Privacy Policy — Supplement Learning Platform “Lab” — v3

1. Controller

Jaciel Antonio Acea Ruiz
Prinzenallee 38
13359 Berlin, Germany

General: kontakt@techlogia.de
Data protection: datenschutz@techlogia.de

No Data Protection Officer required per § 38(1) BDSG / Art. 37 GDPR.

2. Personal Data Processed

2.1 Individual Learner Registration

Email address — identification + double opt-in
Password — bcrypt hash only
Birth year — age verification (min. 8), parental consent trigger (<16). Data minimization: year only.
hCaptcha token — ephemeral, not stored
Confirmation token (DOI) — 24-hour validity

2.2 During Lab Usage

IP address — server logs, abuse prevention, quota enforcement
VM metadata — Hetzner VM-ID, IPv4/IPv6, status, timestamps
Learning progress — lessons started/completed with timestamps
Validator results — JSON with check names and status, no learner input stored
XP points — cumulative progress value (gamification)

2.3 Audit Logs

Security-relevant actions: timestamp, user ID, action type, affected entity, IP address.

2.4 Parental Consent for Minors Under 16

Guardian email address
Parental consent token (14-day validity)
Consent timestamp (Art. 7(1) GDPR proof)

Auto-deletion after 14 days without confirmation.

2.5 Teachers and School Administration

Email, display name, school role, class assignments

Legal basis: Art. 6(1)(b) GDPR + DPA per Art. 28 GDPR. School is the controller; Techlogia acts as processor.

2.6 Class-Based Students (No Email)

Login name (assigned by teacher, pseudonym possible)
Class code
Learning progress and validator results

Not collected: email, password, birth year. Parental consent: school’s responsibility. Retention: 90 days after class deactivation.

2.7 OAuth Login (Google, GitHub)

Provider ID (anonymous), email, display name, OIDC session ID

No password stored. Provider receives no lab usage data.

2.8 Forensic Snapshots (Security Incidents)

Only upon concrete suspicion of abuse (e.g. unusual load/traffic or an abuse report from our host) do we capture a technical snapshot before the lab VM is automatically deleted: process list, network connections, and system and authentication logs. This does not happen during normal use or when a session ends regularly. Purpose: incident investigation, abuse prevention, and asserting and defending legal claims (Art. 6(1)(f) GDPR). Snapshots are stored encrypted in a data centre in the EU and are automatically deleted after 90 days. Exception (legal hold): if an official or criminal-law request relates to an incident, we retain the affected data for evidentiary purposes for as long as required for the respective proceedings and delete it immediately afterwards.

3. Purpose and Legal Basis

Processing	Purpose	Legal Basis
Account creation, login, DOI	Lab access	Art. 6(1)(b) GDPR
Birth year + parental consent	Legal obligation	Art. 6(1)(c) + Art. 8 GDPR
hCaptcha	Bot prevention	Art. 6(1)(a) GDPR (consent, “Functional” category)
IP + quota	Abuse protection	Art. 6(1)(f) GDPR
Lab VMs	Exercise delivery	Art. 6(1)(b) GDPR
Progress + XP	Progress display	Art. 6(1)(b) GDPR
Watchers	Mining/DDoS prevention	Art. 6(1)(f) GDPR
Forensic snapshots	Incident investigation	Art. 6(1)(f) GDPR
School-based usage	School learning platform	Art. 6(1)(b) + Art. 28 GDPR
OAuth	Alternative authentication	Art. 6(1)(a) + Art. 6(1)(b) GDPR

4. Recipients / Processors

4.1 Hetzner Online GmbH — Cloud hosting, EU data centers, DPA per Art. 28 GDPR.

4.2 Intuition Machines, Inc. (hCaptcha) — Bot prevention. Loads only after consent (“Functional” cookie category). US transfer: EU-US DPF + SCCs.

