Privacy policy

In short

This website collects very little, and most of what it does collect it cannot avoid.

• We use no analytics, no tracking pixels, no tag manager and no advertising cookies. We do not count you, follow you between pages, or build a profile of you.
• Nothing in this website writes a cookie. Two technical cookies can still appear, one from the service that delivers our pictures and one from our donation form. Both are explained in our cookie and storage notice.
• Our fonts are served from our own server, not from Google.
• We have no newsletter and no mailing list.
• Our social media links are ordinary links, not widgets. Nothing is sent anywhere until you click one.
• Nothing is requested from another company until you ask for it, with one exception we cannot avoid: the pictures on our pages come from our content delivery network. The podcast player and the donation form are both loaded only when you press a button.

The rest of this page explains each of those, and what happens if you write to us, listen to the podcast, or make a donation.

1. Who is responsible

To confirmthe full registered name
Belfortstraße 15, 69115 Heidelberg, Germany
Email: contact@just-access.de
Telephone: To confirma telephone number

Full details are in our site notice.

Data protection officer:To confirmthe name and contact details of the data protection officer, or remove this line. If one is appointed, Art. 13(1)(b) GDPR makes these details mandatory. See Q6.

2. When you visit this site

Our web server keeps a log of each request. This is how a web server works, and we cannot serve you a page without it.

What is recorded: your IP address, the date and time, the page you asked for, including anything you typed into our search box because it forms part of the address, whether the request succeeded, how much data was sent, the page you came from if there was one, and your browser's identification string.

What is not recorded: requests for images, and for this site's own script and style files, are not logged at all.

Why we keep it: to run the site securely, to recognise and investigate attacks, and to find faults. Our legitimate interest in operating a secure and functioning website, Art. 6(1)(f) GDPR.

How long:To confirma retention period, which then has to be configured on the server, because nothing enforces one today. Seven days is the usual defensible figure for security purposes. See Q12.

We do not merge these logs with anything else, and we do not try to identify you from them.

3. Pictures on our pages

The images on this site are stored by DigitalOcean, in a data centre in Frankfurt, Germany To confirmthe regions of the server and the database as well, which are not recorded anywhere. See Q10. and delivered from there by Cloudflare. When a page with a picture on it loads, your browser fetches that picture from them, so your IP address reaches them as part of the request and Cloudflare sets a __cf_bm cookie, which it uses to tell automated traffic apart from people. It lasts thirty minutes and is not used to recognise you afterwards. Our own pages set no cookie at all.

Both companies act for us under data processing agreements and may not use what they see for their own purposes. Our legitimate interest in delivering a site that loads quickly and is not overwhelmed by bots, Art. 6(1)(f) GDPR. Both have parent companies in the United States. To confirmthe contracting entities and the safeguards relied on under Art. 46 GDPR, for DigitalOcean and for Cloudflare. See Q8.

4. The podcast

Nothing reaches our podcast host until you press play. The list of episodes on this site is fetched by our own server, not by your browser, so browsing the podcast pages sends nothing about you to anybody.

When you press play, a player is loaded from Acast and the audio is streamed from their network. At that moment Acast receives your IP address, your browser's identification and information about what you play, and they may store information on your device. What happens inside that player is governed by Acast's own privacy policy rather than this one: To confirma link to Acast's privacy policy

Pressing play is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. If you never press play, nothing is loaded and nothing is sent. You can withdraw your consent at any time by not using the player and clearing your browser's storage for this site.

Where you got to in an episode is remembered in your own browser, so that a long episode survives a reload. It is stored only once you have listened for more than thirty seconds, it holds nothing but an episode number and a number of seconds, and it never leaves your device. See our cookie and storage notice.

5. Donations

Our donation form is provided by FundraisingBox, operated by To confirmthe operating company and its address, understood to be Wikando GmbH. Nothing reaches them until you ask for the form. Our donation page shows the case for giving and a button; only when you press it is the form loaded from FundraisingBox. If PayPal is selected as the payment method, PayPal is contacted too.

