Privacy policy

For the internet connection we use [Anbieter der Internetanbindung]. In addition, traffic is routed through a rented virtual server at [Anbieter und Sitz des vorgeschalteten virtuellen Servers] so that the website is reachable at a fixed address. The connection to it is encrypted, and HTTPS encryption only ends on our own server. These service providers therefore only see technically necessary connection data such as IP addresses and timestamps, but no content. [We have concluded a data processing agreement pursuant to Art. 28 GDPR with the provider of the virtual server.]

Our mail server also runs on this server of our own. The virtual server forwards emails addressed to us to it, and emails from us leave via its fixed address. Whether emails are encrypted on this route also depends on the other side’s mail server – today almost all use transport encryption (STARTTLS).

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in providing the website securely and reliably.

Purpose: delivering the website, finding errors, and detecting and preventing attacks. Legal basis: Art. 6(1)(f) GDPR. Log files are deleted automatically after 14 days. We do not combine them with other data and do not create profiles from them. Only if a specific security incident has to be investigated do we keep the affected entries for as long as necessary.

• When a page loads, a small script sends a message to our own server: the path of the page, the address of the previous page (we only store its domain name), the width of the browser window (from this and the browser identifier we only derive a rough device class such as “phone” or “desktop”) and, if present, campaign parameters from the address (utm_source, utm_medium, utm_campaign).
• Our server derives a daily ID from this: it combines your IP address and browser identifier (user agent) with a random value that is valid for one day only, and calculates a shortened one-way hash. The IP address itself is not stored.
• The random value is replaced every day and the old one is deleted. After that nobody – including us – can link the ID to an IP address or recognise you on another day.
• We store nothing on your device (no cookies, no local storage) and do not use fingerprinting.
• If you have enabled “Do Not Track” or “Global Privacy Control” in your browser, the script sends nothing at all. Without JavaScript there is no counting either.

We filter out obvious bots and unusually frequent requests. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in improving our service based on aggregated usage figures. We delete the individual records automatically after 400 days.

Card opens: if you open a provider card in the text, we count this as a daily total per card and page – without cookies, without an identifier in the database and not at all with “Do Not Track” or “Global Privacy Control”. To avoid double counting, our server briefly checks the daily ID described above, in memory only. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in knowing which cards are helpful.

What we store when you click

• a random click number
• the partner, date and time
• the page and the position of the link, and the language
• the device class and the domain name of the previous page
• the daily ID as used for audience measurement – without the IP address
• whether the click is valid: bots, duplicate clicks and altered links are not counted as valid

We do not set a cookie.

What is passed to the provider

We redirect you to the provider’s address. If the provider runs a partner programme, this address contains our partner ID and the random click number. Your browser also tells the provider that you are coming from blockchain21.net – but not from which page. We do not pass on your name, email address or other personal details; we do not even know them.

What the provider reports back to us

If the click leads to a sign-up or purchase, the provider or its affiliate network reports the click number, the type of transaction, the amount of our commission and its status. We do not receive names, contact details or details of your purchases.

What happens at the provider

As soon as you are on the provider’s website, its privacy policy applies. Providers and affiliate networks (currently, for example, FirstPromoter, Impact, Oshi) usually use their own cookies or similar technologies there to recognise that you came via us, and may ask for your consent. They are responsible for this themselves. Our partners are listed on How we are funded.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in settling commissions correctly and in a tamper-proof way, and thereby funding our free service. We delete click data after 400 days. Clicks for which a sale was reported are kept together with the accounting records for as long as tax and commercial law require (Art. 6(1)(c) GDPR).

Double opt-in: after signing up you receive an email with a confirmation link that is valid for 7 days. You are only subscribed once you confirm with it. This way nobody can sign up other people’s addresses. We delete unconfirmed sign-ups after 30 days.

Abuse protection: the form contains an invisible field and a timing check. We also limit the number of sign-up attempts; for this we store a hash of your IP address formed with a secret key – not the IP address itself – and delete it after 24 hours at the latest.

No tracking: our emails contain no tracking pixels. We do not measure whether or when you open an email or which links you click. Links to partners go through our redirect just like on the website – without any connection to your email address.

Content: new articles and tools, important changes such as regulation and tax, security tips and occasionally offers from our partners – always labelled as advertising.

Sending: we send the emails via our own mail server, which runs on our server alongside the website.

Legal basis: your consent (Art. 6(1)(a) GDPR). Logging the sign-up serves as proof of your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can unsubscribe at any time via the link in every email or by sending a short message to support@blockchain21.net. You will then receive no further newsletters, and we delete your address completely within 30 days. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Sign-in link instead of a password

You enter your email address and we send you a sign-in link. It is valid for 15 minutes and works only once; the account is created when you first use it. The email only contains the link – no ads, no partner links. If you did not request the link, simply ignore the email: without using it, no account is created. We delete requested links after one day.

