PRIVACY

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Alexander Mackensen
Wieslinger Weg 3
71116 Gärtringen
Germany
Email: hallo@gw4.me

Access data and server log files

When you visit this website, our provider automatically collects information about your visit and stores it in so-called server log files. This includes, in particular, browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. This data is not assigned to specific persons. This data is not merged with other data sources.

Legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the technically error-free and secure operation of the website).

Contact enquiries

When you contact the provider (for example by contact form or email), the information provided will be stored for the purpose of handling the enquiry and in case follow-up questions arise. This data will not be shared without your consent.

Legal basis is Art. 6 (1) lit. b GDPR (contract initiation) or Art. 6 (1) lit. f GDPR (legitimate interest in responding to the enquiry).

Hosting

This website is hosted on the servers of an external provider. Personal data collected on this website is stored on the hoster's servers. The processing is carried out for the purpose of secure, fast and reliable operation of the website.

Legal basis is Art. 6 (1) lit. f GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the hoster.

Contact form (FormSubmit)

The contact form on this website uses the service FormSubmit (FormSubmit.co, operated by Devro Labs, USA) to forward the entered data via email to the controller. The data you enter in the form (name, email address, organisation if provided, message) is transmitted to FormSubmit servers and delivered as an email from there.

According to FormSubmit, the transmitted data is not stored permanently and is used solely for the purpose of delivering the email. There is no data processing agreement pursuant to Art. 28 GDPR in place with FormSubmit. The use is based on our legitimate interest in providing a functional means of contact.

Legal basis is Art. 6 (1) lit. b GDPR (contract initiation) or Art. 6 (1) lit. f GDPR (legitimate interest). Further information: FormSubmit Privacy Policy.

Account creation, password login and sign-in via email link

The standard login for the app app.gw4.me uses your email address and a password. We store your password exclusively in cryptographically hashed form (technical and organisational measure pursuant to Art. 32 GDPR); it is never stored or displayed in plain text. In addition, we offer sign-in via a one-time link that we send to you by email; this is a convenience option and is technically the same link as the confirmation link used during account creation. When you enter your email address on the sign-in page and request the email link, we process the following data:

• Email address — as the identifier of your account.
• IP address — to detect spam and to enforce the rate limit (3 requests per email/hour, 20 per IP/hour).
• Timestamp of the request and of the later use of the link — for security and audit purposes (single-use protection).

How your account is created: As soon as you submit your email address and it is not yet known to us, we create an as-yet-unconfirmed account (email as identifier, initially without a password). We send a confirmation link to that address. By clicking the link you demonstrate access to the mailbox, the account is deemed confirmed and you are signed in for the first time (double opt-in: the active entry and the active link click are the two confirmation steps). You then set a password of at least 12 characters, which completes account creation. A password must be set in order to sign in via the regular password page.

Storage period:

• Unconfirmed accounts (the confirmation link was never opened and no password was set) do not permit sign-in. They remain stored until deletion takes place; you may request deletion at any time, informally, at hallo@gw4.me (Art. 17 GDPR).
• Identifiers of links that have already been used are stored to prevent them from being used again.
• Active accounts remain in place until you request deletion or delete the account yourself.

Legal basis: Art. 6 (1) lit. b GDPR (contract initiation and performance) and Art. 6 (1) lit. f GDPR (legitimate interest in spam and abuse protection for the rate limits).

Security properties of the link: The confirmation and sign-in link is valid for 10 minutes, can be used only once and is HMAC-SHA-256 signed. A separately requested link to reset your password is valid for 1 hour for security reasons. If you lose access to the email mailbox on file, please contact hallo@gw4.me.

Cookies

This website does not use tracking or analytics cookies, no audience measurement, no profiling services and no advertising networks. Only strictly necessary cookies are used, required for operating the login area (app.gw4.me):

• gw_session — session identifier, signed, HttpOnly, SameSite=Lax, domain .gw4.me. Validity: session duration.
• gw_role — role marker (user or admin) used solely to control the navigation (e.g. the admin menu). SameSite=Lax, domain .gw4.me. Contains no personal data.
• gw-theme — stored locally (localStorage) for the chosen appearance (Sunrise / Moonrise), not transmitted as a cookie.

Legal basis: § 25 (2) No. 2 TTDSG (strictly necessary for the requested service) or Art. 6 (1) lit. f GDPR.

Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. An encrypted connection is indicated in the address bar of the browser.

Your rights

You have the right to free information about your stored personal data, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR) as well as the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), objection (Art. 21) and data portability (Art. 20). In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.

Contact for privacy matters

For privacy-related enquiries please contact: hallo@gw4.me