anonymisation, blocking or deletion of unnecessary data, data portability, information about shared use, as well as withdrawal of consent.

To exercise your rights, an informal message to info@insidefavela.com is sufficient.

Right to lodge a complaint with a supervisory authority: In Germany you can contact the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Nordrhein-Westfalen (LDI NRW). In Brazil, the Autoridade Nacional de Proteção de Dados (ANPD) is responsible.

4. Hosting

The website is hosted with Lovable (operator of the lovable.dev and lovable.app platform). When accessing the website, technical data (IP address, timestamp, user agent, requested URL, referrer) is processed to ensure delivery and security of the website. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in a stable, secure website).

5. Server log files

Our hosting provider automatically collects and stores information in server log files transmitted by your browser:

• IP address
• Date and time of the request
• Time zone difference to GMT
• Content of the request (specific page)
• HTTP status code and amount of data transferred
• Referrer URL and user agent

This data is not merged with other data sources. Legal basis: Art. 6 (1)(f) GDPR. The storage period is usually a few days to a few weeks.

6. Cookies, local storage and consent management

We exclusively use technically necessary storage technologies. We store your consent decision in your browser's local storage under the key inside-favela.consent.v1, so that your choice is respected on future visits. This storage is strictly necessary for the operation of the website and to honour your consent choice (§ 25 (2) no. 2 TDDDG).

Optional categories (statistics, marketing, preferences) only load after your explicit consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). We currently do not use any such services; the consent banner is designed so that any future addition is transparent and only takes effect with your consent.

You can change your settings at any time: Cookie settings.

7. Google Fonts

This website loads fonts ("Lora" and "Nunito Sans") from Google Fonts servers (fonts.googleapis.com and fonts.gstatic.com) operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the font is loaded, your IP address is transmitted to Google. A transfer to the USA cannot be excluded; Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in consistent, performant typography). Further information: policies.google.com/privacy.

8. Google Maps

On the favelas overview page we embed an interactive map from the Google Maps service (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the map is loaded, your IP address and, where applicable, location and usage data are transmitted to Google and may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in a clear presentation of the described locations). Further information can be found in the Google privacy policy.

9. Contact by email

If you contact us by email, your details (name, email address, content of the message) are processed exclusively to handle your request. The legal basis is Art. 6 (1)(b) GDPR (initiation or performance of a contract) or Art. 6 (1)(f) GDPR (answering other enquiries). Your data will be deleted as soon as the purpose no longer applies and no statutory retention obligations apply.

10. Data transfers to third countries

Where personal data is transferred to recipients outside the European Economic Area (in particular the USA), this is done on the basis of adequacy decisions (EU-US Data Privacy Framework) or standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR.

11. LGPD notices (Brazil)

Insofar as personal data of individuals in Brazil is processed or processing takes place in Brazil, the LGPD applies in addition. The legal bases for processing are, in particular, Art. 7 LGPD (consent, legitimate interest, performance of a contract). Contact for the supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.

12. Storage period

Personal data is stored only for as long as necessary for the stated purposes or as required by statutory retention periods. Afterwards, the data is deleted or anonymised.

13. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will then apply to your next visit.