Imprint/Privacy Policy

January 1, 1 • 3070 words • 15 min

**Last updated / effective date: **

This privacy policy explains how personal data is processed when you use the websites docka.org, docs.docka.org, newsletter.docka.org and desk.mpldr.de (together, the “Website”). It is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the German Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG).

1. Controller (Verantwortlicher)

The controller responsible for data processing on this Website within the meaning of Art. 4(7) GDPR is:

Moritz Poldrack Engelsdorfer Str. 29 04316 Leipzig Germany Email: hi@docka.org

The Website is operated by a private individual and not by a company or other legal entity.

[NOTE FOR LAWYER: A “ladungsfähige Anschrift” (an address at which the operator can actually be served) is required for any Impressum; a P.O. box or virtual office is not sufficient (BGH, 25.03.2010, I ZR 47/08 line of authority). Please confirm the operator is willing to publish a private residential address or arrange an alternative (e.g. a lawyer/agency as authorised recipient), and advise whether a separate Impressum under § 5 DDG and/or § 18 MStV is required in addition to this privacy policy — see the Impressum note after Section 16.]

A data protection officer (Datenschutzbeauftragter) has not been appointed, as there is no legal obligation to do so for this type of processing (§ 38 BDSG).

2. Overview of processing activities

We process personal data only to the extent necessary to provide a functional Website and our content and services. The categories of processing are:

provision of the Website and generation of server log files (Section 4);
the newsletter (Section 5);
reach measurement / analytics with umami (Section 6);
handling of contact enquiries and support via our helpdesk (Section 7);
receipt and processing of email (Section 8).

The Website is fully self-hosted. We do not use third-party content delivery networks (CDNs), third-party embeds, Google services, social-media plugins, advertising networks or third-party tracking. We do not set cookies or store information on your device for tracking purposes.

[NOTE FOR LAWYER: If any technically necessary cookie/localStorage is in fact set by any component (e.g. the helpdesk login, the newsletter management page, or a CSRF/session token), please confirm and, if so, add a brief statement covered by § 25(2) No. 2 TDDDG (strictly necessary). Current understanding is that no cookies are set for public visitors.]

The Website and all associated services are hosted on leased dedicated/root server hardware operated by:

netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (Amtsgericht Mannheim, HRB 705547).

netcup acts as our processor (Auftragsverarbeiter) within the meaning of Art. 28 GDPR and processes personal data only on our documented instructions. We have concluded a data processing agreement (Auftragsverarbeitungsvertrag) with netcup in accordance with Art. 28 GDPR. The server used for the Website is located in netcup’s data centre in Nuremberg, Germany. Netcup Data are therefore processed exclusively within the European Union; no transfer to a third country takes place (see Section 9).

The legal basis for the use of the hosting provider is our legitimate interest in the secure and efficient provision of the Website (Art. 6(1)(f) GDPR).

4. Server log files

Each time the Website is accessed, our server automatically collects and temporarily stores information that your browser transmits, in so-called server log files. The following data are recorded:

the IP address of the requesting device;
the date and time of the request;
the requested resource / URL (and, where applicable, the volume of data transmitted);
the HTTP status code returned;
the referrer URL (the page from which the request originated), where transmitted;
the user-agent string (browser type and version, operating system).

Purpose: ensuring the operability, stability and security of the Website, and detecting and preventing abuse and attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically secure and stable operation of the Website.

Retention: Log files are deleted after three (3) months.

[NOTE FOR LAWYER: German supervisory-authority practice regards ~7 days for IP-containing web logs as unproblematic (ULD Schleswig-Holstein: security storage “für sieben Tage … normalerweise nicht beanstandet”; BGH: 7 days for dynamic IPs for fault detection); the BayLDA accepts up to 30 days; commentary considers up to 90 days defensible for security purposes with justification. Three months is at the upper end and requires a documented justification (specific security needs) or should be shortened to 7–30 days. Consider shortening IP retention specifically (e.g. IP truncation/anonymisation after 7 days) while keeping non-personal log fields longer. Please advise on the defensible period and adjust this figure.]

