Privacy policy

You can read hauptstadt.net without signing in and without giving your name. We use no advertising cookies, no Google Analytics and no social-media buttons. Maps and audience measurement with Matomo on our own server are only loaded once you’ve agreed (sections 8 and 15). We process personal data only if you write to us, register for an event or look after a listing as a business.

Details

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

[Operator – to be added]
E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.

The full operator details (name, address, authorised representatives and phone number) will be added before launch and will then also appear in the legal notice.

Data protection officer: Not appointed — we are not subject to a statutory obligation to appoint one under Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act).

2. Principles

• We collect only the data we need for the respective purpose (data minimisation, Art. 5 GDPR).
• Browsing the directory, the map and the events calendar is possible without signing in.
• Audience measurement only takes place with your consent: we use the Matomo web analytics software on our own server for this (section 15). We do not use third-party tracking services.
• We do not embed content from Google, Meta, X, YouTube or Vimeo and do not load fonts from external servers. The spam protection on our forms (ALTCHA) also runs entirely on our own server (see the section “Spam protection with ALTCHA”).
• There is no automated decision-making and no profiling.
• We do not pass on data for advertising purposes and do not sell data.

3. Accessing the website and server log files

Every time a page is accessed, our web server processes technical data that your browser transmits automatically: the address accessed, date and time, amount of data transferred, status code, referring page, browser type and version, operating system and the IP address. This data is technically necessary to deliver the page and serves the security of the system (defending against attacks, troubleshooting).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and trouble-free operation of the portal. The web server keeps no permanent access logs for this portal; the data mentioned is processed only transiently to deliver the page and to defend against disruptions. This data is not combined with other data sources.

4. Cookies and local storage

This website uses technically necessary cookies; statistics cookies (Matomo) are set only with your consent (see section 15):

• a session cookie of the Joomla content management system, which identifies the session and expires at the latest when you close your browser or when the session duration ends;
• a cookie that stores your language selection, if you switch the language;
• a login cookie for signed-in operator and editorial accounts;
• a cookie aufst_osm if you click “Load map” before deciding in the cookie notice (one year; deleted as soon as you decline maps in the cookie notice);
• a cookie yootheme_consent storing your choices from the cookie notice (30 days): maps (OpenStreetMap) and statistics (Matomo); you can change them any time via “Cookie settings” in the footer;
• if you withdraw statistics consent, Matomo sets a strictly necessary cookie mtm_consent_removed so that your refusal is honoured.

The legal basis for the strictly necessary cookies is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(f) GDPR; for the statistics cookies (Matomo) and for loading the maps it is your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (sections 8 and 15). You can delete or block cookies in your browser at any time; certain functions such as signing in will then no longer work.

5. Contacting us by e-mail

If you write to us, we process your e-mail address, your name and the content of your message in order to reply to it. The legal basis is Art. 6(1)(b) GDPR (for enquiries relating to a listing or a user relationship) or Art. 6(1)(f) GDPR (legitimate interest in answering general enquiries). We delete the correspondence as soon as it is no longer needed and no statutory retention periods stand in the way.

Please note: Do not send us any sensitive data or any information about third parties that we do not need for your enquiry. E-mail is not a particularly confidential channel.

6. Directory of vegan places (SobiPro component)

The directory contains details of restaurants, cafés, shops, initiatives and organisations. These are predominantly contact details of businesses and organisations, not private data. Where the names of contact persons are given, this is done only with their knowledge and in the context of their professional or voluntary activity.

• Listings by the businesses themselves: Anyone who creates and looks after a listing needs a user account. For this we process name, e-mail address, username, password (only as a cryptographic hash), time of last login and the data provided in the listing. Legal basis: Art. 6(1)(b) GDPR (user relationship).
• Editorial approval: Every new listing and every change is reviewed editorially before publication. For traceability, we store the source of the listing and the date of the last review.
• Publication: Approved listings are publicly accessible, appear on the map and can be indexed by search engines. So please enter only data that may be published.
• Location data: To display listings on the map, we convert the address entered into coordinates (see section 8).
• Deletion: You can change your listing or request its deletion at any time. We will delete the user account along with it on request.

7. Events calendar and registrations (RSEvents!Pro component)

You can view events without signing in. If you register for an event via the portal, we process the data you provide (usually name, e-mail address and, where applicable, phone number and comments) and pass it on to the organiser so that they can organise your participation. The legal basis is Art. 6(1)(b) GDPR. We delete registration data after the event has ended, at the latest after six months, unless retention obligations apply. If you post events yourself, the provisions under section 6 apply accordingly: events also go through editorial approval before publication.

8. Maps with OpenStreetMap

To display locations, we use maps based on OpenStreetMap. We have deliberately decided against Google Maps. When a map is loaded, map tiles are retrieved from servers of the OpenStreetMap Foundation; in the process, your IP address is transmitted to these servers. The OpenStreetMap Foundation is based in the United Kingdom, for which an adequacy decision of the European Commission is in place.

We load maps only with your consent: the legal basis is Art. 6(1)(a) GDPR and, for the access to your device, § 25(1) TDDDG. You give it in the cookie notice or by clicking “Load map”, and you can withdraw it at any time via “Cookie settings” in the footer. Without consent no map is loaded; all addresses are additionally given in text form, so you do not have to use the map. Information on data protection at OpenStreetMap: osmfoundation.org. To convert addresses into coordinates (geocoding) we use the Photon service of komoot GmbH (Potsdam, Germany); Esri/ArcGIS is no longer used. Information on data protection at komoot: komoot.com. When listings and events are created, only the address data of the places entered is transmitted, no data about visitors.

