Privacy policy

Scope: local test version

Last updated: 24 September 2026. This notice describes the local test version of this website. Here, forms send only to the local email testing service Mailpit; messages are not delivered to an external recipient mailbox. Please do not use real contact or application data in this test environment.

The future public hosting, production email service and operational deletion periods have not yet been finalised. This test version is therefore not intended to receive genuine enquiries or applications.

Controller and privacy contact

The controller is thiwico IT-Systemhaus e.K., proprietor Michael Steffen Thiel, Kieselstraße 13, 22929 Hamfelde / Lbg., Germany. Contact us at info@thiwico.de or +49 (0)4154-804247-0.

For privacy enquiries, use datenschutz@thiwico.de or write to the address above, for the attention of Mr Thiel.

Website operation and logs

When a page is requested, connection data is processed, including the IP address, time, requested address and technical information sent by the browser. This supports delivery of the website and the detection and investigation of errors and misuse. The legal basis is our legitimate interest in a reliable and secure website under Article 6(1)(f) GDPR.

The test version runs in a local virtual machine. Container logs are subject to volume limits. Effective automatic rotation or time-based deletion has not yet been demonstrated for the separate PHP and WordPress log files. No fixed deletion period in days is therefore promised. Logs may contain technical errors and information about the affected requests; the form does not deliberately write submitted message contents to an enquiry log.

The local website uses HTTP. This test connection therefore has no HTTPS transport encryption. The future public website and its email transport must be separately configured and checked before receiving real data.

Contact form

The contact form requires your name, email address, topic and message. Phone number and organisation are optional. The required information is needed to identify and answer an enquiry; without it the form cannot be submitted. If an input error occurs, the information you entered is shown again on the response page.

The form creates a text message containing the supplied information, form language and receipt time. Your email address is used as the reply address. There is no automatic confirmation email to the sender and no additional contact database in WordPress. In this test version, only Mailpit receives the message.

Article 6(1)(b) GDPR applies where an enquiry is necessary for a contract with you or pre-contractual steps requested by you. Other enquiries, including those from an organisation’s contact person, are handled under our legitimate interest in business communication, Article 6(1)(f) GDPR. Blanket consent is not the basis for every enquiry.

Applications and PDF attachments

The application form requires your name, email address, intended role or application area and message. A phone number and the two PDF attachments are optional. Each file may be up to 5 MiB. Please provide only information needed for the application. Only fictional test information may be used in the local test version.

Processing a genuine application as necessary to decide whether to establish an employment relationship is based on section 26(1) of the German Federal Data Protection Act (BDSG). The form code does not automatically add applicants to a talent pool or evaluate applications automatically. Processing in the future recipient mailbox, authorised people and the deletion rule after the recruitment process must be defined before production use.

During the email submission attempt, PDF attachments are held in a private file area outside the publicly accessible website. They are not added to the WordPress media library. The form removes these working copies after the submission attempt, including when sending fails. An additional hourly cleanup job is configured for files left behind by an interrupted process. It removes matching working copies more than one hour old at the next cleanup run that actually executes. Operational interruptions may delay deletion.

Deleting these working copies does not delete the message or attachments in the email testing service. The same applies to a future recipient mailbox and its backups. File type and size checks are not a guarantee that a file is free from malware.

Protecting the forms against misuse

The forms check security values, the origin and age of a submission, and a limit on attempts. An identifier is derived from the IP address using a secret key. This identifier is pseudonymised; it is not used as an anonymous statistic. The security check does not use an external CAPTCHA service.

Random form security values with the form type, language and creation time are temporarily stored in the WordPress database. They are valid for two hours. IP-derived identifiers, time windows and markers for previously used forms are also stored in the database. The scheduled cleanup job removes these markers when they are more than three hours old; actual removal depends on the job running. The validity period does not guarantee deletion of every database row or backup.

This processing serves our legitimate interest in accessible contact channels protected against misuse, under Article 6(1)(f) GDPR. This protection mechanism does not store the name, email address or message as submitted form content in the database.

Cookies and browser storage

The German and English versions are selected through the page address and language switcher. In the configuration intended here, the language is not saved in a persistent language cookie. WordPress’s additional emoji support tests and their browser storage are disabled. Our form and navigation scripts do not use LocalStorage or SessionStorage. There are no analytics or advertising trackers on the public pages that were checked.

When the WordPress login page is deliberately opened, wordpress_test_cookie checks whether cookies are supported. After login, wordpress_… and wordpress_logged_in_… identify the authenticated session. These were session cookies in the tested login without persistent sign-in. Choosing persistent sign-in or using HTTPS later may change cookie names and lifetimes.

The editorial area also used wp-settings-time-… with a one-year lifetime. It contains a timestamp for user settings. These editorial cookies do not apply to ordinary visits without signing in. Cookies can be deleted or blocked in browser settings; blocking authentication cookies prevents reliable sign-in.

Storage and access on your device are assessed under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The exception in section 25(2)(2) TDDDG applies to the necessary functions of a login service expressly requested by you. A future optional storage or tracking feature cannot be justified merely by referring to that exception.

Local content and external support download

Fonts, our scripts, styles and local replacement images for user profiles are loaded from the website server. Gravatar is not contacted for these images. The website does not automatically embed external maps, videos, social media plugins or translation services.

Following an external link connects to its destination. The remote-support download expressly leads to the existing website www.thiwico.de. The download server receives the connection data needed for the request, particularly your IP address and the requested file. Processing on that existing server is separate from the local test environment.

Downloading the ZIP archive does not start a remote-support session. Please arrange a session with thiwico before starting the included application. Remote-support data flows, such as relay servers or access to the supported device, are not described by the download alone.

Email testing, recipients and backups

The local email testing service Mailpit retains sent test messages and attachments. It is configured with a limit of 500 messages. No time-based deletion is configured; messages may remain until they are removed because of the message limit or manually. A restart alone does not delete them. No forwarding to an external email provider is configured.

Access to the test environment and its data should be limited to authorised people. Production hosting and email providers, any further recipients and access outside the EU/EEA remain to be clarified. No blanket promise is therefore made that the future public service will process data exclusively in Germany.

Existing database backups contain the complete WordPress database. This can include user accounts, session data, and form security values and IP-derived identifiers that are still present. Expiry or deletion in the running database does not retrospectively remove this information from existing backups. The website file export does not contain private PDF working copies or the Mailpit database; full virtual-machine backups may include more data.

No automatic time-based deletion is currently configured for local database and migration backups. The operational period, authorised access and treatment of previously deleted data after restoration must be defined before production use. Automatic deletion of all enquiries immediately after they have been handled is not promised.

Your rights

Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Please contact our privacy address to exercise them.

Right to object: You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing actually relies on your consent, you may withdraw it for the future; this does not affect the lawfulness of earlier processing.

You may complain to a data protection supervisory authority. The authority for Schleswig-Holstein is the Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, mail@datenschutzzentrum.de. Information and complaint options are available on the ULD website.