4.3 Own mail server (mail.techlogia.de) — Hetzner Nürnberg, Germany. No third-country transfer.

4.4 Google Ireland Ltd — OAuth login. No lab data shared with Google.

4.5 GitHub, Inc. (Microsoft) — OAuth login. US transfer: EU-US DPF + SCCs.

5. Retention Periods

Data	Retention
Account data	Until account deletion
Parental consent token	14 days (auto-delete)
DOI token	24 hours; account deleted after 48h
Lab session metadata	Until account deletion
Progress + validator + XP	Until account deletion (cascaded)
Class student data	90 days after class deactivation
OAuth provider ID	Until account deletion
Forensic snapshots	90 days
Audit logs	Pseudonymized after deletion; 1 year retention
Server logs (IP)	7 days (DSK recommendation)
Push tokens	90 days after last use
DPA signature events	7 years (§ 257 HGB)

6. Data Subject Rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17) via self-service, restriction (Art. 18), portability (Art. 20) as JSON, objection (Art. 21), consent withdrawal (Art. 7(3)) via footer “Cookie Settings” link.

School-based usage: exercise rights against the school as controller.

Supervisory authority: Berlin Commissioner for Data Protection (BlnBDI), Alt-Moabit 59-61, 10555 Berlin.

7. Cookies

Necessary: access_token, refresh_token, cookie_consent (no opt-in). Functional: hCaptcha cookies (opt-in required). Analytics: Umami (cookieless, opt-out available). Marketing: TikTok pixel (opt-in required, no learner PII shared).

8. Automated Decision-Making (Art. 22 GDPR)

Watchers terminate VMs on threshold breach. No account bans without human review. Does not meet Art. 22(1) threshold. Objection: datenschutz@techlogia.de (5 business days).

9. Minors (Art. 8 GDPR)

Min. age 8. Under 16: parental consent required. Revocation: datenschutz@techlogia.de (full account deletion). No advertising, no profiling. School-based: school responsible.

10. Security (Art. 32 GDPR)

TLS, bcrypt, dedicated DB user, HttpOnly+Secure+SameSite cookies, JWT+refresh rotation, MFA for admins, encrypted backups, brute-force protection, CrowdSec WAF, CSP+HSTS.

11. Changes

Current version: techlogia.de/lab/datenschutz. Material changes communicated by email.

Date: 2026-05-26 — Version 3

Supplement 2026-07-12 — Sign in with Apple

Login via Apple („Sign in with Apple“)

You can alternatively sign in with your Apple account („Sign in with Apple“). From Apple we receive only: a pseudonymous user identifier („sub“), your e-mail address — optionally an Apple-generated private relay address („Hide My Email“) so we never see your real address — and, on first login only, optionally your name. There is no tracking via Apple; we receive no further profile or device data.

This data is used solely for account creation and login (legal basis Art. 6(1)(b) GDPR — performance of contract). Provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; see Apple’s privacy policy for details. Transactional e-mails (e.g. sign-in codes or system notifications) are sent to the address provided by Apple — for relay addresses Apple forwards them to your mailbox.

Supplement 2026-07-12 — Push notifications

Push notifications of the mobile app

If you enable notifications in the Techlogia app, your device generates a device identifier (push token) which we store so we can send you targeted notifications (e.g. new lab modules or a reminder that your lab environment will shut down automatically soon). For delivery the push token is transmitted to the Apple Push service (APNs); Apple forwards the notification to your device. No account content beyond the title and body of the notification is shared with third parties in this process.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant via the iOS permission prompt. You can withdraw it at any time — either in iOS Settings → Notifications or by logging out of the app; the push token is then deleted. The delivery service provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.

Supplement 2026-06-13 — App usage statistics

Usage statistics of the mobile app

In the Techlogia app we measure — unless you have objected — an anonymous usage statistic to understand which areas are used and to improve the app. We collect only: the visited app area from a fixed list (e.g. „Blog“, „Lab terminal“), the session duration in seconds and a timestamp. To group related views we use a random, locally generated identifier (install_id) that is not linked to your account, e-mail or device hardware.

