Privacy policy

You can read hauptstadt.net without signing in and without giving your name. We use no advertising cookies, no Google Analytics and no social-media buttons. Maps and audience measurement with Matomo on our own server are only loaded once you’ve agreed (sections 8 and 15). We process personal data only if you write to us, register for an event or look after a listing as a business.

Details

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

Reuther Media
Owner: Ulrich Reuther
Zossener Str. 41
10961 Berlin
Phone: +49 30 84523850
E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.

The operator details also appear in the legal notice.

Data protection officer: Not appointed — we are not subject to a statutory obligation to appoint one under Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act).

2. Principles

• We collect only the data we need for the respective purpose (data minimisation, Art. 5 GDPR).
• Browsing the directory, the map and the events calendar is possible without signing in.
• Audience measurement only takes place with your consent: we use the Matomo web analytics software on our own server for this (section 15). We do not use third-party tracking services.
• We do not embed content from Google, Meta, X, YouTube or Vimeo and do not load fonts from external servers. The spam protection on our forms (ALTCHA) also runs entirely on our own server (see the section “Spam protection with ALTCHA”).
• There is no automated decision-making and no profiling.
• We do not pass on data for advertising purposes and do not sell data.

3. Accessing the website and server log files

Every time a page is accessed, our web server processes technical data that your browser transmits automatically: the address accessed, date and time, amount of data transferred, status code, referring page, browser type and version, operating system and the IP address. This data is technically necessary to deliver the page and serves the security of the system (defending against attacks, troubleshooting).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and trouble-free operation of the portal. We keep the web server's access logs (including the IP address) for 30 days to defend against attacks and for troubleshooting; after that they are deleted automatically. This data is not combined with other data sources.

4. Cookies and local storage

This website uses technically necessary cookies; statistics cookies (Matomo) are set only with your consent (see section 15):

• a session cookie of the Joomla content management system, which identifies the session and expires at the latest when you close your browser or when the session duration ends;
• a cookie that stores your language selection, if you switch the language;
• a login cookie for signed-in operator and editorial accounts;
• a cookie aufst_osm if you click “Load map” before deciding in the cookie notice (one year; deleted as soon as you decline maps in the cookie notice);
• a cookie yootheme_consent storing your choices from the cookie notice (30 days): maps (OpenStreetMap) and statistics (Matomo); you can change them any time via “Cookie settings” in the footer;
• if you withdraw statistics consent, Matomo sets a strictly necessary cookie mtm_consent_removed so that your refusal is honoured.

The legal basis for the strictly necessary cookies is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(f) GDPR; for the statistics cookies (Matomo) and for loading the maps it is your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (sections 8 and 15). You can delete or block cookies in your browser at any time; certain functions such as signing in will then no longer work.

5. Contacting us by e-mail

If you write to us, we process your e-mail address, your name and the content of your message in order to reply to it. The legal basis is Art. 6(1)(b) GDPR (for enquiries relating to a listing or a user relationship) or Art. 6(1)(f) GDPR (legitimate interest in answering general enquiries). We delete the correspondence as soon as it is no longer needed and no statutory retention periods stand in the way.

Please note: Do not send us any sensitive data or any information about third parties that we do not need for your enquiry. E-mail is not a particularly confidential channel.

5a. Reporting an activity or event for children

If you report an activity through the form of The Family Capital, we store the details of the activity, your email address for follow-up questions and a non-reversible hash of your IP address (to prevent abuse, at most five reports per hour). We do not ask for any data about children. The editorial team checks every detail against the official source before anything is published; only details of the activity are published, never your email address. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in complete and verified information). We delete the email address after six months at the latest.

6. Directory of vegan places (SobiPro component)

The directory contains details of restaurants, cafés, shops, initiatives and organisations. These are predominantly contact details of businesses and organisations, not private data. Where the names of contact persons are given, this is done only with their knowledge and in the context of their professional or voluntary activity.

• Listings by the businesses themselves: Anyone who creates and looks after a listing needs a user account. For this we process name, e-mail address, username, password (only as a cryptographic hash), time of last login and the data provided in the listing. Legal basis: Art. 6(1)(b) GDPR (user relationship).
• Editorial approval: Every new listing and every change is reviewed editorially before publication. For traceability, we store the source of the listing and the date of the last review.
• Publication: Approved listings are publicly accessible, appear on the map and can be indexed by search engines. So please enter only data that may be published.
• Location data: To display listings on the map, we convert the address entered into coordinates (see section 8).
• Deletion: You can change your listing or request its deletion at any time. We will delete the user account along with it on request.

