Website Privacy Notice

This notice explains how Access to Energy gGmbH (A2EI) processes personal data when you visit a2ei.org.

It covers this website only. The PROSPECT platform (prospect.energy, app.prospect.energy) is a separate service with its own processing activities — see the PROSPECT Data Protection Policy.

1. CONTROLLER AND CONTACT

The party responsible for the processing described here (the "controller") is:

Access to Energy gGmbH (A2EI)
Paul-Lincke-Ufer 8D
10999 Berlin, Germany
E-Mail: info@a2ei.org

Full legal details are in our Imprint.

For data protection inquiries, contact our Data Protection Officer at dpo@prospect.energy.

2. SUMMARY

This is a static informational website. To be explicit about what it does not do:

First-party analytics only. We measure site usage with cookieless analytics software (self-hosted Umami) hosted on A2EI's own EU infrastructure. No external analytics vendor is involved. See Section 4.6.
No tracking or advertising. No advertising pixels, no remarketing tags, no cross-site tracking, no profiling, no automated decision-making.
Videos load only when you press play. Videos from YouTube or Vimeo are shown as a placeholder. Nothing is sent to either provider until you press play. See Section 4.7.
Embedded pages load only when you ask. Some pages show a dashboard or page from PROSPECT or ADP as a placeholder. Nothing is loaded from those sites until you press "Load". See Section 4.8.
No third-party spam protection. The contact form is protected by a check that runs entirely on our own servers. No captcha provider is contacted.
No third-party fonts. Fonts are served from our own domain, not from Google Fonts.
No consent banner. The only things on this site that need your consent are playing an embedded video and loading an embedded page, and pressing play or "Load" is how you give it. See Sections 3, 4.7 and 4.8.

3. COOKIES AND LOCAL STORAGE

This site sets one cookie:

Cookie	Set when	Contains	Lifetime	Purpose
`NEXT_LOCALE`	Your first visit, and again whenever you choose a language	Your chosen language code (`en`, `fr`, `de`, `sw`, `pt`)	Until you close your browser	Keeps the site in the language you picked as you navigate

It holds no identifier, is never read by a third party, and is not used to recognise you.

It is set on your first visit, so that the site can serve and keep serving you a consistent language version, and updated if you later pick a different language yourself. Because it does nothing but carry that language preference, it is strictly necessary within the meaning of § 25(2) no. 2 TDDDG and does not require your consent. You can delete it through your browser at any time; the site will simply stop remembering your language choice.

This site uses no localStorage, no sessionStorage, no IndexedDB and no browser fingerprinting.

If you press play on an embedded video, the video provider may store its own cookies or similar data on your device. That is covered by your consent, see Section 4.7.

Language detection. If you have not chosen a language, our server reads the Accept-Language header your browser sends with every request to pick a sensible default. This header is not stored and nothing is written to your device.

4. PROCESSING ACTIVITIES

4.1 Server logs

Our hosting provider records technical data for every request: IP address, date and time, requested page, HTTP status, referrer, and browser and operating system identifiers.

Purpose: operating the site, diagnosing faults, and detecting attacks.
Lawful basis: Art. 6(1)(f) GDPR. Our legitimate interest is providing a functioning, secure website. This processing is technically unavoidable when serving a web page.
Retention: as set out in our hosting provider's log retention policy; we do not export these logs into any separate system, and they are not combined with any other data.

4.2 Contact form

If you use the contact form, we process the name, email address, organisation (optional) and message you enter.

Purpose: receiving and answering your enquiry.
Lawful basis: Art. 6(1)(f) GDPR — our legitimate interest, and yours, in responding to an enquiry you sent us. Where your enquiry concerns entering into a contract with us, Art. 6(1)(b) GDPR also applies.
Recipients: the submission is delivered to A2EI as an email through our email service provider. It is not stored in any database on this website.
Retention: 12 months after your enquiry is resolved, unless a longer period is required by law or the exchange has become part of an ongoing working relationship.
Mandatory? Entirely voluntary. You can email us at info@a2ei.org instead.

4.3 Spam protection

The contact form is protected against automated abuse without using any third-party service. When you start filling the form in, our server sends your browser a small computational puzzle, which your browser solves in the background and returns with your message. Solving it is quick for one message and expensive for a machine sending thousands.

Purpose: preventing spam and automated abuse of the form.
Lawful basis: Art. 6(1)(f) GDPR — our legitimate interest in not having our contact channel abused.
Data processed: none about you. The puzzle and its answer contain no personal data, and nothing is stored on your device.
Recipients: none. No captcha provider, no external service, no transfer outside the EU.

We also use a hidden form field that only automated submissions fill in, and we limit how often the form can be submitted from the same network address. The address is held in memory for that check alone and is never logged or stored.

4.4 Images and downloads

The images, PDFs and datasets on this site are stored with Hetzner Object Storage in Helsinki, Finland. The interactive notebook is stored in our hosting provider's file storage. All of them are delivered through this site's own domain: your browser only ever contacts our hosting provider, which serves the file from its own copy or fetches it from the storage service for you. In that case the storage service receives the request from our hosting provider, and it may receive your IP address with it.

Purpose: delivering an image or file you requested.
Lawful basis: Art. 6(1)(f) GDPR — delivering content you requested.
Transfers outside the EU: none for Hetzner Object Storage.

4.5 People named on this site

Pages describing our team, advisory board and partners contain names, roles and, in some cases, photographs. Some articles name a contact person, with their work email address and, in some cases, work phone number.

