Data Protection Policy
This is a non-binding English translation provided for convenience. In case of any discrepancy, the German original (switch language above) is legally binding.
This privacy policy informs you which data we collect when you visit this website, how we use it, and for what purpose.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions is:
Attacking-Lab UG (haftungsbeschränkt)
Mühlenstraße 8a
14167 Berlin, Germany
[email protected]
Data collected when visiting the website
Each time this website is accessed, our system automatically collects data from the accessing computer. The following data may be collected:
IP address
Browser type and version
Operating system used
Referrer URL (the previously visited page)
This data is stored in our system's log files. It is not stored together with any other personal data of the user. Temporary storage of the IP address is technically necessary to deliver the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
For forensic purposes and to ensure the security of our IT systems, we retain IP addresses for up to 48 hours. Beyond that, no further storage or analysis of these IP addresses takes place as part of operating the website. The legal basis for the temporary storage of this data and of the log files is Art. 6(1)(f) GDPR (legitimate interest in providing the website and ensuring system security).
Contact and engagement requests
If you request an engagement at /engage or contact us via a mailto link on this website, the
data you enter is not transmitted to our servers. Instead, your browser opens a pre-filled email window in
your own email program; transmission to [email protected] only happens
once you send that email yourself. Your progress on this request is stored exclusively locally in your
browser's localStorage so you can resume it on a later visit. This data never leaves your device
and can be deleted at any time via the "Reset" button on the /engage page or through your
browser's settings.
Cookies, tracking and third parties
This website does not use cookies and does not embed any third-party services (e.g. external fonts, maps, or advertising networks). Fonts are served locally.
For traffic analysis, we use Umami, a self-hosted, open-source analytics tool. The Umami
server runs exclusively on our own infrastructure (ue.atklab.io); no data is transmitted to
third parties. Umami operates without cookies and without persistent identifiers, does not build
cross-device profiles, and does not store the full IP address — when a page is loaded, only a coarse,
non-traceable location (country/region) is derived from the IP address, and the IP address itself is then
discarded and not stored. We collect aggregated, anonymous usage data such as pages visited, referrers,
device type/screen resolution, and time on page; none of this allows conclusions about individual persons.
Browsers that send "Do Not Track" are automatically excluded from data collection by Umami.
Since the analysis covers exclusively anonymized data that cannot be attributed to a person, no consent under Art. 6(1)(a) GDPR is required. The legal basis for its use is our legitimate interest (Art. 6(1)(f) GDPR) in the demand-oriented design and statistical evaluation of our website.
Rights of data subjects
As a data subject, you have the following rights regarding personal data concerning you:
Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed. Where that is the case, you have the right to access that personal data and further information about it.
Right to rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure (Art. 17 GDPR): You have the right to request that personal data concerning you be erased without undue delay, provided one of the grounds listed in Art. 17(1) GDPR applies.
Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing where one of the conditions listed in Art. 18(1) GDPR is met.
Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR.
Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw, at any time and with effect for the future, any consent you have given for the processing of personal data.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.