You can subscribe to our newsletter on newsletter.docka.org. The newsletter is sent using Listmonk, an open-source, self-hosted newsletter and mailing-list manager that runs on our own infrastructure at netcup (Section 3). No external newsletter service provider is involved.

Data collected: the email address you provide is mandatory. Providing a name is optional. In addition, for the purpose of documenting your consent, we store your subscription status, the date and time of your subscription request and confirmation, and the IP address used, together with the version of the consent text applicable at that time.

Double opt-in: We use the double opt-in procedure. After you enter your email address, you receive a confirmation email; your subscription becomes active only after you click the confirmation link in that email. Until then, your entry is stored with the status “unconfirmed” and you receive no newsletter. This procedure documents that the subscription was actually requested by the holder of the email address.

Purpose: sending our newsletter with information about the project.

Legal basis: your consent under Art. 6(1)(a) GDPR, in conjunction with § 7(2) No. 3 of the German Act against Unfair Competition (UWG). Externer-datenschutzbeauftragter-dresden The logging of the opt-in and confirmation (including IP address and timestamps) is based on our legitimate interest in being able to demonstrate that valid consent was given, as required by Art. 7(1) GDPR (Art. 6(1)(f) GDPR).

Withdrawal / unsubscribe: You can withdraw your consent at any time with effect for the future, without giving reasons and as easily as it was given (Art. 7(3) GDPR). Every newsletter contains an unsubscribe link; you can also unsubscribe by emailing [PLACEHOLDER — CONTACT EMAIL]. After you unsubscribe, your email address is removed from the distribution list. The consent documentation is retained for evidentiary purposes for the limitation period and then deleted.

[NOTE FOR LAWYER: (a) Please confirm the exact fields Listmonk stores in this instance (email, optional name, subscription status, opt-in/confirmation timestamps, opt-in IP) and align the list with reality. (b) Please advise how long the consent documentation should be retained after unsubscribe — three years (regular limitation period, § 195 BGB) is commonly used. (c) Ensure the confirmation email is purely transactional and contains no advertising (OLG München, 27.09.2012, 29 U 1682/12).]

6. Web analytics with umami

We use umami, an open-source, privacy-focused web analytics tool, in its default self-hosted configuration on our own infrastructure at netcup (Section 3). No data are transmitted to third parties.

According to the tool’s operation, umami does not use cookies in its tracking code umami and does not store IP addresses. It collects: page views, the requested URL/hostname, the referrer URL, browser, operating system, device type, screen size, language, and approximate location (country, region, city). Your IP address is used transiently to derive the approximate location but is not stored. umami Unique visits are identified by means of a hash generated from data such as website ID, hostname and user-agent string together with a salt that rotates regularly (monthly for visitors, hourly for visits). umami This means visitors cannot be tracked across days or across websites, no persistent identifier is written to your device, and no individual user profiles are created.

Purpose: statistical analysis of the use of the Website (reach measurement) in order to understand and improve our content.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the needs-based, statistical evaluation of the use of our Website. As umami does not store or access information on your terminal equipment beyond what is necessary to deliver the requested content, we take the view that consent under § 25 TDDDG is not required.

Retention: Analytics data are stored for [PLACEHOLDER — RETENTION PERIOD, e.g. 12 months] and then deleted.

[NOTE FOR LAWYER: The consent question for cookieless analytics under § 25 TDDDG is genuinely unsettled. The mainstream position — supported by the DSK’s Orientierungshilfe Tracking (§ 25 TDDDG does not apply where only data transmitted with the page request are processed) — is that self-hosted, cookieless, IP-not-stored, first-party analytics such as default umami do not require a consent banner and can rely on Art. 6(1)(f) GDPR. Stricter readings exist (e.g. that reading the user-agent/screen size can constitute “access to information on terminal equipment”), and recent case law reads § 25 TDDDG broadly (OLG Frankfurt, 11.12.2025, 6 U 81/23). Please confirm reliance on legitimate interest without a banner, or advise whether a consent solution/opt-out is prudent. Also: self-hosted umami retains data indefinitely by default — a deletion routine must be configured and the chosen period inserted above.]

