In accordance with the legal requirements of data protection law (in particular pursuant to the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the European General Data Protection Regulation (GDPR)), we provide the following information regarding the nature, scope, and purpose of our company’s processing of personal data. This Privacy Policy also applies to our websites and social media profiles. Regarding the definition of terms such as “personal data” or “processing,” please refer to Article 4 GDPR.
Name and Contact Information of the Controller
The controller (hereinafter “Controller”) within the meaning of Article 4(7) GDPR is:
Akademie der Katastrophenforschungsstelle (AKFS) gGmbH
Am Juliusturm 7
13599 Berlin
Email: kontakt@a-kfs.de
Commercial Register (HRB): 185783B, Amtsgericht Charlottenburg (Berlin)
Managing Director: Dr Daniel F. Lorenz
Certificate of Nonprofit Status issued by the Finanzamt für Körperschaften I (Tax Office for Corporations I), 14057 Berlin
Data Protection Officer
Nicolas Bock, Akademie der Katastrophenforschungsstelle (AKFS) gGmbH, Am Juliusturm 7, 13599 Berlin, E-Mail: bock@a-kfs.de
You can contact our Data Protection Officer directly and in confidence with any questions or concerns regarding data protection.
Types of Data, Purposes of Processing, and Categories of Data Subjects
Below, we provide information about the nature, scope, and purpose of the collection, processing, and use of personal data.
1. Types of Data we process
Usage data (access times, websites visited, etc.), personal information (name, address, etc.), content data (text entries, videos, photos, etc.), communication data (IP address, etc.),
2. Purposes of processing pursuant to Article 13(1)(c) GDPR
Optimise the website technically and economically, ensure easy access to the website, make the website user-friendly, prevent spam and misuse, handle contact requests, provide websites with features and content,
3. Categories of data subjects pursuant to Article 13(1)(e) GDPR
Visitors/Users of the website, the individuals concerned are collectively referred to as “users.”
Legal Basis for the Processing of Personal Data
Below, we provide information about the legal basis for the processing of personal data:
1. If we have obtained your consent to the processing of personal data, the legal basis is Article 6(1)(a) GDPR.
2. If the processing is necessary for the performance of a contract or in order to take steps at your request prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR.
3. If the processing is necessary to comply with a legal obligation to which we are subject (e.g., statutory retention requirements), the legal basis is Article 6(1)(c) GDPR.
4. If the processing is necessary to protect the vital interests of the data subject or of another natural person, the legal basis is Article 6(1)(d) GDPR.
5. If the processing is necessary to protect our legitimate interests or those of a third party and your interests or fundamental rights and freedoms do not override those interests, the legal basis is Article 6(1)(f) GDPR.
Recipients of your data
Your personal data will be disclosed to third parties only where one of the following conditions is met: you have given your consent (Article 6(1)(a) GDPR; the disclosure is necessary for the performance of a contract (point (b)); we are under a legal obligation to disclose the data (point (c)), for example to courts, law enforcement authorities or tax authorities; or the disclosure is necessary for the purposes of our legitimate interests and is not overridden by your interests (point (f)).
In addition, we use service providers which process personal data on our behalf and solely on our instructions. These processors are not third parties within the meaning of Article 4(10) GDPR. We have concluded a contract pursuant to Article 28 GDPR with each of our processors. We currently use the following processors:
| Service Provider | Purpose | Registered Office / Server Location |
| hosting.de | Operation of the website, server log files | Germany |
Transfer to countries outside the EU/EEA
Where we transfer personal data to countries outside the European Union or the European Economic Area, or have it processed there, we do so only where the conditions of Articles 44 et seq. GDPR are met. This is the case where the European Commission has adopted an adequacy decision for the country concerned pursuant to Article 45 GDPR; where appropriate safeguards pursuant to Article 46 GDPR are in place – in particular standard data protection clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures; or where one of the derogations under Article 49 GDPR applies.
For the United States, an adequacy decision of the European Commission has been in place since 10 July 2023 (EU-U.S. Data Privacy Framework). It applies only to companies certified under that framework. Where a recipient is not certified, we base the transfer on standard data protection clauses.
We point out that, in the case of transfers to third countries, a level of protection equivalent to European standards cannot be guaranteed in every case. In particular, it cannot be ruled out that public authorities in those countries will access the data without effective legal remedies being available to you.
You may obtain a copy of the safeguards agreed in each case on request, using the contact details given above.
