Privacy policy
This page is merely a translation of the binding legal texts of the German-language page.
Unless otherwise stated below, the provision of your personal data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide data has no consequences. This only applies if no other information is provided in the following processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.
We host the content of our website with the following provider:
Hetzner
The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter referred to as "Hetzner"). When you visit our website, Hetzner collects various log files including your IP addresses.
Details can be found in Hetzner's privacy policy: https://www.hetzner.com/de/legal/privacy-policy/
The use of Hetzner is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in displaying our website as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Order processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that the personal data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.
Server log files
You can visit our website without providing any personal data.
Each time you access our website, usage data is transmitted to us or our web host / IT service provider by your Internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in ensuring the trouble-free operation of our website and to improve our offer.
We delete the server log files automatically after 14 days.
Change log
If something changes in your customer account, your licence (including cancellation, pause, invitation or classroom), an invoice, payment, refund or payment reminder, we record what was changed and when, and who made the change (you, our team or an automated process) – together with the IP address, your browser identifier (user agent) and the address called up from which the change originated. This serves the traceability of our billing and the protection of your account against misuse; the legal basis is our legitimate interest in this (Art. 6 para. 1 lit. f GDPR). After 90 days we shorten the IP address (IPv4: last block set to 0, IPv6: to the first 48 bits) so that it can no longer be assigned to an individual connection. We delete the log entries themselves after ten years, counted from the end of the calendar year of the change – this is how long the related billing records must be kept under German commercial and tax law (Section 257 HGB, Section 147 AO). In our backups, the full IP address is retained until the respective backup is deleted in the regular cycle.
Contact details
Person responsible
Please contact us on request. The controller responsible for data processing is: 4eck Media GmbH & Co. KG, Papenbergstr. 43, 17192 Waren (Müritz) Germany, +49 174 7330699 , info@tutkit.com
Proactive contact by the customer by e-mail
If you contact us by e-mail on your own initiative, we will only collect your personal data (name, e-mail address, message text) to the extent provided by you. The purpose of data processing is to process and respond to your contact request.
If the purpose of the contact is to carry out pre-contractual measures (e.g. advice in the event of an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit . f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR at any time for reasons arising from your particular situation.
We will only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Collection and processing when using the contact form
When you use the contact form, we only collect your personal data (name, e-mail address, message text) to the extent that you provide it. The data processing serves the purpose of establishing contact.
If the purpose of the contact is to carry out pre-contractual measures (e.g. advice on an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit . f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR at any time for reasons arising from your particular situation.
We will only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Customer account orders
Customer account
When you open a customer account, we collect your personal data to the extent specified there. The purpose of data processing is to improve your shopping experience and simplify order processing. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent until revocation. Your customer account will then be deleted.
Account protection (device list)
When you log in to TutKit.com, we store a random identifier of your device in a cookie (“tk_geraet”, valid for 400 days from the last use); on our side only an irreversible hash of it is stored. Together with browser, operating system and device type and – for your logins – a shortened IP address (IPv4: last block set to 0, IPv6: first 48 bits), this lets us show you in your account which devices you have logged in with and when you last used them; there you can log out individual devices. We may also inform you by e-mail when someone logs in from a new device. We delete the logins including the shortened IP address after 90 days, and the device entry (without IP address) 400 days after the device was last used. If you change your e-mail address, we store the request (previous and new address encrypted, shortened IP address) for 100 days. The cookie is strictly necessary for the security of your account (Section 25 (2) No. 2 TDDDG); the legal basis for the processing is our legitimate interest in protecting your account against unauthorised access (Art. 6 para. 1 lit. f GDPR).
Collection, processing and forwarding of personal data for orders
When you place an order, we collect and process your personal data only to the extent necessary to fulfill and process your order and to process your inquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR and is necessary for the performance of a contract with you. Your data will be passed on, for example, to the shipping companies and dropshipping providers you have selected, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is kept to a minimum.
Advertising reviews
Data collection when writing a comment or rating
When you comment on an article or post, we only collect your personal data (name, email address, comment text) to the extent that you provide and for the purpose of verification. The processing serves the purpose of enabling commenting and displaying comments. By submitting the comment/review, you consent to the processing of the transmitted data. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent until revocation. Your personal data will then be deleted.
