Privacy policy

Protecting your personal data is important to us. This privacy policy explains which data is processed when you visit this website. Personal data is any information relating to an identified or identifiable natural person.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Sebastian Keutmeier – IT Consulting
Norddeutsche Straße 7, 24143 Kiel, Germany
Email: contact@maxanoo.com

This website runs on a dedicated server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Each request automatically collects and stores access data (server log files): IP address, time, requested address, browser identification and referring page. This data is used to operate the website and to defend against attacks, and is deleted after 6 months. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in providing the website in a stable and secure manner).

This website does not set any cookies for visitors and does not store anything in your browser.

All parts of the website – including fonts and images – are delivered from our own server. No content from other providers is embedded. Links to other websites (for example YouTube) are plain links: data is only transferred when you follow a link, in which case the privacy policy of that provider applies.

Only in the administration area is a technically necessary session cookie set for logged-in editors.

We use Matomo, an open-source web analytics tool that runs on our own servers. Matomo does not use cookies. Anonymised usage data (e.g. pages viewed, time spent) is collected to evaluate the use of the website statistically. Your IP address is anonymised immediately; the data is not passed on to third parties. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving our website).

When you write to us using the contact form, we process your name, your email address, your message and the page on which you submitted the form. The message is stored on our server and forwarded to our email inbox. We use this information solely to answer your request; it is not passed on to third parties.

The legal basis is Art. 6 (1) (b) GDPR insofar as your request relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). Stored messages are deleted automatically after 12 months, or earlier on request.

To protect against automated spam, the form contains a field that is invisible to humans, and the number of messages per connection is limited. For this purpose, a non-reversible hash of your IP address is cached for one hour. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse).

If you email us directly, we likewise process your details only to answer you. We run our email inboxes ourselves on our own servers.

The shop check at /shop-check/ lets you have an online store checked for known security vulnerabilities. Our server loads the store at the address you enter, just like a normal browser.

Check: We store the checked address (domain) and the results of the individual checks permanently, so that we can check stored stores again when we add new checks. We also log every check with the time, the checked address, your confirmation that you are allowed to have the website checked, and a pseudonymised hash of your IP address. The hash is created with a secret key, so your IP address cannot be calculated back from it. The log serves to prevent abuse and is deleted after 90 days. In addition, the number of checks per connection is limited; for this purpose the same hash is cached for one hour. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure service free of abuse and in developing the check tool further). A domain is generally not personal data; this may be different if it contains your name.

Notifications and newsletter: On the results page you can enter your email address and choose whether we should notify you if the checked store fails a check during a later regular re-check, and whether you would like to receive our occasional newsletter on Magento security. These are two separate consents. We use the double opt-in procedure: you first receive an email with a confirmation link, and you are only signed up once you click it. We store your email address, the related store, your choices, the language, the time of sign-up and confirmation, and the pseudonymised hash of your IP address, so that we can prove your consent. We delete unconfirmed sign-ups after 7 days.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future, using the unsubscribe link in every email or by emailing us. After you unsubscribe, we keep your email address with the time of sign-up, confirmation and unsubscription, so that we can prove that you had consented and no longer wish to receive emails (Art. 6 (1) (f) GDPR in conjunction with Art. 7 (1) GDPR). On request, we delete this information completely.

We send the emails ourselves via this website and our own servers, without an external newsletter service provider. We do not track whether you open our emails or click links in them. We do not pass your details on to third parties.

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise your rights, please contact the controller (contact details above).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Kiel, Germany.

October 2026