6a. Owner cockpit and view counting

For owners who look after their listing we count views and impressions of their listings per day without cookies and without storing IP addresses or other personal data. We store only one number per listing, day and source (detail page, list, map); automated access, the editorial team and the owner themselves are not counted. The figures are visible only to the respective owner in the “My listing” area; comparison values are averages over at least ten listings of a category. Daily values are aggregated into monthly values after 400 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show owners the reach of their listing. When an owner confirms “Details are still correct” in the cockpit, we store the date and user account of this confirmation in the listing’s change history.

6b. Newsletter

If you subscribe to our weekly newsletter, we store your e-mail address, the chosen language, optionally a district, the sections you have chosen (you only receive “Children and families” if you tick it yourself), and the time and wording of your consent (double opt-in: sign-up, confirmation and, if applicable, unsubscription, each with a shortened, non-reversible hash of the IP address that is deleted after 90 days). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every issue. Sending is done through our own mail server at our hosting provider All-Inkl (data processing agreement); we do not use open or click tracking and no external newsletter services. Unconfirmed sign-ups are deleted after 7 days, unsubscribed addresses after 30 days; the sending log is kept for 90 days.

7. Events calendar and registrations (RSEvents!Pro component)

You can view events without signing in. If you register for an event via the portal, we process the data you provide (usually name, e-mail address and, where applicable, phone number and comments) and pass it on to the organiser so that they can organise your participation. The legal basis is Art. 6(1)(b) GDPR. We delete registration data after the event has ended, at the latest after six months, unless retention obligations apply. If you post events yourself, the provisions under section 6 apply accordingly: events also go through editorial approval before publication.

8. Maps with OpenStreetMap

To display locations, we use maps based on OpenStreetMap. We have deliberately decided against Google Maps. When a map is loaded, map tiles are retrieved from servers of the OpenStreetMap Foundation; in the process, your IP address is transmitted to these servers. The OpenStreetMap Foundation is based in the United Kingdom, for which an adequacy decision of the European Commission is in place.

We load maps only with your consent: the legal basis is Art. 6(1)(a) GDPR and, for the access to your device, § 25(1) TDDDG. You give it in the cookie notice or by clicking “Load map”, and you can withdraw it at any time via “Cookie settings” in the footer. Without consent no map is loaded; all addresses are additionally given in text form, so you do not have to use the map. Information on data protection at OpenStreetMap: osmfoundation.org. To convert addresses into coordinates (geocoding) we use the Photon service of komoot GmbH (Potsdam, Germany); Esri/ArcGIS is no longer used. Information on data protection at komoot: komoot.com. When listings and events are created, only the address data of the places entered is transmitted, no data about visitors.

Proximity search on the events map. On the “Events map” page, you can search for events within a radius of an address. The map and the proximity search are only loaded after you consent to OpenStreetMap. The preset location (“Berlin, Deutschland”) and addresses you enter are then sent to Photon (komoot GmbH, Potsdam) for geocoding; no transfer to the USA takes place. If you additionally share your location via your browser, the location coordinates are transmitted to the same service – this sharing happens only after your express consent in the browser and can be refused or withdrawn at any time. The legal basis for loading the map and the proximity search is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); the geocoding of your input that follows is based on Art. 6(1)(f) GDPR – our legitimate interest is carrying out the search you started for places close to where you live. You do not have to use the proximity search: in the events calendar you can instead filter by district or county, category and venue.

Proximity search in the directory. If you search the directory by town or postcode with a radius, your town/postcode input is transmitted to the Photon geocoding service of komoot GmbH (Potsdam, Germany) for conversion into coordinates; no further information about you is transmitted. If you use “Use my location”, this happens only after your express permission in the browser; the coordinates may be transmitted to the OpenStreetMap Foundation’s Nominatim service to display the place name. This transmission only happens if you actively use the proximity search; no map tiles are loaded without your consent. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is carrying out the search you started for places close to where you live. Alternatively, you can filter by district or county without entering a location.

9. Search

The search function runs on our own server (Joomla Smart Search). Search terms are not evaluated on a personal basis and are not transmitted to third parties.

10. Hosting and processors

The portal is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) on a server in the Nuremberg (Germany) data centre. A data processing agreement under Art. 28 GDPR is in place with the hosting provider. As a further processor, we use the mailbox provider for This email address is being protected from spambots. You need JavaScript enabled to view it. (sending and receiving e-mail), likewise with a corresponding agreement. Apart from the map use and geocoding mentioned in section 8, no personal data is transferred to countries outside the EU/EEA.

11. Retention period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (in particular the commercial and tax-law periods of six and ten years respectively). After that, the data is deleted or anonymised.

12. Your rights

Under the GDPR you have the following rights:

• access to the data we process about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on a legitimate interest (Art. 21),
• withdrawal of consent you have given, with effect for the future (Art. 7(3)),
• lodging a complaint with a supervisory authority (Art. 77).

