This Privacy Policy explains how personal data is collected, processed, and stored when accessing shapeXT.com, shapeXT.de, shapeIT-software.com, shapeIT-software.de, and their respective subdomains, in compliance with the General Data Protection Regulation (GDPR / DSGVO) and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

1. Controller

The controller responsible for data processing on this website pursuant to Art. 4 No. 7 GDPR is:

Dr. Michael Böhme Softwareentwicklung Röhrstraße 66 99423 Weimar, Germany Email: mail@shapeXT.com Website: www.shapeXT.com

2. Web Hosting & Server Log Files

This website is hosted on servers located within the European Union (Germany). To ensure compliance with data protection regulations, a Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV) has been concluded with the web hosting provider pursuant to Art. 28 GDPR.

When you visit this website, the hosting server automatically collects and temporarily stores technical connection data in server log files:

  • IP address of the requesting terminal device
  • Date and time of the request
  • URL of the retrieved file or page
  • HTTP status code
  • Referrer URL (the previously visited page)
  • Browser type, version, and operating system

Statistical Analysis: For the purpose of understanding website usage and detecting technical errors, these server log files are analyzed using the self-hosted, open-source tool GoAccess. GoAccess runs locally on the same server, processes the log data in place, and does not transmit any data to external third parties or cloud services. Prior to analysis, IP addresses are anonymized (the last octet of IPv4 addresses / equivalent portion of IPv6 addresses is truncated), so that no direct identification of individual visitors is possible. The resulting statistical dashboard is accessible only to the site operator and is not publicly available or shared with third parties.

Legal basis & retention: Processing is carried out pursuant to Art. 6(1)(f) GDPR based on the legitimate interest in maintaining system stability, ensuring data security, and detecting/preventing malicious attacks. Server log files are retained for a maximum of 4 weeks and automatically deleted thereafter, unless retention is required for evidentiary purposes in connection with illegal activity.

3. Cookies & Local Storage

This static website (generated via Hugo) is engineered to operate without tracking cookies or third-party profiling scripts.

Any cookies used are strictly technical session cookies necessary for essential functionality (e.g., handling form validation or basic security controls). In accordance with § 25 (2) No. 2 TDDDG and Art. 6 (1)(f) GDPR, strictly necessary cookies do not require prior user consent. You can configure your browser to block, limit, or automatically delete cookies upon closing.

4. Newsletter Subscription via phpList

If you subscribe to the shapeXT release notification or product updates, the email address provided during sign-up is processed to deliver the newsletter.

  • Self-Hosted Infrastructure: The newsletter is managed exclusively through an in-house installation of the open-source software phpList, hosted locally on the same server environment in Germany. No subscriber data is shared with, transferred to, or processed by external third-party email service providers or cloud vendors.
  • Double Opt-In (DOI): Registration uses a double opt-in procedure. After entering your email address, you will receive a verification email containing a confirmation link. Your subscription becomes active only after clicking this link. This prevents unauthorized registrations using third-party email addresses.
  • Logging for Proof of Consent: Pursuant to Art. 7(1) GDPR, each registration is logged. Recorded data includes the email address, IP address, and timestamps of both the initial registration and the double opt-in confirmation. Server log files are retained for a maximum of 4 weeks and automatically deleted thereafter, unless retention is required for evidentiary purposes in connection with illegal activity.
  • Legal Basis: The processing of your data is based entirely on your consent pursuant to Art. 6(1)(a) GDPR.
  • Unsubscribe & Retention: You may withdraw your consent and unsubscribe from the newsletter at any time with future effect by clicking the “Unsubscribe” link included in every newsletter email, or by sending a message to mail@shapeXT.com. Upon unsubscription, your email address is removed from the active mailing list.

5. Social Media & External Links

This website contains links to external social media platforms and profiles (such as Instagram, YouTube, X/Twitter, and academic repositories).

These are implemented as standard external hyperlinks, not active tracking widgets, embedded iframes, or tracking pixels. No personal data or browsing information is transferred to these platforms simply by visiting this website. Data transfer to the respective platform occurs only if you actively click on the link to visit the external service.

6. Automated Decision-Making and Profiling

We do not use any form of automated decision-making or profiling within the meaning of Art. 22 GDPR. No decisions producing legal effects concerning you, or similarly significantly affecting you, are made on this website through automated means alone.

7. Your Rights Under the GDPR

As a data subject, you hold the following statutory rights under Chapter III of the GDPR:

  • Right of Access (Art. 15 GDPR): Request information on whether and what personal data concerning you is processed.
  • Right to Rectification (Art. 16 GDPR): Request the correction of inaccurate or completion of incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): Request the deletion of your personal data (“right to be forgotten”), provided no statutory retention obligations apply.
  • Right to Restriction of Processing (Art. 18 GDPR): Request the restriction of data processing under certain statutory conditions.
  • Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Withdraw Consent (Art. 7(3) GDPR): Revoke any previously granted consent (such as for the newsletter) at any time with effect for the future.
  • Right to Object (Art. 21 GDPR): Object at any time to the processing of personal data based on legitimate interests (Art. 6(1)(f) GDPR).

To exercise any of these rights, contact: mail@shapeXT.com.

8. Right to Lodge a Complaint

If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

The competent supervisory authority for this business location is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8
99096 Erfurt, Germany
Website: www.tlfdi.de