To prevent abuse, we limit the number of sign-in links per address, per connection and in total per day. For this we store a hash of your IP address formed with a secret key – not the IP address itself – and delete it after 24 hours at the latest. Under the GDPR, such a hash is still personal data.

What we store

• your email address, a display name if you want one, your language
• the time of registration, address confirmation and last sign-in
• the version of this privacy information shown to you when you registered
• your saved items and learning progress (stages, checks, goal, kit, checklists), as far as you sync them
• registered certificates with a verification code – your name on them only if you explicitly want this
• a session cookie (__Host-b21_konto) that keeps you signed in for 30 days

No link to advertising: we do not connect your account with audience measurement, clicks on partner links or commission data. We do not build profiles and do not send you advertising through the account.

Sync between your devices

Your browser remains the main source. When you are signed in, the site syncs your saved items and progress with our server. If a browser already holds progress, we ask on the first sync whether it should be added to your account.

Publicly verifiable certificate

The learning-path certificate is created only in your browser. If you voluntarily register it, anyone with the verification code can see which type of certificate was issued when and whether it is still valid. We only show your name there if you explicitly consent. You can withdraw your consent at any time; we then remove the name.

Deletion

You can delete your account yourself at any time. We then delete it immediately together with saved items, progress and sessions; registered certificates are revoked and the name removed. Beforehand you can download all your data as a file. If you have not signed in for 24 months, we send you a notice and delete the account 30 days later. In our encrypted backups the data remains for at most 12 months; if we ever had to restore a backup, we would delete accounts deleted in the meantime again.

Legal basis: Art. 6(1)(b) GDPR – the terms of use for the optional account. The session cookie is strictly necessary for the sign-in you use (§ 25(2) no. 2 TDDDG). Abuse protection: Art. 6(1)(f) GDPR. Name on the certificate: your consent (Art. 6(1)(a) GDPR).

This data never leaves your device. It is not transmitted to us or to third parties, and we cannot see it – unless you have a reader account and are signed in: then we sync your saved items and learning progress with our server. You can delete the data in your browser at any time using the reset buttons or by clearing the site data for blockchain21.net in your browser.

Legal basis: § 25(2) no. 2 TDDDG – storage is strictly necessary for the feature you explicitly use, for example a checklist you tick off.

Our own mail server

Emails to addresses at blockchain21.net are received and sent by our own mail server, which runs on our server alongside the website – we do not use an external email provider. Besides the content, the mail server processes sender and recipient addresses, timestamps, technical headers and the IP address and name of the delivering mail server. We delete its logs (connections, deliveries, access by the application) after 30 days. The mail server notifies our website of new emails using technical identifiers only, so that the team can see them.

Protection against spam and fraud

The mail server automatically checks every incoming email: whether it really comes from the stated domain (SPF, DKIM, DMARC – for this it queries the sender domain’s DNS), whether the delivering server is on public blocklists ([abgefragte Sperrlisten und Sitz ihrer Betreiber]; only the address or domain of the delivering server is transmitted) and whether content and structure suggest spam. Emails recognised as spam go to a spam folder and are deleted automatically after [Anzahl] days. For our domain the mail server also creates and receives technical delivery reports (DMARC and TLS reports) with IP addresses of mail servers and message counts, but no content. We do not automatically load images from the internet in emails we receive.

Who reads your email

Your email is read by the team members responsible for the mailbox concerned. They sign in only via our website, with a password and – always for team accounts – a second factor. Our mailboxes may only be used for business purposes. If a team member is absent or a matter needs to be clarified, the administration can view a mailbox – only for defined occasions (cover, a specific business matter, compliance, technical issues, legal obligations), with a written reason, for a limited time and fully logged. We keep these logs for 3 years after the end of the calendar year.

Retention

Business emails are commercial and business letters that tax and commercial law require us to keep. We therefore archive incoming and outgoing emails – except spam – in a tamper-proof way: business letters for 6 years, accounting records such as invoices and commission statements for 8 years, automatic reports and notifications for 1 year, each from the end of the calendar year. If you want us to delete your email earlier, we restrict its processing: it is then blocked from search and display and only retrievable for a tax audit or legal dispute; we delete it when the period ends (Art. 17(3)(b), Art. 18 GDPR). Emails that do not have to be kept are deleted once your matter has been dealt with.

Our replies

When we reply, the email goes from our mail server to the mail server of your email provider, which is responsible for it. Our emails contain no tracking pixels and no read receipts. Our signature links to this privacy information.

Legal bases: Art. 6(1)(f) GDPR – our legitimate interest in answering requests, working with partners, ensuring cover and continuity of business and protecting ourselves against spam, fraud and attacks; where a contract is concerned, Art. 6(1)(b) GDPR; for retention, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.