1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hamburg Space Team e.V. c/o E-EXK3
Am Schwarzenberg-Campus 3 (E)
21073 Hamburg
Germany

Email: [email protected]
Phone: +49 40 306012037

2. Purposes and Legal Bases of Processing

We process personal data for the operation and provision of this website (https://hamburgspace.de), for communication with you, and for the security and stability of the service. The legal bases are Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website), Art. 6(1)(b) GDPR (contract/per-contractual measures, e.g. in the case of membership-related or contract-related inquiries), and, where applicable, Art. 6(1)(c) GDPR (legal obligations).

3. Hosting (Cloudflare) and Server Log Files

This website is provided via Cloudflare Pages and uses the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, including Content Delivery Network, edge caching, DDoS protection and Web Application Firewall services. When our pages are accessed, Cloudflare processes, among other things, IP address, date/time, requested URL/request path, referrer, user agent, HTTP headers, error/status codes, a Ray ID (request identifier), and logs security-relevant events in server logs.

Processing is carried out for technical provision, accelerated delivery, network security (protection against attacks/bot traffic), and stability of the services. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and performant provision of our website, as well as in protection against abusive or harmful access.

Cloudflare maintains security- and operations-relevant logs. These are generally stored for a short period and then deleted or anonymized; longer storage may occur in individual cases for the preservation of evidence in the event of specific security incidents. Further information can be found in the Cloudflare Privacy Policy and the Cloudflare Data Processing Addendum.

4. Cookies and Similar Technologies

We do not use tracking or analytics cookies.

Where Cloudflare sets technically necessary cookies as part of the technical provision and protection of our website, these are used exclusively for the security, stability, and availability of the website. This may include, in particular, cookies such as __cf_bm for detecting and preventing automated access, or cf_clearance as proof of a successfully completed security check, provided that the corresponding Cloudflare security functions are active.

These cookies do not contain tracking IDs used by us and are not used for advertising-related tracking of users. The legal basis for the processing of personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and uninterrupted provision of our website. For storing and accessing technically necessary information on the user’s device, § 25(2) No. 2 TDDDG applies.

5. Communication

If you contact us, for example by email, we process the information you provide, such as your name, email address, and the content of your message, in order to handle your inquiry.

The legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry relates to contractual, membership-related or pre-contractual communication. In all other cases, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of incoming inquiries.

Data will be deleted as soon as it is no longer required for handling the inquiry and no statutory retention obligations apply.

6. Embedded Content and External Links

Apart from the services described in this Privacy Policy, we do not embed third-party content that transfers data to third parties when the website is loaded.

Our website may contain links to external websites, such as Instagram. When you open external links, you leave our website. The respective providers are responsible for the processing of personal data on the linked websites; their privacy policies apply.

7. Recipients and Transfers to Third Countries

Recipients of personal data are, in particular, technical service providers, especially Cloudflare for the provision, protection, and analysis of the website.

Personal data may be transferred to the USA in this context. We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. International transfers are based, where required, on Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR. In addition, Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF).

Further information can be found in the Cloudflare Data Processing Addendum and in Cloudflare’s DPF entry.

8. Storage Period

We process personal data only for as long as necessary for the purposes mentioned above or as required by statutory retention obligations. Afterwards, the data will be deleted or anonymized.

Where individual services, in particular Cloudflare, provide their own retention periods for technical log or analytics data, these are governed by the respective service configurations and the contractual arrangements with the provider.

9. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR).

You also have the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

You also have the right to lodge a complaint with a data protection supervisory authority.

One competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information:
Ludwig-Erhard-Str. 22
20459 Hamburg
Germany
Phone: +49 40 428 54-4040
Email: [email protected]

10. Obligation to Provide Data

The provision of personal data is generally neither legally nor contractually required. However, it may be necessary for certain functions, in particular contacting us. Without the relevant information, we may not be able to process your inquiry.

11. Security

We take technical and organizational measures to protect personal data against loss, destruction, access, alteration, or disclosure by unauthorized persons, and adapt these measures in line with the state of the art.

12. Web Analytics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics, an analytics service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

According to Cloudflare, Cloudflare Web Analytics operates without cookies, without LocalStorage, and without fingerprinting individual users. Statistical usage data is collected, in particular visited pages, referrers, device type, browser and operating system information, and time of access.

Processing is carried out for statistical evaluation, error analysis, and improvement of our website. We do not combine this data with other personal data to create personal user profiles.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in reach measurement, technical optimization, and improvement of our website.

Cloudflare processes the data as a processor. We have concluded a data processing agreement with Cloudflare; appropriate safeguards apply to any transfers to third countries, in particular the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses.

Further information can be found in the Cloudflare Web Analytics documentation and the Cloudflare Data Processing Addendum.

If you have any questions, please contact us at [email protected].

13. Last Updated

Last updated: June 2026