Daniel Christian Sander
Marktstraße 41
67466 Lambrecht (Pfalz)
Deutschland
daniel-sander@skykopf.com
Delivering this website through a reverse proxy
Every request to this website passes through a reverse proxy (AtmoX). It accepts your browser’s connection, encrypts it (TLS) and forwards the request to the responsible application server. It processes:
- your IP address,
- date and time, the requested host and path, HTTP method, status code, bytes transferred and response time,
- what your browser sends about itself (user agent, referrer, language).
This is necessary to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation, see recital 49); where the request serves a contract, Art. 6(1)(b) GDPR.
Logs, troubleshooting and statistics
- Access log: every request with the details above. Retention according to our log rotation, is 7 days
- Request trace: for troubleshooting, the requests of the last 24 hours are kept with their path through the proxy and then deleted automatically.
- Statistics: aggregated figures (requests, errors, countries, browsers) are derived from the log and kept for 30 days (per minute) and 365 days (per hour and day). IP addresses are stored in full and kept for at most 7 days.
- Location and network operator: the country and network operator (ASN) of an IP address are looked up locally in a database on the server; no third party is asked.
Protection against overload and attacks
To protect the website, the proxy limits the number of requests per sender (rate limiting) and can block addresses that are known attackers or behave suspiciously (for example many failed sign-ins or requests for typical attack paths). For this, IP addresses are stored with the reason and duration of a block until it expires (at most 30 days; repeated incidents are considered for 30 days). Public block lists (for example Spamhaus DROP, blocklist.de) and the CrowdSec community block list are downloaded to the server and only compared there. The legal basis is Art. 6(1)(f) GDPR.
Sharing attack signals with CrowdSec
When the proxy detects an attack (a trap was hit, an automatic block, a recognised attack pattern), a signal is sent to CrowdSec SAS (Montrouge, France): the attacking IP address, the kind of attack (scenario), the time and duration of the block and the random identifier this server signs in to CrowdSec with; for attack patterns CrowdSec detects itself, also the country, network operator and approximate location of the address. CrowdSec uses the signals for a shared block list that protects all participants. Normal visits and allowlisted addresses are never sent. The legal basis is Art. 6(1)(f) GDPR (IT security, recital 49). More information: CrowdSec’s privacy policy.
Recipients
ZAP-Hosting GmbH (Server provider) ; CrowdSec SAS (attack signals only, see above). Data is not transferred to third countries.
Your rights
You have the right of access, rectification, erasure, restriction of processing and objection (Art. 15–18 and 21 GDPR) and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
Last updated: 24.10.2026