ThreaddatabasePrivacy policy
Draft – some details are only settled once the service goes live; they are marked below.
Translation for information only; the German version is legally binding.
1. Controller
The controller responsible for data processing in the Threaddatabase is:
Martina Wolter-Kampmann
Bergstraße 49
58739 Wickede, Germany
Phone: +49 2377 2428
E-mail: info@wolter-kampmann.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, e-mail addresses).
2. In brief
The Threaddatabase stores only what your access and its operation require:
- for an account, your e-mail address, your name, your password (only as an irreversible hash), your language, the term of your access and your favourites;
- two strictly necessary cookies: one for logging in, one for your language;
- to prevent misuse, counters of requests — without login by origin, with the IP address stored only as a checksum (hash).
There is no advertising, no analytics or statistics tool and no third-party service embedded in the pages. Fonts are loaded from this server, not from Google.
3. Hosting
The Threaddatabase is operated by a provider with servers in the European Union, under a data processing agreement (Art. 28 GDPR).
to be added Name and address of the hosting provider
4. Account and access
For your access we process your e-mail address, your name, a user name if you chose one, your password as an irreversible hash, your language, the term of your access, the time of your last login and the threads on your favourites list. The access code is stored as a checksum and additionally encrypted, so that we can tell you your code if you can no longer find it; only the Threaddatabase administration can read it.
The legal basis is Art. 6(1)(b) GDPR (contract). The data is kept as long as your access exists. At your request we delete it: name, e-mail address, password, favourites and logins are then erased, not merely blocked. Payment records are kept without your name for as long as tax and commercial law require.
6. Protection against misuse
To keep the collection from being scraped, we count requests per account. Without login we count by the origin of the request; the IP address is stored only as a checksum (hash), never in plain text. The same applies to failed login attempts, to slow down guessing of passwords and codes.
The legal basis is our legitimate interest in protecting the collection and the accounts (Art. 6(1)(f) GDPR). The counters are deleted after one to two days, reports of unusually many requests after one year.
7. E-mails
We only send e-mails about your access: a link to confirm your e-mail address before the first subscription, a password reset link you requested yourself, your access code, confirmations about your subscription (start, cancellation, a failed payment, end) and reminders before your access ends or before it renews automatically. Reset links are valid for two hours, confirmation links for one day; after that they are deleted. We keep a send log of which message went to which address and when (recipient, subject, time, result, not the content), so that each message goes out only once and can be proven; it is deleted after two years. The legal basis is Art. 6(1)(b) GDPR (contract). For sending we use a service provider under a data processing agreement.
to be added Name and address of the e-mail service provider
The Threaddatabase has no newsletter.
8. Payment
Access with automatic renewal that you take out on this site is paid through the payment service Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For this we pass to Stripe your e-mail address, your name if you have given one, your language, the chosen package and an internal account number. You enter your payment details directly with Stripe; they do not reach us. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Stripe also processes data in the USA, on the basis of the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. Stripe's privacy information: https://stripe.com/privacy
If you pay by bank transfer, payment data stays with your bank and ours. If you buy access in the shop, the shop's privacy notice applies. Beyond that, we pass personal data to third parties only where necessary to perform the contract, for example to the bank handling the payment (Art. 6(1)(b) GDPR).
9. Server logs
to be added What the web server logs on each request, and for how long
10. Enquiries by e-mail or phone
If you contact us by e-mail or phone, your enquiry including all personal data it contains (name, request) is stored and processed to handle your request. We do not pass this data on without your consent.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR).
The data remains with us until you ask us to delete it or the purpose no longer applies (e.g. once your request has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.
11. Storage period
Unless a more specific period is stated in this policy, your personal data remains with us until the purpose of processing no longer applies. If you make a justified request for deletion, your data is deleted unless we have other legally permissible reasons for keeping it (e.g. tax or commercial retention periods); in that case it is deleted once those reasons cease to apply.
12. Your rights
Within the applicable law you have the right at any time to free information about your stored personal data, its origin, recipients and the purpose of processing, and a right to have it corrected or deleted. You also have the right
- to request restriction of processing (Art. 18 GDPR),
- to receive data we process automatically on the basis of your consent or a contract in a common, machine-readable format (Art. 20 GDPR),
- to withdraw any consent at any time with effect for the future,
- to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.
Right to object (Art. 21 GDPR): where processing is based on Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
For all of this, an informal message to info@wolter-kampmann.de is enough.
13. SSL/TLS encryption
For security and to protect confidential content in transit, these pages use SSL/TLS encryption. You can recognise an encrypted connection by the address bar starting with “https://” and the padlock symbol in your browser. With encryption enabled, the data you send us cannot be read by third parties.