Privacy policy

Last updated: 5 November 2026. Translation for convenience; the German version is legally binding.

1. Controller

Email: info@hmmaha.com
Contact form: https://hmmaha.com/en/contact/

The controller responsible for this website is Ramzi CHENINI, who publishes under the name hmmaha. You can reach us at the email address below or through the contact form. The full address is in the Impressum (legal notice).

We have not appointed a data protection officer, as we are not required to. For any privacy question, just write to the email address above.

2. The short version

This website gets by with very little data. There are no user accounts, no shop, no newsletter, no advertising and no third-party analytics or advertising services (no Google, no Facebook). Fonts, pictures and scripts are loaded from our own server. We do not sell data, do not create profiles and do not make automated decisions within the meaning of Art. 22 GDPR.

3. Hosting and email

The website runs on a rented server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in the European Union. Our email mailbox is also hosted by IONOS. IONOS processes the data only on our behalf; we have concluded a data processing agreement with IONOS under Art. 28 GDPR. The connection to this website is encrypted (HTTPS).

4. Visiting the website and server logs

When you open a page, the server processes technically necessary data: your IP address, date and time, the page requested, the status code, the amount of data transferred, the previously visited page (referrer) and the browser identifier. Without this data the page cannot be delivered.

In the server log we store the IP address only in shortened form (IPv4 without the last block, IPv6 only the first 32 bits). We use the log to find errors and fend off attacks. It is deleted automatically after 7 days at the latest. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

5. Cookies

We set only one technically necessary cookie: “csrftoken”. It is set when you open a page with a form (book code entry or contact form) and protects the form against forged requests. It contains a random number and no information about you, and it is deleted when you close the browser. No consent is required for it (§ 25(2) no. 2 TDDDG); the legal basis for the processing is Art. 6(1)(f) GDPR. We set no other cookies, in particular none for advertising or statistics.

6. Visitor statistics (Umami)

To see which pages are read, we use the open-source software Umami. It runs on our own server (analytics.hmmaha.com); no data is passed to third parties. Umami sets no cookies and stores nothing on your device. It records the page visited, the previous page, browser, operating system, device type, screen size, language, and the country, region and city derived from the IP address. The IP address itself is not stored; only an anonymous value that changes regularly is derived from it and the browser identifier, so we cannot draw conclusions about you. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object, for example by switching on “Do Not Track” in your browser or by blocking JavaScript for analytics.hmmaha.com.

7. Contact form and email

You can also write to us anonymously: name and email address are optional. We store only what you enter (the message and, if given, name and email address), plus date and language, but no IP address. A copy of the message is sent to our mailbox. The same applies if you email us directly.

We use this data only to read and answer your message. The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, where a purchase or contract is concerned, Art. 6(1)(b) GDPR. Messages are deleted 6 months after receipt unless statutory retention obligations require otherwise. After that they remain in our database backups for at most 14 more days.

8. Book codes and bonus pages

When you enter the code from the book, we only increase a counter for that edition (how often and when last). No IP address and no information about you is saved in our database. To stop people from guessing codes, after a wrong code we keep a scrambled (hashed) form of the IP address in the server’s working memory for one hour; it is not written to disk. The contact form uses the same short-lived protection against mass sending.

9. Links to Amazon

Our books are sold through Amazon. As long as you do not click an Amazon link, Amazon learns nothing about your visit. After the click you are on Amazon’s website, where Amazon’s privacy policy applies.

10. Children

Our books are for children, but the contact form is for grown-ups. Children under 16, please don’t send us personal data without your parents. If we learn that a child has sent data without parental consent, we delete it.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to info@hmmaha.com. We reply within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

12. Changes

If the website or the law changes, we will update this privacy policy. The version published here applies.