Last updated: 20 September 2026
1. Controller
The controller responsible for processing personal data on this website is:
Olaf Lienau
Graf-Bentinck-Straße 7
74405 Gaildorf
Germany
Telephone: +49 (0) 7971 9192927
Email for privacy enquiries: tech-c@olienau.de
This policy covers the olienau.de portal, including public information pages, the contact form, user management, guest and private areas, and file management. For separately accessed services such as Webmail and meineWolke, please also consult the privacy information provided by those services.
2. Website delivery and hosting
This private, free-of-charge service is operated by its owner on the owner's own local servers. This includes the website, database, email and backups. No external hosting, email or cloud storage services are used for this storage. When you visit, your browser transmits information including your IP address, the requested address, time and technical request details. This data is needed to deliver the website, investigate faults and defend against attacks. The web server logs requests, response status and transferred data volumes; depending on its configuration, it may also log the browser identifier and referring page. Technical faults may be recorded in error logs.
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is secure and reliable operation. Logs serve these purposes and are not used to create advertising profiles. Retention is determined by the needs of fault analysis and security checks; where a specific incident occurs, necessary evidence may be retained for longer to investigate it and pursue legal claims.
3. Technically necessary cookies and sessions
The portal uses the session cookie olienau_session. It contains a random identifier used by the server to associate a session. This enables sign-in, access checks, form protection and feedback after input. Anonymous visits to information-only pages do not create a new session. The session cookie is used for sign-in, registration, the contact form and access to protected areas. An existing session may continue during subsequent page visits. Server-side session data includes the session identifier, the user association when signed in, the time of the last activity and a form security token.
The cookie is a session cookie and is normally removed when the browser session ends; browser session restoration may retain it. Signed-in sessions become invalid after 30 minutes without activity. Signing out and certain account changes also end authenticated access. Session invalidation and later cleanup of stored session files are separate processes.
Where storage and access are strictly necessary for the requested session and form functions, they are based on section 25(2)(2) of the German TDDDG. Related personal data processing is based on Article 6(1)(f) GDPR for secure portal operation. The portal does not use analytics or advertising cookies.
4. Registration, sign-in and user management
Registration requires a username, name, email address and password. Additional data includes creation time, approval status, role and last sign-in time. Passwords are stored as hashes, not readable plain text. New accounts require administrator approval. Administrators manage accounts, roles, suspensions and password resets. Your profile lets you edit your details, change your password and delete your account.
This processing enables the access to protected areas you requested and prevents unauthorised access. For this personal portal, the basis is Article 6(1)(f) GDPR: the legitimate interest is providing and managing the requested access. Where use is provided under a contractual arrangement, Article 6(1)(b) GDPR applies to the processing necessary for that arrangement. Confirming the privacy information during registration is an acknowledgement, not blanket consent to other processing.
An account cannot be created without the required details. Public information pages remain accessible without signing in. Account data is processed for the duration of the account. Deleting an account removes its uploads and file-sharing permissions from the live system. Enquiries, emails already sent and independently stored security logs are not automatically deleted with it.
Email notifications about new accounts
When an account is registered or created by an administrator, the operator receives a notification at mailto@olienau.de. It contains the name, username, email address and information about account review; passwords are not sent. The purpose is timely processing of new accounts and their approval. The legal basis is Article 6(1)(f) GDPR, with the legitimate interest in orderly and secure access management. Sending status is recorded as an administrative event. The notification is needed in the operator's mailbox only for as long as processing and necessary account-management records require; deleting the account in the portal does not automatically delete it.
5. Uploading, downloading and sharing files
Uploads store the file contents, original file name, type, size, upload time and owner association. Files may contain personal data that you provide. Only upload content and share data that you are entitled to process and disclose.
Your own files are accessible to you and administrators. When you use Share, the selected users and sharing time are recorded. These recipients see the file and its owner's name and can download it. The user selection shows signed-in file owners other accounts' names and usernames and, where applicable, a notice that an account is disabled. Email addresses are not shown in that selection.
Only the owner may delete a file or change sharing permissions in file management. Revoking sharing ends further access through the portal. Copies already downloaded by recipients cannot be recalled this way. Deleting a file also removes its sharing permissions. Administrators retain viewing and downloading rights for management and support. Administrative account deletion also removes that account's files.
The legal basis is Article 6(1)(f) GDPR: legitimate interests are the file exchange requested by the user and the associated access control. Article 6(1)(b) GDPR applies to necessary operations where use is provided contractually. Files are generally retained until the file or owner account is deleted; sharing permissions remain until revoked or until the associated file or recipient account is deleted.
6. Contact form and email copies
For an enquiry, we process your name, email address, subject, message, receipt time and IP address. The enquiry is stored in the administrative inbox. A copy containing the name, email address, subject and message is also emailed to mailto@olienau.de. The form user's email address is set as the reply-to address. The IP address is not included in the email copy. Sending status and, following successful handover to the mail server, the sending time are also stored.
