Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Data protection contact: [DATA_PROTECTION_CONTACT]

2. Purposes and legal bases of processing

We process personal data solely to operate the toolkit:

• Providing the toolkit

  Operating the access-restricted toolkit and delivering its content to authorised users.

  Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the access-restricted service).

• Account and sign-in (incl. two-factor authentication)

  Registration, sign-in, session management and the optional two-factor authentication that protects the account.

  Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship); two-factor authentication additionally Art. 6(1)(f) GDPR (account security).

• Comments and file uploads

  Storing the comments written by users and the support documents they upload, including author attribution.

  Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship).

• System emails

  Sending transactional emails to confirm registration and to reset the password.

  Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship).

3. Recipients and processors

To provide the toolkit we rely on carefully selected service providers acting as processors (Art. 28 GDPR):

• Vercel — Application hosting and delivery · EU (Frankfurt)

• Neon — Database · EU (Frankfurt)

• Scaleway — File storage and email delivery · EU (Paris)

• Sentry — Error monitoring · EU (Frankfurt)

Processing takes place within the EU. Should transfers to third countries occur in individual cases, we safeguard them through appropriate guarantees — in particular the EU Standard Contractual Clauses.

4. Log and security data

When the toolkit is accessed, our servers automatically process technical access data (including IP address, timestamp and the resource requested). This data serves secure operation, error diagnosis and the prevention of abuse — for example by limiting the request rate (rate limiting). It is stored only for short periods and deleted afterwards. The legal basis is Art. 6(1)(f) GDPR.

5. Cookies and usage statistics

We use only strictly necessary session cookies required for sign-in and operation (§ 25(2) no. 2 TDDDG); these require no consent, which is why we do not use a cookie banner. No tracking or marketing cookies are used. Any usage statistics are collected without cookies and only in aggregate form without any personal reference.

6. Monitoring and web analytics

To keep the toolkit reliable, secure and fast we use the following privacy-preserving services:

• Error tracking (Sentry)

  When a technical error occurs, an error report is sent to Sentry and stored exclusively in the EU. Reports are anonymised before transmission: request headers, cookies, request bodies and user identifiers are removed and query strings are masked. The reports contain technical error details only — no user profiles are created.

• Web analytics (Vercel Web Analytics)

  We measure the use of the toolkit with Vercel Web Analytics. The measurement works without cookies and without persistent identifiers; page views are recorded only in aggregate form and cannot be traced back to individual users. No tracking across other websites takes place.

• Performance measurement (Vercel Speed Insights)

  To monitor loading performance, Vercel Speed Insights collects anonymous performance metrics (Core Web Vitals) from real page views. The metrics contain no cookies and no personal reference.

The legal basis for all three services is Art. 6(1)(f) GDPR (legitimate interest in the stable, secure and performant operation of the toolkit).

7. Your rights

Subject to the statutory conditions, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). To exercise them, a message to the controller named above is sufficient.

Independently of this, you have the right to lodge a complaint with a data protection supervisory authority.