If your comment is published, only the name you provide will be published.
Evaluation reminder
After your order, we would like to ask you to rate your purchase from us.
For this purpose, we use your personal data (name, e-mail address, order information) independently of the contract processing in order to send you an evaluation reminder by e-mail after an order has been placed, provided you have expressly consented to this.
The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by using the corresponding link in the email or by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.
Use of the e-mail address for sending contract-relevant system e-mails and newsletters
We use your e-mail address to process your request and to send you contract-relevant system e-mails (e.g. for invoices). The contract-relevant system e-mails may also contain offer information.
We use your e-mail address independently of the contract processing exclusively for our own advertising purposes for sending newsletters, provided you have expressly consented to this. The processing takes place on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list.
Payment service provider
Payment via Braintree (PayPal)
We process payments by PayPal and credit card and – for single purchases – by Google Pay via Braintree, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). For this purpose we transmit the data required for the payment to PayPal, such as name, address, e-mail address, amount and invoice number. You enter card details directly into Braintree’s input fields; they do not reach our servers – we only see details such as the card type and the masked card number. For card payments your bank may verify your identity via 3-D Secure; for this, Braintree transmits data via its service provider Cardinal Commerce to the card-issuing bank. For subscriptions, Braintree stores your payment method so that subsequent payments can be collected automatically. The processing serves the performance of the contract with you (Art. 6 para. 1 lit. b GDPR); where PayPal checks payments for fraud and misuse, this is done on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR).
If you pay with PayPal or Google Pay, the respective provider’s interface opens; scripts from PayPal or Google are loaded and cookies of these providers that are technically necessary for the payment are set (Section 25 (2) No. 2 TDDDG). For Google Pay, the privacy policy of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland also applies. Whether PayPal carries out a credit check for payments via your PayPal account (e.g. by direct debit) depends on PayPal’s terms. PayPal and Google may transfer data to third countries such as the USA; for this they rely on the adequacy decision of the EU Commission (EU-US Data Privacy Framework) or on standard contractual clauses.
Purchase on account
If you choose purchase on account, you pay by bank transfer to our bank account. We match incoming payments using the name, invoice number and amount of your invoice (Art. 6 para. 1 lit. b GDPR).
Older PayPal subscriptions
Older subscriptions that still run directly via PayPal are billed by PayPal itself. PayPal reports payments and changes to us (including name, e-mail address, amount and status) so that we can manage your account and your invoices (Art. 6 para. 1 lit. b GDPR).
Further information can be found in PayPal’s privacy policy (which also applies to Braintree) at https://www.paypal.com/de/webapps/mpp/ua/privacy-full and in Google’s at https://policies.google.com/privacy.
Cookies
Our website uses cookies. Cookies are small text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your Internet browser, you can be notified before cookies are set and decide whether to accept them individually and prevent the storage of cookies and transmission of the data they contain. Cookies that have already been saved can be deleted at any time. However, we would like to point out that you may then not be able to use all the functions of this website to their full extent. You can find out how to manage (including deactivating) cookies in the most important browsers by clicking on the links below:
Chrome: https: //support.google.com/accounts/answer/61416?hl=de
Internet Explorer: https: //support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-l%C3%B6schen-63947406-40ac-c3b8-57b9-2a946a29ae09
Mozilla Firefox: https: //support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Technically necessary cookies
Unless otherwise stated below in the privacy policy, we only use these technically necessary cookies for the purpose of making our website more user-friendly, effective and secure. Furthermore, cookies enable our systems to recognize your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognized even after a page change. The use of cookies or comparable technologies is based on § 25 para. 2 TDDDG. Your personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.
Cookie notices and consent on TutKit.com
How we inform you and ask for your consent depends on which pages you visit and whether you are logged in.
Pages without advertising and logged-in members
On pages without advertising (for example the home page, course and package pages, checkout and customer account) and – if you are logged in – on all pages, neither advertising nor Google Analytics is used. There we only use the technically necessary cookies and storage entries listed in the overview below; a notice informs you about this. No consent is required for this. We store the fact that you have closed the notice in your browser’s local storage (“cookie-banner”); no data is transmitted to us or to third parties (Section 25 (2) No. 2 TDDDG).
