Privacy Policy
Last updated: 26/09/2026
This is a translation. The German version is legally binding.
1. Applicable Law
The processing of personal data on this website is subject to the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications Digital Services Data Protection Act (TDDDG).
2. Controller
Responsible for data processing on this website is:
IT Service Hammer
Inhaber: Alexander Hammer
Korneliusstraße 40
52076 Aachen
Deutschland
Telefon: +49 2408 59 800 20
E-Mail: hello@regelwerk.io
A Data Protection Officer is not to be appointed (§ 38 BDSG: less than 20 persons are permanently employed with the automated processing of personal data).
3. Hosting
This website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The servers are located in a netcup data center in Nuremberg, Germany. There is a data processing agreement with netcup according to Art. 28 GDPR; the netcup privacy policy can be found at https://www.netcup.de/kontakt/datenschutzerklaerung.html.
The legal basis is the legitimate interest in a reliable and secure operation of this website (Art. 6 para. 1 lit. f GDPR).
4. TLS Encryption
This website uses TLS encryption, recognizable by "https://" and the lock symbol in the address bar of your browser. As a result, the data you transmit to us cannot be read by third parties during transmission.
5. Server Log Files
When you visit any page, information transmitted by your browser is automatically recorded: IP address, date and time of access, requested URL, HTTP status code and amount of data transmitted, your browser (user agent), and the referring page (referrer), if transmitted.
This data is technically necessary to deliver the website, ensure its stability and security, and isolate errors. The legal basis is the legitimate interest in a functional and secure web presence (Art. 6 para. 1 lit. f GDPR). We store this data only as long as necessary for this purpose and do not merge it with other data sources.
To automatically detect your language (when no cookie or browser preference is set), your IP address is matched locally on our server against a local DB-IP Lite database to determine your country as a language hint. The IP address is never transmitted to third parties for this purpose, and neither your IP address nor the resolved country is stored or logged for this purpose.
6. Contact Form
You can send us an inquiry via the contact form. We process your name, email address, and your message.
Your data is not stored in a database, but forwarded directly to us via email (see "Email Delivery" below) and then remains in our inbox until we delete it.
The legal basis is Art. 6 para. 1 lit. f GDPR due to our legitimate interest in answering inquiries, or Art. 6 para. 1 lit. b GDPR, as far as your inquiry is directed towards concluding a contract.
7. Waitlist
You can use the waitlist form to sign up to be notified as soon as Regelwerk launches. Your email address is processed for this. The form also requires you to confirm that you have read and agreed to the privacy policy; this confirmation is only checked upon submission and is not saved as a separate record.
To ensure that only you can sign up with your email address, we use a double opt-in procedure: We send you a confirmation email with a link that is valid for one hour. Only when you click it will your entry on the waitlist take effect.
The legal basis is your consent (Art. 6 para. 1 lit. a GDPR), which you give by submitting the form and confirming via the link.
If you do not confirm your registration within the validity period of the link, we will automatically delete the unconfirmed entry at the latest one day after. We keep a confirmed entry until you request its deletion or until we dissolve the waitlist as part of the launch of Regelwerk.
You can request the deletion of your waitlist entry at any time informally via the contact address given above.
8. Email Delivery
For sending emails (account confirmations, password resets, answers to contact inquiries, waitlist confirmations, and similar system messages), we use Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland, as a processor under Art. 28 GDPR. The data is stored in data centers in Switzerland.
The European Commission has determined an adequate level of data protection for Switzerland (adequacy decision according to Art. 45 GDPR). The transfer is therefore permitted without additional safeguards.
9. Data Backup (Backups)
So that nothing is lost after a technical defect or other data loss, we secure the entire database of this website every night (including user accounts, manual contents, and waitlist entries) as well as all uploaded files.
We store the backups with Infomaniak Swiss Backup, a service of Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland, in data centers in Switzerland. There is a data processing agreement with Infomaniak according to Art. 28 GDPR. For Switzerland, the adequacy decision of the European Commission mentioned in the previous section applies.
The data is encrypted on our server before being transmitted. Infomaniak receives it only in this encrypted form and cannot read it.
We keep one backup per day for 7 days, per week for 4 weeks, and per month for 12 months; older backups are automatically deleted. Deleted data may therefore still be included in the backups for up to about 12 months. We only access the backups to restore the service after data loss or to test this restoration.
The backups serve data security (Art. 32 para. 1 lit. c GDPR). The legal basis is our legitimate interest in being able to restore the service after data loss (Art. 6 para. 1 lit. f GDPR).
