Privacy Policy

Last updated: November 2026

This is a translation of the German privacy policy (Datenschutzerklärung). If the two versions differ, the German version applies.

1. Controller

The controller responsible for processing personal data on this website is:

Marco Harz – Harz Autosport Media
Am Sportplatz 5
21614 Buxtehude
Germany
Email: info@harz-autosportmedia.com
Phone: +49 176 72958376

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Summary

  • This website sets no cookies, stores nothing on your device and uses no tracking or analytics scripts.
  • All content, including the fonts, comes from our own server. No content is loaded from third parties such as Google Fonts, YouTube or social media plugins.
  • For every request, our server writes an access log with a shortened IP address. It is deleted after 7 days at the latest.
  • From this log we create anonymous visitor statistics on our own server.
  • If you write to us via the contact form or by email, we process your details to answer your enquiry.
  • Our client galleries at galleries.harz-autosportmedia.com work a little differently: they use a login cookie and keep a security log with IP addresses, which are made unrecognisable after 7 days (section 7).

3. Hosting

This website runs on a virtual server that we operate with Oracle Cloud Infrastructure in the Frankfurt am Main data centre (Germany). Our contractual partner is ORACLE Deutschland B.V. & Co. KG, Riesstraße 25, 80992 Munich, Germany. Oracle only provides the server. We run the web server, the access log, the visitor statistics and the client galleries ourselves on this server.

Oracle processes the data stored on the server as a processor under Art. 28 GDPR, on the basis of the Oracle Data Processing Agreement. The data is stored in Frankfurt. Where Oracle companies outside the EU, for example in the USA, may have access as part of maintenance or support, this is safeguarded by appropriate safeguards under Art. 46 GDPR (EU Standard Contractual Clauses or Oracle's Binding Corporate Rules).

The legal basis is our legitimate interest in providing this website securely and reliably (Art. 6(1)(f) GDPR).

Domain and DNS: The name resolution for our domain (DNS) is provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare only answers the question of which server address this website can be reached at. These lookups are usually made not by your device but by your internet provider's DNS server. The website itself is not delivered through Cloudflare: your browser connects directly to our server in Frankfurt. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies to the USA (Art. 45 GDPR). The legal basis is our legitimate interest in our domain being reliably reachable (Art. 6(1)(f) GDPR). More information: cloudflare.com/privacypolicy.

4. Visiting the website and access log

When you visit this website, your browser necessarily sends data to our server. To deliver the pages to you, the server briefly processes your full IP address. It writes the following to the access log:

  • your IP address in shortened form: for IPv4 addresses the last byte is removed, for IPv6 addresses everything after the first 48 bits. The shortened address can no longer be linked to an individual connection.
  • the date and time of the request
  • the requested address, the request method and the protocol
  • the status code of the response, the amount of data transferred and the response time
  • the previously visited page (referrer), if your browser sends it
  • your browser's identifier (user agent) and other technical details of the request, e.g. preferred language and supported file formats

Purpose: delivering the website, detecting and preventing attacks, troubleshooting, and the anonymous visitor statistics (section 5).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and reliably.

Storage period: the log starts a new file every day. Files are deleted automatically after a further 6 days, i.e. no later than 7 days after the request. The data is not combined with other data.

5. Visitor statistics

To learn which pages and work attract interest, we create visitor statistics from the access log. For this we use the open-source software GoatCounter, which we run ourselves on our server in Frankfurt. No data is passed on to third parties. No script runs in your browser for this, no cookies are set and your device is not accessed.

Only aggregated figures are stored, not individual visits:

  • number of views per page and time period
  • referring pages (referrers), e.g. a search engine or Instagram
  • browser and operating system with version, derived from the user agent
  • country, derived from the shortened IP address

So that several views by the same person are not counted as separate visitors, GoatCounter forms an identifier from the shortened IP address and browser identifier. It is kept only in memory and discarded after 8 hours. IP addresses and full browser identifiers are not stored in the statistics. Requests from known search engines and bots are recorded separately and not counted.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in understanding and improving our website and its reach. The aggregated statistics contain no personal data and are kept without a fixed time limit. You can object to this processing at any time (see section 11).

