PIK and the partner institutions behind co2removal.org take the protection of personal data seriously. This policy explains what happens to data when you use this website, on what legal basis, and what rights you have. It describes our actual technical setup rather than a generic template.
You may contact us using the details given in Clauses 1 and 2 below.
1. Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection provisions of the Member States is:
Potsdam-Institut für Klimafolgenforschung (PIK) e. V.
Telegrafenberg A 31
P.O.B. 60 12 03
14473 Potsdam, Germany
Telephone: +49 (0)331 288-2500
Email: datenschutzanfrage@pik-potsdam.de
Web: https://www.pik-potsdam.de
co2removal.org is operated by PIK as part of its research communication. Where this policy says “we”, it means PIK as controller.
2. Data Protection Officer
Dr.-Ing. Thomas Nocke
Potsdam-Institut für Klimafolgenforschung (PIK) e. V.
Telegrafenberg A 56
14473 Potsdam, Germany
Telephone: +49 (0)331 288-2626
Email: datenschutz@pik-potsdam.de
You may contact our Data Protection Officer directly with any question about how your personal data is processed, or to exercise your rights under the GDPR.
3. General information on data processing
We process personal data only where a legal basis permits it, and only as far as is needed to provide a working website and the content you have asked for. Personal data is erased once the purpose for storing it no longer applies, unless a statutory retention obligation requires otherwise.
We do not sell personal data, and we disclose it to no one except the processors named in this policy, each of which acts on our documented instructions under Art. 28 GDPR.
4. Provision of the website and server log files
4.1 Scope of the processing
Each time the website is accessed, our hosting provider’s systems automatically record technical data sent by your browser:
- the address (URL) requested
- the IP address of the requesting device
- the date and time of the request
- the browser type and version, and the operating system used
- the referring address (URL), where your browser transmits one
- the access status (file transferred, file not found, and similar)
- the volume of data transferred
This data is held in server log files. It is not combined with other personal data, and it is not used to build profiles of individual visitors.
4.2 Legal basis and purpose
Processing rests on Art. 6(1)(f) GDPR, namely our legitimate interest in delivering the website reliably, keeping it technically stable, and detecting and investigating attacks or misuse. Temporarily storing the IP address is technically necessary in order to deliver the page you requested to your device.
4.3 Retention
Access log data is held by our hosting provider with IP addresses partially anonymised. It is reviewed and deleted once it is no longer required for the purposes described above.
Where the sending of email is involved — for example when you use the contact form — separate mail logs are kept. Mail logs from the web environment are anonymised after one day, by removing sender and recipient details, and deleted after 60 days. Logs held by the mail servers used for delivery are deleted after 28 days.
4.4 Objection and removal
Recording log data is strictly necessary for operating the website, so there is no way to object to this particular processing while using the site.
5. Cookies
This website sets no cookies when you simply browse it. Reading the public pages stores nothing on your device and reads nothing from it. There is therefore no cookie banner, because there is nothing to consent to.
Cookies occur in only two situations:
- If you choose to play an embedded video. Enabling an embed may store a cookie named
embed-privacyso that your choice is remembered and you are not asked again. It is created only by your own action — see Clause 8. - If you log in to the editorial area. Registered users receive strictly necessary session and authentication cookies, without which login cannot work. They are never used for analysis or advertising.
Both cases are covered by Art. 6(1)(f) GDPR together with § 25(2) TDDDG, as each is strictly necessary to provide a function you have expressly requested.
6. Web analytics with Plausible
6.1 Scope of the processing
We use Plausible Analytics to understand, in aggregate, which content is read. Plausible is a privacy-focused analytics service operated by Plausible Insights OÜ, Estonia, with data held on servers inside the European Union.
Our installation differs from a standard analytics deployment in two ways that materially reduce its effect on you:
- No cookies and no identifiers. Plausible sets no cookies, stores nothing on your device, and assigns you no persistent identifier. Visitors are not recognised across sessions or across websites.
- First-party proxying. Measurement requests are routed through co2removal.org itself. Your browser never opens a connection to Plausible’s servers, and your IP address is never disclosed to Plausible.
What is recorded is limited to aggregate figures: the page URL, the referring source, an approximate country derived from the IP address, and a general device and browser category. In addition, “page not found” errors and clicks on outbound links are counted so that broken links can be repaired. The IP address is used only momentarily to derive these values and is not retained.
