Data protection notices

1. Accountable person

Matthias Gläßner IT-Lösungen
Weinsheimer Weg 10, 55593 Rüdesheim (near), Germany
E-mail: info@seitenreport.de

A data protection officer is not currently appointed.

2. Definitions

Personal data is information that identifies or makes identifiable a person. Processing includes collection, storage, transmission and deletion. For the storage and reading of browser information, § 25 TDDDG additionally applies.

3. Purposes and legal bases

• Performance and contract: We process inquiries, account management, desired analyses, reports, orders and payments for contract initiation or contract fulfillment, also for existing free suite accounts (Art. 6 para 1 lit. b GDPR).
• Operation and protection: Our legitimate interest in secure operation, misdeclaration, support and abuse prevention is the basis for corresponding technical and internal processing (Art. 6 para 1 lit. f GDPR).
• Legal obligations: In particular, accounting, tax and storage obligations are based on Art. 6 para. 1 lit. c GDPR.
• Voluntary marketing: Advertising requested separately takes place to the extent of your consent (Art. 6 para 1 lit. a GDPR). You can revoke them at any time.

The product and conversion evaluation of public offers explained Point 8c. For terminal accesses, the conditions in Paragraph 5.

4. Hosting and server logs

Website, suite and e-mail services we operate ourselves on server infrastructure of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the EU. There is an AV contract with Hetzner. We also deliver static content via our own subdomains.

When a page is called up, technical protocols with IP address, time, URL called up, status code, origin page (referrer), browser identifier and data volume are created. They serve delivery, security and error analysis (Art. 6 para 1 lit. f GDPR). Storage shall be governed by: Number 12.

5. Cookies and browser storage

For registration, security and functions you want, we use cookies and local browser storage:

• Notification: sr_audit_license maintain the suite session for up to 30 days. For existing annual license sessions, the previous longer validity can apply. The cookie is not readable for scripts and is transmitted encrypted.
• Form protection: sr_suite_form protects up to two hours from foreign form requests.
• Presentation and processing: Selected dark mode, audit views, completed measures, unlock and share link information can remain local until the browser memory is changed or deleted.
• Continuation of a process: Short-term form assignments support clicked tool and offer functions. The suite saves the tile/list view ()suite-project-view) and a domain selected for the project (suite-project-intent) in the memory of the respective tab. The domain will be considered for a maximum of 24 hours and will be removed upon return, project installation or deregistration. The tab memory ends with the browser session if it is not restored.

As far as these accesses are absolutely necessary for the desired function, § 25 para. 2 No. 2 TDDDG; for personal data additionally Art. 6 para. 1 lit. b or f GDPR. We do not use these function stores for cross-site advertising profiles.

Product analysis: The suite does not use marketing cookies or browser-side product analysis. Public event measurements are in Point 8c described above. Even without cookies, not necessarily necessary terminal accesses generally require consent according to § 25 Abs. 1 TDDDG; a GDPR legal basis does not replace this.

6. Contact and requests

In the case of contact, offer and result requests, we process your information in order to answer, prepare an offer and provide requested information:

• contact details such as name, e-mail and, where applicable, company, telephone or website;
• Message and desired performance, such as package, budget or period;
• associated audit context, result link and key figures, as well as confirmation, consent and campaign information;
• technical protection data, such as browser identifier, abbreviated or hashed IP address and features for the recognition of automated requests.

Legal bases are Art. 6 para. 1 lit. b GDPR in case of contract and lit. f for communication, support and protection against abuse. Without the information necessary for processing, we cannot fulfill the request.

Result by e-mail: A requested result message contains the audit link and key figures. If you additionally or separately indicate an interest in paid SEO support, Matthias Gläßner will contact you by e-mail for this specific request. The sending of results is also possible without such a request. General advertising requires a separate, voluntary and revocable consent (Art. 6 para 1 lit. a GDPR). Time limits: Number 12.

7. Registration and login

New suite accounts will be set up after confirmed tariff booking with the email address from the Stripe checkout. A unique activation link confirms access to the mailbox and logs it in. It is valid 24 hours; you can then set your own password. Existing passwords are not replaced. We store password hashes, activation and session data as well as version and proof of the accepted terms of use. The processing serves booking, fulfillment of the contract and access protection (Art. 6 para 1 lit. b and f GDPR).

