Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Hass-Hetze – Stephan Rajewski
Palmaille 7, 22767 Hamburg, Germany
Email: info@hass-hetze.de

2. The key points first

• ›

  No cookies, no tracking, no analytics tools, no cookie banner.

• ›

  Our fonts are hosted on our own server.

• ›

  The website and data are hosted by Hetzner on servers in Germany; we send emails via Oracle (data centre in Frankfurt).

• ›

  We pass your report on to a law firm only with your consent.

3. No legal services

4. Hosting

We host the website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.

Our database (PostgreSQL) and all uploaded files – evidence for reports and law firm photos – are on the same server as the website. We keep the files in a private storage area; they are not publicly accessible. Exception: the photo in the network profile of a law firm that has agreed to its publication.

5. Server logs

Each time a page is requested, our server automatically stores:

• ›

  your IP address

• ›

  date and time of the request

• ›

  the requested address (URL)

• ›

  browser and operating system (user agent)

We need this data to deliver the page and to defend against attacks. We delete it after 7 days. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

6. Defence against attacks (CrowdSec)

To defend against attacks, we analyse the logs automatically with the CrowdSec software. If it detects an attack, it transmits the IP address, time and type of the attack to CrowdSec SAS, Paris, France, which uses this to compile a shared blocklist (Art. 6 (1) (f) GDPR).

7. No cookies, no tracking, no external fonts

We do not use cookies or any tracking or analytics tools for visitors to this website. That is why there is no cookie banner. The fonts Barlow and Inter are hosted on our own server. When a page is loaded, your browser does not connect to Google Fonts or any other third party.

You can choose a light or dark appearance with the switch in the page header. Only when you use it do we store your choice (“light” or “dark”, without any identifier) in your browser's local storage so that it is kept for your next visit. It is not transmitted to us. You can change it at any time with the switch or delete it in your browser (Section 25 (2) no. 2 TDDDG).

8. Spam protection

The report form contains an invisible field and a timestamp. Both are used to detect automated submissions and are not stored.

To prevent anyone from abusing the form in bulk, the server briefly keeps your IP address in its working memory (rate limit). It is not stored permanently. Legal basis: Art. 6 (1) (f) GDPR (protection against abuse).

9. Reporting by email

We process what you write to us: usually the link, platform, description, your email address and attachments. We receive incoming emails via Hetzner (data processing on our behalf, servers in Germany).

The prepared email contains a declaration of consent: by sending it, you consent to us processing your details – including sensitive ones such as origin, religion or sexuality – in order to review and refer your report (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR). You can withdraw it at any time by writing to info@hass-hetze.de. Before we pass anything on to a law firm, we also ask you first.

10. Online report form

If you report via the online form, we store your report in our database on our server at Hetzner in Germany:

• ›

  link to the content or profile

• ›

  your description

• ›

  your email address

• ›

  name or pseudonym (optional)

• ›

  screenshots (optional)

• ›

  whether you are under 18

• ›

  when you learned of the offence and the offender (optional)

• ›

  time of the report and language of the page

We ask for your age to protect you: if you are under 18 or the report is about sexual harassment, the form accepts no files, so that no intimate images end up with us. You also get suitable advice, for example that your parents usually file the request for prosecution and that for anyone under 16 we also need their consent before passing the report on to a law firm. From the day you learned of the offence and the offender, we calculate the deadline for a request for prosecution as an orientation and tell you in the confirmation email and on your status page.

We store evidence files such as screenshots unchanged, including any metadata they contain, and calculate a SHA-256 checksum for each file. This makes it possible to prove later that nobody has altered the file.

We do not store your IP address with the report. After you submit it, you receive an email with a confirmation link (double opt-in). This is how we make sure the address belongs to you. If you do not confirm within 48 hours, we delete the report automatically.

The legal basis is your consent (Art. 6 (1) (a) GDPR, and for sensitive information Art. 9 (2) (a) GDPR).

11. Sensitive information

Online hate often targets origin, religion or sexual orientation. Your report may therefore contain specially protected data (special categories of personal data) under Art. 9 GDPR. We process it only with your explicit consent (Art. 9 (2) (a) GDPR).

12. Referral to a partner law firm

Beyond that, we pass on your data only if a law obliges us to do so.

13. Data of the reported person

Reports contain data about the person who wrote the content – such as profile name, link and content. We process it so that those affected can enforce their rights. Legal basis: Art. 6 (1) (f) GDPR (pursuit of legal claims).

We do not inform the reported person. Doing so would jeopardise the pursuit of legal claims, for example because evidence could disappear. The duty to inform under Art. 14 GDPR therefore does not apply, pursuant to Art. 14 (5) (b) GDPR and § 33 (1) no. 2 (a) of the German Federal Data Protection Act (BDSG).

14. Portal for partner law firms

Law firms log in with a username and password. After logging in, their browser stores a session token and the account name in local storage; the token is valid for 12 hours, and both are deleted on logout. This is technically necessary for the login (Section 25 (2) no. 2 TDDDG). Law firms only see cases that we have released to them.

