Last updated: November 2026
1. Controller
TC-Innovations GmbH
Hanns-Martin-Schleyer-Straße 27
41564 Kaarst, Germany
Email: info@tc-innovations.de
We are not obliged to appoint a data protection officer. Please send questions about data protection to the email address above.
2. Your Rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may object to processing based on our legitimate interests on grounds relating to your particular situation (Art. 21 GDPR).
You may object at any time, without giving reasons, to the processing of your data for direct marketing, for example for our newsletter (Art. 21 (2) GDPR).
You can withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR); for cookies and analytics use the “Cookie settings” link in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before it.
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
3. Hosting and Server Log Files
This website is hosted by dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany, on servers in Germany. We have concluded a data processing agreement with dogado (Art. 28 GDPR).
When you call up a page, the server automatically stores information transmitted by your browser: IP address, date and time, page requested, referrer URL, browser and operating system. This is necessary for secure and stable operation, for example to detect attacks (Art. 6 (1) (f) GDPR). The log files are deleted after 14 days. Entries we need to investigate a specific security incident are kept until it has been resolved.
4. Cookies and Consent
We set technically necessary cookies without consent (Section 25 (2) No. 2 TDDDG, Art. 6 (1) (f) GDPR). These include the cookies cookieconsent_essential, cookieconsent_analytics and cookieconsent_marketing. They only store your choice in the cookie banner and expire after 400 days. We operate the banner ourselves on our server cookieconsent.tc-tools.de, also hosted by dogado; we do not use an external consent management provider. A session cookie (PHPSESSID) needed to run the website expires when you close your browser.
Services that store or read further information on your device are only loaded after your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Consent is voluntary; all functions of the website remain available without it. You can change or withdraw your choice at any time via “Cookie settings” in the footer.
5. Google Tag Manager and Google Analytics
With your consent we use Google Analytics 4, integrated via Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics creates pseudonymous statistics on how our website is used, for example which pages are viewed. We use these statistics to improve our website. Neither Tag Manager nor Google Analytics is loaded before you consent.
Google Analytics sets the cookies _ga and _ga_*, which expire after 400 days; the period restarts with each new visit. Google Analytics keeps user and event data for two months and then deletes it in its monthly deletion run; new activity restarts the period for the user identifier; aggregated reports without personal reference remain.
The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). We have concluded a data processing agreement with Google. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
6. Enquiries by Email
If you write to us by email, we process your details (name, email address, your message and any further information you provide) to handle your enquiry. Our contact form on tc-innovations.de has its own privacy information. The legal basis is Art. 6 (1) (b) GDPR if you are a contracting party yourself or are entering into a contract with us; if you write as the contact person of a company or without reference to a contract, processing is based on our legitimate interest in answering enquiries and communicating with business customers (Art. 6 (1) (f) GDPR).
We manage enquiries in the Freshdesk ticket system of Freshworks Inc., USA, which acts on our behalf (Art. 28 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework, under which Freshworks Inc. is certified (Art. 45 GDPR). We delete enquiries once they have been dealt with, unless a retention obligation under section 10 applies.
7. AI Support Chat “Tobi”
On our pages and in the ThemeWare® plugin we offer an AI support chat. It is only loaded when you open it; no data is transmitted before that. TC-Innovations GmbH is responsible. When you use the chat, we process your messages and the answers in order to respond to your request (Art. 6 (1) (b) GDPR if you are a contracting party yourself, otherwise Art. 6 (1) (f) GDPR). We use your rating and an optional comment to improve the chat; this is our legitimate interest (Art. 6 (1) (f) GDPR). The content is stored on servers of our host dogado in Germany and deleted after 12 months.
The chat application does not store your IP address in plain text (for server log files see section 3). To limit misuse we derive a hash from it that is deleted after 4 hours, and for evaluation a pseudonymous identifier that lets us see conversations from the same connection together; it is deleted with the conversation after 12 months (Art. 6 (1) (f) GDPR, our interest in preventing misuse and in quality). To keep the conversation when you change pages, the chat stores a conversation ID in your browser's session storage, which disappears when you close the tab; this is strictly necessary for the chat you opened (Section 25 (2) No. 2 TDDDG).
To generate the answers, your message, the conversation so far and matching sections of our documentation are transmitted to Anthropic, PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA), which operates the language model Claude. Anthropic processes the data on our behalf, does not use it for training and, according to the provider, deletes it after 30 days at the latest, unless longer storage is required to check for misuse or for legal reasons. The transfer to the USA is based on EU standard contractual clauses (Art. 46 (2) (c) GDPR); you can obtain a copy on request at the email address above. Please do not enter access credentials or sensitive personal data in the chat.
8. Newsletter and Downloads with Klick-Tipp
For our ThemeWare® newsletter (usually one to two emails per week) and for free downloads that you request with your email address, such as the ThemeWare® Utilities, we use Klick-Tipp of KLICK-TIPP LIMITED, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom, as our processor. We only send you emails if you request them and confirm your registration via a confirmation link (double opt-in). Mandatory fields are marked in the form; without them registration is not possible. We also store the time and IP address of registration and confirmation. Klick-Tipp uses a tracking pixel and personalised links to record whether our emails are opened and which links are clicked so that we can evaluate our mailings. Where this stores or accesses information on your device, your consent also covers these operations (Section 25 (1) TDDDG).
The legal basis for sending and evaluation is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link in every email; mailing then stops and we delete your data. We keep proof of your registration separately until the end of the third calendar year after you unsubscribe, in order to defend against legal claims (Art. 6 (1) (f) GDPR). Klick-Tipp automatically deletes unconfirmed registrations, usually after three and at the latest after seven days. There is an adequacy decision of the EU Commission for the United Kingdom (Art. 45 GDPR).
9. YouTube Videos
On some pages we embed videos from YouTube in extended privacy mode (youtube-nocookie.com). A video is only loaded when you click on it; before that no connection to YouTube is established. After the click your browser transmits data such as your IP address to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and YouTube may store information on your device. Data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework, Art. 45 GDPR). By clicking you request the video yourself; storing information on your device is necessary for this (Section 25 (2) No. 2 TDDDG), and the processing is based on our legitimate interest in showing our videos (Art. 6 (1) (f) GDPR). How long Google keeps this data is set out in Google’s Privacy Policy and retention policy.
10. Storage Period and Encryption
Unless stated otherwise above, we delete personal data as soon as the purpose no longer applies. Documents that we must keep for commercial and tax law reasons, such as business letters for six years and invoices for eight years, are deleted when these periods expire (Art. 6 (1) (c) GDPR in conjunction with Section 257 HGB and Section 147 AO). This website is encrypted with TLS throughout.