Privacy

Data controller

Correspondence address

Contact

1. Delivery and hosting

This website is hosted in Germany. The hosting provider processes IP addresses and technical connection data to deliver requested content. Our legitimate interest is an available, secure and properly functioning website (Article 6(1)(f) GDPR). Processing is limited to the data necessary for these purposes. Hosting logs and the statistics described below are separate operations; the specific logging setting is stated under “Hosting provider”.

2. Functional session without a session cookie

Navigation and form protection use a short-lived PHP session. A random signed identifier is submitted through POST form fields, not URLs or a session cookie. Sessions contain no IP addresses or raw browser headers. The basis is Article 6(1)(f) GDPR for secure delivery and, where necessary device access is involved, section 25(2)(2) TDDDG.

3. Session expiry and deletion

A session becomes invalid after 15 minutes without registered activity and after no more than 8 hours. A departure signal reduces this period to 10 seconds when no active tab remains; these signals are not guaranteed. Expired records are deleted in bounded batches during the next due cleanup triggered by a page request, irrespective of its source. A configured maintenance job can also trigger cleanup without visitors. Without requests or such a job, physical deletion may occur later; the session remains unusable.

4. Visitor statistics

We count one entry on the server when a public website visit starts. We store only separate totals by day or hour, entry page, browser family, primary browser language, network registration country, source category, search engine and identifiable automation. Approved campaign IDs identify a shared advertising source, never a person. Technical information already transmitted with the page request is processed briefly for this purpose. The legal basis is Article 6(1)(f) GDPR: our interest in assessing reach, language needs and technical use with limited data. IP addresses, IP networks, raw headers, full referring URLs and individual browsing histories are not stored as statistics. We create no analytics cookies, additional analytics identifiers or visitor profiles. Do Not Track and Global Privacy Control suppress counting. Security logs are not used to generate statistics. We also count public page views as separate daily totals per page, including internal navigation and language changes. No individual browsing histories or time-spent records are created.

5. Country, browser and bot information

When statistics are enabled, the IP address is shortened to an IPv4 /24 or IPv6 /48 network before the local country lookup. Neither the address nor its network is stored. The result describes network registration, not a reliable physical location. Browser families and bot names are derived from existing User-Agent and Sec-CH-UA headers; headers may be missing or manipulated. A bot IP may briefly be checked against locally stored published network lists without retaining the address. Unconfirmed claims remain labelled as such. No external service is queried.

6. Contact and abuse prevention

Your name, email address, topic and full message are sent as a plain-text email to info@trkye.com to handle your enquiry. Your email address is used as the reply address. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries, otherwise Article 6(1)(f) GDPR and our legitimate interest in answering business and product questions. The website stores no name, email address, topic or message in its database or a delivery queue. It processes the entries in request memory and sends them directly to the mail server. Success is shown only after the server accepts the message; this does not confirm delivery to the recipient mailbox. On failure, the returned form retains the entries for review and another submission. No automatic retries take place. A technical form receipt contains only a one-way key, a protected check value of the entries to identify identical retries, delivery state and expiry, with no contact contents; it expires within 8 hours and is removed at the next cleanup. Retention in the email mailbox depends on the handling purpose and any statutory retention duties. The hosting and email provider processes the data for provision and delivery. No automatic confirmation emails are sent to the supplied visitor address. Short-lived, purpose-specific values derived from IP and time windows limit misuse based on our legitimate interest in protecting the contact channel; they are not used for statistics and are removed at the next cleanup after 2 days. Attachments are not accepted. If the mail server acknowledgement is missing, the enquiry may already have been accepted. The website identifies this outcome as uncertain and never automatically resends it.

7. Recipients and third parties

Statistics are processed on our webspace and kept behind internal access controls. We send no visitor data to analytics or advertising providers and do not sell data. Our hosting provider processes data required for delivery; contact by email also involves the relevant email providers. Scripts, images and stylesheets are loaded from our own webspace; text uses the system fonts available on your device. We do not use Google Analytics, Tag Manager, advertising pixels, external consent services or browser fingerprinting. Search Console is not integrated into this website. Deliberately opening external links leads to providers with their own privacy notices. Local visitor statistics are not transferred to recipients outside the EEA. Hosting and relevant email providers are separate recipient categories; their necessary processing is not a sale of data.

8. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to processing under Art. 6(1)(f) GDPR on grounds relating to your particular situation. Contact the controller listed above. You may complain to a data protection authority. Aggregate statistics without attribution cannot subsequently be associated with an individual. No decisions with legal effects are made solely by automated processing.

9. Providing information

Visiting the website does not require registration. Technical connection data is needed to deliver it. Contacting us is voluntary and not legally required. The form requires a name, email address, subject and message and cannot be sent without them. An enquiry does not conclude a contract or create an employment relationship.

10. Employment and business enquiries

Enquiries about working with us and business enquiries are processed to address your request. No indefinite candidate or partner pool is created. Where a message already concerns a decision on establishing an employment relationship, the necessary information is processed under section 26(1) of the German Federal Data Protection Act. Further recruitment or equity participation procedures are accompanied by the relevant privacy information. Please initially send no health data, identity documents, personal financial documents or extensive application materials.

11. Necessary browser information

The transmitted language preference may determine the initial website language. When statistics are enabled, browser family and primary language are immediately counted only as separate totals. There is no device probe, browser fingerprinting or raw-header storage for statistics. Limited browser information is also recorded for logged sign-ins, sign-outs, password recovery and important dashboard actions; sections 13 and 14 provide details.

