Privacy policy
This page is merely a translation of the binding legal texts of the German-language page.
Unless otherwise stated below, the provision of your personal data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide data has no consequences. This only applies if no other information is provided in the following processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.
We host the content of our website with the following provider:
Hetzner
The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter referred to as "Hetzner"). When you visit our website, Hetzner collects various log files including your IP addresses.
Details can be found in Hetzner's privacy policy: https://www.hetzner.com/de/legal/privacy-policy/
The use of Hetzner is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in displaying our website as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Order processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that the personal data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.
Server log files
You can visit our website without providing any personal data.
Each time you access our website, usage data is transmitted to us or our web host / IT service provider by your Internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in ensuring the trouble-free operation of our website and to improve our offer.
We delete the server log files automatically after 14 days.
Change log
If something changes in your customer account, your licence (including cancellation, pause, invitation or classroom), an invoice, payment, refund or payment reminder, we record what was changed and when, and who made the change (you, our team or an automated process) – together with the IP address, your browser identifier (user agent) and the address called up from which the change originated. This serves the traceability of our billing and the protection of your account against misuse; the legal basis is our legitimate interest in this (Art. 6 para. 1 lit. f GDPR). After 90 days we shorten the IP address (IPv4: last block set to 0, IPv6: to the first 48 bits) so that it can no longer be assigned to an individual connection. We delete the log entries themselves after ten years, counted from the end of the calendar year of the change – this is how long the related billing records must be kept under German commercial and tax law (Section 257 HGB, Section 147 AO). In our backups, the full IP address is retained until the respective backup is deleted in the regular cycle.
Contact details
Person responsible
Please contact us on request. The controller responsible for data processing is: 4eck Media GmbH & Co. KG, Papenbergstr. 43, 17192 Waren (Müritz) Germany, +49 174 7330699 , info@tutkit.com
Proactive contact by the customer by e-mail
If you contact us by e-mail on your own initiative, we will only collect your personal data (name, e-mail address, message text) to the extent provided by you. The purpose of data processing is to process and respond to your contact request.
If the purpose of the contact is to carry out pre-contractual measures (e.g. advice in the event of an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit . f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR at any time for reasons arising from your particular situation.
We will only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Collection and processing when using the contact form
When you use the contact form, we only collect your personal data (name, e-mail address, message text) to the extent that you provide it. The data processing serves the purpose of establishing contact.
If the purpose of the contact is to carry out pre-contractual measures (e.g. advice on an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit . f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR at any time for reasons arising from your particular situation.
We will only use your e-mail address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Customer account orders
Customer account
When you open a customer account, we collect your personal data to the extent specified there. The purpose of data processing is to improve your shopping experience and simplify order processing. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent until revocation. Your customer account will then be deleted.
Account protection (device list)
When you log in to TutKit.com, we store a random identifier of your device in a cookie (“tk_geraet”, valid for 400 days from the last use); on our side only an irreversible hash of it is stored. Together with browser, operating system and device type and – for your logins – a shortened IP address (IPv4: last block set to 0, IPv6: first 48 bits), this lets us show you in your account which devices you have logged in with and when you last used them; there you can log out individual devices. We may also inform you by e-mail when someone logs in from a new device. We delete the logins including the shortened IP address after 90 days, and the device entry (without IP address) 400 days after the device was last used. If you change your e-mail address, we store the request (previous and new address encrypted, shortened IP address) for 100 days. The cookie is strictly necessary for the security of your account (Section 25 (2) No. 2 TDDDG); the legal basis for the processing is our legitimate interest in protecting your account against unauthorised access (Art. 6 para. 1 lit. f GDPR).
Collection, processing and forwarding of personal data for orders
When you place an order, we collect and process your personal data only to the extent necessary to fulfill and process your order and to process your inquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR and is necessary for the performance of a contract with you. Your data will be passed on, for example, to the shipping companies and dropshipping providers you have selected, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is kept to a minimum.
Advertising reviews
Data collection when writing a comment or rating
When you comment on an article or post, we only collect your personal data (name, email address, comment text) to the extent that you provide and for the purpose of verification. The processing serves the purpose of enabling commenting and displaying comments. By submitting the comment/review, you consent to the processing of the transmitted data. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent until revocation. Your personal data will then be deleted.
