Privacy policy

This is an English translation of our Datenschutzerklärung. If the two versions differ, the German version applies.

1. Controller

The controller responsible for processing data on this website under the General Data Protection Regulation (GDPR) is:

[Name / Firma]
[Straße und Hausnummer]
[PLZ] [Ort]
Deutschland
Email for privacy requests: datenschutz@topicdrill.com

Data protection officer: [none appointed, as there is no legal obligation – please check].

2. Overview

• You can use Topicdrill without an account and without giving us your name or email address.
• Our tools (moving checklist, benefits finder, disposal finder) run in your browser – your answers are not sent to our servers. The one exception: if you enter a postcode, we look up the matching municipality via our own API.
• The site is funded by Google ads. Cookies for advertising and analytics are only set with your consent.
• We don't sell data and we don't build user profiles ourselves.

3. Hosting and server log files

The website is hosted by: [name and address of the hosting provider]. Every request makes the server process technically necessary data: IP address, date and time, requested URL, amount of data transferred, status code, referrer and browser identifier (user agent).

• Purpose: delivering the website, stability, security and troubleshooting.
• Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
• Retention: log files are deleted after [number] days unless we need them longer to investigate a security incident.
• We have a data processing agreement with the host (Art. 28 GDPR).

4. Cloudflare (CDN and security) and Bunny.net (images)

Cloudflare

Our domain is served through the content delivery and security network of Cloudflare, Inc. (USA). Every request to topicdrill.com first passes through Cloudflare servers, which cache content and block attacks (e.g. DDoS, bots). Cloudflare processes the connection data listed above, including your IP address. To fight bots, Cloudflare may set a strictly necessary cookie (see our cookie policy).

Legal basis: our legitimate interest in a fast, secure website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply.

Bunny.net

Images and uploaded media are delivered via the Bunny.net content delivery network run by BunnyWay d.o.o., Ljubljana, Slovenia (EU). When an image loads, Bunny.net receives your IP address and technical connection data. Legal basis: Art. 6(1)(f) GDPR (fast, reliable delivery). We have a data processing agreement with BunnyWay.

Fonts

All fonts are hosted on our own server. Loading a page makes no connection to Google Fonts or any other font provider. We don't embed third-party maps.

5. Consent and consent management

We use storage on your device that is strictly necessary or that you explicitly request on the basis of § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act). Everything else – especially for advertising and analytics – only with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR.

We collect consent with Google's certified consent management platform ("Privacy & messaging"), which implements IAB Europe's Transparency & Consent Framework (TCF) v2.2. Your choice is stored in the platform's cookies (FCCDCF, FCNEC) so we can respect and document it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Before any Google tag loads, we set Google Consent Mode v2 to "denied". Only once you agree may Google services set or read cookies for advertising or analytics.

You can change or withdraw your choice at any time, with effect for the future: Open cookie settings. Every cookie in detail: cookie policy.

6. Google Tag Manager

We use Google Tag Manager (container GTM-PCB6VVM5) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool for managing other scripts (such as ad or analytics tags). It doesn't set cookies itself, but when it loads Google receives your IP address and technical data. The tags inside it only fire according to your consent (Consent Mode).

To keep pages fast, we load the Google tags only after your first interaction (e.g. scrolling or tapping) or a few seconds after the page loads. This doesn't change the consent logic: Consent Mode still starts at "denied".

Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) where information is stored on or read from your device; otherwise our legitimate interest in managing the services we use in an orderly way (Art. 6(1)(f) GDPR).

7. Advertising: Google AdSense and Google Ad Manager

Topicdrill is free and funded by advertising. We use Google AdSense (publisher ID ca-pub-6856285581519202) and Google Ad Manager (network 23075088739), both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Ads are labelled "Advertisement" ("Anzeige" on German pages); advertisers have no influence on our content.

• With your consent, Google and its ad partners use cookies and similar technologies to serve ads, cap how often you see them, prevent fraud, measure performance and – depending on your choices – show personalised ads.
• Without consent, only non-personalised or limited ads are served. Google still processes technically necessary data such as your IP address and browser information to display the ad at all.
• Refresh: an ad slot may reload after it has been visible for at least 30 seconds. This sends a new ad request to Google – still respecting your consent choices.
• Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for limited ads without cookies, Art. 6(1)(f) GDPR (funding a free service).
• Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.
• More information: How Google uses information from sites that use its services and Google's privacy policy. You can also turn off personalised ads in your Google ad settings.

