1. Data controller

The controller responsible for personal data processed in connection with this website is:

Represented by its chair, Dr Dominika Schiebl, in accordance with the association's rules of representation.

2. Website provision, hosting and server logs

We use hosting services provided by Webspace-Verkauf.de ISP e. K., Lichtenfelser Straße 17 a, 96271 Grub am Forst, Germany. According to the provider, the managed virtual server used for our websites and its backups are located in Leipzig, Germany.

When you access the website, technically necessary connection data are processed. These may include your IP address, the date and time of access, pages or files requested, referring website, browser and operating-system information, response codes and volume of data transmitted.

We process these data to deliver the website, troubleshoot errors and maintain its stability and security. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in operating a secure and functioning website.

According to the hosting provider, server logs are retained for seven days. IP addresses are anonymised after one day or during the first log rotation. Backups are retained for at least seven days, and incremental backups may remain available for several additional days.

The provider may access data to the extent necessary for operation, maintenance and security. Processing on our behalf is governed by an arrangement under Article 28 GDPR. Its subcontractors and technical and organisational security measures are detailed in the agreement's annexes.

3. Contact form and email

You may contact us using our website form or by email. When you use the form, we process the title or salutation you select, your name, email address and the message you submit. The contact page identifies surname and email address in particular as mandatory fields. Email correspondence also involves sender details and the content of communications.

We use this information to receive and respond to enquiries and to communicate about the association's activities. Generally, the legal basis is Article 6(1)(f) GDPR. For contractual or pre-contractual matters, Article 6(1)(b) GDPR applies; Article 6(1)(c) GDPR applies where legal obligations require processing.

We delete these data once your enquiry has been dealt with, unless statutory retention requirements or another lawful reason require further storage. The email providers of the parties involved may also process technical data necessary to deliver messages.

4. Special protection of health information

MCT8 Forschung e. V. supports people with MCT8 deficiency (Allan-Herndon-Dudley syndrome, AHDS) and their families. Enquiries may contain sensitive information such as diagnoses, treatments or a child's health. Such information constitutes special-category personal data under Article 9 GDPR.

Please avoid sending detailed medical records or sensitive health data through the general contact form or by unencrypted email. Where such information is necessary for a specific purpose, we will clarify the appropriate means of transmission and legal basis separately. We process such data only where legally permissible and necessary.

Processing relating to membership, patient surveys or research projects may require separate privacy notices and, where appropriate, specific consent. This notice primarily covers website visits and general enquiries.

5. Videos and other media

Our homepage provides an MCT8 information film as a video file served through our website. When you request or play a locally hosted video, technical connection data are processed as described in section 2.

Some pages also link to interviews, research publications and other media. Merely viewing an ordinary external link does not automatically load the linked website. If an external media provider's content is embedded on a page, however, that provider may receive data when the content loads. Such embeds must be assessed according to their actual technical operation and may require prior consent.

6. Cookies, Google Analytics and reCAPTCHA

Source code supplied for the MCT8 website contains scripts for Google Analytics (legacy Universal Analytics) and Google reCAPTCHA. If these scripts are loaded on published pages, technical data such as IP address, browser and device information and usage information may be transferred to Google, potentially including transfers outside the EEA. Google's privacy information: policies.google.com/privacy.

7. External links and social networks

Our website links to other websites, academic institutions, publications and potentially our Facebook community or other social networks. With ordinary links, data are normally transferred to the destination provider only when you click the link.

Once you visit an external website, the operator of that website is responsible for its data processing. Social networking providers may also process data outside the European Union or European Economic Area. Please read the relevant provider's privacy notice.

8. Donations and association communication

When you support our association, for example through a bank transfer, we may process your name, payment details and other information needed for accounting and, where applicable, issuing donation receipts. The purposes are processing the donation and complying with documentation and legal retention obligations (depending on the circumstances, Article 6(1)(b), (c) and/or (f) GDPR).

The website currently provides information on making donations by bank transfer. If online payment providers or registration forms are introduced, we will provide additional information. Separate notices may apply to membership records.

9. Recipients, processors and transfers

Within the association, personal information is accessible only to those who need it to perform their duties. Hosting and IT service providers may process data on our behalf to operate the website and email services. We disclose information to other recipients only where a lawful basis exists, for example where required by law or to handle an enquiry.

Our hosting provider has confirmed that the server and backup locations are in Germany. Processing by external services or websites accessed through links may differ, including transfers to countries outside the EU/EEA. The relevant services and their privacy notices apply.

10. Your rights

Subject to the requirements of the GDPR, you have the right to access your data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You may withdraw consent at any time with effect for the future (Article 7(3)).

To exercise your rights, contact info@mct8-research.com. To the best of our knowledge, the ordinary use of this website does not involve solely automated decision-making, including profiling.

11. Right to complain

Under Article 77 GDPR, you have the right to complain to a data protection supervisory authority. For an association based in Hesse, Germany, the competent authority may be the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), PO Box 3163, 65021 Wiesbaden, Germany.

Website: datenschutz.hessen.de

12. Updates to this notice

We will amend this notice if our website, services or applicable legal requirements change.

Last updated: 9 November 2026