If your comment is published, only the name you provide will be published.
Evaluation reminder
After your order, we would like to ask you to rate your purchase from us.
For this purpose, we use your personal data (name, e-mail address, order information) independently of the contract processing in order to send you an evaluation reminder by e-mail after an order has been placed, provided you have expressly consented to this.
The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by using the corresponding link in the email or by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.
Use of the e-mail address for sending contract-relevant system e-mails and newsletters
We use your e-mail address to process your request and to send you contract-relevant system e-mails (e.g. for invoices). The contract-relevant system e-mails may also contain offer information.
We use your e-mail address independently of the contract processing exclusively for our own advertising purposes for sending newsletters, provided you have expressly consented to this. The processing takes place on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list.
Payment service provider
Payment via Braintree (PayPal)
We process payments by PayPal and credit card and – for single purchases – by Google Pay via Braintree, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). For this purpose we transmit the data required for the payment to PayPal, such as name, address, e-mail address, amount and invoice number. You enter card details directly into Braintree’s input fields; they do not reach our servers – we only see details such as the card type and the masked card number. For card payments your bank may verify your identity via 3-D Secure; for this, Braintree transmits data via its service provider Cardinal Commerce to the card-issuing bank. For subscriptions, Braintree stores your payment method so that subsequent payments can be collected automatically. The processing serves the performance of the contract with you (Art. 6 para. 1 lit. b GDPR); where PayPal checks payments for fraud and misuse, this is done on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR).
If you pay with PayPal or Google Pay, the respective provider’s interface opens; scripts from PayPal or Google are loaded and cookies of these providers that are technically necessary for the payment are set (Section 25 (2) No. 2 TDDDG). For Google Pay, the privacy policy of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland also applies. Whether PayPal carries out a credit check for payments via your PayPal account (e.g. by direct debit) depends on PayPal’s terms. PayPal and Google may transfer data to third countries such as the USA; for this they rely on the adequacy decision of the EU Commission (EU-US Data Privacy Framework) or on standard contractual clauses.
Purchase on account
If you choose purchase on account, you pay by bank transfer to our bank account. We match incoming payments using the name, invoice number and amount of your invoice (Art. 6 para. 1 lit. b GDPR).
Older PayPal subscriptions
Older subscriptions that still run directly via PayPal are billed by PayPal itself. PayPal reports payments and changes to us (including name, e-mail address, amount and status) so that we can manage your account and your invoices (Art. 6 para. 1 lit. b GDPR).
Further information can be found in PayPal’s privacy policy (which also applies to Braintree) at https://www.paypal.com/de/webapps/mpp/ua/privacy-full and in Google’s at https://policies.google.com/privacy.
Cookies
Our website uses cookies. Cookies are small text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your Internet browser, you can be notified before cookies are set and decide whether to accept them individually and prevent the storage of cookies and transmission of the data they contain. Cookies that have already been saved can be deleted at any time. However, we would like to point out that you may then not be able to use all the functions of this website to their full extent. You can find out how to manage (including deactivating) cookies in the most important browsers by clicking on the links below:
Chrome: https: //support.google.com/accounts/answer/61416?hl=de
Internet Explorer: https: //support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-l%C3%B6schen-63947406-40ac-c3b8-57b9-2a946a29ae09
Mozilla Firefox: https: //support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Technically necessary cookies
Unless otherwise stated below in the privacy policy, we only use these technically necessary cookies for the purpose of making our website more user-friendly, effective and secure. Furthermore, cookies enable our systems to recognize your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognized even after a page change. The use of cookies or comparable technologies is based on § 25 para. 2 TDDDG. Your personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.
Cookie notices and consent on TutKit.com
How we inform you and ask for your consent depends on which pages you visit and whether you are logged in. Independently of this, we count the page views of our public pages by visitors who are not logged in on the server side with our own installation of Plausible Analytics – without cookies and without any script in your browser. We do not ask for your consent for this, but you can object at any time. We do not count the checkout, customer account or login, and we never count logged-in members (see “Reach measurement with Plausible Analytics”).
