Privacy policy

This privacy policy explains which personal data is processed when you visit this website and use our contact options.

1. Controller

Marco Gernt
Marco Gernt Architekten
Oberhafenstraße 1
20097 Hamburg
Germany

Email: info@marco-gernt.com
Telephone: +49 40 3095 0622
Website: www.marco-gernt.com

No data protection officer has been appointed. Under our current organisational structure, there is no statutory obligation to appoint a data protection officer.

2. Scope of this privacy policy

We process personal data only to the extent necessary to provide this website, ensure its security and stability, respond to enquiries, and enter into or perform contractual relationships.

Processing is based on the General Data Protection Regulation (GDPR), in particular Article 6(1) GDPR. Where information is stored on your device or information already stored on your device is accessed, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies.

We obtain personal data concerning your enquiry primarily from your entries and technically necessary requests. Urban research also uses expressly identified official and public sources. Their factual research purpose and reference date are stated with the relevant content.

3. Hosting, CDN and technical service providers

3.1 Hosting and email at Hetzner

This website runs on a dedicated server hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The server is located in Finland. Our email mailboxes are also hosted at Hetzner and are managed using mailcow.

Hosting involves processing technical access and operational data. For email correspondence, we process sender and recipient details, messages and attachments where necessary to handle your enquiry or perform a contract. We have a data processing agreement with Hetzner under Article 28 GDPR. Section 4 covers website logs, section 6.1 covers enquiries, and section 10 covers retention. Further information is available in Hetzner's privacy policy.

3.2 Cloudflare

We use Cloudflare to deliver this website securely and reliably. The provider is:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare may be used as a content delivery network, DNS service, security service, web application firewall and protection against abusive access. This may involve processing technical access data, particularly IP addresses, requested URLs, access dates and times, browser information, system information, referrer URLs and security events.

Purposes: Secure and fast delivery of the website, protection against attacks, operational stability and error analysis.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, efficient and reliable operation of this website.
Transfers to third countries: Where data is transferred to the USA or other third countries, the transfer takes place using the legally recognised mechanisms, in particular appropriate safeguards under Articles 44 et seq. GDPR.
Provider information: Further information about processing by Cloudflare is available in Cloudflare's privacy policy.

3.3 Cloudflare Web Analytics

With your consent, we use Cloudflare Web Analytics to evaluate page visits and loading times and improve this website's usability. These statistics are separate from Cloudflare's technical protection and delivery of the website. Without consent to “Cloudflare: visits and loading times”, this website does not load the measurement script.

Measurements include page views, an identifier for each page load, timing and performance metrics, and technical characteristics such as browser, operating system and device type. They may also include the page visited and the source of a visit. The script loads from static.cloudflareinsights.com and sends measurements to the Cloudflare endpoint /cdn-cgi/rum. Our integration excludes pages with URL query parameters, local development addresses, signed-in administrative areas and pages with forms for submissions. Measurement also does not start when a referring URL contains query parameters or comes from this website's submission forms or administrative areas.

According to Cloudflare, this script does not use cookies or comparable persistent browser identifiers. It processes temporary performance data from browser APIs. The IP address technically received with a measurement request is, according to the provider, discarded at the processing Cloudflare data center and is not stored in core RUM databases or RUM logs. This statement concerns RUM; technical delivery and security logs are covered separately in sections 3.2 and 4.

The legal basis for these optional statistics is Article 6(1)(a) GDPR and, where access to your device is involved, Section 25(1) TDDDG. You can change your selection and withdraw consent for the future at any time using “Privacy settings” in the footer. After withdrawal, the page reloads to stop measurement code that is already running. This does not retroactively undo measurements lawfully transmitted before withdrawal. Klaro stores your consent selection as described in section 5.3.

RUM processing is not restricted to the location of our Hetzner server and may take place outside the European Economic Area; see section 9. For further information, see Cloudflare's documentation of measurements and processing and the provider's privacy policy.

4. Website delivery and server logs

When you visit this website for information purposes only, we process data transmitted by your browser to our server or to the technical service providers involved. This processing is necessary to deliver the website and ensure its stability, security and functionality.

Data processed: IP address, access date and time, requested page or file, volume of data transferred, status code, referrer URL, browser type and version, operating system, language settings and technical access information.
Purposes: Website delivery, IT security, error analysis, prevention of abuse and operational stability.
Legal basis: Article 6(1)(f) GDPR.
Legitimate interest: Secure, stable and error-free operation of the website.
Retention period: Server logs are retained only for as long as necessary for website delivery, error analysis and security checks, and are then deleted or anonymised. The specific period depends on the log rotation settings and the relevant security purpose. Longer retention occurs only where necessary to investigate or prevent security incidents or to defend legal claims.