The information is used to process and answer your enquiry; the IP address helps limit abusive requests. The basis is Article 6(1)(f) GDPR, with the legitimate interest in communication and preventing abuse. Where an enquiry concerns a contract or steps prior to entering a contract, Article 6(1)(b) GDPR applies accordingly. The form cannot be submitted without the required information; you may alternatively contact us by email or telephone.
Enquiries are needed for as long as processing, necessary follow-up questions and, where relevant, clarification of legal claims require. Statutory retention obligations take precedence where actually applicable. The portal message and its email copy are separate records: deleting the portal message does not automatically delete the email copy. Ordinary email does not provide continuous end-to-end encryption.
7. Abuse prevention and security logs
The portal uses local form checks and limits sign-in, registration and contact attempts. No external CAPTCHA service is integrated. Sign-in attempts record the IP address, time, success or failure, and a hashed user identifier. Registration attempts use an appropriate technical marker. Administrative and security events record the event type, time and, where applicable, the acting user ID and affected object ID.
The basis is Article 6(1)(f) GDPR. The legitimate interest is protecting accounts and files, detecting abuse and tracing security-relevant changes. The planned maintenance cleanup removes sign-in and registration logs older than 30 days and event logs older than 180 days. These are distinct from separate web server logs. Necessary evidence relating to substantiated security incidents may be retained separately until final resolution.
8. Network data and Contact Points from PeeringDB
The Peering page displays exchange points and approved contact details for network AS202929. The source is PeeringDB. Contact details may include role, name, email address, telephone number and website. They are displayed to make the network operator reachable and coordinate peering. The basis is Article 6(1)(f) GDPR, with the legitimate interest in these technical contact options.
The web server retrieves this data through the PeeringDB API and caches it locally. The request sends no user account, form or upload data and no IP address of the individual website visitor to PeeringDB. PeeringDB technically receives the requesting server's connection and API authentication. Updates take place on the first visit after 24 hours or when triggered by an administrator. If retrieval fails, the last successfully retrieved data may remain displayed.
The Contact Points approved for this website are publicly readable. Requests to correct or erase personal contact data displayed here, or objections to its processing, may be addressed to the controller. Outdated cached data may be corrected or removed independently of the next scheduled update.
9. Recipients and linked services
Access is granted to the operator and authorised administrators and, for shared files, the users selected by their owner. The email copies described above are delivered to the operator's mailbox through the configured mail server. In direct email communication, the email services of the respective correspondents are also involved. Disclosure to authorities or other parties occurs only where a legal basis exists.
Webmail, meineWolke, PeeringDB and other services are accessible through links. Your browser connects to the destination only when you follow a link; its own processing activities and privacy information then apply. Your portal account does not automatically sign you in to those services. Portal pages do not load external fonts, analytics tools or advertising trackers. Merely displaying the locally stored network report does not send visitor data to PeeringDB.
10. Retention, deletion and data security
Personal data may only be retained for as long as the relevant purpose or an applicable legal obligation requires. Criteria include the account's continued existence, existing file-sharing permissions, the status of an enquiry, necessary security checks and specific legal claims. Once the purpose no longer applies and no overriding retention obligation exists, the data must be deleted or anonymised. You may contact the controller at any time about this.
Technical backups are distinct from actively used data. Any data still held in backups is used solely for recovery and must be removed at the end of the respective backup cycle. Following restoration, deletions made in the meantime must be reapplied.
The portal uses access roles, password hashes, protected file paths and form security tokens. An HTTPS address indicates transport encryption when accessing the public website. Please do not send confidential information over an unencrypted connection. Absolute protection against all risks cannot be guaranteed.
11. Your data protection rights
Subject to the statutory conditions, you have in particular the following rights:
- Access to your personal data and information about processing (Article 15 GDPR).
- Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
- Erasure and restriction of processing (Articles 17 and 18 GDPR).
- Data portability where automated processing is based on consent or a contract (Article 20 GDPR).
- Withdrawal of consent for the future, without affecting prior lawful processing (Article 7(3) GDPR).
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Processing will then stop unless overriding compelling legitimate grounds exist or the data is required for legal claims. You could object to processing for direct marketing at any time without giving a reason; the portal does not use your data for direct marketing.
To exercise your rights, contact tech-c@olienau.de. Where there are reasonable doubts about identity, further information necessary to identify the requester may be requested. There is no solely automated decision-making, including profiling, that produces legal or similarly significant effects. Accounts are approved by an administrator.
12. Complaints to a supervisory authority
Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in the member state of your habitual residence, workplace or the alleged infringement. For the operator in Baden-Württemberg, the following authority is a relevant point of contact:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
Email: poststelle@lfdi.bwl.de
Complaint information and submission options
13. Changes
This policy is updated when functions, operating conditions or relevant legal requirements change. The date above identifies this version.