Privacy policy
How this website handles your data. It sets no cookies for readers and loads nothing from third-party servers.
This is a translation for convenience. In case of doubt, the German version (Datenschutzerklärung) is authoritative. The guide is deliberately lean: nothing loaded from third-party servers (no external fonts, maps or scripts) and no cookies for readers. If the website measures its reach, this is described in the section “Audience measurement” below, where you can also object.
Controller
Wang Marketing Consulting
Lily Wang
Heerstr. 26
31079 Sibbesse
Germany
Email: mail@lily-wang.com
Feedback, printed edition and contribute
The forms “Feedback” (button at the bottom right and on “Get involved”), “Printed edition” and “Contribute” send your details as an email to the controller (mail@lily-wang.com). The website does not store these submissions, and they are not published.
- Feedback: your rating, your text, the page you write from and, if you choose, your email address for a reply. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in improving the guide); if you leave an address, Art. 6 (1) (b) GDPR for the reply.
- Printed edition: name, email address, country, preferred language editions and whether you need several copies. We notify you when the printed edition is available and delete the details afterwards. Legal basis: your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by email to mail@lily-wang.com.
- Contribute: name, email address, optionally role and organisation, the type of contribution and your message, to reply to your request. Legal basis: Art. 6 (1) (b) GDPR.
Spam protection of the forms
To protect against automated spam, the website checks every submission itself, without external services: a form field invisible to people, a minimum time between loading the page and sending (based on a signed timestamp in the form), a local list of blocked words and a limit on how often forms can be sent. For this limit, a pseudonymised value of your IP address (hashed with a secret key; for IPv6 only the /64 network) is counted for the current hour and deleted after three hours at the latest. Rejected submissions are noted in the server logs with the reason and a shortened pseudonymised value of the IP address; these logs are deleted after 31 days.
In addition, the form plugin CF7 AntiSpam, which runs entirely on this website’s server, checks submissions to the contact forms: further invisible fields, a reference value of your IP address that is embedded in encrypted form when the form is loaded, the browser identifier (user agent) and the referring page for typical signs of automated programs, the content and email address for blocked words, blocked patterns and random strings of characters, and a learning text filter (Bayesian filter). For this filter it keeps a statistic of individual words from the messages (how often a word occurred in wanted and unwanted messages), without any reference to the sender, the time or the individual message.
If a submission is classified as spam, the plugin stores the sender’s IP address together with the reason in a block list, and further submissions from this address are rejected. Entries are deleted automatically 90 days after the last spam hit. Submissions that are not classified as spam leave no entry.
No data is passed to third parties for spam protection.
Legal basis: Art. 6 (1) (b) GDPR (handling your request) and Art. 6 (1) (f) GDPR (spam protection; the legitimate interest lies in protecting the forms and the controller’s mailbox against automated submissions and abuse).
Update emails (subscribe)
If you subscribe to updates, we store your email address and chosen language. You first receive a confirmation email; only after you confirm are you added to the list (double opt-in). The emails are occasional notices when new chapters, cases or language versions of the guide are published, in the language you chose. You give your consent by sending the sign-up form with the notice shown there; the subscription only takes effect when you click the link in the confirmation email. As proof of your consent we log the time of sign-up and confirmation, the version of the consent text, whether a consent box was ticked (where the form has one) and a pseudonymised, shortened value of your IP address; the IP address itself is not stored. Unconfirmed sign-ups are deleted after 7 days. Sign-ups are checked against abuse as described in “Spam protection of the forms” (invisible field, minimum time, rate limit; the form plugin is not involved), and an address receives at most one confirmation email per day. You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email (email programs that offer an unsubscribe button use the same link) or by email to mail@lily-wang.com; after unsubscribing your address is deleted after 30 days, leaving only a non-reversible check value as proof. Emails are sent from the technical operator’s mail servers in Germany, without external newsletter services, and contain no tracking pixels and no redirected links. Legal basis: Art. 6 (1) (a) GDPR (consent); for the log Art. 6 (1) (c) and (f) GDPR.