7. Contact and support (helpdesk)

If you contact us by email at hi@docka.org (or via any contact form linking to it), your message is ingested into Libredesk, an open-source, self-hosted helpdesk/customer-support system GitHub that runs on our own infrastructure at netcup (Section 3) and is reachable at desk.mpldr.de. No external helpdesk provider is involved.

Data collected: your email address, any name or other details you provide, the content of your message, and the resulting conversation history.

Purpose: receiving, managing and responding to your enquiry.

Legal basis: where your enquiry relates to (the initiation or performance of) a contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in dealing with enquiries addressed to us, Art. 6(1)(f) GDPR.

Retention: We store your enquiry and the conversation history until it has been fully dealt with and no follow-up questions arise, and then delete it after [PLACEHOLDER — RETENTION PERIOD], unless statutory retention obligations require longer storage.

[NOTE FOR LAWYER: Please define the concrete retention period for helpdesk conversations (e.g. delete X months after resolution), taking into account any statutory retention duties (§§ 147 AO, 257 HGB — likely inapplicable to a private individual, but please confirm). Also confirm whether Libredesk stores additional metadata (IP addresses, technical headers) that should be disclosed. Note: Libredesk is relatively new software — verify behaviour against the running version.]

8. Email (self-hosted mail server)

Email to and from [PLACEHOLDER — CONTACT EMAIL / hi@docka.org] is handled on our own self-hosted mail server (Stalwart Mail Server) running on the same netcup infrastructure (Section 3). No third-party email provider is used.

When you send us an email, we process the data contained in it (your email address, name and message content) for the purpose of processing your request, on the legal basis set out in Section 7. Please note that the transport of email over the internet may be subject to security vulnerabilities beyond our control. Our mail server supports transport encryption (TLS) for the secure transmission of messages where your provider also supports it.

9. Recipients and third-country transfers

We do not sell or rent your personal data. Personal data are disclosed only to our hosting processor, netcup GmbH (Section 3), on the basis of an Art. 28 GDPR data processing agreement, and otherwise only where we are legally obliged to do so or where you have consented.

All processing takes place on servers located in Germany (Nuremberg). No transfer of personal data to a third country outside the EU/EEA takes place, and none is intended.

10. Data subject rights

Under the GDPR you have the following rights in respect of your personal data:

Right of access (Art. 15 GDPR): to obtain confirmation as to whether we process your data and, if so, access to that data and the information listed in Art. 15.
Right to rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed.
Right to erasure (Art. 17 GDPR): to have your data deleted where one of the grounds in Art. 17 applies.
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR): to receive data you have provided in a structured, commonly used, machine-readable format.
Right to object (Art. 21 GDPR): see the specially highlighted notice in Section 11.

To exercise any of these rights, please contact us at [PLACEHOLDER — CONTACT EMAIL].

RIGHT TO OBJECT
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR (processing in the legitimate interest of the controller); this also applies to any profiling based on that provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your right to object, please contact us at [PLACEHOLDER — CONTACT EMAIL].

Where processing is based on your consent (Art. 6(1)(a) GDPR — in particular the newsletter), you may withdraw that consent at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority competent for the controller is:

Die Sächsische Datenschutz- und Transparenzbeauftragte Maternistraße 17, 01067 Dresden, Germany (Postal address: Postfach 11 01 32, 01330 Dresden) Telephone: 0351 85471-101 Email: post@sdtb.sachsen.de BfDI Website: https://www.datenschutz.sachsen.de

14. No automated decision-making; no profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The statistical reach measurement described in Section 6 does not produce individual user profiles.