6. Contact form and email

If you write to us via the contact form, we process the details you enter: your email address and your message (required), and, if you wish, your first and last name. Our server forwards the message to our mailbox as an email and does not store it itself. An additional field that is invisible to people only serves to detect automated spam.

If you email us directly, we process your email address, the message and any other details you give us.

Our mailbox is provided by Google (Google Workspace). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the emails on our behalf. A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies (Art. 45 GDPR). More information: policies.google.com/privacy.

The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a commission or its preparation, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

We delete your message once your enquiry has been fully dealt with. If it leads to a commission, we keep the related correspondence for as long as commercial and tax law requires (usually 6 years, Art. 6(1)(c) GDPR).

7. Client galleries

We deliver photos to our clients in online galleries at galleries.harz-autosportmedia.com. A gallery can only be reached through its personal link, optionally with a password as well. For this we use the open-source software PicPeak, which we run ourselves on our server in Frankfurt (section 3). All content, including the fonts, comes from this server. The galleries use no analytics or tracking services, no third-party content and no face recognition. They are closed to search engines, and gallery visits are not included in the website's access log or visitor statistics (sections 4 and 5).

Data of our clients

For each gallery we store the client's name and email address, a phone number if they wish, the name and date of the event, and the photos themselves. The photos may show people, for example drivers, team members or spectators. Only people who have been given the link (and the password, if there is one) can see them.

The purpose is delivering the photos we were commissioned to take; the legal basis is Art. 6(1)(b) GDPR. Every gallery has an expiry date. After that it can no longer be reached and is archived. We delete the gallery and the details once we no longer need them for the job, for example for re-orders. Anything we must keep for commercial and tax law reasons is kept until those periods end (Art. 6(1)(c) GDPR).

Opening a gallery

When you open a gallery, our server processes your IP address, as with any website. The gallery software also logs:

  • opening the gallery, login attempts, and viewing and downloading individual photos, each with date and time
  • your full IP address and your browser's identifier (user agent)
  • for photo requests and security-related events, also a technical checksum made from the IP address, browser identifier, language setting and supported file formats

The purpose is protecting the galleries and our clients' photos, for example against guessed passwords or mass downloads. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in keeping the galleries secure.

Storage period: IP addresses, browser identifiers and checksums are automatically made unrecognisable after 7 days. What remains is an anonymous entry (for example, that a particular photo was viewed on a particular day), which is deleted together with the gallery.

Cookies and storage on your device

Unlike the rest of this website, the galleries store a few items on your device. They are strictly necessary for using the gallery as you requested (Section 25(2) No. 2 TDDDG), so no consent is required.

  • Cookie "gallery_token": your login to the gallery, valid for 24 hours
  • Cookie "i18next" and local storage: the language you chose
  • Browser session storage: login and gallery data, deleted when you close the tab
  • Local storage: the gallery background style you chose and a randomly generated guest ID for the favourites and rating feature
  • Only if a gallery offers favourites or ratings and you use them: cookie "picpeak_feedback" with a random ID, valid for 30 days, so your selections stay linked to you

You can delete this data at any time in your browser settings.

8. Instagram

This website links to our Instagram profile. This is a simple link: Instagram receives no data unless you click it. If you open the link or visit our profile on Instagram, Instagram's privacy policy applies. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. More information: privacycenter.instagram.com/policy.

9. Encryption

This website and our client galleries are only transmitted encrypted via HTTPS. You can tell by the padlock icon and "https://" in your browser's address bar.

10. No cookies, no automated decisions

This website sets no cookies and uses no similar techniques such as local storage, pixels or fingerprinting. Consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required. The client galleries are the exception; section 7 lists what they store on your device. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Your rights

You have the following rights regarding your personal data:

  • access to the stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

An informal message to the email address above is all it takes.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the data protection supervisory authority of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.