We transmit no personal data, no free text, no content and no precise device IDs. Processing is done as anonymous aggregate counters on our own server in Germany (retention 90 days). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in product improvement). You can object to this collection anytime in the app under Settings → Usage statistics (Art. 21 GDPR).

Supplement 2026-07-17 — Error and crash diagnostics

Error reports (website, learning platform and app)

When a technical error or crash occurs on our website, in the learning platform or in the Techlogia app, the application transmits an error report to our own, self-hosted error-analysis system (Sentry, operated on our servers in Germany — there is no transfer to third parties or third countries). An error report contains: the technical error message including the program execution path, the affected page or app area, browser or device type and operating-system version, and a timestamp.

We have technically configured the reports so that they contain no passwords, login tokens, cookies, e-mail addresses or form input — such fields are automatically removed or masked before sending; IP addresses are not stored. Reports are automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, error-free operation).

Supplement 2026-07-17 — Anonymous performance measurement

Performance data (website, learning platform and app)

In addition to error reports, our applications transmit anonymous performance metrics to the same self-hosted analysis system (servers in Germany, no third-country transfer): the name of the accessed area or operation (e.g. „app start“, „load lab overview“), the loading duration in milliseconds, device type/operating-system version and a timestamp. This lets us identify slow areas and make the application noticeably faster.

The metrics contain no personal data, no input and no account linkage; only a sample of operations is transmitted. The data is automatically deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, reliable operation).

Supplement 2026-08-07 — CRA reporting assistant

Processing in your browser

The CRA reporting assistant at /cra-meldeassistent processes all details of your case exclusively locally in your browser. Product names, vulnerability descriptions, timestamps, generated notification texts, PDF, JSON and calendar files are produced on your device and are not transmitted to us and not stored on our servers. Interim storage takes place in your browser's local storage and can be removed by you at any time via „discard case“ or by clearing your browser data.

Launch notification sign-up (CRA file)

After an export we offer to notify you when our paid follow-up product launches. We process only your email address together with the selected language and the time of your sign-up and confirmation. No link to your case is created, and none is transmitted.

Sign-up uses a double opt-in procedure: you first receive a confirmation email, and we only add you to the list once you click the link it contains. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future — via the unsubscribe link in every email or informally to info@techlogia.de. The data is kept in a list separate from the newsletter and is deleted after withdrawal or at the latest once the product has launched and the related information has ended.

Supplement 2026-08-14 — Page speed measurement on the website

Page speed metrics

In addition to page views, our self-hosted analytics (Umami, servers in Germany) records page speed metrics for the page you open: the point in time at which the largest visible content is rendered, unexpected layout shifts during page construction, the response time to the first interaction, the first visible content and the server response time. Alongside these we store the page path, a coarse device class (mobile, tablet or desktop), browser and operating-system family and a timestamp.

The sole purpose is to identify slow pages and make the site faster. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fast, reliable service).

Retention: The metrics are stored together with the remaining access statistics on our own servers in Germany. They are automatically deleted after 14 months at the latest. Deletion runs daily and is logged. The period allows page speed to be compared across a full year including seasonal variation.

As with the rest of our analytics, collection happens without cookies: no identifiers are stored on or read from your device, there is no link to a user account, and the data never leaves our own servers in Germany. No transfer to third countries takes place. You can object to analytics via the cookie notice as before.

Explicitly not collected are session recordings (session replay), mouse and click heatmaps, or form field input. These features exist in the analytics software in use and remain deliberately switched off.

Supplement 2026-10-04 — Retention of server and security logs

This information replaces all earlier statements in this policy on the retention of log files and server logs (stated there as 90 days or 7 days).

Web server access logs (IP address, time, requested address without query parameters, status code, browser identifier): 14 days, then deleted automatically.
Application logs of the platform (including IP address, requested path, status code, internal account identifier; passwords, tokens and e-mail addresses are automatically removed or masked before storage): 7 days.
Security and system logs in our central logging system (sign-ins to our servers, system events, audit logs; these may contain IP addresses): 12 months, then deleted automatically.