5. Cookies and similar technologies

5.1 Strictly necessary storage

Drupal uses a session cookie for sign-in and the protected client area. Its purpose is authentication and protection of the agreed collaboration. The configured cookie lifetime is 2,000,000 seconds, about 23 days. Session data become eligible for technical cleanup after 200,000 seconds of inactivity. Signing out ends the session. Browser scripts cannot read the cookie; under HTTPS it is transmitted only over an encrypted connection. Its SameSite setting is Lax.

The legal bases are Article 6(1)(b) GDPR for the agreed collaboration and Article 6(1)(f) GDPR for secure operation. Strictly necessary device access is based on Section 25(2), point 2 TDDDG. You do not need a client account to read public content.

5.2 Optional services and withdrawal

Cloudflare visitor statistics, the external project-atlas background map and embedded YouTube videos are optional and initially disabled. Text, local images and the project list remain available without these services. Consent is based on Article 6(1)(a) GDPR and, where access to terminal equipment is involved, Section 25(1) TDDDG.

You can change or withdraw your choice at any time using “Privacy settings” in the footer. You can also select “Deactivate map” or, for a loaded video, “Deactivate video”. Withdrawal stops further measurements, map requests or the active video embed; it does not reverse lawful transfers already made.

5.3 Consent manager and local form protection

Klaro is loaded from this website and stores your service choices in the “klaro” cookie for 90 days. You can change your choice earlier or delete the cookie in your browser. The choice is not stored as a separate visitor profile in a central consent database. Storage needed to respect your choice is based on Article 6(1)(f) GDPR and Section 25(2), point 2 TDDDG.

Drupal provides the enquiry forms locally. A local honeypot and minimum completion time help prevent automated submissions. Opening the forms does not load an external CAPTCHA service. The legal basis is our legitimate interest in preventing misuse under Article 6(1)(f) GDPR.

6. Contacting us

If you contact us by email, telephone or through a contact form, we process the data you provide to handle your enquiry and communicate with you.

Data processed: Name, contact details, message content, time of contact and any additional information you provide.
Purposes: Handling and responding to your enquiry and, where applicable, entering into or performing a contractual relationship.
Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a contract or steps taken prior to entering into a contract. Otherwise, Article 6(1)(f) GDPR.
Retention period: Data is deleted once the enquiry has been fully resolved, unless statutory retention obligations or legitimate interests justify further retention.

6.1 Project enquiries directly by email

We process the contact and project information you enter to assess and answer your enquiry personally. New submissions are emailed directly to info@marco-gernt.com. They are not stored as new enquiries in Drupal. Processing temporarily requires your form entries. No newsletter subscription is created.

Article 6(1)(b) GDPR applies to enquiries about a possible contract with you. For general business enquiries and company contacts, Article 6(1)(f) GDPR applies: our interest in dealing with relevant enquiries. A detected sending failure is shown. Acceptance by the mail service does not confirm arrival in the mailbox. Section 4 covers technical logs and Section 10 covers retention.

6.2 Providing your data

We need the fields marked as required in the local project enquiry form to assess and respond to your enquiry. Other fields are optional. There is no statutory obligation to provide this data.

6.3 Source information in links

Links from our profiles and posts may contain UTM parameters identifying the source of a visit. These can form part of technical server logs. Enquiry forms do not copy them into separate enquiry fields. Optional statistics do not start on pages with URL query parameters; see Section 3.3.

6.4 Urban research contributions

District, contribution type, text, source or observation, email address and optional name are emailed directly to info@marco-gernt.com. New contributions are not stored as Drupal submissions or published automatically. Editors assess the content; any publication, further use and necessary rights are agreed separately.

The legal basis is Article 6(1)(f) GDPR: assessing factual contributions and answering questions. Your name is optional. The form accepts no files. Please do not submit private information about others. Use our contact details above for questions or deletion requests.

7. Maps, external links and embedded content

7.1 Locally embedded interactive city map

On our urban research page for Lutherstadt Wittenberg, we provide an interactive schematic city map. This map is embedded directly in the website as HTML and SVG content and is delivered through our own website infrastructure.

The display and operation of this map do not involve loading map tiles, application programming interfaces, scripts or other content from Google Maps, OpenStreetMap, Mapbox or any other external mapping provider. Using the map therefore does not result in any additional transfer of data to an external mapping provider.

Clicking on a city area opens only an internal page of this website. This involves processing only the technical access data and server logs described in Section 4.

Purpose: Displaying city areas, providing geographical orientation and navigating to the associated research and information pages.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is to present our urban planning research in a clear and interactive format.

7.2 External link to Google Maps

The contact section of this website contains an external link to Google Maps through which the location of Marco Gernt Architekten can be opened. Google Maps content is not embedded in this website and is not loaded merely by visiting our website.