6.2 Legal basis and purpose
Processing rests on Art. 6(1)(f) GDPR. Our legitimate interest lies in understanding which research content reaches its audience, so that the site can be improved. Because no information is stored on or read from your terminal equipment, § 25 TDDDG does not require consent for this processing.
6.3 Retention
Only aggregated statistics are kept. They contain no personal data and so are not subject to erasure on an individual basis.
6.4 Objection
You may object to this processing at any time under Art. 21 GDPR using the contact details in Clauses 1 and 2. Because the measurement is anonymous and cookieless, ordinary browser tracking protection will also prevent it.
7. Contact form and contact by email
7.1 Scope of the processing
The website provides a contact form. If you use it, we process what you enter: your name, your email address and, where you supply one, your message. If you write to us by email instead, we process the address you write from together with the content of your message.
Submissions are delivered by email to the responsible member of staff at PIK. They are not stored as entries in the website database, and they are not passed to any third party.
7.2 Legal basis and purpose
Processing rests on Art. 6(1)(f) GDPR, namely our legitimate interest in answering enquiries about our research. Where your enquiry concerns entering into or performing a contract, Art. 6(1)(b) GDPR applies as well. The data is used solely to deal with your enquiry.
7.3 Retention
We erase your message once your enquiry has been dealt with conclusively and no statutory retention obligation applies.
7.4 Requirement to provide data
Your name and email address are needed for us to reply, and the form cannot be submitted without them. You are under no obligation to use the form — you may write to the postal address in Clause 1 instead.
8. Embedded videos (YouTube)
8.1 Scope of the processing
Two articles on this site present video recordings hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
These videos do not load automatically. A placeholder served from our own server is shown in their place, and no connection to Google is made while you read the page. Only when you click to play is the video requested from YouTube. At that point your IP address, together with information about the page you are viewing, is transmitted to Google, and the transfer may involve servers in the United States. Google may process that data for its own purposes; we have no influence over this and no access to the resulting data.
If you ask for your choice to be remembered, a cookie named embed-privacy is stored so that you are not prompted again. Clearing it restores the placeholder.
8.2 Legal basis and purpose
The transfer happens only on the basis of the consent you give by clicking to play, under Art. 6(1)(a) GDPR, and Art. 49(1)(a) GDPR covers the transfer to a third country. You may withdraw your consent at any time with effect for the future by clearing the cookie and not playing further videos.
Further information is available in Google’s privacy policy at policies.google.com/privacy.
9. Hosting
This website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany, on servers located in Germany. The provider processes the data described in Clause 4 exclusively on our behalf as a processor, under a data processing agreement pursuant to Art. 28 GDPR.
10. Data security
This website uses TLS encryption for every connection, recognisable by the https:// prefix and the lock symbol in your browser. Data you send through the contact form cannot be read by third parties in transit.
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. These measures are reviewed and adapted as technology develops.
11. Your rights
Where your personal data is processed, you have the following rights, which you may exercise using the contact details in Clauses 1 and 2:
11.1 Right of access — Art. 15 GDPR
You may ask whether we process personal data concerning you and, if so, obtain a copy of it together with information on the purposes, categories, recipients, envisaged storage period and origin of the data.
11.2 Right to rectification — Art. 16 GDPR
You may require us to correct inaccurate data concerning you without undue delay, and to complete data that is incomplete.
11.3 Right to erasure — Art. 17 GDPR
You may require us to erase data concerning you without undue delay, provided none of the exceptions in Art. 17(3) GDPR applies.
11.4 Right to restriction of processing — Art. 18 GDPR
You may require us to restrict processing, for example while the accuracy of contested data is being checked.
11.5 Right to data portability — Art. 20 GDPR
You may receive data you have provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller.
11.6 Right to object — Art. 21 GDPR
You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then stop that processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms.
11.7 Right to lodge a complaint
Without prejudice to any other remedy, you may lodge a complaint with a supervisory authority. The authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany
12. Changes to this privacy policy
We review this policy whenever the technical setup of the website changes, and update it so that it continues to describe our actual processing. The version in force is always the one published on this page.
Version of 28 August 2026.