Data: name, role, photograph, and for contact persons a work email address and phone number.
Purpose: transparency about who we are and who we work with.
Lawful basis: Art. 6(1)(f) GDPR — our legitimate interest in presenting our organisation publicly.
If you are featured and want your entry changed or removed, write to dpo@prospect.energy and we will act on it.

4.6 Website analytics (first-party)

We run Umami, an open-source web-analytics tool, self-hosted on A2EI's own EU infrastructure (umami.a2.lu). It sets no cookies on your device and runs no scripts from third-party domains; pageview data is sent directly from your browser to our own server and stored in our own database.

Data: hashed IP address, page visited, referrer, browser and device identifiers, screen size, country.
Purpose: understanding which pages are used, in order to improve the website.
Lawful basis: Art. 6(1)(f) GDPR — our legitimate interest in maintaining accurate usage statistics and improving the website. No profiling, no automated decision-making, no marketing use, no sharing.
Retention: 12 months, after which the data is deleted automatically.
Recipients: none. The tool runs on our own infrastructure; no external processor is involved.

Because the tool sets no cookies and runs entirely on our own server, no consent is required.

4.7 Embedded videos

Some pages contain videos hosted on YouTube or Vimeo. Each is shown as a placeholder with a play button: nothing is loaded from YouTube or Vimeo until you press play. When you do, your browser loads the provider's video player directly from the provider's servers. The provider then receives your IP address, the page you are on, and browser and device information, and may store cookies or similar data on your device and use the data for its own purposes.

Providers: YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube's privacy-enhanced mode (youtube-nocookie.com). Vimeo, operated by Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. We load Vimeo's player with its "do not track" setting.
Purpose: showing you a video you chose to play.
Lawful basis: your consent, given by pressing play — Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything the player stores on your device.
Withdrawal: your choice is not remembered. Every video asks again each time a page loads, so you withdraw consent for the future simply by not pressing play (Art. 7(3) GDPR). Cookies a provider has already set can be deleted through your browser.
Recipients: the providers act as independent controllers, not as our processors. Their own privacy policies apply: Google and Vimeo.
Transfers outside the EU: both providers may process data in the USA. Such transfers rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.8 Embedded pages

Some pages show a dashboard or page of the PROSPECT platform (prospect.energy and its subdomains) or of ADP (adp.energy and its subdomains) in a frame. Both are run by A2EI's PROSPECT team. Each is shown as a placeholder with a "Load" button: nothing is loaded from those sites until you press it. When you do, your browser loads the page directly from that site, which then receives your IP address, the address of the page you are on, and browser and device information. The embedded page may set a session cookie on your device and measures its own use with the same self-hosted analytics tool as this site (Section 4.6).

Controller: A2EI, as for this website. The PROSPECT Data Protection Policy describes the platform's processing in full, including its hosting.
Purpose: showing you data or content you chose to load.
Lawful basis: your consent, given by pressing "Load" — Art. 6(1)(a) GDPR, and § 25(1) TDDDG for anything the embedded page stores on your device.
Withdrawal: your choice is not remembered. Every embedded page asks again each time a page loads, so you withdraw consent for the future simply by not pressing "Load" (Art. 7(3) GDPR). Cookies an embedded page has already set can be deleted through your browser.
Transfers outside the EU: none. The platform is hosted in Helsinki, Finland.

5. PROCESSORS

We use the following service providers, each bound by a data processing agreement under Art. 28 GDPR:

Processor	Role	Processing location
Vercel Inc.	Website hosting, serverless functions, server logs, file storage for the interactive notebook	Frankfurt (function execution); company established in the USA
Hetzner Online GmbH	Storage of the site's images and downloadable files, including files uploaded through our editorial interface	Helsinki, Finland (EU)
GitLab Inc.	Repository holding this site's content, and authentication for our editorial interface	USA
Our email service provider	Delivery of contact form submissions to A2EI	EU

Umami is not a processor — it is not a third party: the tool runs on A2EI's own EU infrastructure under A2EI's own control (see Section 4.6).

YouTube and Vimeo are not processors either. If you play an embedded video, they process your data as independent controllers (see Section 4.7).

Where a processor is established outside the EEA, transfers are safeguarded by Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where applicable, the EU-U.S. Data Privacy Framework.

6. YOUR RIGHTS

You have the right to:

Right	GDPR Article
Access your personal data	Art. 15
Have inaccurate data corrected	Art. 16
Have your data erased	Art. 17
Restrict processing	Art. 18
Data portability	Art. 20
Object to processing based on legitimate interest	Art. 21
Lodge a complaint with a supervisory authority	Art. 77

Apart from the language cookie, embedded videos and embedded pages, every processing activity on this website relies on legitimate interest, so your right to object under Art. 21 GDPR is the relevant one. Object at dpo@prospect.energy and we will stop unless we can show compelling legitimate grounds that override your interests.

Playing an embedded video and loading an embedded page rely on your consent instead. You can withdraw it at any time with effect for the future (Art. 7(3) GDPR), as described in Sections 4.7 and 4.8.

We respond within one month of receiving a request.

7. SUPERVISORY AUTHORITY

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 93-95
10559 Berlin, Germany
Phone: +49 30 138 89-0
Website: https://www.datenschutz-berlin.de

8. CHANGES

We will update this notice when the site changes. The version number and dates above always reflect the current text.

9. LANGUAGE

This notice is published in English, German and French. In the event of any discrepancy between versions, the English version governs, except where German law requires the German version to prevail.