Data Deletion and Retention Periods
We process your personal data only for as long as is necessary for the respective purposes. The specific periods are stated with the individual processing operations. Beyond that, we erase your data as soon as you withdraw a consent you have given, or effectively object to an operation based on legitimate interests, unless continued retention is necessary for the establishment, exercise or defence of legal claims or statutory retention obligations preclude erasure.
Statutory retention obligations arise in particular from commercial and tax law (Section 257 of the German Commercial Code, Handelsgesetzbuch (HGB), and Section 147 of the Fiscal Code of Germany, Abgabenordnung (AO)). Depending on the type of document, they range from six to ten years, in each case running from the end of the calendar year in which the document was created. For the duration of the retention obligation we restrict the processing of the data concerned; once the period has expired, the data are erased.
Automated decision-making
Automated decision-making, including profiling, within the meaning of Article 22 GDPR does not take place.
Provision of our website and creation of log files
1. Each time our website is accessed, our system automatically collects data and information from the system of the requesting computer. The following are collected: IP address, date and time of access, time zone, the specific page or file requested, the HTTP status code, the volume of data transferred, the website previously visited (referrer), browser type and version, the operating system used, and the language setting.
2. The purposes of the processing are the technically error-free delivery of the website, ensuring the security of our systems, and investigating and defending against attacks on our server infrastructure.
3. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring that our website operates without disruption and is protected against misuse.
4. The log files are automatically erased after 30 days. Storage beyond that period takes place only where there is specific cause, namely where there are concrete indications of an attack or other unlawful activity; in such cases the entries concerned are retained until the incident has been conclusively resolved and are erased thereafter.
5. These data are not combined with other personal data, nor are they analysed in order to create usage profiles.
Cookies and access to terminal equipment
Our website uses strictly necessary cookies only. These are small text files stored on your device, without which the functions of the website that you have expressly requested cannot be provided. These cookies are stored, and information on your terminal equipment accessed, without your consent pursuant to Section 25(2) no. 2 TDDDG, the German act on data protection and privacy in telecommunications and digital services (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten). The legal basis for the subsequent processing of the personal data is Article 6(1)(f) GDPR; our legitimate interest lies in providing our website in working order. We use the following cookies:
| Name | Purpose | Storage Period |
| Pll_language | Stores the language version of the website you have selected (German or English) so that you remain in that language as you move between pages. | 1 year |
| Hosting.de | Web Server Logs | 7 days |
You can configure your browser to refuse cookies generally or to delete them when the browser is closed. If strictly necessary cookies are disabled, individual functions or our website may be unavailable.
Contacts via the contact form / email / fax / mail
1. When you contact us, we process the information you provide depending on the channel, your name, your email address or postal address, and the content of your message for the purpose of dealing with your enquiry.
2. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries and in documenting the matter for evidentiary purposes. Where your enquiry is directed at the conclusion or performance of a contract, Article 6(1)(b) GDPR is an additional legal basis. Where you have given us your consent, the legal basis is Article 6(1)(a) GDPR; you may withdraw that consent at any time with effect for the future.
3. Providing your contact details is neither a statutory nor a contractual requirement. Without a means of contacting you, however, we cannot reply to you. In the contact form, only the information marked as a mandatory field is required.
4. We erase your information as soon as the underlying matter has been conclusively resolved and no statutory retention obligations preclude erasure. Where the communication constitutes business correspondence within the meaning of commercial or tax law, the statutory retention periods apply and the data are erased once those periods have expired.
5. Please note that emails may be transmitted without encryption. If you wish to send us confidential information, please use the post.
Contact by Phone
1. When you contact us by phone, your phone number is processed to handle the contact request and its follow-up and is temporarily stored in the RAM/cache of the phone device/display or displayed on it. This storage is carried out for liability and security reasons, to provide proof of the call, as well as for business reasons, to enable a callback. In the case of unauthorised telemarketing calls, we block the phone numbers.
2. The legal basis for processing the phone number is Article 6(1)(f) GDPR. If the contact is intended to lead to the conclusion of a contract, the additional legal basis for the processing is Article 6(1)(b) GDPR.
3. The device cache stores calls for 365 days and gradually overwrites or deletes old data; when the device is disposed of, all data is deleted, and the storage medium is destroyed if necessary. Blocked phone numbers are reviewed annually to determine whether the block is still necessary.
