Privacy
Information on the processing of personal data on this website
1. Controller: The controller for processing on this website is [Firmenname], [Anschrift]. Privacy contact: [Datenschutz-E-Mail].
2. Hosting and infrastructure: This website is self-hosted on servers operated by Hetzner Online GmbH (Germany/EU). Server log files are processed to ensure operation; legal basis: legitimate interest (Art. 6(1)(f) GDPR).
2a. Processors: Where we use service providers to process personal data on our behalf (Art. 28 GDPR), we conclude data processing agreements. This includes [Firmenname] and, where used, Hetzner Online GmbH and Hetzner Storage. A list of processors is available on request at [Datenschutz-E-Mail].
3. Cookies and consent: By default, only strictly necessary cookies are set. Optional categories are enabled only after consent via the cookie banner. You may withdraw consent at any time – see section 10.
4. Cookie overview
| Cookie | Zweck | Speicherdauer | Kategorie |
|---|---|---|---|
cc_cookie | Stores your cookie consent and selected categories | 182 days | Necessary |
rcms_locale | First-party: stores your language preference on our website (ReportCMS). Not the same as Meta/Facebook's "locale" cookie on facebook.com. | 30 days | Necessary |
rcms_sid | Pseudonymous session ID for audience measurement | 30 minutes (SameSite=Lax) | Statistics (after consent only) |
5. Consent logs (audit trail)
Cookie decisions are logged pseudonymously via /api/consent/log: timestamp, consent type, revision, locale, hashed session ID, accepted categories, browser family, and page path.
Retention: 24 months; older entries are deleted automatically. Legal basis where consent applies: Art. 6(1)(a) GDPR.
6. First-party analytics
With statistics consent, aggregated usage metrics are collected via our own infrastructure (no Google Analytics etc.). Events include page views, scroll depth, active reading time, internal search (no plaintext queries), and newsletter sign-ups (hashed identifier only).
Where ad slots are enabled, we also record viewability events (ad_viewable_impression) with metadata (adPlace, adType). No personal profiles are created.
No names, email addresses, or full IP addresses are stored. Legal basis: consent (Art. 6(1)(a) GDPR).
7. External embeds (two-click)
Third-party embeds (YouTube, Vimeo, X/Twitter, Instagram/Facebook/Meta, TikTok, LinkedIn, OpenStreetMap/uMap) load only after social media consent (or the respective service). HTML house ads load only after marketing consent.
Two-click with screenshot preview: Until consent, no provider iframe or script is loaded. Where available, we show a locally hosted preview image behind the consent notice. External preview thumbnails (e.g. YouTube/Vimeo CDNs) are not fetched in the browser before consent. Without a local image, a neutral placeholder is shown.
Meta/Facebook may set its own cookies (e.g. locale on .facebook.com) after social consent – separate from our first-party rcms_locale cookie on this domain. Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG.
6b. Google Search Console (optional): If we import Search Console data, we store only aggregated page-level metrics. Search queries are not imported. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Provider: Google Ireland Limited.
8. Search (first-party): Site search uses our own infrastructure. With Meilisearch enabled, queries are sent to our index; otherwise a Payload API fallback is used. Search terms are not stored in plaintext in analytics.
9. Newsletter: We store only a hashed form of your email address – not plaintext. Sign-ups are rate-limited (hashed client IP). You always receive the same neutral confirmation response. Legal basis: consent (Art. 6(1)(a) GDPR); withdraw via unsubscribe link or email to [Datenschutz-E-Mail].
10. Data subject rights: You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21 GDPR). Withdraw consent via Cookie settings in the footer.
11. Right to lodge a complaint: Competent authority: [Zuständige Aufsichtsbehörde eintragen].
12. Retention and deletion: Raw analytics events are deleted after 90 days. Consent logs after 24 months.