Privacy notice

Controller

Aktiokrat Verlag

Torsten Nicodemus

Holsteiner Straße 27

22941 Bargteheide

Germany

Email: info@aktiokrat.com

Open contact form →

Website access and technical logs

When the website is accessed, the system processes technically necessary connection and request data. This may include the IP address, time, requested address, browser identifier, response status and a technical request or correlation identifier. This data is used for secure delivery, error analysis and prevention of abusive access.

Public search

Search terms are processed to provide results and search suggestions. The system uses limiting security mechanisms to protect against automated or abusive requests.

Contact requests

When the contact form is used, Aktiokrat processes the subject, name where supplied, email address, message, consent status and technical processing data. The information is used solely to receive and handle the request.

Newsletter

When you subscribe to the newsletter, Aktiokrat processes the email address supplied, language, subscription and confirmation status, timestamps, source of the subscription and the security and evidence data required for double opt-in and unsubscribing. The subscription becomes active only after confirmation through the link sent by email. Confirmation and unsubscribe tokens are stored only as hashes. Every newsletter email will include an individual secure unsubscribe option. Unsubscribing takes effect for the future; evidence of the consent previously given is retained to the extent required.

Customer account and sign-in

For a public account, the system processes in particular the email address, optional display name, technically protected password verifier, confirmation status, sessions and the security data required for registration, confirmation and password recovery. Passwords are not stored in plain text.

Support requests

For a support request, the system processes the account link, topic, subject, message, optional order reference, status, timestamps and message history. Uploaded attachments are stored in a non-public storage area and delivered only to authorised users.

Personalised digital delivery

Paid EPUB and PDF editions are individually marked at an authorised download with the purchaser’s name, the order number and a random internal watermark identifier. This supports personal assignment, evidence and prevention of misuse. The unchanged master file remains in the protected archive; only a temporary delivery copy is generated. The watermark is not used to monitor reading behaviour and contains neither the email address nor postal address.

Technically necessary cookies and sessions

The application uses technically necessary session information for sign-in, account sessions, form protection and secure navigation. These functions are necessary for the service requested.

Recipients and processors

Access is limited to authorised persons and the service providers required for operation, email delivery and technical provision. Disclosure for third-party advertising purposes is not intended for the functions described.

Storage period

Data is stored only for as long as required for the relevant purpose, security and evidence or statutory retention obligations. It is then deleted or anonymised unless an obligation or legitimate reason requires continued retention.

Data-subject rights

Subject to the statutory requirements, rights include access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn with effect for the future. A complaint may also be lodged with a competent data-protection supervisory authority.

Send a privacy request →

Cookies, consent settings and PayPal

AKTIONEXTPUBLIC is technically necessary session information for the basket, sign-in, form protection and secure order context. AKTIOKRAT_CONSENT stores the selected privacy categories and valid consent version for six months. The optional visit measurement is described in the following section. No external marketing services are registered.

PayPal

PayPal is loaded or contacted only during a PayPal payment process expressly initiated by the customer. Transaction data required to process payment is transmitted to PayPal. PayPal is not integrated as an analytics or marketing service.

Consent-based visit measurement

After you voluntarily consent to the Analytics category, we measure page views, visits, entry pages, last observed exit pages and relevant link clicks on Aktiokrat and connected satellite websites. We analyse recognised source categories and editorially defined campaign information. Missing sources remain unknown. We do not count uniquely identified people.

A random visit identifier is stored per domain and browser tab in session storage as AKTIOKRAT_VISIT. A new visit starts after 30 minutes of inactivity. The shop also uses the protected AKTIOKRAT_ANALYTICS_VISIT cookie with a 30-minute lifetime. Domain transitions carry only public domain, source and campaign hints, never a visit identifier. Aktiokrat collects these events centrally at aktiokrat.com.

For attributable orders, we store a reduced association of order number, visit reference and source. Confirmed purchases, cancellations and succeeded refunds are read from existing shop records. Measurement changes neither orders nor payments. This analytics system stores no complete IP addresses, browser profiles, form contents, credentials, payment details or sensitive URL parameters. It uses no fingerprinting and shares no analytics data with external advertising platforms.

Event identifiers and visit records are deleted after 7 days. Aggregate counters and reduced order attribution, including its visit reference, are deleted after 400 days. Cleanup runs automatically. Technical security logs are separate and described in the website-access section.

The legal basis is your consent under Article 6(1)(a) GDPR and, for storing or accessing information on your device, section 25(1) TDDDG. This visit measurement does not run without consent. You can withdraw your choice at any time through Privacy settings in the footer. Measurement then stops; the visit identifier and its remaining visit records and order associations are deleted. Previously formed aggregate counters remain. Do Not Track and Global Privacy Control are respected.

Internal browsers registered by the operator

The operator can explicitly register their own browsers as internal devices so that their visits and attributable orders do not affect regular marketing statistics. Each browser and connected domain uses its own random, revocable credential. Activation uses a single-use code valid for five minutes. This credential provides no account, purchase or administrator permission and does not rely on an IP address or browser fingerprint.

The expressly requested exclusion preference is stored in local browser storage as AKTIOKRAT_INTERNAL_DEVICE for up to 365 days. The shop also uses a protected cookie with the same name and maximum lifetime (Secure, HttpOnly, SameSite=Lax). Each other domain receives a separate credential; this does not create a shared login or a shared cookie across different main domains. Clearing website data, expiry or revocation requires activation again.

A separate technical test mode is off by default. If enabled for a device, technical events are still recorded only after valid analytics consent; Do Not Track and Global Privacy Control are respected. These separate test events contain the domain, sanitized page path, event type and timestamp and are removed within seven days. Withdrawing analytics consent removes the device's remaining test events for that domain. The expressly requested exclusion preference remains separate and can be disabled or revoked through device management.

For internal shop orders that can actually be attributed, only a reduced exclusion reference containing the order identifier, internal device reference and observation timestamp is retained for up to 400 days. Statistical evaluation also respects orders already explicitly classified as test orders. This changes no orders, payment data, accounting entries or existing business test classification. Earlier visits are not retrospectively assigned to devices on the basis of assumptions.