Legal notice
Provider identification pursuant to § 18(1) of the German Interstate Media Treaty (MStV) and, insofar as applicable, § 5 of the German Digital Services Act (DDG).
Privacy overview
The controller responsible for the processing described on this page is Tobias Klingenberg, contactable using the details in the legal notice.
TWKS is a collection of predominantly privately operated, self-hosted online services. Some services are also accessible to other people. Depending on the service you visit or use, personal data may include technical connection information, account identifiers, authentication data, and information you choose to upload or submit.
Personal data is processed where needed to deliver the requested website or service, manage user accounts, protect the systems against abuse, and respond to enquiries. The applicable legal bases may include:
- Art. 6(1)(f) GDPR: legitimate interests in reliable operation, availability, and security of the website and infrastructure;
- Art. 6(1)(b) GDPR: provision of a service requested by a user, where necessary for a contract or pre-contractual measures;
- Art. 6(1)(a) GDPR: consent, where specifically requested for optional processing.
When you visit
Technical connection data
To serve this website, the web server and any reverse proxy necessarily process technical connection information, in particular the requesting IP address, requested URL, and connection time. Depending on the configuration, access or error logs may additionally record browser or user-agent information, request method, response status, and referring page.
This processing serves the delivery of requested pages, troubleshooting and system security (Art. 6(1)(f) GDPR). If logs are stored, their actual retention period is 6 months.
Cookies and browser storage
The static landing page is designed without advertising trackers or an analytics integration. Linked applications can use cookies or browser storage for essential functions such as sign-in, session management and security. Necessary storage may be exempt from consent under § 25(2) TDDDG; optional storage or tracking requires appropriate information and, where applicable, prior consent.
Direct communication
When you contact the operator, the content of your message and contact details are used to handle and respond to the enquiry (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where relevant). Messages are retained for 6 months, unless a legal obligation requires longer retention.
Hosted services
The following applications may process additional personal data when you create an account, sign in, or use their features. This can include the data you enter or upload, account identifiers, usage and security information. Access is subject to the permissions granted for each service.
File storage, synchronization and sharing. May process account information, uploaded files, file metadata and sharing permissions.
Repositories and development collaboration. May process usernames, email addresses, source code, issues, commits and contribution history.
Authentication and access management. May process identifiers, authentication methods, session information and security events.
AI-related requests and responses. Input submitted to this service may contain personal data. Data may be sent do external AI providers.
Password management. May process account information, encrypted vault data, authentication events and service metadata. Do not assume all metadata is encrypted.
Document management. May process stored documents, their contents, tags, metadata and associated user accounts.
Accounts and authentication
Some applications may use a central identity service. Information required to authenticate users and enforce access permissions may be exchanged between the application and the identity provider. Account data is processed to provide the requested service and secure access (Art. 6(1)(b) or 6(1)(f) GDPR, as applicable).
Information submitted within these applications is retained according to the service's settings, account lifecycle and backup policies. See Storage & security for details that must be completed before publication.
External providers
Self-hosting means operating applications under your own control; it does not necessarily mean every layer of the service runs on your own hardware. Hosting, domain name resolution, CDN or proxy services, email delivery and optional AI backends may involve additional providers.
Where such providers process personal data on behalf of the operator, they should be identified by name, purpose and, where appropriate, location. The providers currently used are:
Netcup, Cloudflare
Transfers outside the EEA
Depending on the providers and their configuration, personal data may be processed outside the European Economic Area. Any such transfer must be assessed against Chapter V GDPR and the applicable transfer mechanism, such as an adequacy decision or appropriate safeguards.
Storage & security
Personal data is retained only for as long as required for the relevant processing purpose or legal retention obligations. The actual criteria depend on the type of information:
- Technical logs: 6 months.
- User accounts: Until explicitely requested for deletion.
- Uploaded or submitted content: Until explicitely requested for deletion.
- Backups: Until explicitely requested for deletion.
Access controls, authenticated connections and other technical measures are used to protect the services. No internet-connected system can be guaranteed to be free from security risks. Users should avoid submitting information to services for which they have not been granted access.
Your rights
Subject to the requirements and limitations of applicable law, you may exercise the following rights in relation to your personal data:
- Access to your personal data (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure of data (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability, where applicable (Art. 20 GDPR).
- Objection to processing based on legitimate interests (Art. 21 GDPR).
- Withdrawal of consent at any time, without affecting prior lawful processing (Art. 7(3) GDPR).
There is no automated decision-making with legal or similarly significant effects on the basis of this static page.
You may also lodge a complaint with a competent data protection supervisory authority. An overview of German authorities is available from the German Data Protection Conference.
Contact
For privacy enquiries, correction or deletion requests, or questions about any TWKS service, contact the operator using the email address listed in the legal notice.
To help identify the relevant data without unnecessarily sharing sensitive information, mention the service concerned and the account identifier you used, if applicable.
↑ Back to top