privacy policy

Last updated: 25 October 2026

1. Controller

Ing. Stefan Schulz
Damberg 1
83236 Übersee
Germany
Email: contact@germanmanualofstyle.org
Telephone: +49 176 766 802 52

2. Hosting and server logs

The website is operated on a virtual server supplied by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. When pages are requested, the hosting and web-server infrastructure processes the IP address, date and time, requested URL, HTTP method and status, transferred data volume, referrer where supplied, and browser user-agent. These data are required to deliver the website, maintain availability, diagnose faults and defend against misuse.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the reliable and secure operation of the website. Host-level nginx logs are rotated daily and retained through 14 archive generations. The internal web container and Laravel also keep technical access or error logs; no fixed automatic deletion interval is currently configured for those diagnostic logs. They are reviewed and removed when no longer required for operational security, fault analysis or the establishment, exercise or defence of legal claims.

3. Necessary cookies and sessions

Laravel currently sets two technically necessary cookies: XSRF-TOKEN protects state-changing requests against cross-site request forgery, and german-manual-of-style-session assigns the browser to its server-side session. Both cookies are marked Secure and SameSite=Lax; the session cookie is also HttpOnly. Their configured lifetime is 120 minutes.

Server-side session records contain a session identifier, IP address, user-agent, last activity time and a serialised session payload. Expired database sessions are removed by Laravel's probabilistic cleanup process, so deletion may occur after rather than exactly at the end of the 120-minute inactivity period. Processing is necessary to provide security and the requested community function. The legal basis is Article 6(1)(f) GDPR; storage or access on the device is limited to what is necessary within the meaning of Section 25(2) TDDDG.

4. Community voting

The community page offers an advisory vote on logo concepts. For each accepted vote, GMS stores the selected variant, the submission time and a SHA-256 hash of a randomly generated browser-session token. The vote record does not contain the visitor's name, email address or IP address. The related Laravel session separately contains the technical session data described above.

Multiple and automated submissions are limited through the unique token hash, a short form-timing check, a hidden anti-bot field, CSRF protection and request rate limiting. The rate limiter normally uses a hash derived from the session token and falls back to the IP address if no token is available; its counters are short-lived cache records. Vote records have no automatic deletion date and are retained while required to document and evaluate the project consultation, then deleted manually. The legal basis is Article 6(1)(f) GDPR, based on the legitimate interests in conducting a reliable consultation, preventing misuse and documenting aggregate research input. Visitors may object on grounds relating to their particular situation.

5. Contact page and correspondence

The contact form processes the name, email address, message and language to receive and review enquiries. These data are stored in the GMS database with application-level encryption for message content and contact details. Each accepted enquiry receives a personal conversation link containing a randomly generated 256-bit access secret. The secret is shown only when the enquiry is submitted and is not stored in plain text; GMS stores only a keyed cryptographic hash. The browser transfers the secret from the URL fragment to the server in a protected POST request and exchanges it for a time-limited session. The conversation history becomes available after the first administrative reply. Email notifications and email verification codes remain inactive and are not required for this web-based conversation; submitting the form does not promise an email response. To prevent misuse, GMS processes pseudonymous keyed hashes derived from IP and email identifiers, server-verified form timing, honeypot results, rate-limit events and a rule-based spam score. Pseudonymous security events use the administratively configured retention period, initially 30 days, and are removed automatically after expiry. No fixed automatic deletion period is currently configured for contact enquiries. They are retained only while needed to handle the enquiry and meet applicable legal obligations or claims and are then removed following administrative review. Depending on the subject, processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR; the legitimate interests are reviewing and responding to enquiries and operating a secure, abuse-resistant contact channel.

6. Newsletter

When a visitor registers for GMS Updates, GMS transmits the email address, the expressly accepted consent-text version including the selected language, the registration source (gms_footer or gms_community), the IP address, an encrypted form-timing proof and any honeypot signal to the existing 1a-Studi News Radar system through an authenticated HTTPS interface. The address is assigned only to the gms_updates distribution list and is initially stored as pending. News Radar sends a double-opt-in email through its existing SMTP infrastructure using newsletter@1a-studi.de; the subscription becomes active only after the personal confirmation link is used. No additional confirmation email is sent after that activation. Pending subscriptions are automatically removed after seven days if they are not confirmed. Confirmed subscriptions and their consent history are retained until withdrawal and as necessary to demonstrate compliance. Every newsletter provides the central list-specific unsubscribe process; unsubscribing from GMS Updates does not change other newsletter subscriptions. Processing for registration and delivery is based on consent under Article 6(1)(a) GDPR. The IP address, form proof, honeypot result, rate limits and pseudonymous security records are used to prevent misuse under Article 6(1)(f) GDPR.gms_footer or gms_community), the IP address, an encrypted form-timing proof and any honeypot signal to the existing 1a-Studi News Radar system through an authenticated HTTPS interface. The address is assigned only to the gms_updates distribution list and is initially stored as pending. News Radar sends a double-opt-in email through its existing SMTP infrastructure using newsletter@1a-studi.de; the subscription becomes active only after the personal confirmation link is used. No additional confirmation email is sent after that activation. Pending subscriptions are automatically removed after seven days if they are not confirmed. Confirmed subscriptions and their consent history are retained until withdrawal and as necessary to demonstrate compliance. Every newsletter provides the central list-specific unsubscribe process; unsubscribing from GMS Updates does not change other newsletter subscriptions. Processing for registration and delivery is based on consent under Article 6(1)(a) GDPR. The IP address, form proof, honeypot result, rate limits and pseudonymous security records are used to prevent misuse under Article 6(1)(f) GDPR.

7. Google Fonts

The website requests IBM Plex Sans and IBM Plex Mono stylesheets and font files from Google Fonts domains operated by Google. This causes the visitor's browser to connect to Google infrastructure and transmit technical connection data, including the IP address and browser request information. Google may process data outside the European Union or European Economic Area. GMS uses the fonts to maintain the approved, consistent presentation of the website and relies on Article 6(1)(f) GDPR. The use of externally hosted fonts and the applicable transfer safeguards remain subject to legal review; local hosting is being evaluated.

8. External links and sharing services

The community and research pages contain ordinary links to Citation Style Language, LinkedIn, X, WhatsApp and Facebook, as well as an email-sharing link. No scripts, pixels, frames or social plugins from those services are embedded. Data are transmitted to the selected provider only when a visitor activates the relevant link; the provider's own privacy terms then apply.

9. Other recipients and transfers

Technical data may be available to the hosting provider where necessary to provide and secure the server. Google receives connection data when externally hosted fonts are requested. Newsletter registration data are transmitted to the existing 1a-Studi News Radar and SMTP infrastructure solely for double opt-in, list administration and delivery of GMS Updates. Apart from these cases, the active contact function and visitor-initiated external links, the public website currently uses no analytics, advertising or payment providers. Data are disclosed to public authorities only where legally required.

10. Data subject rights

Subject to the statutory conditions, data subjects have rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 21 GDPR. Where processing is based on consent, consent may be withdrawn with future effect. Requests can be directed to the controller using the contact details above.

11. Right to complain

Data subjects may lodge a complaint with a data protection supervisory authority under Article 77 GDPR. The authority responsible for private-sector controllers in Bavaria is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Security and updates

The public website uses HTTPS, while administrative functions require authentication and additional authorisation. This notice will be updated when the website's functions, providers or processing activities change.