Only when you click the link labelled “Open in Google Maps” do you leave our website and your browser establishes a direct connection to Google. Google may then process information including your IP address, browser and device information, referrer URL, and the date and time of access. If you are signed in to a Google account, Google may associate the visit with your account.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

We have no control over the subsequent processing carried out by Google. Further information is available in Google's privacy policy.

7.3 Media, YouTube and external links

Project images, fonts and our own video files are loaded from this website. Embedded YouTube videos also use a preview image hosted on this website. No external player or YouTube thumbnail is loaded before you select “Load video”.

By selecting “Load video”, you allow a connection to YouTube, a Google service. The player uses privacy-enhanced mode at youtube-nocookie.com. Loading transmits data to Google, including your IP address, browser and device information and technical request data. Cookies or similar storage technologies may be used. Privacy-enhanced mode does not mean anonymous use or use without any data processing. If you are signed in to Google, activity may be associated with your account.

The player loads after your consent; you start playback within the player. Klaro stores your choice. You can remove an active embed using “Deactivate video” or the central privacy settings. See the Google Privacy Policy and information about privacy-enhanced mode. Possible international transfers are described in Section 9.

An external link alone is not an embed. You access the provider’s service only when you open the link. The separately enabled atlas background map is described in Section 7.7.

7.4 City game and reading path

The city game and research navigation are delivered by our own website. The game remembers visited areas and your best score for the seven questions only in your browser's session storage; the reading path remembers open chapters and its scroll position. These details are not sent to us and end with the browser session. They are stored solely to preserve the game and reading position you have chosen while using the site. The game still works if your browser blocks this storage.

7.5 Local content search

The visitor guide and the research discovery form search published content on this website. Your question is processed on our server to display source passages and links. Processing takes place exclusively on our server. Your input is not saved as a contribution or CRM record. The form may temporarily retain input during form processing. Please avoid personal details.

For abuse prevention, the search records an IP address and event time in a local rate-limit entry, with a one-minute validity period. Expired entries are removed during the maintenance run. Ordinary server access logs are described in section 4. The legal basis is Article 6(1)(f) GDPR: providing the requested search and protecting it against misuse.

7.6 Local maps, city model and spatial analysis

District maps, historical population comparisons and the Wittenberg city model load from this website. Research displays do not load external map tiles, request your device location or create a visitor profile. The 3D geometry loads only when you open that view.

Spatial analyses use locally supplied paths and public facilities. Accessibility and hotspots are displayed or calculated in the browser. A selection may appear in the page URL. Reloading or sharing it can therefore include its parameters in technical access logs. Housing-cost comparison entries are processed in browser memory and not submitted as enquiries. We do not record your actual movements.

Public GIS derivatives contain no owners’ names or private parcel attributes. Sources and licences appear with each display. Article 6(1)(f) GDPR is the legal basis for the requested display and its technical delivery; Section 4 covers ordinary access logs.

7.7 Project atlas with optional background map

The project list, location information and Leaflet library load from this website. Only clicking “Load map” permits the external background map. Your browser then requests tiles from tile.openstreetmap.org. The OpenStreetMap Foundation receives technical data including IP address, browser information, request time and the map area requested. No device location is requested.

The project list works without map consent. The legal bases are Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. “Deactivate map” or the “Project atlas: OpenStreetMap background map” service in Privacy settings stops further map requests. The choice is stored with your Klaro choices as described in Section 5.3. OpenStreetMap Foundation privacy information.

7.8 Local search, source catalogue and editorial review

Filtered search and suggestions use a local database index containing explicitly selected public text fields. Client documents, user accounts, private project addresses and import drafts are not indexed. Search terms are processed on our server to answer the request; no additional search analytics or external search service is used. Section 4 applies to technical access logs.

The source catalogue lists approved places with source dates and licences and links to the central research display. It does not load a second external map. Opening an external source link calls that provider’s website.

Administrators can review public place data supplied as CSV. Uploads and review packages are protected; publication requires a separate release. Unapproved packages and their drafts are removed during maintenance after 30 days. Temporary uploads also follow Drupal’s cleanup process. Approved public source versions are retained for traceability. Internal review tasks record content, deadline and status, and, on completion, the time and editor identifier. They support editorial quality checks without automatically publishing new data.

7.9 Protected client area

For agreed project work, we process accounts, project membership, folder assignments, files and editing revisions with time and editor identifier on our server. Files use private storage. Assigned members with reading rights and authorised administrators can access approved documents. Without approval they are not publicly accessible and are excluded from public search and public downloads.

Processing serves the agreed collaboration under Article 6(1)(b) GDPR; for business contacts and access security we rely on Article 6(1)(f) GDPR. Client documents are not automatically sent to external file or AI services. Section 10 covers retention and deletion review.

7.10 Research data, design options and project stories

Spatial design options, terrain profiles, sun and shadow views, charts and project stories are served by this website. Your selections are processed in your browser for display. These features do not request your device location, set additional cookies or send your selections to external services.