15. No obligation to provide data

The provision of personal data is neither legally nor contractually required. You are under no obligation to provide personal data to browse the public pages of the Website. If you wish to subscribe to the newsletter or contact us, you must provide the data described above (in particular your email address); without it, we cannot provide the respective service.

16. Data security

We use appropriate technical and organisational measures (Art. 32 GDPR) to protect your data. In particular, the Website is delivered over an encrypted TLS/HTTPS connection, and our mail server supports TLS transport encryption. Our infrastructure is operated on ISO-27001-certified hosting facilities.

17. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our processing activities or the legal framework. The version marked with the effective date at the top applies. The current version is always available on the Website.

[NOTE FOR LAWYER — IMPRESSUM: Separately from this privacy policy, please assess the provider-identification (Impressum) obligation. A publicly accessible project website is very unlikely to qualify as “purely personal or familial” and therefore probably triggers at least the “small” Impressum obligation under § 18(1) MStV (name + address). If the site is “geschäftsmäßig” (broadly interpreted — even an indirect commercial purpose, donations, sponsorship, or a link to paid services can suffice), the full Impressum under § 5 DDG applies (name, address, and a means of rapid electronic contact such as an email address). Note also that a mass newsletter has itself been treated as an impressum-relevant service (OLG München, 2003). Please advise which regime applies and prepare the Impressum accordingly.]

Recommendations

Before publishing, hand this draft to a German data-protection/IT lawyer and resolve the three flagged judgment calls (log retention, § 25 TDDDG analytics consent, Impressum obligation). These are the items most likely to attract a warning letter (Abmahnung) if wrong.
Fill in all [PLACEHOLDER] fields — controller name and ladungsfähige address, contact email, effective date, and the two retention periods (umami analytics; helpdesk).
Shorten or justify the log-retention period. Default to 7 days (authority benchmark) unless a documented security justification supports up to 30 days; treat 3 months as requiring specific written justification, or truncate/anonymise IPs after 7 days.
Configure a umami data-deletion routine (self-hosted umami keeps data indefinitely by default) and insert the chosen period into Section 6.
Verify the exact data fields stored by Listmonk and Libredesk in the live instances and align Sections 5 and 7 with reality; confirm no cookies/localStorage are set for public visitors.
Prepare a separate Impressum per the lawyer’s advice (§ 18 MStV and/or § 5 DDG), and update any references elsewhere on the site from TMG→DDG and TTDSG→TDDDG.
Benchmarks that would change the approach: if the operator later adds advertising, affiliate links, donations or any commercial element, the full § 5 DDG Impressum becomes clearly mandatory and the analytics legitimate-interest analysis should be revisited; if umami is reconfigured to store IPs, set cookies or enable session replay (added in v3.1), a consent banner and a DPIA become necessary.

Caveats

This is a draft for legal review, not legal advice, and must be checked by a qualified German lawyer before publication.
The § 25 TDDDG position on cookieless analytics is genuinely unsettled: the DSK Orientierungshilfe and mainstream commentary support a no-banner/legitimate-interest approach for self-hosted umami, but recent broad readings of § 25 TDDDG (e.g. OLG Frankfurt, 6 U 81/23, Dec. 2025) create residual risk.
The official umami documentation confirms “no cookies in the tracking code” but does not contain an explicit statement about localStorage; a third-party source-code audit once alleged a localStorage “sessionKey” was used. The operator should confirm the behaviour of the deployed version so Section 2/6 remains accurate.
netcup’s LEI record shows a headquarters-address change event dated 9 October 2025, while netcup’s own live imprint continues to list Emmy-Noether-Straße 10, 76131 Karlsruhe. The operator should re-confirm the current registered address from netcup’s live imprint / the DPA before publishing.
Facts about Listmonk and Libredesk internal data storage are drawn from official docs and source repositories but should be verified against the operator’s actual running instances and versions (Libredesk is relatively new/early-stage software).
The Saxon authority’s visitor address moved in April 2025; its postal Postfach, phone and email have remained stable. If the authority moves again, update Section 13.