Privacy policy for sw-labs.de and alerts.sw-labs.de

Controller

SW labs – Felix Winkel
Email: team@sw-labs.de

Postal address: see legal notice.

General

I process personal data only insofar as this is necessary to provide these websites and my services. sw-labs.de sets no cookies and requires no registration; only those who take part in the referral program sign up through a form and get a strictly necessary cookie for their personal overview (section “Referral form”). In your browser’s session storage (sessionStorage) it only keeps the scroll position of the home page, so you can continue reading where you left off when you return; the value does not leave your device and expires when you close the tab.

Data is transmitted in encrypted form via HTTPS.

Hosting and delivery

sw-labs.de and alerts.sw-labs.de are hosted and delivered via Cloudflare (Cloudflare, Inc., USA), each by its own program (Cloudflare Worker); Cloudflare also provides name resolution (DNS). Traffic between your browser and these websites therefore passes through Cloudflare servers, and technical connection data is processed (IP address, date, time, page requested, browser information) in order to deliver the websites, fend off attacks and keep it available. This data is stored only for as long as these purposes require.

The legal basis is my legitimate interest in providing these websites securely and reliably (Art. 6 (1) (f) GDPR). Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR); in addition, standard contractual clauses under Art. 46 (2) (c) GDPR apply.

alerts.sw-labs.de

On alerts.sw-labs.de I show what the status pages of other providers report about their state, which security vulnerabilities are being exploited, and news headlines with a link. To stay current while you have the page open, it loads its data via JavaScript from the same host. Each of these requests is a request like the one for the page itself: Cloudflare technically processes your IP address and the other connection data as described under “Hosting and delivery”, on the same legal basis.

alerts.sw-labs.de sets no cookies and stores nothing in your browser (neither local storage nor session storage). There is no audience measurement, no operational log, no form and no account; the sections “Operational logs”, “Audience measurement”, “Contact form” and “Referral form” concern sw-labs.de only. Fonts and logos come from the same host; your browser does not contact any third party for them. Only the situation itself is stored (states and their history), no information about visitors.

Links lead to the pages of the providers and of the news sources. Only when you click one does your browser request the other site; from then on, that site’s privacy policy applies.

Operational logs

The program that delivers sw-labs.de on Cloudflare (a Cloudflare Worker) writes short operational messages to Cloudflare Workers Logs, so that I notice when a process fails: the type of event, counters and error codes. I do not write names, email addresses, IP addresses, form contents or access credentials into them. A log of every single request is switched off. Cloudflare may attach technical details of the request a message belongs to, such as the time and the address requested. Cloudflare deletes the messages after seven days.

The legal basis is my legitimate interest in operating sw-labs.de reliably (Art. 6 (1) (f) GDPR). Cloudflare acts as processor; for transfers to the USA, the same applies as in the section “Hosting and delivery”.

Audience measurement

To understand how sw-labs.de is used and how fast it loads, I use Cloudflare Web Analytics. The service sets no cookies and stores nothing on your device; no profiles are built, and you are not recognized across different websites. What is evaluated: pages visited, referring page, country, browser, operating system and page-load metrics. IP address, user agent and other request headers are used to tell visits apart; they are hashed immediately and not stored.

The legal basis is my legitimate interest in designing this website according to need and optimizing it technically (Art. 6 (1) (f) GDPR). Since your device is not accessed, no consent under Section 25 TDDDG is required. The transfer to the USA is covered as described under “Hosting and delivery”.

Contact by email

If you send me an email, I process your message and the information it contains in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry is aimed at a contract, otherwise my legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

Emails are processed on my behalf by the email provider Zoho (Zoho Corporation). Insofar as data is transferred to countries outside the EU in the process, this is done on the basis of standard contractual clauses under Art. 46 (2) (c) GDPR.

I keep your enquiry until it has been dealt with in full. Statutory retention obligations, in particular under Section 257 HGB and Section 147 AO, remain unaffected.

Contact form

Through the contact form, you send me your name, your email address and your message, and if you wish, the name of your business. If you filled in the self-check on the home page beforehand, its answers are sent along as long as you leave the checkbox for them ticked. I process this information to answer your inquiry and, where appropriate, to prepare a proposal. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps at your request); if your inquiry is not aimed at a contract, my legitimate interest in answering inquiries (Art. 6 (1) (f) GDPR). Without a name, email address and message, I cannot reply to you.

Referred by. If you wish, you can state who pointed you to me: a referral code or the name of a person or business. In doing so, I also process data of this third party. If it is a referral code, a mention is created in the referral program with the name of your business (without a business, with your name), the time, the channel “contact form” and the ID of your inquiry; it counts only once I have confirmed it in the first conversation with you. If the code belongs to a participant, they learn by email that a business has mentioned their code, but not which one (section “Referral form”). I do not enter a name given instead of a code into the program; it stays only as a note on your inquiry. The legal basis is Art. 6 (1) (b) and (f) GDPR (running the referral program; my legitimate interest in matching the bonus to the right person).

The inquiry is received by the Cloudflare Worker that delivers this website and stored in its own Cloudflare Workers storage (Durable Objects), together with the time of receipt and the language of the page; I do not store your IP address or your browser there. Cloudflare Email Sending sends it to me as an email to my mailbox at Zoho (section “Contact by email”); this sending can only go to my own address. The form does not send any email to the address you enter; my reply comes from my mailbox. Only I can access the stored inquiries, through Cloudflare Access. Cloudflare acts as processor; for transfers to the USA, the same applies as in the section “Hosting and delivery”.