Purpose: to detect attacks, misuse and faults and to be able to investigate them even if they only come to light weeks or months later, and to demonstrate the security of our systems (information security under BSI IT-Grundschutz and ISO/IEC 27001). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and integrity of our services and your data.

The logs are stored on our own servers in Germany (Hetzner, Falkenstein data centre), are not passed on to third parties and can only be viewed by administrators over encrypted connections. Individual entries are kept longer only where this is necessary to investigate a specific security incident or to pursue legal claims.

Supplement 2026-10-07 — Learning events in the Lab

To improve the learning platform — for example to see which task learners get stuck on, which hints are too brief and whether learners come back — we store learning events for your Lab account:

your first visit to the Lab on a given day, opening the module catalogue, lessons and tasks, opening hints (including the hint level) and the solution, completing a lesson and reaching the daily quota,
that the terminal of your practice VM was connected and when you first typed something,
in each case the time, the module or task concerned and whether you used the website or the app; for practice sessions also whether they were started from the website or the app.

For school accounts (sign-in with a class code or via Eduplaces) we store no learning events: we process their data solely on behalf of the school.

We store no terminal content (no commands, no output), no IP addresses and no free text. Evaluation is aggregated (e.g. „share of learners who pass a task“) in our administration area; there is no disclosure to third parties, no advertising and no profiling with legal effect. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the learning platform and its tasks. Retention: 13 months, after which the events are deleted automatically; they are deleted immediately together with your account. The events are part of your data access request (Art. 15 GDPR, „Download my data“). You can object to this processing at any time (Art. 21 GDPR) by e-mail to datenschutz@techlogia.de.

Supplement 2026-10-08 — Quiz answers and reflections in the Lab

In the Lab you can answer knowledge checks (quiz questions without a practice VM) and, at the end of a lesson, optionally save a short reflection („What do you take away?“, at most 500 characters). For this we store for your Lab account:

for each quiz question you answer, whether your answer was correct and when — not the answer you chose,
the text of your reflection, the lesson it belongs to and the time.

Answering a quiz question (correct or wrong, without the answer itself) is also one of the learning events described in the section „Learning events in the Lab“ — with the same legal basis, retention period and exception for school accounts.

Purpose: showing your learning progress (which questions you already answer reliably), suggesting questions for review later and improving the tasks. Only you see your reflections, in your data access export; we do not evaluate them individually and do not pass them on. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre).

The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use). For school accounts we process the data on behalf of the school. Retention: 13 months, after which quiz answers and reflections are deleted automatically; they are deleted immediately together with your account. They are part of your data access request (Art. 15 GDPR, „Download my data“). A reflection is optional — everything works the same without it.

Supplement 2026-10-08 — Review, learning streak and personal notices in the Lab

So that you do not forget what you have learned, the Lab suggests short reviews (quiz questions without a practice VM). For this we store for your Lab account, per skill you practised (e.g. „disable SSH root login“): a review level from 0 to 4, when the next review is due, whether the last review was correct, how often you reviewed and when you last did. We do not store the answers you chose.

From your learning activity (checked tasks, quiz questions, reviews) we calculate your learning streak (days or weeks in a row). No new data is stored for this, only your setting „count weeks or days“ and whether the streak should be shown. For learners under 16 it is hidden by default.

Personal notices may appear in the bell in the Lab, e.g. a new badge, a finished module with a suggestion for the next one, „almost done“ (module at least 70 % done and untouched for two days, at most once per module) or „reviews are due today“ (at most twice a week). We send no emails and no push notifications for this. No notices are created between 9 pm and 7 am; after 30 days without learning activity we stop reminding you. Learners under 16 and school accounts get no reminders, only notices about badges and completions.