Pages without advertising and logged-in members
On pages without advertising (for example the home page, course and package pages, checkout and customer account) and – if you are logged in – on all pages, no advertising is shown. There we only use the technically necessary cookies and storage entries listed in the overview below; a notice informs you about this. No consent is required for this. We store the fact that you have closed the notice in your browser’s local storage (“cookie-banner”); no data is transmitted to us or to third parties (Section 25 (2) No. 2 TDDDG).
Pages with advertising
Blog posts, help articles (including the colouring pages), text tutorials and the overview pages of the colouring pages show advertising via Google AdSense to visitors who are not logged in. On these pages your browser loads the consent management tool “Privacy & messaging” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) from fundingchoicesmessages.google.com – a consent management platform certified by Google that works according to the Transparency & Consent Framework (TCF) of IAB Europe. Based on your IP address, it determines whether you are in the European Economic Area (EEA), the United Kingdom or Switzerland. For technical reasons Google receives your IP address, information about your browser and device and the address called up.
In the EEA, the United Kingdom and Switzerland a window from Google asks you: with “Consent” you agree to all listed purposes and vendors, with “Do not consent” you decline, and under “Manage options” you decide individually by purpose and vendor and can also object to processing for which vendors rely on a legitimate interest. The window shows you which vendors and purposes are involved. Google stores your choice as a consent string (TC string) in the cookie “FCCDCF” (valid for 13 months according to Google) and passes it on to the vendors integrated via the TCF; Google also sets the cookie “FCNEC” (365 days, according to Google for analytics purposes of the consent management).
In all other countries (for example in Turkey) Google does not show a window. In that case we ask with our own window: with “Agree & continue” you consent to advertising via Google AdSense; instead, you can also register free of charge and use TutKit.com without advertising and tracking. We only load Google AdSense after you have agreed. We store your consent in your browser’s local storage (“advertisements-accepted”); no data is transmitted to us or to third parties.
The legal basis for storing and reading your decision is Section 25 (2) No. 2 TDDDG (strictly necessary in order to respect it), and for the processing Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR (obligation to obtain and document consent). Google may transfer data to Google LLC in the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified.
Withdrawing or changing your consent
You can withdraw or change your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out until then – via the link “Privacy and cookie settings” at the bottom of every page. In the EEA, the United Kingdom and Switzerland it reopens Google’s window; in all other countries it deletes your consent given in our own window so that we ask again on the next page with advertising. On pages without advertising, your browser only loads Google’s consent management when you click this link.
Overview of the cookies used:
| Use | Name | For what purpose? | Storage duration | Storage location |
| Necessary | XSRF-TOKEN | Protects forms and requests against forgery (CSRF protection). | 24 hours | Cookie |
| Necessary | laravel_session | Stores the session ID so that TutKit.com recognises you during your visit (e.g. login, shopping cart). | 24 hours | Cookie |
| Necessary | remember_web_… | Keeps you logged in if you log in via a login link without a password. | 400 days | Cookie |
| Necessary | tk_geraet | Recognises your device after login for the device list in your account (account protection). | 400 days from the last use | Cookie |
| Necessary | cookie-banner | Remembers that you have closed the cookie notice. | until deleted in the browser | Local storage |
| Consent | advertisements-accepted | Remembers your consent given in our own consent window (outside the EEA, the United Kingdom and Switzerland). | until withdrawn or deleted in the browser | Local storage |
| Necessary | theme | Stores which theme (dark/light mode) is displayed. | until deleted in the browser | Local storage |
| Necessary | translation | Required for language settings. | until deleted in the browser | Local storage |
| Necessary | notifications | Required for on-site notifications after login. | until deleted in the browser | Local storage |
| Necessary | __paypal_storage__ | Ensures proper transactions via PayPal. | Session | Local storage |
| Necessary | simpleStorage | Ensures proper transactions via PayPal. | Session | Local storage |
| Necessary | formData | Stores form data so that it is still displayed when the page is reloaded. | temporary | Local storage |
| Consent (Google) | FCCDCF | Google’s consent management: stores your choice (TC string). | 13 months | Cookie |
| Consent (Google) | FCNEC | Set by Google’s consent management, according to Google for analytics purposes. | 365 days | Cookie |
