Last updated: 3 November 2026
This notice explains how personal data is processed when you visit this information website or contact us through the contact details shown here. Personal data means information relating to an identified or identifiable person.
Controller and privacy contact
HAFRIVA – Network for Health and Occupational Safety
Cäcilienstraße 10
22301 Hamburg
Email: info@hafriva.com
Overview of processing
- Types of data
- Technical connection and access data; the language preference stored in your browser; contact and business details and the contents of enquiries you send us. The following sections explain the respective purposes and legal bases.
- People concerned
- Visitors to this website, people making enquiries and contacts at companies or other organisations who communicate with us.
- Purposes
- Providing and securing the website, displaying the language you select, answering enquiries and preparing or carrying out the business relationship concerned.
- Sources of data
- Connection data is transmitted by your browser when it requests pages. Other information is provided by you when contacting us. The language preference is generated by your active selection.
Website delivery and hosting
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Connection and access data are processed to deliver pages and protect the service. This can include the IP address, time of access, requested file, browser and operating system information, response status and a referring page where transmitted.
Our purpose is to provide a reliable, secure information website. The legal basis for our processing is Article 6(1)(f) GDPR, reflecting our legitimate interest in secure website delivery. The scope and duration of logging depend on the hosting service and the actual technical and contractual settings. We cannot currently specify a verified fixed deletion period. Information from the hosting provider is linked below.
Processing outside the EU/EEA
We use STRATO as the hosting provider for technical website delivery. Whether further providers are involved and whether processing outside the EU/EEA occurs depends on the services and agreements actually used. Any such transfer must meet the requirements of Articles 44 et seq. GDPR. Review of the specific contractual and provider arrangements is not yet complete; we therefore do not claim either a general exclusion of third-country processing or particular safeguards already agreed.
Language preference, cookies and tracking
Our website does not use analytics tools, advertising pixels, profiling, newsletters or embedded social-media, map or video services. Our website code does not set cookies.
If you actively select EN or DE, we store only that language code under “afrisav-language” in your browser’s localStorage. The value is not a user identifier and is not sent to us by the language-selection function. It is read on subsequent visits to display your chosen language. It has no automatic expiry and remains until replaced, removed by you or cleared by your browser. You can remove it through your browser’s site-data settings; language switching also works when storage is blocked.
This storage serves the language function you have requested. We rely on Section 25(2)(2) TDDDG for storage/access necessary for that function. Insofar as personal data is processed, Article 6(1)(f) GDPR applies, based on our interest in providing the requested language setting.
Locally hosted fonts
The Inter and Playfair Display fonts are delivered from the same hosting as this website. Loading these fonts does not require your browser to connect to Google Fonts servers. The technical connection data involved is covered by the hosting section above.
Contact by email or telephone
If you contact us, we process the information you provide, such as your name, organisation, contact details, message, communication time and the information needed to respond. The purpose is to answer your enquiry and, where applicable, prepare or carry out a business relationship. No enquiry or patient data is collected through a website submission form; email and telephone links open your chosen communication application.
The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract with you or steps requested by you before entering into a contract. For other enquiries, including communications with contacts at corporate clients, we rely on Article 6(1)(f) GDPR and our legitimate interest in responding and maintaining business communications. Statutory retention duties may require processing under Article 6(1)(c) GDPR.
Please do not send diagnoses, medical reports, psychological case details or other particularly sensitive information by ordinary email. Contact us first to arrange a suitable communication channel. This website notice does not replace the separate information and legal bases required for medical, psychological or other individual services.
Recipients and external links
Website requests are received by the hosting provider and the technical infrastructure it uses. Email and telephone communications involve the relevant email and telecommunications providers. Within our organisation, enquiries should be accessed only by those who need them for the matter concerned. Disclosure to other recipients requires an appropriate legal basis.
Links to Hafenpraxis, WOLDEAB Consulting, smadvo, usuk.de and other external information are ordinary links, not embedded services. The destination provider receives connection data when you follow a link. Our website uses a no-referrer policy, so the browser is instructed not to transmit our page address as a referrer. The destination website’s privacy notice applies there.
Retention and provision of data
Enquiry data is retained for as long as needed to handle the matter and any necessary follow-up. We then delete it unless statutory retention obligations or the establishment, exercise or defence of legal claims require further retention. Applicable duties depend on the document and business transaction; we do not apply one blanket period to all communications. If data must be retained after its original purpose has ended, further use must be limited to the purposes justifying that retention. Retention of hosting data and the language preference is described in their respective sections.
Sending us an enquiry is voluntary. Without sufficient contact details or the information necessary for your request, we may be unable to respond. Technical connection data is needed to deliver the website. We do not carry out automated individual decision-making or profiling through this website.
Your rights
You have the following rights, subject to the conditions and exceptions provided by law:
Access (Article 15 GDPR): confirmation of whether we process personal data about you, information about the processing and a copy of your personal data.
Rectification (Article 16): correction of inaccurate data and completion of incomplete data.
Erasure (Article 17): deletion where the legal conditions are met, for example because data is no longer needed. Statutory retention duties or the need to establish, exercise or defend legal claims can prevent immediate deletion.
Restriction (Article 18): restriction of processing in the cases provided by law, for example while the accuracy of disputed data is being verified.
Data portability (Article 20): receipt of data you have provided in a structured, commonly used, machine-readable format and, where technically feasible, transmission to another controller, insofar as processing is automated and based on consent or a contract.
Withdrawal of consent (Article 7(3)): where processing is based on consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of earlier processing.
Exercising your rights
You can exercise your rights by emailing info@hafriva.com or writing to HAFRIVA – Network for Health and Occupational Safety at the address above. No particular form is required. If we have reasonable doubts about your identity, we may request only the additional information necessary to confirm it.
Under Article 12 GDPR, information on action taken must be provided without undue delay and generally within one month of receipt. Where a legally permitted extension is necessary, you must be informed within the first month of the extension and its reasons. Information and the first copy are generally free of charge; statutory exceptions apply, in particular to manifestly unfounded or excessive requests.
Right to object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation under Article 21 GDPR. We will then stop the processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Complaints to a supervisory authority
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. For Hamburg, the authority is the Hamburg Commissioner for Data Protection and Freedom of Information. Its complaint service is linked below.
Security
The public website is delivered over HTTPS to protect data in transit. Email and telephone communication are separate from website delivery; a mailto link does not guarantee end-to-end encryption of your message. No method of transmission or storage can guarantee absolute security.
Scope and updates
This notice covers the current information website and initial enquiries. Changes to hosting, communication services, tracking, booking functions or other processing may require an update and additional information before use. Where a change requires consent or an individual notice, that consent must be obtained or that notice provided before the processing concerned.
STRATO privacy information
Hamburg supervisory authority: submit a complaint
