When processing your personal data, we comply with the provisions of the Church Data Protection Act (KDG) and the Telecommunications Digital Services Data Protection Act (TDDDG), as well as all other relevant legal provisions. The type and scope of data processing are generally determined by the functions or information you select and by your use of our website. If you have consented to data processing, your personal data will be processed on the basis of § 6 (1) lit. b KDG. If you have expressly consented to the transfer of personal data to third countries, data processing will also be carried out in accordance with § 41 (1) KDG. If you have consented to the storage of cookies or access to information on your end device (e.g., through device fingerprinting), data processing is carried out in accordance with § 25 (1) of the Telecommunications Digital Services Data Protection Act (TDDDG). Your data is generally processed and stored in order to provide you with our website services. Once the data is no longer required for the fulfillment of contractual or legal obligations and rights, it is usually deleted. However, exceptions may occur if further processing is necessary for a limited period of time due to an overriding legitimate interest in fulfilling the above-mentioned purposes. If certain processing of personal data requires other deletion periods, these are explained in more detail in the description of the respective processing operations in Part 2. Personal data will only be transferred to a third country or an international organization if we inform you of this and the requirements of § 39 KDG are met. A third country is a country outside the European Economic Area (EEA) in which the KDG is not directly applicable. A third country is considered unsafe if the EU Commission has not issued an adequacy decision for that country in accordance with § 40 (1) KDG, confirming that adequate protection for personal data exists and that this does not conflict with important church interests. The USA is such an unsafe third country, which means that it does not offer a level of data protection comparable to that in the EU. There are certain risks involved in transferring personal data to the US. There is a risk that US authorities may gain access to personal data on the basis of surveillance programs such as PRISM and UPSTREAM, which are based on § 702 of the Foreign Intelligence Surveillance Act (FISA), as well as on the basis of Executive Order 12333 or Presidential Policy Directive 28. EU citizens have no effective legal protection against such access in the US or the EU. We will inform you when and how we transfer personal data to the USA or other unsafe third countries. We will only transfer your personal data if the recipient offers sufficient guarantees in accordance with § 40 KDG for the protection of personal data and you have expressly consented to the transfer in accordance with § 41 (1) KDG after we have informed you of the risks, or if the transfer is necessary for the fulfillment of contractual obligations between you and us, or if another exception in accordance with § 41 KDG applies. Guarantees in accordance with § 40 KDG can be, for example, so-called standard contractual clauses. In these clauses, the recipient assures that they will protect the data appropriately and guarantee a level of protection comparable to that of the KDG.