Privacy notice

In short

Last updated: 27 October 2026

Before you activate a video or the map, this website sets no cookies and uses no local storage, session storage or IndexedDB in your browser. It uses no analytics. That is why it shows no cookie banner.
Its assets — text, pictures, fonts, scripts and the search — are self-hosted: they come from this website's own address. Activated videos and the map contact external providers, as described below.
Cloudflare delivers the website and, like any web host, sees the technical data of every request.
A video or the map loads from YouTube, Vimeo or OpenStreetMap only when you click it, and the line beside it says so before you do.
The contact form and the newsletter pass what you enter to Brevo, which delivers it. The website itself keeps no copy.
With your consent, our newsletter mails tell Brevo when they are opened and which links are clicked.
The bot check on the forms runs on this website. No outside service is involved.

Who is responsible

The controller for this website under the EU General Data Protection Regulation (GDPR) is:

elbarlament GmbH
Elbestraße 28/29
12045 Berlin
Germany

E-mail: info@elbarlament.org
Phone: +49 1516 2733609

Our data protection officer is Dr. Birgit Laubach. You can reach her at:

elbarlament GmbH, data protection officer
Elbestraße 28/29
12045 Berlin
Germany
E-mail: info@elbarlament.org, with the subject "Datenschutz"

When you visit this website

This website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. To send you a page, Cloudflare necessarily receives what every browser sends with a request: your IP address, the date and time, the address of the page or file you asked for (including any words in it you searched for, see below), the browser and operating system your browser reports, and the address of the page you came from where your browser sends it.

Cloudflare processes this data for us under a data processing agreement, to deliver the website, keep it secure and protect it against attacks. For example, our forms accept at most five submissions from one IP address within ten minutes.

Cloudflare does not keep these request logs for us: we have switched on no storage of them, and we cannot look them up. Cloudflare processes them for delivery and security for a period it sets.

Cloudflare runs data centres around the world, so the data may be processed outside the EU, in particular in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, and our agreement with Cloudflare includes the EU standard contractual clauses.

The legal basis is our legitimate interest in delivering a secure website, Art. 6 (1) (f) GDPR.

We do not look at individual requests. Once a month we read the totals Cloudflare shows us: the number of requests, the number of distinct visitors and the most-requested pages of the last 30 days. These are counts. They do not tell us who you are.

Pages are sent over an encrypted connection (HTTPS), and your browser is told to use no other.

We use no analytics or tracking tool, no tag manager, no advertising pixel and no social media plug-in. The Cloudflare features that would add a script or a cookie to the pages, Cloudflare's own analytics among them, are switched off.
Before you activate a video or the map, this website sets no cookies and writes nothing into your browser's local storage, session storage or IndexedDB — not while you read, and not when you search or use a form.
Only a video and the map need your consent, and they ask for it where you load them (see "Videos and the map"). That is why there is no consent banner.

Everything comes from this website

The assets of this website are self-hosted: fonts, pictures, documents, scripts and the search all come from its own address. No font service, image service or other company's network is contacted. Our content is written in a content management system (Sanity, see "Where our content lives"), but pictures and documents are copied onto this website when it is built, so your browser never contacts Sanity. Activated videos and the map contact external providers, as described under "Videos and the map".

The search runs in your browser, over an index that is a file of this website. The words you search for appear in the address bar (/search/?q=…). Cloudflare receives them when that address is requested or reloaded, for example when you search from the field at the top of a page; searches you run within the search page itself stay in your browser. No search provider is involved.

When you follow a link to another website — our profiles on Facebook, LinkedIn or YouTube, or a partner's website — you leave this website, and that website's own privacy policy applies. Our pages do not tell the other website which of our pages you came from.

Videos and the map

Videos from YouTube or Vimeo, and the map on the contact page, are shown first as a still picture with a button. The picture is a copy on this website, made when the website was built. Until you click the button, your browser has not contacted YouTube, Vimeo or OpenStreetMap, and no part of their player is in the page. Before you click, a line under the video or the map, or once for a group of videos, says where the data goes and links this notice.

When you click, your browser loads the player from the provider, and only then:

YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): the video loads from www.youtube-nocookie.com and starts playing. YouTube receives your IP address, what your browser sends with every request, which video you chose and the address of this website (but not of the page). The player stores data in your browser's storage and contacts further Google addresses, for example www.google.com and fonts.gstatic.com. Google says this mode does not use what you watch to personalise your YouTube experience or the ads you see. Once the video plays, YouTube may store further information on your device. Google processes YouTube data internationally, including in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and Google uses the EU standard contractual clauses where they are required. Privacy policy: https://policies.google.com/privacy
Vimeo (Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA): the video loads from player.vimeo.com with Vimeo's "do not track" setting, which, according to Vimeo, stops the player from collecting session data and analytics. It starts playing. Vimeo receives the same as YouTube. Vimeo's security service (Cloudflare) sets cookies to tell people from automated traffic, and the player keeps a value for your browser tab in its session storage. Vimeo is certified under the EU-US Data Privacy Framework. Privacy policy: https://vimeo.com/legal/privacy/policy
OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom): the map of our office loads from www.openstreetmap.org and tile.openstreetmap.org. OpenStreetMap receives your IP address and what your browser sends with every request, but not the address of this website. Our October 2026 test observed no cookies or browser storage from the map. The OpenStreetMap Foundation logs the IP address, browser and time of requests; it holds its map-tile logs in the United Kingdom and the Netherlands. Data reaches the United Kingdom under the EU's adequacy decision for it. Privacy policy: https://osmfoundation.org/wiki/Privacy_Policy

Once loaded, the player or the map is run by its provider, who is responsible for it under its own privacy policy. Reloading the page brings back the still picture. No other provider can be loaded on this website: our pages allow frames from these three addresses only.

