Translation of the Datenschutzerklärung. The German version is legally binding.
In short: this website sets no cookies for visitors, uses no tracking or audience measurement and loads nothing from other servers. We process personal data in the server log files, when you contact us, when you sign up for the CachePilot beta and use the beta account (newsletter, download, feedback) and when the CachePilot plugin on your website checks for updates.
This privacy policy explains the type, scope and purpose of the processing of personal data (hereinafter “data”) in the course of providing our services and within our online offering and the websites, functions and content connected with it (hereinafter together “online offering”). For the terms used, such as “processing” or “controller”, we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
Controller
Patrick Schlesinger
Theresienhöhe 1
80339 München
Germany
Phone: +49 89 21 5505 88 – 8
Fax: +49 89 21 5505 88 -9
Email: support@cms-admins.de
Types of data processed
- Master data (for example personal master data, names or addresses).
- Contact data (for example email, phone numbers).
- Content data (for example text entries, photographs, videos).
- Usage data (for example websites visited, interest in content, access times).
- Meta and communication data (for example device information, IP addresses).
Categories of data subjects
Visitors and users of the online offering (hereinafter we refer to the data subjects together as “users”).
Purpose of processing
- Providing the online offering, its functions and content.
- Answering contact requests and communicating with users.
- Security measures.
- Running the CachePilot beta: beta account, download, updates, feedback and newsletter.
Terms used
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (for example a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Relevant legal bases
In accordance with Article 13 GDPR, we inform you of the legal bases of our data processing. For users within the scope of the GDPR, that is the EU and the EEA, the following applies unless the legal basis is named in this privacy policy:
The legal basis for obtaining consent is Article 6 (1) (a) and Article 7 GDPR;
The legal basis for processing to provide our services and carry out contractual measures and to answer requests is Article 6 (1) (b) GDPR;
The legal basis for processing to comply with our legal obligations is Article 6 (1) (c) GDPR;
Where vital interests of the data subject or of another natural person make processing of personal data necessary, Article 6 (1) (d) GDPR is the legal basis.
The legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Article 6 (1) (e) GDPR.
The legal basis for processing to protect our legitimate interests is Article 6 (1) (f) GDPR.
The processing of data for purposes other than those for which they were collected is governed by Article 6 (4) GDPR.
The processing of special categories of data (according to Article 9 (1) GDPR) is governed by Article 9 (2) GDPR.
Security measures
In accordance with the law, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, input, disclosure, securing the availability and separation of the data. We have also set up procedures that ensure the exercise of data subjects’ rights, the deletion of data and the response to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default.
Cooperation with processors, joint controllers and third parties
If, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transfer data to them or otherwise grant them access to the data, this is done only on the basis of a legal permission (for example if a transfer of data to third parties, such as payment service providers, is necessary to perform a contract), if users have consented, if a legal obligation provides for it or on the basis of our legitimate interests (for example when using agents, web hosts, etc.).
If we disclose or transfer data to other companies of our group or otherwise grant them access, this is done in particular for administrative purposes as a legitimate interest and beyond that on a basis that complies with the law.
Hosting and sending emails
This website runs on servers that we operate ourselves (Patrick Schlesinger, CMS ADMINS), located in Germany: a web server for the website and the beta account and a separate database server. No other hosting provider receives your data.
The hosting services we use serve to provide the following: infrastructure and platform services, computing capacity, storage space and database services, sending emails, security services and technical maintenance, which we use to operate this online offering.
In doing so, we process master data, contact data, content data, contract data, usage data, meta and communication data of customers, prospects and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering according to Article 6 (1) (f) GDPR.
Emails from this website are sent through our own mail server. Account emails come from beta@getcachepilot.com, the newsletter from news@getcachepilot.com. No mailing service receives your address.
Access data and log files
On the basis of our legitimate interests within the meaning of Article 6 (1) (f) GDPR, we collect data on every access to the server on which this service is located (server log files). The access data include the name of the web page or file accessed, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
For security reasons (for example to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required as evidence are excluded from deletion until the incident in question has been finally resolved.
Cookies
“Cookies” are small files stored on users’ computers. Different information can be stored in cookies. A cookie serves primarily to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes the browser. Such a cookie can store, for example, the contents of a shopping cart in an online shop or a login status. Cookies that remain stored after the browser is closed are called “permanent” or “persistent”. For example, the login status can be stored if users visit after several days. Such a cookie can also store the interests of users that are used for audience measurement or marketing purposes. “Third-party cookies” are cookies offered by providers other than the controller operating the online offering (otherwise, if they are only its own cookies, they are called “first-party cookies”).