10. Cookies
This website sets a technically necessary session cookie that keeps you logged in after authentication. Without "Stay signed in", it is deleted when you close your browser, and your login ends no later than 12 hours after you sign in. With "Stay signed in", it is deleted 30 days after you sign in. If you log out, we delete it immediately. It is set without your consent because it is strictly necessary for the operation of the website (§ 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR).
If your organization uses device approval, we set a technically necessary cookie when you sign in from a new device, which lets us recognize your browser after it has been approved. It is deleted after 90 days (§ 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR).
We store your decision in the cookie banner in the local storage of your browser so that we do not ask you again on every page view. This is also technically necessary (§ 25 para. 2 no. 2 TDDDG).
To store your selected language, we set a cookie ("lang"). This is also technically necessary (§ 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR). It is deleted after one year.
Only if you consent, Google Analytics additionally sets the cookies "_ga" and "_ga_<ID>" to recognize your browser. They are deleted after a maximum of 2 years. Details can be found in the following section.
We do not use cookies for marketing or advertising purposes.
11. Web Analytics with Google Analytics
If you consent in the cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This helps us understand how visitors and logged-in users use Regelwerk, such as which areas are viewed and how often the search is used, and allows us to improve the website. Without your consent, we do not load any scripts from Google.
We do not transmit contents of your manual: we shorten page addresses in the manual area to a uniform placeholder before transmission, and we do not transmit page titles, search terms, file names, and the destinations of external links, nor your name, your email address, or your organization.
Transmitted are the shortened page address and interactions such as page views, searches (only the number of hits), downloads (only the file type), and clicks on external links (without the destination), as well as technical details such as browser, operating system, screen size, language setting, and the approximate region that Google derives from your IP address. Google Analytics 4 does not store IP addresses. We have deactivated Google Signals and the use of data for advertising purposes.
There is a data processing agreement with Google according to Art. 28 GDPR. It cannot be ruled out that data may be transmitted to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has determined an adequate level of data protection (adequacy decision according to Art. 45 GDPR).
The legal basis is your consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time with effect for the future by selecting "Decline" via "Cookie settings" (in the footer of this website or, if you are logged in, in your settings); the Google Analytics cookies will be deleted. The legality of the processing carried out until the withdrawal remains unaffected.
Google automatically deletes the stored event data after 2 months. Further information can be found in Google's privacy policy at https://policies.google.com/privacy.
12. What We Don't Do
We do not load fonts or images from Google, Meta, or other third parties. All fonts are self-hosted. The only third-party script is Google Analytics, and only after your consent.
We do not show ads and do not integrate social media buttons that track you across other sites.
We do not engage in automated decision-making including profiling (Art. 22 GDPR).
13. Your Rights
You have the following rights regarding your personal data at any time. For all inquiries, an informal message to the contact address given above is sufficient.
Right of access (Art. 15 GDPR): You can request confirmation as to whether we process data about you, and if so, a copy of this data and information on how we use it.
Right to rectification (Art. 16 GDPR): If your data is incorrect or incomplete, you can request its correction or completion.
Right to erasure (Art. 17 GDPR): also known as the "right to be forgotten". You can request the deletion of your data; we will delete it provided no legal retention obligation prevents this.
Right to restriction of processing (Art. 18 GDPR): Instead of deletion, you can request that we temporarily restrict the processing of your data, for example while we clarify a matter.
Right to data portability (Art. 20 GDPR): You can receive your data in a structured, common, and machine-readable format to transfer it to another controller.
Right to object (Art. 21 GDPR): You can object to processing based on a legitimate interest. This applies to most of the processing described here (log files, answers to contact inquiries, data backups). More details in the following section.
14. Right to Object (Art. 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on a legitimate interest (Art. 6 para. 1 lit. f GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
For an objection, an informal message to the contact address given above with a brief description of your situation is sufficient.
15. Right to Lodge a Complaint with a Supervisory Authority
Independently of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Phone: 0211 38424-0, Email: poststelle@ldi.nrw.de.
16. External Links
This website may contain links to external websites. If you follow such a link, you leave this website, and the privacy policy of the respective external site applies.
We have no influence on how external websites process personal data and cannot continuously monitor their content. If you notice problematic or illegal content on a linked page, please let us know.
17. Changes to this Privacy Policy
This privacy policy will be updated as soon as the data processing on this website or the legal requirements change. The version published here applies in each case.