Official whole-city statistics are retrieved on our server from the Statistical Office of Saxony-Anhalt using our technical account. Visitor questions, visitor IP addresses and internal studies are not sent in these requests. New data versions are reviewed by an editor before publication.

Authorised editors may record aggregate pedestrian counts and verified access attributes for spatial studies. This feature does not identify or track individuals and processes no camera recordings. Only explicitly approved factual attributes are published; internal source references and editor identifiers remain protected.

Protected studies and data approvals store working records, versions, times and the signed-in editor’s account identifier in the Drupal database. These records support traceable project work and error correction. Internal studies are not automatically published or sent to external services. Responsible editors review access and deletion according to the purposes and rules in section 10.

The automatic technical check requests predetermined pages without a visitor login and stores the result, page path, duration and data version. It does not retain form entries or visitor profiles. The latest report and the last 30 check summaries are retained.

7.11 Internal editorial accessibility checks

Authorised administrators use Editoria11y to check website content for potential accessibility barriers. The checker and its language files load from this website. Checks run in the signed-in administrator’s browser. They do not send content to an external checking or AI service, and the checker does not load for visitors who are not signed in.

Synchronisation of findings with a central Drupal results list is disabled. The checker may store display preferences, previously seen findings and manually dismissed findings in the administrator’s local browser storage. These entries can be removed using the browser’s website-data controls. The checker supplements editorial review and does not replace a complete accessibility assessment.

7.12 Internal link checking

The internal Link Checker checks links in approved public text fields only against this website. It stores the link, source page, check time and response status for authorised administrators. It does not read submissions or send content to external checking services.

8. Recipients of personal data

Hetzner provides hosting and email. Cloudflare supports delivery and protection of the website and, with consent, visitor statistics. The OpenStreetMap Foundation receives technical request data for the optional atlas background map. Google receives technical request and usage data when you enable YouTube videos. The purposes and conditions are described in Sections 3, 5, 7.3 and 7.7.

Enquiries and research contributions are handled by the responsible staff in our office mailbox. Agreed client documents are accessible only to assigned project members with reading rights and authorised administrators. Technical service providers access data only as necessary for their work. Other disclosure occurs where necessary to perform a contract, required by law or otherwise lawfully permitted.

9. Processing outside the European Economic Area

The confirmed Hetzner server location in Finland is within the European Economic Area. Cloudflare, the optional OpenStreetMap background map and enabled YouTube videos may involve processing outside the EEA. Consent to an optional feature does not replace the requirements of Articles 44 et seq. GDPR for international transfers. Google describes its international transfer safeguards in the Privacy Policy linked in Section 7.3.

Cloudflare provides a data processing addendum including standard contractual clauses. Information on recipients and safeguards is available in the Cloudflare data processing addendum and the provider information in Section 7.7. Contact info@marco-gernt.com for information about the safeguards applicable to our processing and a copy of applicable guarantees.

10. Retention and deletion

Enquiries are handled in our office mailbox. We review closed matters to determine whether continued retention is needed for questions, a contract, statutory records or legal claims. Enquiry data no longer needed are deleted. Required business and project records are retained under the applicable legal duty.

Client accounts, project membership, folders, files and editing revisions are held for the agreed collaboration. After it ends, access, records and versions are reviewed according to project purpose, agreed periods and statutory duties. There is no single automatic deletion date for all project records.

Backups include the database and public and private files and serve restoration. Access is restricted. They may contain older data; completed deletions must be reapplied after restoration. Technical logs follow the criteria in Section 4. Sections 5 and 7.4 give browser storage periods.

11. Your rights

Under the GDPR, your rights include:

The right of access under Article 15 GDPR;
The right to rectification under Article 16 GDPR;
The right to erasure under Article 17 GDPR;
The right to restriction of processing under Article 18 GDPR;
The right to data portability under Article 20 GDPR;
The right to object under Article 21 GDPR;
The right to withdraw consent with effect for the future.

11.1 Automated decisions

This website does not make solely automated decisions with legal or similarly significant effects under Article 22 GDPR. Project enquiries are reviewed personally. Calculators, charts and spatial models provide information and do not decide whether an individual contract is accepted.

12. Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You may object to the processing of personal data for direct marketing purposes at any time without giving reasons. Such processing currently takes place only where the applicable legal requirements have been met.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

The competent authority for Hamburg is:

Hamburg Commissioner for Data Protection and Freedom of Information
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
datenschutz-hamburg.de

14. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other security risks. These measures are reviewed regularly and adapted to reflect the state of the art.

15. Updates and changes to this privacy policy

This privacy policy may be updated to reflect technical, legal or organisational changes. The version published on this website applies.

Last updated: 24 October 2026