12. Earlier privacy choices

No public consent dialog is shown and no new statistics consent is collected. Earlier statistics preference cookies are deleted on the next page request. Historical consent evidence is retained only until its existing deletion deadline and then cleaned up. It is not used for new measurements or visitor profiles. For enquiries about earlier evidence, contact the controller named above.

13. Dashboard and separate security audit

Internal dashboard access requires a username and password. A username verification value and password hash are stored. Entered passwords, form contents and session tokens are not stored in the security log. Sign-in uses a short-lived functional session with signed POST form fields and sets no new cookie. Purpose-specific HMAC values limit attempts per session and network, with an additional overall limit. Earlier security cookies are deleted on the next page request. Sign-in attempts including rejected attempts, sign-outs, password recovery and important dashboard actions such as creating, updating, exporting and erasing cases, sending mail and reviewing delivery create a private size-limited security record: UTC time, event, outcome, complete IP, and bounded User-Agent, language and Sec-CH-UA fields. Certain case actions also include a random case reference. Passwords, recovery codes, case contents and other visited pages are excluded; the log is not used for analytics. Its purpose is to protect our website, its data and access points against attacks and misuse, and to detect and investigate related incidents, based on Article 6(1)(f) GDPR. Normal retention: 14 days. Old daily files are removed during the next due maintenance run and can be deleted manually sooner. With no requests or maintenance job, physical deletion can be delayed; the operator must then ensure the deadline through maintenance or manual deletion. Evidence needed for a specific incident may only be retained separately with a justified incident-related purpose. Before each new dashboard sign-in, an initially unchecked checkbox requires acknowledgement of the notice about recording that sign-in attempt. This acknowledgement is not consent; the legal basis remains our legitimate interest in IT security. Logging does not depend on the checkbox: technically rejected or automated sign-in attempts without acknowledgement may also be recorded. The checkbox only acknowledges the notice; it does not waive privacy rights or provide consent to visitor statistics. Access is limited to authorized security administrators and necessary hosting providers. Subject to the statutory conditions, access, rectification, erasure, restriction and objection may be requested from the controller identified above; the right to complain to a data protection authority remains unaffected.

Objecting to processing based on legitimate interests

Where we rely on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Art. 21 GDPR). Please use the contact details above. We review the request and continue the affected processing only where the statutory conditions are met. Statistical totals that are no longer attributable cannot subsequently be linked to an individual.

Internal reporting

Visitor statistics are accessible only in the authenticated dashboard and show totals for the selected period. Security logs and enquiries are not combined into visitor statistics. The sign-in checkbox acknowledges the security notice; it is not consent to visitor statistics.

Language selection and navigation

Language, appearance and form protection use a short-lived server-side functional session. The session identifier is transmitted only through signed POST form fields. The website uses neither cookies nor Local Storage or Session Storage for this purpose, including dashboard sign-in.

Hosting provider

united-domains GmbH. According to the operator, general webspace access and error logs are disabled. The separate private security log for access, password recovery and important dashboard actions is described below. Connection data is still processed to deliver content.

You may complain in particular to an authority in your habitual place of residence, place of work or the location of the alleged infringement. Local contact: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany; poststelle@datenschutz.rlp.de.

Returning visits

Visitors are not statistically recognised on return. New website entries can create new functional sessions; internal navigation uses the existing session. When statistics are enabled, the start of a public visit is counted in aggregate. Session identifiers and individual session histories are not transferred into statistics.

No personal visitor profiles

The website creates no visitor profiles, uses no fingerprinting and integrates no external analytics or advertising services. Enquiries, technical delivery and necessary security measures remain separate processing operations as described above.

14. Internal dashboard processing

Authorised operators may manually create records to handle customer and privacy requests: contact address, short title, message reference, receipt and processing dates, necessary notes, reply draft and documented review steps. Contact forms do not create these records automatically; emails continue to be handled in the operator mailbox. Contract-related enquiries are processed under Article 6(1)(b) GDPR; compliance with data subject rights under Article 6(1)(c) together with the applicable GDPR duties. Where necessary, organisation of other enquiries relies on the legitimate interest in reliable, traceable handling under Article 6(1)(f). Only necessary information is entered. Content fields are encrypted in the database; case type, status and dates remain available for organisation. Completed cases receive an erasure review date. Information no longer needed is erased after checking applicable retention grounds; there is no blanket automatic erasure of all company data. Mailboxes, backups and other systems are considered separately. A review export is generated only on explicit request and is not stored as an additional server file. Dashboard sign-ins, recovery attempts and important case actions are normally retained in the private security log for 14 days; passwords, recovery codes and case contents are excluded. Password verification values are stored separately from functional sessions. Recovery uses a single-use code valid for 15 minutes, sent to the configured operator mailbox. Administrative access is solely for website management and creates no personal visitor profiles. Cases receive a random ticket number. After preview, authorised operators can send acknowledgements and responses through the configured mail server. Recipient address, language, message content, ticket reference and sending status are stored with the case, using encryption for content and necessary organisational metadata. Internal notes are not sent. Previews expire after 30 minutes and are removed by maintenance. SMTP acceptance does not prove inbox delivery. The template embeds the logo as an email attachment without remotely loaded images or opening trackers. Confirmed erasure also removes the erasure request itself, other cases under the same email address, associated messages and ticket references in administrator logs. The final notice is then sent from memory without retaining a new case copy. Data in the mailbox, at the mail provider, in backups, exports or under other addresses must be reviewed separately and erased where required. Legal retention duties and other permitted exceptions are assessed individually. Independent security logs of administrative access retain their stated retention period.