We may use temporary and permanent cookies and explain this in our privacy policy.
If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. Excluding cookies can limit the functions of this online offering.
Cookies on getcachepilot.com
Visitors get no cookies. WordPress sets cookies only for people who log in: to manage the site or in the beta account. By these cookies WordPress recognises you as logged in; the account does not work without them (section 25 (2) no. 2 TDDDG). They last until you log out, for at most two days, or at most 14 days with “Remember me”. We set no cookies for audience measurement or marketing and no third-party cookies.
No tracking, no third-party content
- We use no audience measurement, no tracking pixels and no advertising.
- Fonts, images, videos, styles and scripts come from this server. Your browser contacts no other server, so no third party learns that you visited. There are no Google Fonts, no embedded videos of other providers and no maps.
- There are no comments. Profile pictures are not loaded from Gravatar.
- We protect the sign-up without a captcha service (see “Protection against misuse”).
Contacting us
When you contact us (for example by contact form, email or phone), the information you provide is processed to handle your request according to Article 6 (1) (b) GDPR (within contractual or pre-contractual relationships) or Article 6 (1) (f) GDPR (other requests). The information may be stored in a customer relationship management system (“CRM system”) or a comparable request organization.
We delete requests when they are no longer required. We review the need every two years; statutory archiving obligations also apply.
Requests for CachePilot Server for ISPConfig
With the form at getcachepilot.com/contact/server/ you request CachePilot Server for ISPConfig. We store the information from the form, such as name, email address, company and your message, with the time of the request and send it by email to our own address. Deletion and legal basis follow the section “Contacting us”. The form is protected against misuse like the sign-up.
Beta account
To take part in the CachePilot beta you create a beta account. Only businesses can take part (section 14 German Civil Code). When you sign up, we process:
- required information: email address, password, name, address of your website, your role (site owner, agency, hosting provider, developer), the number of your sites (1, 2 to 10, 11 to 50, more than 50) and whether Redis is available (yes, no, not sure),
- optional information: company and whether you use WooCommerce, WPML or Multisite,
- your declarations: consent to the newsletter, acceptance of the beta terms and confirmation that you register as a business, each with the version of the text (see “Consent log”).
WordPress stores the password only as a hash. We need this information to decide on activation, to give you the download and to tune CachePilot to the environments in use. The legal basis is Article 6 (1) (b) GDPR.
Process and deletion periods
- After you submit the form we send you a confirmation link that is valid for 7 days. Accounts that are not confirmed within that time are deleted automatically after 7 days.
- If the address already has an account, it receives a hint by email instead; the form itself does not reveal whether an account exists.
- After confirmation we receive an email that a new sign-up is ready for review. We decide on activation and inform you by email.
- If we decline a sign-up, you receive no further newsletter and we delete the account after 30 days. The proof of your consent remains as described under “Consent log”.
- If we block an account, login and download are blocked.
Copy of your data and deleting your account
Under “Settings” in the account you can request a copy of your data and delete your account yourself at any time; you enter your password and confirm the deletion. We then delete your account with all information from the sign-up, your downloads and your feedback. Only the consent log remains as proof. We also export and delete the same data on request with the WordPress tools for data export and erasure.
Download
Activated accounts download the CachePilot plugin through a link that is bound to your account and valid for 2 days. We log each download with account, version and time, to detect misuse and to show you your downloads in the account. The legal basis is Article 6 (1) (b) and (f) GDPR. We delete the log with your account.
Feedback
After activation you can send us feedback. We store the type (bug, idea, performance, other), the address of your website, the versions of CachePilot and WordPress, your text and, if you paste it, the output of wp cachepilot status, together with your account, the time and the processing status. We also receive the feedback by email at our own address. You see your previous entries in the account. Do not paste passwords or personal data of third parties. We use feedback to improve CachePilot. The legal basis is Article 6 (1) (b) GDPR. We delete feedback with your account.
Protection against misuse
We protect sign-up, login and the form for server requests without third-party services: with a field invisible to humans, a signed timestamp in the form (valid from 3 seconds up to one day) and a limit on requests per IP address. For the limit we do not store the IP address itself but a counter under a hash of the address. The counter expires with its time window:
- beta sign-ups: at most 5 in one hour,
- failed logins: at most 5 in 15 minutes.
