Privacy
policy.

This policy explains which personal data is processed when you visit hsmaries.space, why, on what legal basis, and which rights you have. The short version:

• No tracking without your consent. Google Analytics and embedded videos stay off until you allow them.
• No advertising. We do not sell data, and the advertising features of Google Analytics are switched off.
• Everything else comes from us. Fonts, images and 3D models are served from our own domain — no Google Fonts, no third-party CDNs.
• You stay in control. Change or withdraw your choice at any time in the Cookie settings.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Represented by

To be confirmed: full name of the responsible person

Email

hsmariesleapone@gmail.com

For any data protection question, and to exercise your rights, write to us at hsmariesleapone@gmail.com.

This website runs on our own server, which our team operates in Germany. It sits behind the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: every request first reaches Cloudflare’s servers, which encrypt the connection, fend off attacks, cache frequently requested files and pass the request on to our server over an encrypted connection. In the process, the information your browser transmits automatically is processed: IP address, date and time of the request, the page requested, the referring URL, the browser and operating system used, and the amount of data transferred.

We need this data to deliver the website, to keep it stable and secure, and to detect and defend against attacks. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website. Log data is deleted as soon as it is no longer needed for these purposes.

Cloudflare processes the data on our behalf (Art. 28 GDPR). Cloudflare is certified under the EU–US Data Privacy Framework, so transfers to the USA rest on the European Commission’s adequacy decision (Art. 45 GDPR); in addition, Cloudflare uses the EU Standard Contractual Clauses. To protect against automated traffic, Cloudflare may set a strictly necessary cookie (see the table in the section on cookies).

When you use one of our forms (contact, joining the team, partnership) or send us an email, we process the information you provide — usually your name, email address and message; for applications also your study programme, semester and preferred department; for partnership enquiries your organisation — to handle your request.

Form submissions are stored in the database of our content management system, which runs on our own server, where the team reads them; a copy of each message goes to our team mailbox. Emails reach our team mailbox, a Google Gmail account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google therefore also processes the content of messages. Transfers to the USA may occur and rest on the EU–US Data Privacy Framework.

The legal basis is Art. 6 (1)(b) GDPR where your request concerns membership, a partnership or other steps prior to an agreement, and otherwise Art. 6 (1)(f) GDPR — our legitimate interest in answering enquiries addressed to us. We delete your data once your request has been dealt with, unless statutory retention obligations apply.

Storing information on your device, or reading information already stored there, requires your consent under § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) — unless it is strictly necessary to provide the service you asked for (§ 25 (2) no. 2 TDDDG). By default we therefore use only strictly necessary storage, and we ask for your consent before anything else.

On your first visit, the consent panel lets you accept or reject all optional categories with one click each, or choose them individually; nothing is pre-selected. Your choice is kept in your browser for twelve months; after that, or when we add a new service, we ask again. You can change or withdraw your consent at any time with effect for the future in the Cookie settings, which are also linked in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before it.

The legal basis for the essential entries is § 25 (2) no. 2 TDDDG together with Art. 6 (1)(f) GDPR, and for the Mission Control login also Art. 6 (1)(b) GDPR; for everything else it is your consent under § 25 (1) TDDDG and Art. 6 (1)(a) GDPR.

With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It shows us how the website is used — for example which pages and mission updates are read, how visitors find us and which devices they use — so we can improve content and navigation.

Data processed

Pseudonymous online identifiers (from the cookies listed above), pages visited and time spent, referring website, approximate location (country/region, derived from the IP address), browser, operating system, device type and screen resolution. Google Analytics 4 does not log or store IP addresses. Google signals and all advertising features are switched off, and we do not combine this data with other data.

Legal basis

Your consent, Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. The Google tag loads only after you consent; before that, no connection to Google is made. Google Consent Mode passes your choice on to Google.

Processor and transfers

Google processes the data on our behalf (Art. 28 GDPR). Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU–US Data Privacy Framework, so the transfer rests on the Commission’s adequacy decision (Art. 45 GDPR).

Retention

Event data is deleted automatically after 2 months.

Withdrawal

In the Cookie settings. Switching analytics off stops all further collection and deletes the Google Analytics cookies set on this website.

More in Google’s privacy policy and how Google uses information from sites that use its services.

Some mission updates contain videos hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed them in YouTube’s privacy-enhanced mode (youtube-nocookie.com). A video loads only after you press “Play video” or have allowed “External media” in the consent panel; until then your browser makes no connection to YouTube.

Once a video loads, Google receives information such as your IP address, the page you are on and device information, and YouTube may store cookies or similar data on your device, particularly when you play it. If you are signed in to a Google account, Google can link the playback to that account. The legal basis is your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). Data may be transferred to the USA; Google LLC is certified under the EU–US Data Privacy Framework. Google is responsible for this processing under its own privacy policy. You can withdraw consent at any time in the Cookie settings.

If a story embeds a Vimeo video instead, the same click-to-load principle applies; the provider is then Vimeo.com, Inc. (USA), under its own privacy policy.

We link to our profiles on LinkedIn, YouTube and GitHub and to partner websites with ordinary links. While you are only viewing our pages, no data is sent to these services. Only when you click a link does your browser open the other website, whose operator is then responsible for processing your data there.

Our team pages show names, roles, photos and short biographies of current and former members, and the mission updates report on team activities. Team members who want their profile changed or removed can write to hsmariesleapone@gmail.com at any time. Content and images are managed in our content management system, which also runs on our own server; access to Mission Control is limited to authorised team members.

All pages are transmitted in encrypted form (HTTPS/TLS), shown by the padlock icon in your browser’s address bar. We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

Under the GDPR you have the following rights towards us:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany, tlfdi.de.

We update this policy when our website or the law changes. The version published here always applies.