1. Controller
The controller is the operator named in the German Impressum, which also provides the postal address and direct email contact.
2. Technical access data and Cloudflare
A page request necessarily transmits connection data such as IP address, timestamp, requested URL, referrer, browser/operating-system information and HTTP status. Utildesk is delivered through Cloudflare Pages and Cloudflare Pages Functions. Cloudflare, Inc. acts as a recipient and processor for delivery, security, DDoS protection and troubleshooting. Processing is based on Article 6(1)(f) GDPR.
Cloudflare may process data outside the EEA. According to Cloudflare, transfers to the United States rely on the EU-US Data Privacy Framework and, where required, the EU Standard Contractual Clauses with supplementary measures.
3. Logs, cookies and local storage
Server and security logs are used only for delivery, troubleshooting, abuse prevention and security. They are deleted, anonymised or overwritten when no longer needed, unless an incident or legal obligation requires longer retention.
The public site does not set marketing cookies. localStorage can retain
utildesk-theme, utildesk-design,
utildesk-tools-view, utildesk-tools-sort and
utildesk-analytics-consent-v1 to remember choices expressly made by the
visitor. The protected editorial area uses the strictly necessary session cookie
utildesk_ratgeber_review.
4. Optional Umami analytics
The self-hosted, cookie-free Umami tracker on stats.utildesk.de is loaded only
after the visitor chooses “Allow statistics”. The legal bases are consent under Article
6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, the analytics script is not loaded.
Umami may process page URL and title, referrer, timestamp, language, browser, operating
system, device type, screen resolution and approximate country or region. The IP address
is used for technical processing and coarse location but, according to Umami, is not
stored. Utildesk also records a qualified-reader event after a trusted
interaction, at least 45 seconds reading time and at least 50 percent scroll depth. It
stores page type, language and threshold values, not the content of user input.
Consent can be changed at any time through “Privacy settings” in the footer. Withdrawal does not affect processing that was lawful before withdrawal.
5. External resources and links
The site loads Google Fonts and may request missing tool favicons from Google, DuckDuckGo or Icon.Horse. The visitor's IP address and technical request information are transferred to the relevant provider. This is based on the legitimate interest in a readable and recognisable directory under Article 6(1)(f) GDPR. Providers outside the EEA may rely on adequacy decisions or Standard Contractual Clauses.
Tool entries and guides can contain affiliate or referral links. The destination provider processes a request under its own privacy policy only after the visitor follows the link. Utildesk does not set its own marketing cookie for this purpose.
6. Machine-readable and editorial endpoints
Utildesk provides feeds, JSON APIs, Markdown mirrors and llms.txt manifests. These
endpoints create the same technical access data as regular page views. The protected
Ratgeber review area stores drafts, images, metadata and status information in Cloudflare
KV and is protected by authentication and technical tokens.
7. Contact
If a visitor contacts Utildesk, the sender address, message, time and voluntarily supplied information are processed to handle the request. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters and otherwise Article 6(1)(f) GDPR.
8. Recipients, transfers and retention
Data is disclosed only to recipients needed for the stated purposes, especially Cloudflare, providers of requested external resources and communication or infrastructure providers. International transfers rely, where required, on an adequacy decision, Standard Contractual Clauses and supplementary measures.
Personal data is retained only while the relevant purpose exists. Contact data is deleted after the request is resolved unless retention duties apply. Security data can be retained until an incident is resolved. Analytics data is deleted or aggregated when no longer needed for audience comparison and service improvement. Local preferences remain on the visitor's device until deleted by the visitor or browser.
9. Your rights
Subject to the statutory conditions, data subjects have rights of access, rectification, erasure, restriction, portability and objection under Articles 15–21 GDPR. Consent may be withdrawn at any time with future effect. A complaint can be lodged under Article 77 GDPR, including with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, www.ldi.nrw.de.
10. Required data and automated decisions
The website cannot be delivered without technically necessary connection data. All other information is voluntary. Utildesk does not make solely automated decisions that produce legal or similarly significant effects.
11. Updates
This policy may be updated when the website, infrastructure or legal requirements change.