Privacy Policy

Last updated: 1 September 2026

1. Controller

The controller responsible for processing personal data in connection with this website and the AVATARA project is:

Jonathan Darrall-Rew
trading as Aquarius Consultancy
Chausseestraße 119, c/o Kalodion Gruppe
10115 Berlin
Germany

Email: jonathan@synergyforum.org
Telephone: +49 176 56925215

AVATARA is a project and trading name, not a separate legal entity. No data protection officer has been appointed, as there is no legal requirement to do so.

2. Scope of this policy

This policy explains how personal data is processed when you:

  • visit www.avatara.one;

  • contact AVATARA;

  • apply for or register for an AVATARA event through a linked Google form; or

  • subscribe to AVATARA communications through Substack.

External websites have their own privacy policies. Where this website merely contains a link to another website, no data is transferred to that provider by AVATARA until you follow the link, unless expressly stated otherwise below.

3. Website hosting and technical data

This website is hosted on Squarespace. When you visit it, Squarespace may process technical information needed to deliver and secure the website, including:

  • IP address;

  • date and time of access;

  • requested page or file;

  • browser type, language and version;

  • operating system and device information;

  • referring website;

  • approximate location derived from the IP address; and

  • security, diagnostic and interaction logs.

The purposes are to display the website, maintain its security and stability, prevent misuse, troubleshoot faults and obtain basic information about website performance.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure, reliable and effective provision of this website. Where information is stored on or accessed from your device and this is not technically necessary, it will be used only with your consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

Provider: Squarespace, Inc., United States. Further information: Squarespace Privacy Policy.

Technical information is retained according to Squarespace’s applicable retention periods and otherwise only for as long as necessary for security, troubleshooting and website operation. Aggregated statistics that no longer identify an individual may be retained for longer.

4. Cookies and Squarespace analytics

Squarespace may use technically necessary cookies, including a security cookie used to protect website requests. Such cookies do not require consent.

If non-essential analytics or preference cookies are enabled, they will be blocked until you choose to accept them through the website’s cookie settings. The legal basis for those cookies and the related processing is your consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. You may refuse or withdraw consent at any time through the cookie settings without affecting the lawfulness of processing that occurred before withdrawal.

AVATARA does not currently use advertising pixels or behavioural advertising cookies and does not use Google Analytics, Google Ads or Meta Pixel on this website.

5. Adobe Fonts

The website uses Adobe Fonts for the consistent display of typefaces. When font resources are requested, Adobe may receive technical information such as your IP address, browser information and operating-system information.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is presenting the website in a consistent and accessible design. Provider: Adobe Inc., United States. Further information: Adobe Privacy Policy.

6. Contact and enquiries

If you contact AVATARA by email, telephone or another communication channel, the information you provide will be processed in order to respond and manage the enquiry. This may include your name, contact details, the content of your message and subsequent correspondence.

The legal basis is Article 6(1)(b) GDPR where the communication concerns an application, event registration or possible contractual relationship. For general enquiries, the legal basis is Article 6(1)(f) GDPR; the legitimate interest is responding to communications concerning AVATARA’s work.

General enquiries are normally deleted within 12 months after the last substantive contact, unless they lead to a continuing relationship or must be retained for legal reasons.

7. Event applications and registrations through Google Forms

AVATARA uses Google Forms for applications and registrations. Depending on the event or application, the form may collect:

• first and last name;
• email address;
• date of birth;
• answers concerning your background, experience, intentions and suitability for the event;
• health information, including relevant conditions, disabilities or medication;
• information provided in scholarship applications, including financial circumstances and socioeconomic circumstances;
• information about salient identities, which may reveal racial or ethnic origin, disability or health status, gender identity or other sensitive personal information; and
• technical information processed by Google, such as IP address, browser and device information and interaction logs.

The purposes are to assess event and scholarship applications, determine eligibility for financial support, communicate with applicants, administer participation, and support participant wellbeing and safety.The purposes are to assess event and scholarship applications, determine eligibility for financial support, communicate with applicants, administer participation, and support participant wellbeing and safety.

For ordinary application and registration information, the legal basis is Article 6(1)(b) GDPR because the processing is necessary to take steps at your request before entering into an agreement and, if you participate, to administer that agreement.