Pages with advertising
Blog posts, help articles (including the colouring pages), text tutorials and the overview pages of the colouring pages show advertising via Google AdSense to visitors who are not logged in; on these pages we also measure usage with Google Analytics 4 (see below). On these pages your browser loads the consent management tool “Privacy & messaging” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) from fundingchoicesmessages.google.com – a consent management platform certified by Google that works according to the Transparency & Consent Framework (TCF) of IAB Europe. Based on your IP address, it determines whether you are in the European Economic Area (EEA), the United Kingdom or Switzerland. For technical reasons Google receives your IP address, information about your browser and device and the address called up.
In the EEA, the United Kingdom and Switzerland a window from Google asks you: with “Consent” you agree to all listed purposes and vendors, with “Do not consent” you decline, and under “Manage options” you decide individually by purpose and vendor and can also object to processing for which vendors rely on a legitimate interest. The window shows you which vendors and purposes are involved. Google stores your choice as a consent string (TC string) in the cookie “FCCDCF” (valid for 13 months according to Google) and passes it on to the vendors integrated via the TCF; Google also sets the cookie “FCNEC” (365 days, according to Google for analytics purposes of the consent management).
In all other countries (for example in Turkey) Google does not show a window. In that case we ask with our own window: with “Agree & continue” you consent to advertising via Google AdSense and to measurement with Google Analytics; instead, you can also register free of charge and use TutKit.com without advertising and tracking. We only load Google AdSense and Google Analytics after you have agreed. We store your consent in your browser’s local storage (“advertisements-accepted”); no data is transmitted to us or to third parties.
The legal basis for storing and reading your decision is Section 25 (2) No. 2 TDDDG (strictly necessary in order to respect it), and for the processing Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR (obligation to obtain and document consent). Google may transfer data to Google LLC in the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified.
Withdrawing or changing your consent
You can withdraw or change your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out until then – via the link “Privacy and cookie settings” at the bottom of every page. In the EEA, the United Kingdom and Switzerland it reopens Google’s window; in all other countries it deletes your consent given in our own window so that we ask again on the next page with advertising. On pages without advertising, your browser only loads Google’s consent management when you click this link.
Overview of the cookies used:
| Use | Name | For what purpose? | Storage duration | Storage location |
| Necessary | XSRF-TOKEN | Protects forms and requests against forgery (CSRF protection). | 24 hours | Cookie |
| Necessary | laravel_session | Stores the session ID so that TutKit.com recognises you during your visit (e.g. login, shopping cart). | 24 hours | Cookie |
| Necessary | remember_web_… | Keeps you logged in if you log in via a login link without a password. | 400 days | Cookie |
| Necessary | tk_geraet | Recognises your device after login for the device list in your account (account protection). | 400 days from the last use | Cookie |
| Necessary | cookie-banner | Remembers that you have closed the cookie notice. | until deleted in the browser | Local storage |
| Consent | advertisements-accepted | Remembers your consent given in our own consent window (outside the EEA, the United Kingdom and Switzerland). | until withdrawn or deleted in the browser | Local storage |
| Necessary | theme | Stores which theme (dark/light mode) is displayed. | until deleted in the browser | Local storage |
| Necessary | translation | Required for language settings. | until deleted in the browser | Local storage |
| Necessary | notifications | Required for on-site notifications after login. | until deleted in the browser | Local storage |
| Necessary | __paypal_storage__ | Ensures proper transactions via PayPal. | Session | Local storage |
| Necessary | simpleStorage | Ensures proper transactions via PayPal. | Session | Local storage |
| Necessary | formData | Stores form data so that it is still displayed when the page is reloaded. | temporary | Local storage |
| Consent (Google) | FCCDCF | Google’s consent management: stores your choice (TC string). | 13 months | Cookie |
| Consent (Google) | FCNEC | Set by Google’s consent management, according to Google for analytics purposes. | 365 days | Cookie |
| Consent (Google) | google_auto_fc_cmp_setting | Stores consent preferences for personalised advertising and tracking. | permanent | Local storage |
| Advertising (Google AdSense) | google_adsense_settings | Stores settings for displaying Google AdSense advertising so that ads are delivered according to your choice. | permanent | Local storage |
| Advertising (Google AdSense) | __gads, __gpi | Delivery and measurement of ads, frequency capping, fraud prevention. | 13 months | Cookie |
| Security (Google AdSense) | __eoi | Fraud prevention. | 6 months | Cookie |
| Analytics (only with consent) | _ga, _ga_<ID> | Google Analytics 4: distinguishes visitors and sessions. | 2 years | Cookie |
Analysis of advertising tracking communication
Use of Google Analytics 4
We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.
