Berlin AI Safety Project
Privacy notice
Last updated: 17 October 2026. This notice explains how personal data is handled when you visit berlin-ai-safety.com, download the plan extract or contact the project.
1. Controller and contact
Michael Heckeroth
Chausseestr. 2a
14109 Berlin, Germany
For privacy enquiries or to exercise your rights, email mh@berlin-ai-safety.com. General enquiries: info@berlin-ai-safety.com. See also the Legal notice.
2. Visiting the website
The website presents the AI safety plan and provides its extract as a PDF. It is publicly accessible without a visitor account. There are no contact forms, newsletter subscriptions, comments or uploads. The PDF is served from this website and can be downloaded without providing a name or email address.
Delivering pages and downloads requires technical information such as your IP address and the requested resource. The hosting infrastructure may also process request times, response status, browser and device information, and a referring address where your browser sends one. These data support delivery, availability, troubleshooting and protection against misuse.
The legal basis for the project’s necessary delivery and security processing is Article 6(1)(f) GDPR. The legitimate interest is to provide a reliable and secure information website. Without the connection data, the requested page or file cannot be delivered.
3. Hosting and recipients
The site is hosted using OpenAI’s ChatGPT Sites service. Under the ChatGPT Sites Data Processing Addendum applicable to this operator, OpenAI Ireland Ltd processes hosted personal data on the operator’s behalf. OpenAI uses infrastructure and other service providers to provide the service; its subprocessor list describes these providers.
For transfers of hosted data outside the European Economic Area, that addendum provides for an adequacy decision or standard contractual clauses. This is not a commitment to exclusively EU-based storage. You may request information about the applicable safeguards using the contact above. OpenAI’s separate processing for its own platform purposes is described in its privacy policy.
4. Cookies, tracking and external content
The project’s own pages do not set cookies, use local browser storage, run analytics or advertising scripts, or load external fonts, videos or social-media widgets. There is no project-operated advertising or visitor profiling. The hosting infrastructure uses Cloudflare bot protection. On a visit it sets the __cf_bm security cookie, which Cloudflare says expires after 30 minutes of continuous inactivity. The infrastructure also adds a browser security check; depending on that check, a cf_clearance cookie may record successful verification for the period configured by the hosting service. These mechanisms distinguish legitimate visits from automated abuse; they are not project-operated advertising analytics. Blocking them may prevent the website from loading. See Cloudflare’s cookie documentation.
External references are ordinary links. Opening one takes you to the other provider, whose privacy notice applies there. Email links open your email application; clicking one does not itself submit a message to the project.
Necessary storage or access on the visitor’s device is based on Section 25(2)(2) of Germany’s TDDDG; associated personal-data processing for service security is based on Article 6(1)(f) GDPR. Cloudflare’s documentation states that cookie data may be processed in the United States by default. The hosting data-processing and international-transfer arrangements described above apply to the service chain.
5. Email correspondence
If you contact the project, your email address, any name you supply, your message and attachments, and delivery information are processed to respond and handle the ensuing discussion. Providing these details is voluntary, but a reply requires a usable contact address.
The legal basis is Article 6(1)(f) GDPR: the legitimate interest in responding to enquiries and discussing the project. Where the correspondence is necessary for a contract with you, or pre-contractual steps you request, Article 6(1)(b) GDPR applies instead.
Email is currently handled by WordPress.com Professional Email, powered by Titan. Its provider is Titan Solution Ltd SEZC, Cayman Islands. Titan processes message content and delivery data and uses service providers listed in its subprocessor list. Its published data processing terms set conditions for international transfers and provide for standard contractual clauses in the circumstances stated there. Its privacy policy describes its handling of service data. This notice does not assert that all email processing occurs in the EU.
Correspondence is used to deal with your enquiry, not to enrol you in a newsletter. There is no automated decision-making with legal or similarly significant effects in the project’s website or enquiry handling.
6. Retention
The retention criterion for correspondence is how long it is needed to answer an enquiry and complete relevant follow-up. Continued retention may be necessary to document an ongoing collaboration, comply with a statutory obligation or establish, exercise or defend legal claims. Once no such purpose remains, correspondence should be deleted. Processing required by a legal obligation rests on Article 6(1)(c) GDPR; necessary retention for legal claims rests on Article 6(1)(f).
The project has no separate visitor-profile database. Technical records and residual copies held by hosting and email providers are subject to their service retention and deletion arrangements, including security and legal obligations. A fixed deletion period for those records is not promised here. Contact the controller for information about a particular record or a deletion request.
7. Your rights
Under the conditions set out in the GDPR, you may request access to your personal data, correction, erasure, restriction of processing and data portability. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Right to object: where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Contact mh@berlin-ai-safety.com.
You may lodge a complaint with a supervisory authority, particularly in the EU country of your habitual residence, place of work or the alleged infringement. The Berlin Commissioner for Data Protection and Freedom of Information provides a complaint procedure.
8. Changes
This notice will be updated when the website’s features, providers or processing activities change. The date above identifies this version.