8. Analytics and marketing (only with consent)

Google Tag Manager loads the following services. All of them run only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): Consent Mode v2 is set to "denied" by default, and the tags are configured in Tag Manager to respect your choice. Without consent they don't set cookies or record anything. You can withdraw consent at any time in the cookie settings.

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (measurement ID G-90WMW3CMQ9). Google Analytics records in aggregate how our pages are used – e.g. pages viewed, time on page, clicks, device type, browser and approximate region – so we can improve content and navigation. Google Analytics 4 doesn't store full IP addresses. Event data is deleted after [2 or 14] months. Cookies: _ga, _ga_* (up to 2 years). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.

Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors interact with a page (mouse movements, clicks, scrolling) and turns this into heatmaps and pseudonymous session recordings, so we can see where pages or tools are confusing. Text typed into form fields is masked. Cookies: _clck (1 year), _clsk (1 day), CLID (1 year), MUID (up to 13 months). Data may be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework. More: Microsoft privacy statement.

Microsoft Advertising (Bing UET)

Provider: Microsoft Ireland Operations Limited (address above). The Universal Event Tracking (UET) tag measures whether visits came to us via Microsoft Advertising (Bing) ads and what happened afterwards (conversion tracking), and may be used for ad audiences. Cookies: _uetsid (1 day), _uetvid (up to 13 months), MUID (up to 13 months). Data may be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework. You can also turn off personalised Microsoft ads in your Microsoft ad settings.

9. Tools and storage in your browser

• Moving checklist: your answers and progress are kept in your browser's local storage (key alltagslotse:umzug-checkliste:v1) so you can carry on later. The data never leaves your device. Delete it with "Start over" in the checklist or in your browser settings.
• Language suggestion: if you close the bar suggesting the other language version, we remember that in local storage (td:lang-suggestion-dismissed).
• Benefits and disposal finders: the results are worked out in your browser; your answers aren't sent to us. For postcodes we only look up the municipality via our own API, without linking the request to you.

Legal basis: § 25(2) no. 2 TDDDG (a feature you explicitly asked for) and Art. 6(1)(f) GDPR.

10. Optional member area

You can choose to create an account to save checklists. For this we process your email address, your name or display name, your password (only as a secure scrypt hash, never in plain text), the time of your last login and your saved checklists (e.g. title, moving date, postcodes, completed tasks).

After you log in we set the cookie al_session (httpOnly, secure), which keeps you signed in for up to 30 days or until you log out. With each session we also store the browser identifier (user agent) so you can recognise your sign-ins.

• Legal basis: the agreement to use the member area (Art. 6(1)(b) GDPR); the cookie is strictly necessary under § 25(2) no. 2 TDDDG.
• Retention: until you have your account deleted. You can ask for deletion at any time by emailing datenschutz@topicdrill.com.

11. Feedback, error reports and contact

• "Was this helpful?": we store the page, your rating (yes/no) and – if you write one – your comment. Please don't include personal details there.
• "Report an error": we store the page, your message and – only if you provide it – your email address so we can ask follow-up questions or reply.
• Email: when you write to us, we process your address and message to deal with your request.
• Abuse prevention: to limit spam and floods of requests (e.g. on forms and at login), we briefly store a cryptographic hash of your IP address together with a counter. The entry is deleted automatically once the time window ends (usually one hour at most).

Legal basis: our legitimate interest in improving content, answering requests and preventing abuse (Art. 6(1)(f) GDPR); for requests about a contract, Art. 6(1)(b) GDPR. We delete messages once they're dealt with, at the latest after [number] months. Reports that led to a correction may be kept longer without any personal data.

12. External links

We often link to websites of authorities and other providers. Data is only sent to them once you click a link; their privacy policies apply from then on.

13. Recipients and transfers outside the EU

Depending on how you use the site, recipients of your data are our hosting provider, Cloudflare, Bunny.net and Google and – with your consent – Microsoft (Clarity, Microsoft Advertising) and the ad partners (TCF vendors) listed in the consent dialog. With Cloudflare, Google and Microsoft, data may be transferred to the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). For ad partners outside the EU, your consent or the safeguard named by the vendor applies.

14. Your rights

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)
• A complaint to a data protection supervisory authority (Art. 77 GDPR), e.g. the one where you live or the one responsible for us: [state data protection authority where the operator is based]

For any of these, just email datenschutz@topicdrill.com.

15. Other information

You're not obliged to give us any data. Without the technically necessary connection data, however, we can't deliver the website, and without an email address we can't create an account. We don't use automated decision-making within the meaning of Art. 22 GDPR. We update this policy when our services or the law change; the version published here applies.

FAQ