The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator.
The following information may be collected: IP address, date and time of the page view, click path, information about the browser and device you are using, pages visited, referrer URL (website from which you accessed our website), location data, purchase activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and any other data that Google has about you.
The IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.
Google uses technologies such as cookies, web storage in the browser and tracking pixels that enable your use of the website to be analyzed. The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TDDDG i.V.m. Art. 6 para. 1 lit. a GDPR.
The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
We only load Google Analytics on pages with advertising, only if you are not logged in, and only after you have given your consent. In the EEA, the United Kingdom and Switzerland we use Google’s consent mode (Consent Mode v2) in its basic implementation for this: all consents are initially set to “denied”, and the Google tag (gtag.js from www.googletagmanager.com) is only loaded once you have consented to analytics in Google’s consent management. Without your consent no data is transmitted to Google Analytics, not even cookieless measurement requests (“pings”). In all other countries we only load Google Analytics after you have agreed in our own window. Google Analytics sets the cookies “_ga” and “_ga_<ID>” (each valid for 2 years according to Google).
The information generated about your use of this website is usually transferred to a Google server in the USA and stored there. An adequacy decision by the EU Commission is in place for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles. Both Google and US government authorities have access to your data.
You can find more information on terms of use and data protection at https://policies.google.com/technologies/partner-sites and at https://policies.google.com/privacy?hl=de&gl=de.
Use of Google AdSense
On blog posts, help articles (including the colouring pages), text tutorials and the overview pages of the colouring pages, we show advertising via Google AdSense of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) to visitors who are not logged in. Logged-in members do not see any advertising. The purpose of the processing is to market advertising space on our website. Google and – depending on your choice – other advertising partners may use cookies and similar technologies to deliver ads, measure their performance, prevent fraud and – only with your consent – tailor ads to your interests (personalised advertising). Without your consent to personalised advertising, Google only shows non-personalised or limited ads. You can see which partners are involved in Google’s consent management. Among others, Google sets the cookies “__gads”, “__gpi” (13 months each) and “__eoi” (6 months). In the EEA, the United Kingdom and Switzerland the AdSense script is loaded as soon as Google’s consent management is ready; whether and which ads and cookies are used depends on your choice there. In all other countries we only load Google AdSense after you have agreed in our own window.
The use of cookies or comparable technologies is based on your consent pursuant to Section 25 (1) TDDDG, and the processing of your personal data for personalised advertising and profiles on Art. 6 para. 1 lit. a GDPR. For certain other purposes – such as selecting basic, non-personalised ads, measuring the performance of ads and content, market research and developing and improving products – Google and other advertising partners may, in accordance with the TCF rules, rely on their legitimate interest instead of your consent (Art. 6 para. 1 lit. f GDPR); you can object to this processing at any time under “Manage options”. Storing and accessing information on your device as well as personalised advertising and content always require your consent. In addition, Google and the partners process data for special purposes that cannot be objected to in the window (security, fraud prevention and debugging, technical delivery of ads and content, saving your privacy choices) on the basis of their legitimate interest (Art. 6 para. 1 lit. f GDPR); your right to object under Art. 21 GDPR remains unaffected. You can withdraw your consent at any time (see above). Data may be transferred to Google LLC in the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified.
Further information: https://policies.google.com/technologies/ads and https://policies.google.com/privacy
Google Ads and remarketing
We do not use our own Google Ads conversion or remarketing tags. If our Google Analytics account is linked to Google Ads, Google may also use the Analytics data collected with your consent to measure the success of our ads and for audiences – only within the purposes to which you have consented.
Plug-ins and miscellaneous
Google tag (gtag.js)
We integrate Google Analytics via the Google tag (gtag.js), which is loaded from www.googletagmanager.com – only in the cases described above and only after your consent. We do not use a Google Tag Manager container or Google reCAPTCHA.