The legal basis is your consent, Art. 6 (1) (a) GDPR, and, for storing information on your device and reading it from there, § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You give it by clicking the button, for that one video or map, after that line has told you where the data goes. Reloading stops this embed loading again; it does not erase information already transmitted or stored. To remove what a player stored, delete the provider's site data in your browser's settings.

The bot check on our forms

Both forms are protected against automated spam by ALTCHA, a check that runs entirely on this website. The task is issued and checked by our own server code, and the program that solves it is a file of this website. When you first click into a form, your browser fetches a task from this website and solves it in the background. ALTCHA is software we run ourselves, not a company that receives your data, and it sets no cookie and stores nothing on your device. The check shows a link to altcha.org, the software's website; nothing is sent there unless you follow it.

The check needs JavaScript. Without it, a form cannot be sent: please write to us by e-mail or post instead.

The contact form

The contact form asks for your name, your e-mail address and your message, and for your agreement that we store these details to answer you. When you send it, our server code checks it and passes it on as one e-mail to our own mailbox, delivered by Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, part of Brevo SAS, Paris). Your e-mail address is set as the reply address, so that we can answer you. Our server code keeps no copy of your message and writes nothing about it to a log.

Brevo processes the message for us under a data processing agreement, only to deliver it, on servers in the EU (see "Data outside the EU"). Brevo keeps a log of the delivery — for example when the e-mail was sent and delivered, its sender, its recipient and its subject, which contains the name you entered — for 12 months. It keeps no copy of the text of your message.

The message is then stored in our mailbox at Google Workspace (see "When you write to us or call us"). We keep it as long as the exchange runs, unless the law requires us to keep it longer.

Name, e-mail address, message and the consent box are required; without them the form cannot be sent. Using the form is not compulsory: you can also write to us by e-mail or post.

The legal basis is your consent, given with the box in the form, Art. 6 (1) (a) GDPR, and, where your message concerns a contract with us or its preparation, Art. 6 (1) (b) GDPR. You can withdraw your consent at any time by writing to info@elbarlament.org. Withdrawal stops the processing based on your consent; we keep your data only where another legal basis requires or permits it.

To subscribe, you enter your name and your e-mail address. Both are required; without them the form cannot be sent. Subscribing is not compulsory. Our server code passes them to Brevo, which sends you an e-mail with a confirmation link. Your address joins our newsletter list only when you follow that link (double opt-in). Until then, nothing is on the list.

With your subscription, Brevo stores your name, your e-mail address, that you subscribed on this website, and the date of the version of this notice you agreed to — the date at the top of this page, which the form names. Brevo also logs when you subscribed, the confirmation e-mail it sent you, and when you confirmed. Together, these are the record of your consent. When you follow the confirmation link, your browser opens a page at Brevo, which therefore receives your IP address, as any website you open does. Brevo holds this data for us under a data processing agreement, on servers in the EU (see "Data outside the EU").

Our newsletter mails measure whether they are opened and which links are clicked. Brevo does this for us:

Opening: the mail contains a tiny invisible image (a tracking pixel). When your e-mail program loads it, Brevo records that you opened the mail, and when.
Clicks: the links in the mail lead through Brevo, which records the click and then sends you on to the page.

Brevo records both with your address. We use them only for the statistics of our newsletter, for example how many subscribers opened the last mailing. To avoid the open measurement, turn off the loading of images in your e-mail program; a click is recorded only when you click a link in the mail. To end both, unsubscribe.

You can unsubscribe at any time with one click on the link in every newsletter. Brevo then keeps your address on its blocklist with a note that you unsubscribed, so that you receive no further newsletter. If you want your address deleted entirely, write to info@elbarlament.org.

How long we keep it:

Your name and address stay on the list as long as you are subscribed.
The record of your consent — when you subscribed and confirmed, and the version of this notice — is kept for the duration of your subscription and up to three years after it ends, so that we can prove your consent.
If you never confirm, the confirmation link expires after 30 days, and the request stays in Brevo's logs for 12 months.
Opens and clicks are kept in Brevo for 12 months.
After you unsubscribe, your address stays on Brevo's blocklist as long as it is needed to make sure you receive no further mails.

Subscribers of our previous newsletter who had confirmed their subscription there were moved to Brevo with the record of their consent, and the previous provider's account is closed.

