Privacy Policy

Applies to winkler.software and all subdomains (*.winkler.software).

This English version is provided for convenience only. In case of discrepancies, the German version (Datenschutzerklärung) shall prevail.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Marvin Winkler
Softwareentwicklung
Dachauer Str. 15
85256 Vierkirchen
Germany
Phone: +49 157 51982847
Email: privacy@winkler.software

2. Hosting and email

This website is hosted on servers of netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany. The servers are located in Germany. We have concluded a data processing agreement with netcup in accordance with Art. 28 GDPR, which ensures that our visitors' data is processed only on our instructions and in compliance with the GDPR.

The mail servers for emails to addresses at @winkler.software are hosted by OVH S.A.S., 2 rue Kellermann, 59100 Roubaix, France. The servers are located within the European Union. We have concluded a data processing agreement with OVH in accordance with Art. 28 GDPR. No data is transferred to third countries.

3. Visiting the website, server log files and security

Our websites consist of static pages only. We use no cookies, no scripts executed in the browser (JavaScript), no analytics or tracking services and no content from third parties (such as fonts or CDNs).

Each time our website is accessed, the server automatically records the following data in a log file:

• the IP address of the requesting computer,
• date and time of access,
• the requested address (domain and URL), the request method and the protocol used,
• the HTTP status code, the amount of data transferred and the processing time,
• your browser's identifier (user agent, usually containing browser type, version and operating system),
• the page from which you reached us (referrer).

No other information, such as other headers of your request, is logged. Technical messages and error messages of the web server (e.g. during connection set-up or for requests to host names that are not configured), which may contain an IP address, are stored in the server's system log. All of these logs are deleted automatically after 7 days at the latest. The data is not combined with other data sources.

Use of Fail2ban to prevent attacks

To protect our servers against attacks (e.g. brute-force attacks, unauthorised access attempts or automated scans), we analyse these log files and the logs of login attempts to the server (SSH: IP address, time and user name used) locally with the software “Fail2ban”. If the system detects abusive behaviour, the IP address concerned is temporarily blocked for the affected service, for no longer than 48 hours. The block list is cleaned up after 5 days at the latest. The logs and the block list remain on our server; they are neither passed on to third parties nor transferred to third countries.

The legal basis for the temporary storage in log files and their analysis is our legitimate interest in providing the website and in the integrity, confidentiality and availability of our IT systems (Art. 6(1)(f) GDPR). Providing the IP address is technically necessary to access the website; there is no legal or contractual obligation to do so. The connection is encrypted with TLS; unencrypted requests via http:// are redirected to the encrypted address and are logged as described above.

Language selection on the homepages

Your browser sends a list of preferred languages with every request (Accept-Language header). When you open the homepage winkler.software/ or rerouter.winkler.software/, our server uses this list to forward you to a matching language version, for example /en/ or /de/. If no supported language matches, you get the English version; without any language information, winkler.software stays in German. The list is evaluated only for this forwarding; it is not written to the log files and not stored. No cookies, browser storage or identifiers are used. Explicit language addresses such as /en/ and all other pages are never forwarded, so you can always choose a language yourself. The forwarding and the request for the selected page appear in the log files described above, like any other page request. The legal basis is our legitimate interest in showing the website in a language you understand (Art. 6(1)(f) GDPR).

4. Contacting us by email

If you contact us by email, we store the information you provide (e.g. email address, name, content of the message) in order to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary for pre-contractual measures, and otherwise our legitimate interest in handling enquiries addressed to us (Art. 6(1)(f) GDPR).

We delete this data as soon as it is no longer needed for handling your enquiry, at the latest 12 months after the correspondence has ended, unless statutory retention obligations (in particular § 147 AO and § 257 HGB for business letters and invoices, 6 or 8 years) prevent this.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise your rights, an email to privacy@winkler.software is sufficient.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR)

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

6. Automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place. The temporary blocking of individual IP addresses by Fail2ban (section 3) is a purely technical protective measure without legal or similarly significant effect.

Last updated: 20 October 2026