Health information and information that may reveal racial or ethnic origin, disability, religious or philosophical beliefs, sexual orientation or other special-category data are processed only with your explicit consent under Article 9(2)(a), together with Article 6(1)(a), GDPR. You may withdraw that consent at any time by contacting jonathan@synergyforum.org. Withdrawal does not affect processing already carried out lawfully. If sensitive information is genuinely necessary to assess an application, eligibility for a scholarship or whether an event can be offered safely, withholding or withdrawing consent may mean that the application cannot be assessed or participation cannot be offered.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data through affiliated companies and infrastructure outside the EEA. Further information: Google Privacy Policy.

Unsuccessful applications are normally deleted within 12 months after the application decision. For participants, application and administrative records are normally deleted within three years after the event unless a longer period is required for legal claims or statutory record-keeping. Health and medication information is normally deleted within three months after the event, unless an incident, continuing safeguarding need or legal obligation makes longer retention necessary.

8. Substack newsletter

AVATARA uses Substack to publish and distribute newsletters. If you subscribe, Substack processes information including your email address, any name you provide, subscription information and technical and interaction data associated with newsletter delivery and use.

The purpose is to send the AVATARA newsletter, updates and information about events. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by using the unsubscribe link in any newsletter. Withdrawal does not affect the lawfulness of earlier processing.

Provider: Substack Inc., United States. Further information: Substack Privacy Policy.

Subscriber information is retained until you unsubscribe. Limited suppression information may subsequently be retained to ensure that no further marketing is sent and to demonstrate compliance with legal requirements.

9. External links, social media and donations

The website contains ordinary links to external services, including Facebook, Instagram, Substack, Zeffy, Wise and websites operated by event or donation partners. These are not embedded tracking tools on the AVATARA website. If you follow an external link, the destination provider processes data under its own responsibility and privacy policy.

Payments and donations are not processed directly through www.avatara.one. AVATARA does not receive payment-card or online-banking credentials through this website.

10. Recipients and processors

Personal data is disclosed only where necessary to:

  • hosting, communications, application and newsletter providers described in this policy;

  • professional advisers or public authorities where legally required; and

  • carefully selected AVATARA personnel who need the information to assess an application, administer an event or support participant safety.

Service providers acting as processors are used subject to the data-protection terms made available by those providers and, where Article 28 GDPR applies, an appropriate data-processing agreement.

AVATARA does not sell personal data.

11. International transfers

Some providers described above are based in the United States or use international infrastructure. Where personal data is transferred outside the EEA, the transfer is based on an applicable adequacy decision, including the EU–US Data Privacy Framework where the recipient is validly certified, or on the European Commission’s Standard Contractual Clauses together with any additional safeguards required by law. Information about the relevant mechanism may be requested using the contact details above.

12. Security

Reasonable technical and organisational measures are used to protect personal data. These include encrypted HTTPS connections and password-controlled access to service accounts. Access is limited to those who need the information for the purposes described in this policy. No internet-based system can be guaranteed to be completely secure.

13. Legal retention requirements

The specific retention periods applying to enquiries, applications, health information and newsletters are described above. Where records form part of accounting, tax or contractual documentation, they may be retained for the applicable statutory period, which can be up to ten years under German law. Data may also be retained for the establishment, exercise or defence of legal claims. It is then deleted or anonymised when the relevant purpose and retention obligation end.

14. Your rights

Subject to the conditions in the GDPR, you may have the right to:

  • obtain access to your personal data;

  • have inaccurate data corrected;

  • request erasure or restriction of processing;

  • receive data you provided in a portable format;

  • object to processing based on legitimate interests;

  • withdraw consent at any time; and

  • lodge a complaint with a data-protection supervisory authority.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

To exercise your rights, contact jonathan@synergyforum.org. Reasonable information may be requested to verify your identity.

The supervisory authority responsible for a Berlin-based controller is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

You may also complain to the supervisory authority in the EU or EEA country of your habitual residence, place of work or the alleged infringement.

15. Changes to this policy

This policy may be updated when processing activities or legal requirements change. The current version and its update date will be published on this page. Where a change requires consent, new consent will be obtained before the relevant processing begins.