To prevent abuse, the form accepts at most five inquiries per minute and connection. I do not store your IP address for this: what is counted is a check value derived from the IP address (for IPv6, from its network) and a secret key, without which it cannot be traced back, and only for 60 seconds in Cloudflare’s rate limiting. The legal basis is my legitimate interest in a form that is not abused (Art. 6 (1) (f) GDPR).

Retention: stored inquiries are deleted automatically 180 days after receipt, or earlier at your request. If the inquiry leads to an order, it is kept until it is transferred to the contract documents; statutory retention periods apply there (Section 257 HGB, Section 147 AO). I treat the email to me like any other inquiry by email (section “Contact by email”). A mention in the referral program is deleted according to its periods (section “Referral form”).

Referral form

If you take part in the referral program (terms of participation), you sign up through a form at sw-labs.de/en/refer. I process your name, your email address, whether you refer as an individual or a business, the time you signed up and confirmed your address, the version of the terms and the referral code you receive. Before you confirm, your details are held as a pending sign-up; the confirmation link is valid for 48 hours, after which the pending sign-up is deleted automatically within one more day.

If a business mentions your code or name, a case is created: time and channel of the mention (contact form, email, phone, conversation), the name of the business, where applicable the ID of its inquiry, the result of my review and how the case proceeds (proposal, order, payment, payout), each with time and reason. A code can have any number of cases.

Overview and emails. You can see where things stand on a personal page. You get access through an email link; once used, the page sets a cookie that keeps you signed in for up to 30 days (strictly necessary for this page, § 25(2) No. 2 TDDDG; it contains your code, the time of the link and a signature). I send you a short email at every step of a case. I do not show or send you the name of the business; it reads “Referral 1” and so on, or the name you gave me for it yourself. How things proceed with the business after I have told you whether the referral counts (proposal, order, payment), I show you only if the business has consented (Art. 6(1)(a) GDPR, question in the proposal); it can withdraw that consent at any time.

Payout details. For the payout, you enter the account holder, IBAN and address in your overview, as a business also the company name and VAT ID or a note on the small-business rule. I store them only in encrypted form (AES-256-GCM, with the key kept separately from the data); they are shown shortened, in plain text only to me for a transfer, and every such view is logged. After every change, I send an email to your registered address and pay nothing out for seven days. The details are kept as long as your account exists, so later bonuses reach you; they are deleted with the account. I keep records of a payout in my accounts for as long as the law requires (§ 147 AO, § 257 HGB).

The purpose is to give you a code, match a referral, keep you informed and pay out the bonus. The legal basis is Art. 6(1)(b) GDPR (participation under the terms); for the payout records, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 160 AO. Without a name and email address, I cannot issue a code; without payout details, I cannot transfer a bonus.

To prevent abuse, I limit requests per connection and emails per address. I do not store your IP address for this: what is counted is a check value derived from the IP address (for IPv6, from its network) or the email address and a secret key, without which it cannot be traced back. Cloudflare’s rate limiting counts the check values per connection and per address for about a minute; I store the check value per address and day (at most three emails) for at most two days. The legal basis is my legitimate interest in a form that is not abused (Art. 6(1)(f) GDPR).

The data is stored in Cloudflare Workers storage (Durable Objects; Cloudflare, Inc., as processor; for transfers to the USA, the same applies as in the section “Hosting and delivery”). Emails to you and to me are sent by Cloudflare Email Sending, also as processor; replies arrive in my mailbox at Zoho (section “Contact by email”). Only I can access the case administration, through Cloudflare Access.

Retention: a code that no business mentions within seven months of signing up or of the last mention, and that has no open case, is deleted. A case is deleted 90 days after it closes (payout, cancellation, expiry or result of the review). A mention that cannot be matched to a code is deleted after seven months. At your request, I delete your account with all cases, payout details and open mentions of your code or name immediately; an email to me is enough.

If a business whose name is also the name of a person (for example a sole proprietorship) mentions your code, I inform it about this processing when it gets in touch with me.

Recordings for case studies

For case studies about my work, I take photos, videos and sound recordings at businesses for which I have built a process. Anyone who is recognizable in the picture or speaks decides for themselves whether and how: before the recording, each person signs their own consent with me and ticks what I may show (image, voice and statements, first name and role, last name) and where (for example this website, my social media accounts, proposals to individual prospects). The business cannot give this consent for its staff. I do not record persons under 18. Nothing is published until the business has approved the finished text and edit.

The purpose is to show other businesses what my work looks like. The legal basis is your consent (Art. 6 (1) (a) GDPR), and for publishing your likeness also Section 22 KUG (German Art Copyright Act). Consent is voluntary; anyone who does not give it or withdraws it suffers no disadvantage, including toward their employer, and the business receives nothing for it. If the business is a sole proprietorship, its name is also the name of its owner; I then process the name, figures and quote of the business on the basis of the agreement with it (Art. 6 (1) (b) GDPR).

Withdrawal. You can withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR); an email to team@sw-labs.de is enough. Within the period stated in the consent, I then remove the recordings in which you can be seen or heard from this website and from my own accounts, or cut you out, and do not use them again. I cannot recall proposals already sent, printed copies or copies that third parties have shared; I inform known recipients where this is reasonable.

Recipients. The recordings are made by a videographer on my behalf. If you ticked it, the videographer also shows them in their own portfolio and is responsible for that themselves. The same applies to the business if you ticked that it shows the video on its website or in its accounts. Social media are partly operated by providers outside the EU; what I show there, these providers also process themselves, under their own terms.

Retention: I keep recordings and raw footage as long as the video is in use and delete them along with it after a withdrawal. I keep the signed consent as proof (Art. 7 (1) GDPR).

Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, write to team@sw-labs.de.

Right to object

Where I process data on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

Currency

This privacy policy is dated November 2026.