4. You can prevent your phone number from being displayed by calling with your number suppressed.
Social Media Presence
1. We maintain profiles on social networks in order to provide information about our work and to engage with those interested in it. We currently maintain the following presence: LinkedIn.
2. When you access these profiles, the platform provider concerned processes personal data, including usage data, device and connection information, and the content of your interactions. The providers regularly use this data to create usage profiles, which are used for market research and advertising purposes. This applies both to logged-in members of the platform and, to a limited extent, to visitors who are not registered. We have no influence over the nature, scope and purposes of this processing, and no access to the underlying data.
3. Insofar as the platform provider makes aggregated statistics on the use of our profile available to us, we are joint controllers with the provider for the associated processing within the meaning of Article 26 GDPR. The essence of the arrangement on joint controllership is available here: https://www.linkedin.com/legal/l/page-joint-controller-addendum. You may exercise your data subject rights against us and against the platform provider alike; we recommend exercising them against the provider, as only the provider has direct access to the data. If you nevertheless approach us, we will forward your request.
4. Purposes: providing information about our research, projects and events; exchange with the academic and professional community; public communications.
5. The legal basis for the processing carried out by us is Article 6(1)(f) GDPR. Our legitimate interest lies in the visibility of our academic work and in professional exchange. Insofar as you have given your consent to the platform provider, Article 6(1)(a) GDPR is the legal basis in that respect.
6. The platform providers also process data outside the European Union. Please refer to the section on transfers to countries outside the EU/EEA above.
7. Providers and their privacy notices: LinkedIn — for users in the EEA, the provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Privacy policy: https://www.linkedin.com/legal/privacy-policy;
Cookie policy: https://www.linkedin.com/legal/cookie-policy.
Rights of the Data Subject
Your right to object under Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
Where your data are processed for direct marketing purposes, you have the right to object at any time and without giving reasons; the data will thereafter no longer be processed for that purpose.
An objection is not subject to any particular form, is free of charge, and may be addressed to the contact details given above.
1. Objection or Withdrawal of Consent to the Processing of Your Data
To the extent that the processing is based on your consent pursuant to Article 6(1)(a) and Article 7 GDPR, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.
To the extent that we base the processing of your personal data on a balancing of interests pursuant to Article 6(1)(f) of the GDPR, you may object to the processing. This is the case, in particular, if the processing is not necessary for the performance of a contract with you, as we will explain in each instance in the following description of the functions. If you exercise such an objection, we ask that you explain the reasons why we should not process your personal data as we currently do. In the event of a justified objection, we will review the circumstances and either cease or adjust the data processing or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.
You may object to the processing of your personal data for the purposes of advertising and data analysis at any time. You may exercise your right to object free of charge.
You can notify us of your objection to direct marketing using the contact details given above.
2. Right of Access
You have the right to access your personal data stored by us pursuant to Article 15 GDPR. This includes, in particular, information regarding the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, and the source of your data, unless it was collected directly from you.
3. Right to Rectification
You have the right to have inaccurate data rectified or accurate data completed pursuant to Article 16 GDPR.
4. Right to Erasure (‚right to be forgotten‘)
You have the right to have your data stored by us erased pursuant to Article 17 GDPR, unless statutory or contractual retention periods or other legal obligations or rights to continued storage preclude this.
5. Right to Restriction of Processing
You have the right to request a restriction on the processing of your personal data if any of the conditions set forth in Article 18(1)(a) through (d) GDPR are met:
• If you contest the accuracy of the personal data concerning you for a period that enables the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;
• the controller no longer needs the personal data for the purposes of processing, but you need it for the establishment, exercise or defence of legal claims, or
• if you have objected to the processing pursuant to Article 21(1) GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.
6. Right to Data Portability
You have the right to data portability under Article 20 GDPR, which means that you may receive the personal data we have stored about you in a structured, commonly used, and machine-readable format, or request that it be transferred to another controller.
7. Right to File a Complaint
You have the right to file a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the location of the alleged infringement.
Data Security
We take appropriate technical and organisational measures pursuant to Article 32 GDPR in order to protect your data against accidental or intentional manipulation, partial or total loss, destruction and unauthorised access. The transmission of data between your browser and our server is encrypted using TLS. Our measures are kept under continuous review and adapted in line with technological developments.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, Germany
Changes to this privacy policy
We will amend this privacy policy if the processing we carry out or the applicable legal framework changes. The version available on this page applies in each case. Last updated: 14 September 2026.