Purpose: reviewing material at the right time and making your progress visible. The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use); for school accounts we process the data on behalf of the school. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre). Retention: the review level is kept as long as your account exists and is deleted immediately with it; personal notices are deleted automatically after 180 days. Both are part of your data access request (Art. 15 GDPR, „Download my data“).

Supplement 2026-10-08 — Learning path certificates and class weekly goal in the Lab

Learning path certificates. Once you have completed all modules of a learning path, you can issue a certificate if you want to. For this we store: your display name at the time of issue, the path, the modules it contains, the date and a random, unguessable verification code. Via the verification link (techlogia.de/verify/…) anyone who knows the link can check that it is genuine; they only see display name, path, date and modules — no real name, no email address and no individual results. So choose a display name you are happy to share.

The legal basis is Art. 6(1)(b) GDPR (providing the function you use). Retention: until you withdraw the certificate (at any time under „My progress“; the verification link stops working immediately) or delete your account. Certificates are part of your data access request (Art. 15 GDPR).

Class weekly goal. If your teacher sets a weekly goal, the class only sees the total of tasks solved this week — no names, no individual values, no ranking. No new data about you is stored for this; the total is calculated from the existing learning progress (processing on behalf of the school).

Supplement 2026-10-08 — Hint levels in the Lab

Hints for a Lab task come in levels: the next level and finally the solution can only be opened once the previous one has been opened. So that this order still applies after reloading the page, we store for your Lab account, per task, only up to which hint level you got and whether you opened the solution, each with the time of the first and last change.

The sole purpose is providing the staged hints; we do not analyse this data. The legal basis is Art. 6(1)(b) GDPR (providing the learning platform you use); for school accounts we process the data on behalf of the school. The data is stored on our own servers in Germany (Hetzner, Falkenstein data centre). Retention: 13 months after the last change; it is deleted immediately together with your account. It is part of your data access request (Art. 15 GDPR, „Download my data“).

Supplement 2026-10-13 — Referral program and review request in the Lab

Referral program

If you take part in the referral program, we store your personal invite code, the link between you and the people who sign up with your code (or the person who invited you), date and status of each invite, and your bonus-minute bookings (credit, use, return, expiry). The purpose is running the program (Art. 6(1)(b) GDPR) and preventing abuse, such as inviting your own second e-mail address; for that we compare e-mail addresses in a normalized form (Art. 6(1)(f) GDPR, legitimate interest in a fair distribution of practice VMs). An administrator reviews suspicious invites manually. If you invite someone, you only see their sign-up date and status — no name and no e-mail address. Bonus minutes expire after 90 days; we keep the data itself until you delete your account. Free learners aged 16 and over can take part; class and school accounts do not.

Review request

After your first completed module we ask you — at most twice — for a review on Google. For this we only store how often the request was shown, whether you chose "Later" and that it has ended. Whether someone clicks "Review on Google" is counted only as a daily total without reference to a person. We don't learn whether or how you review us on Google; Google's privacy policy applies to the review itself. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in feedback on the Lab). Class and school accounts and learners under 16 don't receive the request. There is nothing in return for a review.

Supplement 2026-10-16 — Name on certificates in the Lab

Name on certificates. Under „Settings → Names“ you can voluntarily store a name for your certificates, separate from your display name. It appears on your module and learning path certificates. Anyone who knows the verification link (techlogia.de/verify/…) only sees it with the surname shortened (e.g. „Kim W.“). If you share the link to the PDF file yourself, the recipient sees the full name. It never appears on the leaderboard — that only shows your display name. If you don't store a name for certificates, we use your display name, otherwise your username. Once you set it, we also apply it to earlier module certificates that still show your username.