Use of YouTube (two-click solution)
On some pages – especially text tutorials, help articles and blog posts – we embed videos hosted on YouTube, mostly from our own channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). At first you only see a preview image that our server retrieved once from YouTube and delivers itself; your browser does not connect to YouTube or Google in the process. Only when you click “Play video from YouTube” does your browser load the video in privacy-enhanced mode from www.youtube-nocookie.com. From then on, Google receives your IP address, information about your browser and device, the page called up and information about your use of the player; YouTube may store and read data in your browser’s storage. If you are logged in to Google, Google may associate the call with your account.
The legal basis for loading the video is your consent, which you give with the click (Section 25 (1) TDDDG, Art. 6 para. 1 lit. a GDPR). It only applies to this playback – on your next page view you will see the preview image again. We deliver the preview image on the basis of our legitimate interest in a clear presentation (Art. 6 para. 1 lit. f GDPR); no data is transmitted to Google in the process. Google may transfer data to the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified. Further information on YouTube and Google: https://policies.google.com/privacy
Software comparisons and affiliate links
Redirect via tutkit.com/go/
On our software comparison pages (www.tutkit.com/en/comparisons), links to providers go through a redirect on our own server (addresses starting with tutkit.com/go/). When you click such a link, our server immediately forwards your browser to the provider’s website or, for affiliate links, to the provider’s affiliate network.
What we store when you click
For each click we store one row with: the time, which comparison, entry, product and plan, whether an affiliate link was used (and which one), the page language, where the link was on the page (for example card or table), the page version, whether the request came from a mobile device (yes or no only) and a random twelve-character click ID. We do not store your IP address, your browser identifier (user agent), cookies, your customer number or any other information that identifies you. We do not set cookies for this count and do not read anything from your device. We do not count requests from search engines and other programs, prefetched pages or clicks by our editorial team; for this we evaluate the browser identifier and an existing login only at the moment of the click, without storing them.
Random ID for commissions
For affiliate links we append the random click ID to the target address so that the affiliate network can match a commission to this click. The ID only refers to the stored click row and does not allow any conclusion about you.
Protection against abuse
To prevent mass automated requests, our server counts for at most one minute how often an IP address (for logged-in users: the customer account) calls these redirects. The counter is stored only as a checksum and then expires automatically. Like every page request, the redirect is also recorded in the server log files (see “Server log files”).
Data reaches providers and affiliate networks only when you click
Only when you click a link does your browser open the provider’s or affiliate network’s website. As with any website request, your browser then transmits technically necessary data such as your IP address and browser identifier to that third party. As the origin, your browser usually transmits only our domain (tutkit.com), not the exact page. From that moment the provider or affiliate network is responsible; cookies may be set there, for example to attribute a commission. We do not embed code, pixels or cookies of affiliate networks on tutkit.com.
Purpose, legal basis and storage period
We count clicks to see which comparisons and entries are used, to settle commissions and to prevent abuse. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in funding the comparisons through commissions, improving them and operating the website securely. Where a stored click row cannot be attributed to a person, it is not personal data. We automatically delete click rows after 760 days (about 25 months) so that we can compare figures with the previous year; the abuse counter expires after one minute. Our host Hetzner processes the data on our behalf (see above).
Your right to object
You can object to this processing at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR), for example by e-mail to info@tutkit.com. If you want to avoid the redirect through our server altogether, open the provider’s website directly instead of using the link on our page.
Rights of data subjects and storage duration
Duration of storage
Once the contract has been fully processed, the data will initially be stored for the duration of the warranty period, then in accordance with statutory retention periods, in particular under tax and commercial law, and then deleted after expiry of the period, unless you have consented to further processing and use.
Rights of the data subject
If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.
You also have the right to object to processing based on Article 6(1)(f) GDPR and to processing for the purposes of direct marketing in accordance with Article 21(1) GDPR.
Right to lodge a complaint with the supervisory authority
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that your personal data is being processed unlawfully.
Right to object
If the personal data processing listed here is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time with effect for the future for reasons arising from your particular situation.
Once you have objected, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.
last update: 11.10.2026