For existing basic accounts, name, company and billing address are not required. Advertising consent is not a requirement. Company and invoice information is recorded on a booking ()Point 8a).

When changing from an audit, domain, tariff and payment methods can be provided for pre-occupation; the domain appears in the form and, if necessary, in the confirmation link. A technical domain proof is voluntary.

Existing accounts: We use earlier contact, registration, license and contract data for processing, secure allocation and, if necessary, migration. Imported projects remain paused until they are activated. Account management and migration are based on Art. 6 para. 1 lit. b, security on lit. f and legal evidence on lit. c GDPR. Data deadlines: Number 12.

8. Website analyses

For requested analyses, we process target URLs, analysis time, publicly available page content and technical results, such as HTTP status, forwarding, metadata and indexing. In addition, there are limited control and abuse protection data.

This serves the analysis (Art. 6 para 1 lit. b GDPR) as well as stability and protection against abuse (lit. f). Data from target websites and external search or backlink sources will only be processed as part of the requested check. Consignee: Paragraph 9; time limits: Number 12. For recurring suite projects applies in addition Point 8b.

8a. Booking and payment

For ordering, activation, subscriptions, invoices and proof of contract, we process:

• name/company, e-mail, billing address and, where applicable, VAT ID;
• product, tariff, price, currency, method of payment, term, payment and termination status;
• Customer, payment and order references as well as proof of use, such as associated analytics, domains, quotas and code redemptions;
• Confirmations of the GTC and business use including text version, time and assignment reference.

The legal basis is the fulfillment of the contract (Art. 6 para 1 lit. b GDPR), legal obligations (lit. c) and protection against fraud and unauthorized use (lit. f). Required invoice and payment details are a prerequisite for booking.

Stripe: Checkout and subscription management are carried out via Stripe, in particular Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, each based in Ireland, as well as responsible group companies. Enter payment details at Stripe. Stripe processes them, depending on the purpose, as a processor or self-responsible, for example for payment security and legal audits.

We transfer the company name and proof of booking/confirmation into the account. We do not store complete card or account data. Stripe metadata does not contain entered analysis URLs, detailed test results, or free internal notes. Order, activation and subscription messages are used for contract processing.

Other information: Stripe data protection, Transfers from third countries and Storage periods.

8b. SEO Suite and Notifications

The suite processes data for your projects, recurring analyses, processes, exports and selected reports (Art. 6 para 1 lit. b GDPR):

• Projects: Domains, labels, tags, voluntary domain proofs, quotas, break and notification settings.
• Analyses: Check results, URLs, key figures and scores as well as old and new check values in the change log, such as page titles or HTTP status.
• Rankings and backlinks: Deposited keywords, ranking progressions and organized backlinks. Ongoing external queries are not included in Basis. The transmitted query data describes: Paragraph 9; please do not use confidential or personal information as keywords.

Private results are associated with your account. An activity time is updated at most hourly for account management. The download of audit data and templates for AI does not itself transmit data to an AI provider.

Protection against abuse

Request limits use protected hash values of IP or email addresses. An invisible form field recognizes simple bots; its contents are not stored. Recognized bot requests are rejected. New paid accounts are created only after confirmed payment; the mailbox access is confirmed upon activation. The basis is our legitimate interest in a secure service (Art. 6 para 1 lit. f GDPR); we do not use additional cookies or external CAPTCHA services for this purpose.

Emails and settings

Necessary messages concern confirmation, password resetting, security and billing. Project reports can be posted separately:

• New errors: first switched off; after activation, indications of newly detected errors or an increase in the number of errors per check for comparable crawls. The first analysis is the starting point.
• Project status: preset weekly; selectable every two weeks, monthly or off.

You can turn off reports per project and centrally under “Account & Tariff”. Shipping via our own mail server; no opening pixels or externally reloaded logos. Consignee, subject, content and shipping status are in a queue for delivery and error handling.

Internal functional control: To check registration and tariff activation, we process e-mail address, account ID, time, tariff and payment method. This serves reliable processes and troubleshooting (Art. 6 para 1 lit. f, in the case of contract processing additionally lit. b GDPR).