Proximity search on the events map. On the “Events map” page, you can search for events within a radius of an address. The map and the proximity search are only loaded after you consent to OpenStreetMap. The preset location (“Berlin, Deutschland”) and addresses you enter are then sent to Photon (komoot GmbH, Potsdam) for geocoding; no transfer to the USA takes place. If you additionally share your location via your browser, the location coordinates are transmitted to the same service – this sharing happens only after your express consent in the browser and can be refused or withdrawn at any time. The legal basis for loading the map and the proximity search is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); the geocoding of your input that follows is based on Art. 6(1)(f) GDPR – our legitimate interest is carrying out the search you started for places close to where you live. You do not have to use the proximity search: in the events calendar you can instead filter by district or county, category and venue.

Proximity search in the directory. If you search the directory by town or postcode with a radius, your town/postcode input is transmitted to the Photon geocoding service of komoot GmbH (Potsdam, Germany) for conversion into coordinates; no further information about you is transmitted. If you use “Use my location”, this happens only after your express permission in the browser; the coordinates may be transmitted to the OpenStreetMap Foundation’s Nominatim service to display the place name. This transmission only happens if you actively use the proximity search; no map tiles are loaded without your consent. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is carrying out the search you started for places close to where you live. Alternatively, you can filter by district or county without entering a location.

9. Search

The search function runs on our own server (Joomla Smart Search). Search terms are not evaluated on a personal basis and are not transmitted to third parties.

10. Hosting and processors

The portal is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) on a server in the EU data centre in Helsinki (Finland). A data processing agreement under Art. 28 GDPR is in place with the hosting provider. As a further processor, we use the mailbox provider for This email address is being protected from spambots. You need JavaScript enabled to view it. (sending and receiving e-mail), likewise with a corresponding agreement. Apart from the map use and geocoding mentioned in section 8, no personal data is transferred to countries outside the EU/EEA.

11. Retention period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (in particular the commercial and tax-law periods of six and ten years respectively). After that, the data is deleted or anonymised.

12. Your rights

Under the GDPR you have the following rights:

• access to the data we process about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on a legitimate interest (Art. 21),
• withdrawal of consent you have given, with effect for the future (Art. 7(3)),
• lodging a complaint with a supervisory authority (Art. 77).

The supervisory authority responsible for us (the controller is based in Berlin) is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, phone (030) 13889-0. You can also contact the supervisory authority where you live — for Brandenburg: the State Commissioner for Data Protection and the Right of Access to Records of Brandenburg (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow.

13. Security

The website is delivered exclusively in encrypted form via HTTPS. Administrative access is protected by strong passwords. Security updates are installed promptly; backups are made daily and regularly tested for recoverability.

14. Changes to this policy

We will amend this privacy policy if the legal situation or the functions of the portal change. The version published here applies in each case. Last updated: 30 August 2026.

15. Web analytics with Matomo

We use the open-source analytics software Matomo on our own server (stats.reuther-media.de, Hetzner, Helsinki). Matomo is only loaded if you choose “Accept” in the cookie notice or enable “Statistics” in the cookie settings (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without this consent no measurement takes place.

With consent Matomo sets the cookies _pk_id (13 months) and _pk_ses (30 minutes); your IP address is shortened by two bytes before storage and no data is passed on to third parties. We record the pages visited, time spent, approximate location, browser and device type. You can withdraw consent at any time via “Cookie settings”; the Matomo cookies are then deleted.

Forms on this website

Contact form and listing contact form

If you use the contact form or the contact form for a listing, we process the data you enter solely to handle your enquiry. We store submissions from the contact form for 90 days and submissions from the listing contact form for 30 days; after that they are deleted automatically. Your IP address is not stored. With the listing contact form, we forward your message to the contact address held in the respective listing.

Spam protection with ALTCHA (self-hosted)

To protect our forms from automatically sent spam messages, we use the ALTCHA spam protection. ALTCHA runs entirely on our own server: when you fill in the form, your browser solves a small computational task in the background (proof of work); no image puzzle appears. No third-party content is loaded, no personal data is transmitted to third parties and no usage profiles are created.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms from misuse and spam. If you prefer not to use the form, you can always reach us by e-mail at This email address is being protected from spambots. You need JavaScript enabled to view it..

What to do

1. Request access to your data: Simply write to This email address is being protected from spambots. You need JavaScript enabled to view it. – no particular form is required. We reply free of charge, usually within one month.
2. Have a listing corrected or deleted: Tell us the address of the listing and the change you want.
3. Delete your account: We delete accounts of businesses, organisations and event organisers on request; the associated listing is taken offline at the same time.
4. Remove cookies: Delete this website’s cookies in your browser – this will only sign you out; saved content is not lost.
5. Block maps: If you decline OpenStreetMap in the cookie notice, no map is loaded; all addresses are still shown as text. You can change your decision at any time via “Cookie settings” in the footer.

Where to get help

• Questions about this policy: This email address is being protected from spambots. You need JavaScript enabled to view it. or via the contact form.
• Rules for listings: Listing guidelines.
• Who runs the portal: Legal notice.
• Complaints: You can contact the responsible data protection supervisory authority at any time (see section 12).