Once the form is loaded, FundraisingBox sets one cookie, AWSALBCORS. It exists to keep you connected to the same server while you fill the form in, so that the form works. It does not track you and it is not used for advertising. If you never press the button, nothing is contacted and no cookie is set.

What you enter in that form is collected by FundraisingBox and by the payment provider you choose, not by this website. We receive the details we need to record your donation and to issue a receipt. To confirmexactly which fields reach the organisation, and how. See Q11.

Why: to carry out the donation you have asked to make, Art. 6(1)(b) GDPR, and to meet our obligations under tax and accounting law, Art. 6(1)(c) GDPR.

How long: donation records are kept for as long as tax and accounting law requires, which in Germany is generally ten years under § 147 AO. To confirmconfirmation from the tax adviser, and whether donation receipts carry their own period. See Q15.

PayPal processes data outside the European Economic Area, under its own privacy policy.

6. Writing to us

There is no contact form on this site, by choice. You reach us by ordinary email, at contact@just-access.de, or by post.

Email is not encrypted on its way to us. Anyone who can see the network between your computer and our mail provider can in principle read it, and a copy stays in your own sent folder. If that matters for your safety, please say so in your first message, before you tell us anything else.

Our mailboxes are hosted by To confirmthe mail provider and where its servers are. This is not recorded anywhere in the codebase and has to come from whoever holds the contract. See Q9. who act for us under a data processing agreement.

Why: to answer you, and to deal with the matter you have written about. Art. 6(1)(f) GDPR, our legitimate interest in responding to people who contact us, or Art. 6(1)(b) where your message concerns an agreement between us.

How long:To confirmhow long a message is kept. See Q16.

If you write to us about something that happened to you

We say on our contact page that you can write to us in confidence, including if you have survived a human rights violation. A message like that may contain information the law treats as especially sensitive: your health, your political or religious views, your sexual orientation, or a criminal matter you have been involved in.

To confirmthis section needs counsel's own wording and it is the most important part of this document. It should state the Art. 9(2) basis relied on and how consent can be withdrawn, who inside the organisation can read the inbox, whether anything is ever passed to a partner organisation, to counsel or to a court, how long a message of this kind is kept and what happens when a matter closes, and what somebody can do if they want their message deleted. See Q1.

7. Storage on your device

Nothing in this website writes a cookie. Two technical cookies are set by companies that work for us, described above, and the only thing this site itself stores is your position in a podcast episode, after you have played one. All of it is listed in our cookie and storage notice.

8. Social media

Our footer and our share links point at X, Facebook, LinkedIn and Instagram. They are plain links. There is no embedded button, no widget and no code from any of those companies anywhere on this site, so nothing about you is sent to them unless you click a link, at which point their own privacy policies apply.

9. Search

The search box on this site queries our own server. Nothing is sent to a search company. What you searched for appears in our server log, described in section 2, and is kept for the same period.

10. What we do not do

We do not profile you, we do not make automated decisions about you within the meaning of Art. 22 GDPR, and we do not sell or rent personal data to anybody.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a portable form (Art. 20);
• object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21);
• withdraw consent at any time where we rely on it, without affecting what was lawful before you withdrew it (Art. 7(3)).

To exercise any of these, write to contact@just-access.de. We will not ask you for more than we need to find your data and be satisfied that it is yours.

You also have the right to complain to a supervisory authority (Art. 77). The one responsible for us is To confirmthe supervisory authority and its current address, expected to be the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg. See Q7. You may also complain to the authority where you live or work.

12. Is any of this required of you

No. You are not obliged to give us any personal data in order to read this site. If you write to us, you decide what to put in the message. If you donate, the donation provider needs the details required to take a payment and to issue a receipt, and without them the donation cannot be completed.

13. Changes to this policy

We will update this page when what the site does changes. The date at the foot of the page says when it last changed.