Control and cancellation

Under “Privacy & Account Data” you can download account settings, projects and history or delete the account. A project deletion removes related analyses, changes, rankings and backlinks. In the case of ongoing orders, a new erasing step may be necessary after their completion; the surface indicates this. Legally required proofs of contract remain stored separately. All deadlines are in Number 12.

8c. Product and event analysis

Public audit, monitoring, booking and form offerings collect their own event data for function control, error analysis, product improvement and conversion measurement. In the SEO Suite, browser-side audit events and report call messages are disabled.

• Events: Time, page/product clicks, visible offers, form and checkout steps, exports, feedback and error and success messages.
• Context: Tariff, billing period, offer, selected module, audit key figures, activation and technical order references.
• Technical specifications: Page path, origin page, page title, window size, campaign parameters and pseudonymized assignments such as hashed IP/domain values or analysis IDs.

Entered e-mail addresses are not stored as event metadata; explicitly sent free text feedback is processed. Domain/URL references are pseudonymised where possible for statistical purposes. The events remain on our systems and are not used for recognition across foreign websites.

Report calls: For visibly opened, closed and unlocked public reports, analysis ID, time and call number can be recorded and internal support messages with domain, analysis ID and time can be triggered. There is no additional visit recognition for this. This does not result in reliable proof of the person or the e-mail delivery.

The evaluation is based on legitimate interests in functional control, incorrect declaration and improvement of own offers (Art. 6 para 1 lit. f GDPR); directly contract-related processes on lit. b. Requirements for terminal access remain independent of this ()Paragraph 5) Time limits: Number 12.

8d. Integrated SEO Check Form

Website operators can include a free HTML form that guides visitors to the regular SEO check on Seitenreport. The provided code does not load any Seitenreport scripts, images, fonts or tracking pixels on the foreign website. The form alone does not create a request to us when the page is called up.

Only upon sending will we receive the entered website address, a possibly set factual integration identifier and technically transmitted origin data from the browser. For function control and success measurement, we record time, origin domain, target domain, presence of a referrer, identifier and process status. A missing or unusable origin is stored as unknown; the browser information is not proof of identity. Full referrers, URL paths, URL parameters and IP addresses are not stored in this integration statistic.

A random handover token connects the submit to an audit that has actually been started or an existing result. It is valid for 15 minutes, is stored on the server side only hashed and removed after use or expiration. For this we do not use any additional cookies or fingerprinting. For the subsequent regular audit process, points 5 and 8 apply in addition.

Individual events including target domain and audit assignment are deleted after 90 days. Daily counters are retained for 730 days. Domain-related total counters, first/last submission and first contact status will be maintained for the duration of the integration offer. Newly detected external origin domains can trigger a limited internal notification. No visitor contact data or audit results are transmitted to the integrating website operator.

The server-side evaluation serves our legitimate interest in functional control and improvement of the offer (Art. 6 para 1 lit. f GDPR); the requested analysis is based on Section 8. To protect against abuse, we use short-lived, daily changing HMAC values of the IP address with counters; these are removed at the latest at the next hourly cleaning after two days. General server protocols and their deadlines remain unaffected (paragraph 4). Operators of an integrated website remain responsible for their own data protection notices.

8e. Website website seal and public audit reports

In the expressly ordered seal provision, we process your existing account allocation, domain, payment data, publication consent, possibly an earlier domain proof, right of use and an immutable, limited result snapshot for the fulfillment of the contract (Art. 6 para 1 lit. b GDPR). Payment processing, account security and invoice storage follow the procedures described above. The use license does not justify ongoing website checks.

For new bookings, you confirm your domain authorization and the publication explicitly in the checkout. Only after confirmed payment will the domain, verification date, URL number, total score and selected category scores as well as the license status become public. For previous bookings, expressly release the report once in the account after payment. A technical domain proof is not required; the integration of the seal is voluntary. Individual findings, affected URLs and account data are not published. You can deactivate publication in your account at any time. The reports are noindexed; this does not prevent third-party copying.

The seal graphics are stored on the customer's own web server. Merely displaying this local graphic does not result in requests or cookies from Seitenreport. Only when clicking opens the public test report; the information about server protocols applies.