The legal basis for the newsletter and for measuring opens and clicks is your consent, Art. 6 (1) (a) GDPR. The form and the confirmation e-mail state it in one sentence: "I consent to receiving the newsletter and to Brevo recording my opens and link clicks against my e-mail address for newsletter statistics. I can withdraw this consent at any time." You give it by confirming your subscription. Unsubscribing withdraws it. We keep the record of your consent and of your unsubscribing on the basis of our legitimate interest in proving your consent and respecting your choice, Art. 6 (1) (f) GDPR.

When you write to us or call us

If you write to info@elbarlament.org or to the address of one of our team, your message and the details it contains are stored in our mailbox and used to answer you. What you tell us on the phone is also used only to answer you. We keep messages as long as the exchange runs, unless the law requires us to keep them longer. A job application is the exception; see "Job applications".

Our mailbox is hosted by Google Workspace: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, processes our mail for us under its Cloud Data Processing Addendum. Google may also process the data outside the EU; the addendum includes the EU standard contractual clauses, and Google is certified under the EU-US Data Privacy Framework.

The legal basis is our legitimate interest in answering you, Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR where your message concerns a contract with us or its preparation.

Job applications

When you apply for a position with us, we process your contact details and your application documents to assess your suitability, under § 26 (1) of the German Federal Data Protection Act (BDSG) and Art. 6 (1) (b) GDPR, as a step before a possible contract. The people who decide on the position receive them, and Google Workspace, which hosts our mailbox. Providing them is voluntary, but we cannot assess an application without the relevant information.

If your application is unsuccessful, we delete it six months after the decision, unless we need it to establish, exercise or defend legal claims. If you join us, the records needed for the employment go into your personnel file.

Where our content lives

The texts, pictures and documents of this website — including the names, photos and descriptions of the people it presents — are written and stored in Sanity, a content management system of Sanity US Inc., 351 California Street, Suite 650, San Francisco, CA 94104, USA (together with Sanity AS, Oslo, Norway). Sanity also holds the accounts of our editors — the members of our team who edit this website, with their name and e-mail address — and processes all of this for us under a data processing agreement, which includes the EU standard contractual clauses. Sanity runs on Google Cloud. Its systems run in the EU (Belgium); the data may also be stored in the USA or in other countries where Sanity operates.

We process the personal data in our published content to run this website and present our work and our team, on the basis of our legitimate interest, Art. 6 (1) (f) GDPR, and keep it as long as it is published. We process our editors' accounts so that they can do their work on the website, Art. 6 (1) (b) GDPR, and keep them while the account is active.

Sanity holds no data about visitors: your browser never contacts it, and nothing you enter into a form is sent there. Sanity's AI features are switched off.

Who processes data for us

These companies process personal data on our behalf, each under a data processing agreement:

Cloudflare (Cloudflare, Inc., USA) delivers and protects this website.
Brevo (Brevo GmbH, Berlin) delivers the messages of the contact form and holds the newsletter list and mailings.
Google (Google Cloud EMEA Limited, Dublin) hosts our mailbox.
Sanity (Sanity US Inc., USA) stores the content of this website and no visitor data.

ALTCHA is not on this list: it is software running on our website, not a service. YouTube, Vimeo and OpenStreetMap do not work for us; they receive data only when you load a video or the map, under their own privacy policies.

Data outside the EU

Some of the data reaches countries outside the EU:

Cloudflare and Sanity may process it in the USA; their agreements with us include the EU standard contractual clauses, and Cloudflare is certified under the EU-US Data Privacy Framework.
Google Workspace may process our mail outside the EU, under the EU standard contractual clauses; Google LLC is certified under the EU-US Data Privacy Framework.
Brevo uses OVH in France and Google Cloud in Belgium for its servers, and Cloudflare (USA/EU) to deliver its pages; onward transfers outside the EU are covered by the safeguards in Brevo's data processing agreement.
YouTube, Vimeo and the OpenStreetMap Foundation receive data only when you load a video or the map; see "Videos and the map".

You can ask us at info@elbarlament.org for a copy of the contractual safeguards that apply.

Your rights

Under the GDPR you have the right to:

know what personal data we hold about you (Art. 15),
have it corrected (Art. 16) or erased (Art. 17),
have its processing restricted (Art. 18),
be told to whom we passed on a correction, erasure or restriction (Art. 19),
receive it in a portable format (Art. 20),
object to processing (Art. 21; see "Your right to object" below),
withdraw a consent at any time, with effect for the future (Art. 7 (3)). Withdrawing consent does not affect the lawfulness of the processing before the withdrawal.

To use these rights, write to info@elbarlament.org, to our data protection officer or to the address above.

You also have the right to complain to a data protection supervisory authority (Art. 77). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), https://www.datenschutz-berlin.de.

We make no decisions about you by automated means (Art. 22).

Your right to object

You may object at any time, for reasons relating to your particular situation, to processing of your personal data that is based on our legitimate interests (Art. 6 (1) (f) GDPR). You may object to direct marketing at any time, including profiling related to it. Write to info@elbarlament.org.

Changes to this notice

When this notice changes in a way that affects what newsletter subscribers agreed to, it gets a new date, and the newsletter form names the new date. Your consent record keeps the date of the version you agreed to.