| Consent (Google) | google_auto_fc_cmp_setting | Stores consent preferences for personalised advertising and tracking. | permanent | Local storage |
| Advertising (Google AdSense) | google_adsense_settings | Stores settings for displaying Google AdSense advertising so that ads are delivered according to your choice. | permanent | Local storage |
| Advertising (Google AdSense) | __gads, __gpi | Delivery and measurement of ads, frequency capping, fraud prevention. | 13 months | Cookie |
| Security (Google AdSense) | __eoi | Fraud prevention. | 6 months | Cookie |
Analysis of advertising tracking communication
Reach measurement with Plausible Analytics
To understand which pages and content are read and where our visitors come from, we count the page views of TutKit.com with Plausible Analytics, open-source statistics software that does not create user profiles. We operate it ourselves on our own server (statistik.tutkit.com) at our host Hetzner in the Nuremberg data center (see above); Hetzner processes the data on our behalf. Counting takes place on the server side: no script runs in your browser for this purpose, we do not set cookies for it and we store nothing on your device. We only use what your browser sends with the page request anyway; whether you are logged in and whether your browser sends a privacy signal is checked only at the moment of the request and is not reported to Plausible. We do not transfer any personal data to the developer of the software, Plausible Insights OÜ (Estonia), or to other third parties; there is no transfer to countries outside the EU.
Which pages we count
We count page views of public pages in German and English by visitors who are not logged in – for example the home page, magazine and news, product and course pages, help topics, search, contact, events and software comparisons. We do not count the checkout, customer account, login and registration, previews, personal links (for example from e-mails), error pages, prefetched pages or requests by programs such as search engines. If you are logged in, or if your browser sends the “Global Privacy Control” or “Do Not Track” signal, we do not count you.
What data is processed
When you open such a page, our web server reports the following to the statistics server after delivering the page: the address of the page without search terms or other parameters (only the campaign parameters “utm_source”, “utm_medium” and “utm_campaign” are kept), the domain of the website you came from, if your browser sends it (if you come from another page of TutKit.com, no origin is reported), as well as your IP address and your browser identifier (user agent), which your browser transmits to our web server with every page request anyway. From these, Plausible determines the country the request comes from as well as the browser and operating system (each with version number) and the device type; it discards requests whose browser identifier indicates a program (bot). This information is stored together with the time of the request; the IP address itself is not stored. Form entries, e-mail addresses and customer numbers are not transmitted. The statistics server does not keep access logs with IP addresses.
How visitors are counted and how long we store the data
To be able to count daily visitors, Plausible creates a pseudonymous identifier (hash) from the IP address, browser identifier, our domain and a random value and stores it with each page view. It groups page views with the same identifier into visits (a visit ends after 30 minutes without activity) and stores the entry and exit page, the number of pages viewed and the duration of the visit. Plausible creates a new random value every day at 0:00 UTC (1:00 German time, 2:00 during summer time) and deletes it after two days, in some cases only after three; if a renewal fails, for example because the server is restarting at that moment, the previous value remains valid for one more day. In the daily backups of the entire server at Hetzner it remains until they are overwritten after seven days, and our own database backups do not contain it. After that, the identifier can no longer be recreated. At most, a stored page view could then still be matched, via time, page and browser, with other records: with the server log files of our web server (see “Server log files”, deleted after 14 days) and, if you register or log in immediately afterwards, with the change log and the device list of your customer account (see “Change log” and “Account protection (device list)”). We do not carry out such matching. Plausible links visits on different days only in this exceptional case; otherwise only a session that is in progress at that moment continues into the next day. We keep the statistics for as long as we operate reach measurement.
Purpose and legal basis
We evaluate the use of TutKit.com statistically in order to improve our content and offering and to be able to demonstrate the reach of our pages. The legal basis is our legitimate interest in data-minimizing reach measurement (Art. 6 para. 1 lit. f GDPR). We also show aggregated figures, such as page views per page or where visitors come from, to advertising and cooperation partners via password-protected read-only access; they do not see IP addresses, hashes or other identifiers of individual visitors.