Internal success control includes product promotions, checkouts, confirmed payments, release releases, downloads and calls for public reports. No additional external analytics services or marketing cookies are used. Repeated calls are assigned with daily changing HMAC identifiers and limits of abuse; raw IP addresses are not stored in these events. Call and download events are cleaned up after 180 days. The measurement serves our legitimate interest in product improvement and protection against abuse (Art. 6 para 1 lit. f GDPR). It does not occupy installations or insertions on foreign websites.

The result snapshot and the public audit report are stored for the duration of the contractual use of the seal. New activations are unlimited in time. For previous temporary licenses, the publication can remain after expiration and then shows the expiration status. When the account is deleted, it is deactivated and the result snapshot is removed. Payment and necessary proofs of contract are retained within the framework of statutory storage obligations. Other conditions: Use and publication of the website seals.

8f. 360° expert analysis

For booking and manual processing, we store order ID, website, origin of the offer call (home page, audit result or directly), service and price version, customer and invoice data, Stripe payment references, payment and processing status as well as required internal notes. The processing for the execution of the order and for sending the reports and confirmations takes place on the basis of Art. 6 para. 1 lit. b GDPR; legal storage obligations are based on Art. 6 para. 1 lit. c GDPR. Payment and necessary proof of contract are subject to the statutory retention periods; other work documents are deleted if they are no longer necessary for processing, enquiries and legitimate proof purposes.

The technical and personal examination concerns public content of the commissioned website. Report and screenshots are not provided publicly, but delivered to the email address provided at the time of booking. The payment including invoice is made via the Stripe connection described in these notes. The necessary browser binding and the CSRF protection use the existing function cookie of the booking; an additional tracking cookie is not set.

To improve the offer, we count CTA clicks, landing page views, checkout starts and confirmed payments in the existing internal statistics. Public clicks and views are limited per day and origin based on a value formed with a secret key; raw IP addresses or customer contact data are not stored in the events. Checkout and payment events contain the internal order reference and the origin. The basis is Art. 6 para. 1 lit. f GDPR (economic evaluation of your own offer and protection against abuse). There is no transfer of these events to advertising networks. For the events, the deadlines of the internal statistics described below apply.

Appointment for personal SEO/technical advice

For the appointment agreement, the interview and the written summary, we link the booking with the identifier of your existing audit. We use the e-mail address specified in the checkout for the booking confirmation, appointment suggestions, the access link to the online appointment and the sending of the summary. The associated audit remains available until the completion of the booked service. After completion, his regular storage periods apply again.

8g. Seitenreport API and Credits

For API access and prepaid billing, we store the buyer’s email address, order and payment references, balances and credit bookings. Payment via Stripe is in Point 8a described above. To deliver the personal access link, we use our e-mail queue. We store API keys as a hash.

For requested URL checks, we store the submitted URL, evaluated page features and findings. With a linked suite account, we assign the project requests to the authorized access. This data serves for the provision, access control and billing of the ordered service.

9. Recipients of data

• Infrastructure: Hetzner for the self-operated server (Paragraph 4).
• E-mail: Upon delivery, the mail provider used by the recipient receives the message.
• Payments: Stripe and the service providers involved in the chosen payment method ()Point 8a).
• Backlinks and rankings: Provider of SEO databases and search result APIs based in the EU, currently Estonia. You get required domains/keywords, search area, language and device, no suite login data.
• Technical queries: Target websites and DNS services can process requested URLs and technical access data of our crawler.
• Internal: Authorized persons at Seitenreport for operation, contract processing, support and functional control.

10. Order processing

We use processors on the basis of contracts according to Art. 28 GDPR. Other recipients, such as payment service providers, can act independently depending on the processing.

11. Data processing outside the EU

External payment and data providers may process data outside the EU/EEA:

• Stripe: The Data Transfers Addendum specifies the EU-U.S. Data Privacy Framework and, where applicable, EU standard contractual clauses for registered certified US recipients.
• Backlink and ranking data: The data provider can use technical service providers in the USA, among others. According to him, EU standard contractual clauses or relevant adequacy decisions apply to this.

Information on specific recipients and copies of relevant guarantees can be obtained at info@seitenreport.de.