We store the appearance that a law firm chooses in its profile (light, dark or matching the device) with its account so that it applies on every device (Art. 6 (1) (b) GDPR), and delete it with the account. The browser also keeps it in local storage so that the portal opens in it straight away; it is deleted there on logout (Section 25 (2) no. 2 TDDDG).

After ten failed login attempts in a row, we lock the account for 15 minutes; to do this, we count the failed attempts on the account. In addition, the server briefly keeps the IP address in its working memory to fend off too many attempts; it is not stored in the process. Legal basis: Art. 6 (1) (f) GDPR (protecting accounts and cases against unauthorised access).

Access requests: If a law firm requests access by email, we process the name, firm and email address to check the admission in the official register of lawyers and to set up access (Art. 6 (1) (b) GDPR). We delete rejected requests after six months and all other data when the cooperation ends.

Firm profile: We only use the address and phone number in the profile for the letterheads of the letter templates in the portal; they are never published. Notes, the date of knowledge and status changes are stored with the respective case (Art. 6 (1) (b) GDPR).

Network profile: Only if a law firm explicitly consents in the portal do its name, title, firm, city, areas of practice, short bio and – if provided – a photo appear publicly on the page "Our network" (Art. 6 (1) (a) GDPR). We store the time of consent. Consent can be withdrawn at any time in the portal; the profile then disappears immediately. When a photo is uploaded, we resize it to no more than 400 × 400 pixels and remove metadata such as GPS data.

15. Contacting law firms

To gain partner law firms, we write to law firms by post. For this we store the firm's name and address and, where available, the contact person, phone number, email address, website and area of practice, as well as the source of the details and notes on the course of contact. The details come from publicly available information about the firm, such as directories of lawyers or the firm's website. The legal basis is our legitimate interest in gaining partners (Art. 6 (1) (f) GDPR). The letter itself contains the information required by Art. 14 GDPR.

A law firm can object to this at any time, informally to info@hass-hetze.de (Art. 21 (2) GDPR). We then stop writing to it and delete all details except the firm's name, address, source and the time of the objection. We keep this list of objections for as long as we write to law firms, so that the firm receives no further mail from us. Without an objection, we delete the details two years after the last contact.

16. Administration area

Only the operator has access to the website's administration area. Access is exclusively via a secured connection (SSH tunnel), and the operator logs in with a password and a second factor.

After login, the administration area sets a session cookie. It is technically necessary (Section 25 (2) no. 2 TDDDG) and applies only there. Visitors to the website do not receive this cookie.

17. Sending emails

We send the website's emails – the confirmation link and messages about the status of your report – via Oracle Cloud Infrastructure Email Delivery, data centre region Frankfurt am Main. We have concluded a data processing agreement with Oracle pursuant to Art. 28 GDPR. Oracle processes the sender, recipient, subject and content of the email as well as delivery data. The emails contain the link to your report and, where applicable, your name or pseudonym and the calculated deadline for a request for prosecution, but never the text of your report or evidence files.

For support and operations, Oracle may also access this data from countries outside the EU. Such access is safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

We continue to receive emails to info@hass-hetze.de via our hosting provider Hetzner (data processing on our behalf, servers in Germany).

18. Retention periods

• ›

  Server logs: 7 days

• ›

  Rate limit: only briefly in working memory

• ›

  Website appearance: only in your browser, until you change it or delete the site data

• ›

  Unconfirmed reports: 48 hours after submission, then deleted automatically (hourly check)

• ›

  Reports we do not pass on: 6 months after closure

• ›

  Cases passed on: 12 months after referral. After that they remain only with the law firm.

• ›

  Reports by email: the same periods, depending on whether we pass them on

• ›

  Backups: encrypted, 14 days, then deleted automatically

• ›

  Law firms we have written to: 2 years after the last contact; after an objection, the firm's name and address on the list of objections for as long as we write to law firms

When we delete a report, we also delete all files belonging to it. Deleted reports disappear from backups after 14 days at most. If you withdraw your consent, we delete the data earlier, unless a law obliges us to retain it.

19. Your rights

• ›

  Access (Art. 15 GDPR) – what data we have stored about you

• ›

  Rectification (Art. 16 GDPR) – correct inaccurate data

• ›

  Erasure (Art. 17 GDPR)

• ›

  Restriction of processing (Art. 18 GDPR)

• ›

  Data portability (Art. 20 GDPR)

• ›

  Objection (Art. 21 GDPR) – to processing based on legitimate interests

• ›

  Withdrawal of your consent – at any time, with effect for the future

To exercise them, write to info@hass-hetze.de.

20. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, for example in the federal state where you live or where we are based. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

21. Encryption

The connection to this website is encrypted using TLS. You can recognise this by “https://” in the address bar.

22. Last updated

Last updated: October 2026. If the technology or the legal situation changes, we will amend this policy. The current version is always available at /datenschutz.