The supervisory authority responsible for us (the controller is based in Berlin) is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, phone (030) 13889-0. You can also contact the supervisory authority where you live — for Brandenburg: the State Commissioner for Data Protection and the Right of Access to Records of Brandenburg (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow.

13. Security

The website is delivered exclusively in encrypted form via HTTPS. Administrative access is protected by strong passwords. Security updates are installed promptly; backups are made daily and regularly tested for recoverability.

14. Changes to this policy

We will amend this privacy policy if the legal situation or the functions of the portal change. The version published here applies in each case. Last updated: 14 September 2026.

15. Web analytics with Matomo

We use the open-source analytics software Matomo on our own server (stats.reuther-media.de, Hetzner, Helsinki). Matomo is only loaded if you choose “Accept” in the cookie notice or enable “Statistics” in the cookie settings (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without this consent no measurement takes place.

With consent Matomo sets the cookies _pk_id (13 months) and _pk_ses (30 minutes); your IP address is shortened by two bytes before storage and no data is passed on to third parties. We record the pages visited, time spent, approximate location, browser and device type. You can withdraw consent at any time via “Cookie settings”; the Matomo cookies are then deleted.

16. Commercial communication

Partners and supporters of hauptstadt.net are labelled wherever they appear – with the words “Partner”, “Supporter”, “Topic partner”, “Founding partner”, “Campaign partner” or “Newsletter partner” and a link to the Partners page – never by colour or styling alone. The labelling applies to both parts of the portal, the Vegan and the Green Capital, and to every place it can appear: result lists, maps, detail pages, collections, guides and the newsletter.

Partnerships have no influence on the order in search, on the map or in recommendation lists, on filters and categories, on the editorial verification status, or on whether competitors are listed. What a partnership can include, and what is explicitly not for sale, is set out in full and in public on /en/partners. The basic listing is free of charge, permanently, for every place, project and business.

We do not currently use advertisements or affiliate links. Should that change, it will be described here and on /en/partners beforehand, and every affected place will be labelled accordingly.

17. Contact details in “The Green Capital”

In “The Green Capital” we publish contact details of professionals, advice services, funding bodies and projects. For public authorities and advice services we name only the responsible function and a shared mailbox, never individual people. For businesses and projects these are business contact details that the operators publish themselves or send us for publication; the source and the date of the last check are shown on every listing.

Enquiries do not go through us. We display the contact details and provide no contact form, so no enquiry is forwarded by us to a business, an advice service or a funding body. Anyone getting in touch does so directly – no data is transferred by us in the process, and we store neither the reason for nor the content of such contact. From the moment of contact, the organisation contacted is solely responsible for processing the data, and its own privacy information applies there.

To have a listing corrected, extended or removed, use “Report a change” or “Claim a listing”; we review every report and confirm receipt. We use the email address given only to reply about that report.

Forms on this website

Contact form and listing contact form

If you use the contact form or the contact form for a listing, we process the data you enter solely to handle your enquiry. We store submissions from the contact form for 90 days and submissions from the listing contact form for 30 days; after that they are deleted automatically. Your IP address is not stored. With the listing contact form, we forward your message to the contact address held in the respective listing.

Spam protection with ALTCHA (self-hosted)

To protect our forms from automatically sent spam messages, we use the ALTCHA spam protection. ALTCHA runs entirely on our own server: when you fill in the form, your browser solves a small computational task in the background (proof of work); no image puzzle appears. No third-party content is loaded, no personal data is transmitted to third parties and no usage profiles are created.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms from misuse and spam. If you prefer not to use the form, you can always reach us by e-mail at This email address is being protected from spambots. You need JavaScript enabled to view it..

What to do

1. Request access to your data: Simply write to This email address is being protected from spambots. You need JavaScript enabled to view it. – no particular form is required. We reply free of charge, usually within one month.
2. Have a listing corrected or deleted: Tell us the address of the listing and the change you want.
3. Delete your account: We delete accounts of businesses, organisations and event organisers on request; the associated listing is taken offline at the same time.
4. Remove cookies: Delete this website’s cookies in your browser – this will only sign you out; saved content is not lost.
5. Block maps: If you decline OpenStreetMap in the cookie notice, no map is loaded; all addresses are still shown as text. You can change your decision at any time via “Cookie settings” in the footer.

Where to get help

• Questions about this policy: This email address is being protected from spambots. You need JavaScript enabled to view it. or via the contact form.
• Rules for listings: Listing guidelines.
• Who runs the portal: Legal notice.
• Complaints: You can contact the responsible data protection supervisory authority at any time (see section 12).