Discussion
On the discussion page you can post a comment. We process your name, email address, the chosen topic and your text. Name, topic, date and text are published after review; your email address is never published and is used only for questions about your comment. The editors are notified by email with name, topic and text, without your email or IP address. A shortened IP address is stored with the comment (IPv4 without the last, IPv6 without the last five segments); no browser identifier (user agent), no profile pictures (Gravatar) and no cookies. Spam and deleted comments are removed after 30 days, unreviewed comments after 90 days; published comments remain until you ask for deletion. Legal basis: your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time, for example by email to mail@lily-wang.com; your comment is then deleted.
“Was this topic useful?”
The vote at the end of a chapter is counted anonymously: only the total per page and day is stored, not your IP address, a cookie or the time of your vote. To prevent repeated voting, a pseudonymised value of your IP address (hashed with a daily changing secret key) is kept for 24 hours and then deleted. Results are visible to the editors only. Legal basis: Art. 6 (1) (f) GDPR.
Display settings in your browser
Your browser keeps some settings in its local storage (localStorage) so that the pages look the way you chose on your next visit: light or dark mode, text size, the last perspective chosen in a chapter and your vote. The home page remembers for the session (sessionStorage) that its opening animation has already played. These entries are never sent to the server; you can delete them at any time in your browser settings. Legal basis: § 25 (2) no. 2 TDDDG.
Audience measurement
To understand which pages are read and how visitors find this website, it measures its reach with the open-source software Matomo. Matomo runs on servers of the technical operator in Germany; no data is passed to third parties or to countries outside the EU.
The measurement works without cookies and does not use scripts to read device characteristics such as screen resolution or installed plugins. It processes the page viewed, date and time, the previously visited page (referrer, without search parameters), browser, operating system and language as your browser sends them with every request anyway, as well as clicks on links to other websites, downloads, email, phone and WhatsApp links and successful form submissions (without their content). Your IP address is shortened by 2 bytes before it is stored (for example 192.168.x.x), and the approximate location (country, region) is derived only from the shortened address. Repeat visits can therefore be combined at most within one day; no profile across several days or websites is created.
The raw data of individual visits is deleted automatically after 13 months; after that only aggregated reports remain (for example visits per page and month) without reference to individual visits.
Legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in improving this website based on its use and in knowing its reach. Nothing is stored on or read from your device for the measurement (§ 25 (1) TDDDG). The only exception is the marker of your objection (see below), which is set only when you click and is permitted under § 25 (2) no. 2 TDDDG because it is strictly necessary to respect your objection.
The measurement is operated by the technical operator of this website (see the section on hosting) as a processor on behalf of the controller (Art. 28 GDPR); apart from the controller, it is the only recipient of the data.
You can object to the measurement at any time (Art. 21 GDPR). Clicking the button below stores a marker without any identifier (only the value “yes”) in your browser’s local storage; as long as it exists, this website does not measure your visits in this browser. The objection applies per browser and device and ends when you delete this website’s data in your browser. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, no measurement takes place without any further action.
Without JavaScript, no measurement takes place.This website measures its reach without cookies and with shortened IP addresses. If you do not want to be counted, you can object here.You have objected: this website does not measure your visits in this browser.Your browser sends a “Do Not Track” or “Global Privacy Control” signal, so this website does not measure your visits; no objection is needed.Your browser does not allow local storage, so your objection cannot be saved. Please use your browser’s “Do Not Track” or “Global Privacy Control” setting instead.
Hosting, server logs, encryption and backups
This website is operated on behalf of the controller by Ideal Tech (Florian Henze), Heerstr. 26, 31079 Sibbesse, as a processor under Art. 28 GDPR; the servers are located in a Hetzner Online GmbH data centre in Germany. The web server logs page requests (page and time, data volume and status code, browser and operating system, referrer, IP address) for security and troubleshooting and deletes them after 31 days. All connections are encrypted (HTTPS). Daily backups are kept for 3 days on the server and, encrypted, for up to twelve months on the operator’s separate backup system in Germany. Legal basis: Art. 6 (1) (f) GDPR. The German version describes these points in full.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and you may withdraw any consent at any time with effect for the future. Please contact the controller above. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority is the Data Protection Commissioner of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.