12. Storage periods and deletion

Data will be deleted or anonymized as soon as its purpose ceases and there is no storage obligation. Browser storage periods are in Paragraph 5.

Website, requests and contracts

• Server logs: Usually not more than 30 days; longer only if security-related storage is required in individual cases.
• Questions: regularly up to twelve months after conclusion; longer in the case of necessary contract processing, proof-keeping or legal obligations. Evidence of consent shall be retained for the required period of proof.
• Public analyses and process logs: generally for up to twelve months. The following separate retention periods apply to Suite projects.
• Safety/misuse data: regularly 30-90 days, correspondingly less in case of shorter necessity.
• Product and event data: regularly up to 180 days; longer only if necessary for specific misdeclaration, contract implementation, prevention of abuse or legal obligations.
• Orders, invoices and proof of contract: for the legal storage periods. License, unlock code and redemption dates until the elimination of necessary contract, security and proof purposes; expired session and reset dates are periodically cleaned up.

Suite account and analysis

• Account master data: until the account is deleted; necessary proof of contract may be longer. Missing logins do not end automatic checks and do not trigger a blanket account deletion.
• Condensed histories and change protocols: Base 30 days, Pro 365 days, Business 730 days, Agency 1,095 days (about one, twelve, 24 or 36 months). This includes existing score and ranking progressions. For new paid accounts, automatic checks and project emails are suspended after the end of the paid period. Existing project results are stored for 30 days after the subscription end and are then deleted in regular background runs. Project settings and account master data are retained until project or account deletion. Existing basic accounts retain their previous deadlines.
• Complete raw audit data: the last two completed analyses remain available, even if they are older for paused projects. They are deleted upon redemption, 30 days after the end of the subscription for new paid accounts or for project/account deletion; earlier raw data is regularly removed.
• Quota and API cost records: three months after the end of the period of use. Cost records do not contain domains or keywords.

Technical suite data

• Activation/confirmation and reset links: 24 hours or one hour valid; expired tokens are cleaned.
• Unfinished bookings: Confirmed expired orders without account allocation will be cleaned after 30 days. Bookings that are not yet securely assigned remain until clarification, so that delayed payments are not lost. For paid bookings, the contract and storage periods apply.
• Request limits: Clean up if the time window is more than two days ago.
• queue of dispatch: Completed, failed or cancelled messages as well as outdated project reports after seven days from creation. Unprocessed activation/confirmation/reset emails after two days. Other pending account/billing messages shall remain pending processing; for internal control messages, the maximum time limit set out below shall apply.
• Background contracts: 30 days after completion, final failure or termination.

Automatic adjustments are made in regular background runs, in the case of larger stocks gradually. Deletion processes can be logged without account contents.

Safeguards and internal control messages

Backup copies: Configuration, databases, files and e-mail content can be backed up for recovery (Art. 6 para 1 lit. f GDPR: Availability and Security). Backups are deleted no later than 30 days after creation. Data already deleted in the active system can be included until then; when restored, deletions are taken into account again.

Internal control messages for registration and tariff activation: Deletion after fulfillment of the purpose, at the latest 30 days after creation, also from internal mailboxes. Shorter deadlines for the shipping queue remain. For backup copies, their separate period applies; contract documents required by law remain unaffected.

13. Your rights

Under the legal conditions, you have rights to information (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and data portability (Art. 20). Then they turn to it. info@seitenreport.de.

Objection: You can object to processing on the basis of legitimate interests for reasons of your special situation. An objection against direct advertising is possible at any time (Art. 21 GDPR).

Revocation: You can revoke a consent at any time for the future. The legality of the previous processing remains unaffected (Art. 7 para 3 GDPR).

Complaint: You can complain to a data protection supervisory authority, such as the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate.

14. Social media

When visiting our profiles on Facebook and X, the platform operators process data in accordance with their data protection regulations. For Facebook page statistics, there may be joint responsibility according to Art. 26 GDPR; the information and agreements of the platform operator are decisive.

15. Data security

We protect data through appropriate technical and organizational measures, in particular access restrictions, encrypted transmission and security logging, against loss, manipulation and unauthorized access.

16. Amendments

In the event of changes to our services, data processing or the legal situation, we update these notices. The date above indicates the text status.