The legal basis is our legitimate interest in secure operation (Article 6 (1) (f) GDPR).
Newsletter
With the following information we inform you about the content of our newsletter, the sign-up and sending procedure and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.
Content of the newsletter: We send newsletters, emails and other electronic notifications with promotional information (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. If the content of a newsletter is specifically described when signing up, this description is decisive for the consent of the users. Otherwise our newsletters contain information about our services and us.
Signing up for the newsletter is part of the beta sign-up and a condition of taking part. The newsletter informs about new versions of CachePilot, the course and the end of the beta.
Double opt-in and logging: Signing up for our newsletter uses a double opt-in procedure. This means that after signing up you receive an email asking you to confirm your sign-up. This confirmation is necessary so that nobody can sign up with someone else’s email address. Sign-ups for the newsletter are logged in order to prove the sign-up process in accordance with legal requirements. This includes storing the time of sign-up and of confirmation as well as the IP address.
The newsletter is sent on the basis of the consent of the recipients according to Article 6 (1) (a), Article 7 GDPR in conjunction with section 7 (2) no. 3 of the German Act against Unfair Competition (UWG).
Logging of the sign-up procedure is based on our legitimate interests according to Article 6 (1) (f) GDPR. Our interest is in using a user-friendly and secure newsletter system that serves our business interests, meets the expectations of users and also allows us to prove consent.
No tracking: We send the newsletter through our own mail server and measure neither opens nor clicks. The newsletter contains no tracking pixels and no redirected links.
Cancellation and withdrawal: You can cancel receipt of our newsletter at any time, that is, withdraw your consent. You find a link to cancel the newsletter at the end of each newsletter. It works without logging in; your email program can also trigger it directly (List-Unsubscribe). Alternatively, unsubscribe under “Settings” in the beta account. Withdrawal ends your participation in the beta. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a consent that was given. The processing of these data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.
Consent log
For the newsletter, the beta terms and the confirmation as a business we store per declaration: email address, account number, type of declaration, version of the text you agreed to, time of sign-up, time of confirmation, your IP address shortened (for IPv4 the last byte is removed) and, where applicable, the time you unsubscribed. After unsubscribing the entry remains for 3 years as proof; a daily run deletes it afterwards. The legal basis is Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR and our legitimate interest in the proof (Article 6 (1) (f) GDPR).
Emails from the beta account
The beta account only sends emails that account and beta need: the confirmation link after sign-up, a hint when someone tries to open a second account with your address, the message about activation or rejection and the confirmation of an account deletion. You receive promotional information only through the newsletter. The legal basis is Article 6 (1) (b) GDPR.
Update check of the plugin
When CachePilot is installed on your website, the plugin asks update.cms-admins.de for new versions. Your server transmits the address of your website, the installed version of CachePilot and, for technical reasons, its IP address. We operate the update server ourselves; no third party receives these data. We use them to provide suitable updates and to protect the service against misuse. The legal basis is Article 6 (1) (b) GDPR, otherwise our legitimate interest in a secure update service (Article 6 (1) (f) GDPR).
Other connections of the plugin go only to your own website (for example to preload pages and for the safety check after modules are switched on) and to your own Redis server.
Rights of data subjects
You have the right to request confirmation as to whether data concerning you are being processed, and to access these data as well as further information and a copy of the data in accordance with the law.
In accordance with the law, you have the right to request the completion of data concerning you or the rectification of incorrect data concerning you.
In accordance with the law, you have the right to request that data concerning you be deleted without delay or, alternatively, that the processing of the data be restricted.
You have the right to receive the data concerning you that you have provided to us in accordance with the law and to request their transfer to other controllers.
In accordance with the law, you also have the right to lodge a complaint with the competent supervisory authority.
Right of withdrawal
You have the right to withdraw any consent you have given with effect for the future.
Right to object
You can object to the future processing of data concerning you at any time in accordance with the law. The objection can in particular be made against processing for direct marketing purposes.
Deletion of data
The data we process are deleted or their processing is restricted in accordance with the law. Unless expressly stated in this privacy policy, the data stored by us are deleted as soon as they are no longer required for their purpose and no statutory retention obligations prevent deletion.
If the data are not deleted because they are required for other legally permissible purposes, their processing is restricted. This means the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.
Changes and updates of this privacy policy
Please inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (for example consent) or another individual notification.