This supplement replaces the statement in the supplement of 2026-10-08 that the verification page of a learning path certificate shows the display name and no real name. The legal basis is Art. 6(1)(b) GDPR (providing the function you use). Retention: until you clear the field or delete your account; issued certificates keep the name until you withdraw them. The name is part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Daily challenge and leagues in the Lab

Daily challenge. When you start a challenge, we store the calendar day you started so we can unlock its steps day by day. Nobody but you sees it. Leagues. If you agreed to the public leaderboard and solved at least two tasks, you take part in the weekly leagues. For each week we store tier, group, points, rank and whether you were promoted or demoted. The up to 29 other people in your group see your display name and your weekly points — never your email, username or certificate name. If you withdraw your leaderboard consent, you stop taking part from the next week and immediately no longer appear in any group. The legal basis is Art. 6(1)(a) GDPR (your leaderboard consent), for the challenge Art. 6(1)(b) (providing the function). Retention: We keep the start day of a challenge until you delete your account. We delete completed league weeks 4 weeks after the week ends; we only keep the most recent one so that you start in your tier when you return. If you withdraw your leaderboard consent, we delete your league history after the current week ends. Everything is deleted with your account at the latest. Both are part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Personal storage folder in the Lab

Folder ~/ablage. Your practice VM is deleted at the end of every session. Whatever you put into the folder ~/ablage is saved when the session ends regularly (you end it, it expires or you repeat a module) and restored when your next session starts. Only this folder is saved, at most 5 MB compressed and 500 entries, and only the latest version. The content is stored encrypted in our database in Germany; nobody looks at it. If a session is ended for security reasons, nothing is saved.

The legal basis is Art. 6(1)(b) GDPR (providing the function you use; for school accounts on behalf of the school). Retention: 30 days after last use (save or restore), then deleted automatically. In your profile under „Data export“ you can download the storage at any time or delete it immediately; it is also deleted with your account. It is part of your data access request (Art. 15 GDPR).

Supplement 2026-10-18 — Practice time, idle end and flag tasks in the Lab

Practice time instead of starts. We calculate your daily practice time from the timestamps of your Lab sessions (VM ready, end), which we store anyway. For the first complete finish of a module we book a one-time bonus of minutes; the booking is part of your data access request and expires after 90 days.

Idle end. So that unused practice VMs don't keep running, we store the time of the last terminal connection per session — no input, no content. The value only lives in the cache and is deleted automatically after 6 hours at the latest.

Flag tasks. For tasks where you enter a flag found on the VM, we only store per attempt whether the input was right or wrong, and when — not the input itself. This serves your learning progress and protects against guessing. The legal basis for all three points is Art. 6(1)(b) GDPR (providing the learning platform). Deleted with your account unless something shorter is stated above.

Supplement 2026-10-18 — Test features and additional practice time

We may enable test features (beta) in the Lab for individual accounts or give them additional practice time, such as a higher daily allowance or a one-off credit in minutes. For this we store with your account which feature or allowance applies since when and until when, a short reason (e.g. „learning video“) and which admin account made the change.

The legal basis is Art. 6(1)(b) GDPR (providing the enabled service). Retention: until the entry is removed in the admin area, at the latest with your account; credits expire on the stated date. This information is part of your data access request (Art. 15 GDPR); it does not name the admin account that made the change.

Supplement 2026-10-20 — Country statistics of the learning platform

To understand from which countries our learning platform is used – for example to plan languages and capacity – we evaluate the country from the approximate location of your signed-in devices (see „Signed-in devices“) in aggregated form. For each learning account we count the country of its first sign-in. The result is only a number per country; countries with fewer than three learners are grouped under „Other“ so that nobody can be identified individually. Nothing additional is stored, no profile is created, and only our administrators see the evaluation. Internal accounts and school accounts (classes, Eduplaces) are not included.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in developing and planning our service). You can object to this evaluation at any time under Art. 21 GDPR, for example by email to the contact address above; your account will then no longer be counted.

Supplement 2026-10-28 — Interim backup of the storage folder

In courses where you change the firewall or SSH access of your practice VM yourself, you can accidentally lock yourself out. So that your folder ~/ablage is not lost in that case, we additionally save it there after every check you start yourself (at most every two minutes). The same rules as above apply: only this folder, encrypted, only the latest version, retention 30 days after last use.

Lab Privacy Policy — Supplementary