Your rights regarding reach measurement
As a rule, we cannot identify you in the statistics without additional information from you. You can therefore only exercise the rights of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR) for this data if you provide us with information that enables us to identify you (Art. 11 para. 2 GDPR); once the random value has also been deleted from the backups, the identifier can no longer be recreated, and identification is at most possible via time, page and browser (see “How visitors are counted and how long we store the data”). Your right to object remains unaffected.
Objecting to reach measurement
You can object to reach measurement at any time (Art. 21 para. 1 GDPR). The easiest way is automatic: switch on “Global Privacy Control” or “Do Not Track” in your browser (depending on the browser, in the privacy settings or via an extension); we will then not count your page views. You can also notify us of your objection informally, for example by e-mail to info@tutkit.com. Since we cannot tell your page views apart from those of other visitors without these signals, we will then explain how to switch them on; if you are logged in, we do not count you anyway.
Use of Google AdSense
On blog posts, help articles (including the colouring pages), text tutorials and the overview pages of the colouring pages, we show advertising via Google AdSense of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) to visitors who are not logged in. Logged-in members do not see any advertising. The purpose of the processing is to market advertising space on our website. Google and – depending on your choice – other advertising partners may use cookies and similar technologies to deliver ads, measure their performance, prevent fraud and – only with your consent – tailor ads to your interests (personalised advertising). Without your consent to personalised advertising, Google only shows non-personalised or limited ads. You can see which partners are involved in Google’s consent management. Among others, Google sets the cookies “__gads”, “__gpi” (13 months each) and “__eoi” (6 months). In the EEA, the United Kingdom and Switzerland the AdSense script is loaded as soon as Google’s consent management is ready; whether and which ads and cookies are used depends on your choice there. In all other countries we only load Google AdSense after you have agreed in our own window.
The use of cookies or comparable technologies is based on your consent pursuant to Section 25 (1) TDDDG, and the processing of your personal data for personalised advertising and profiles on Art. 6 para. 1 lit. a GDPR. For certain other purposes – such as selecting basic, non-personalised ads, measuring the performance of ads and content, market research and developing and improving products – Google and other advertising partners may, in accordance with the TCF rules, rely on their legitimate interest instead of your consent (Art. 6 para. 1 lit. f GDPR); you can object to this processing at any time under “Manage options”. Storing and accessing information on your device as well as personalised advertising and content always require your consent. In addition, Google and the partners process data for special purposes that cannot be objected to in the window (security, fraud prevention and debugging, technical delivery of ads and content, saving your privacy choices) on the basis of their legitimate interest (Art. 6 para. 1 lit. f GDPR); your right to object under Art. 21 GDPR remains unaffected. You can withdraw your consent at any time (see above). Data may be transferred to Google LLC in the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified.
Further information: https://policies.google.com/technologies/ads and https://policies.google.com/privacy
Google Ads and remarketing
We do not use our own Google Ads conversion or remarketing tags.
Plug-ins and miscellaneous
Use of YouTube (two-click solution)
On some pages – especially text tutorials, help articles and blog posts – we embed videos hosted on YouTube, mostly from our own channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). At first you only see a preview image that our server retrieved once from YouTube and delivers itself; your browser does not connect to YouTube or Google in the process. Only when you click “Play video from YouTube” does your browser load the video in privacy-enhanced mode from www.youtube-nocookie.com. From then on, Google receives your IP address, information about your browser and device, the page called up and information about your use of the player; YouTube may store and read data in your browser’s storage. If you are logged in to Google, Google may associate the call with your account.
The legal basis for loading the video is your consent, which you give with the click (Section 25 (1) TDDDG, Art. 6 para. 1 lit. a GDPR). It only applies to this playback – on your next page view you will see the preview image again. We deliver the preview image on the basis of our legitimate interest in a clear presentation (Art. 6 para. 1 lit. f GDPR); no data is transmitted to Google in the process. Google may transfer data to the USA; for the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified. Further information on YouTube and Google: https://policies.google.com/privacy
Software comparisons and affiliate links
Redirect via tutkit.com/go/
On our software comparison pages (www.tutkit.com/en/comparisons), links to providers go through a redirect on our own server (addresses starting with tutkit.com/go/). When you click such a link, our server immediately forwards your browser to the provider’s website or, for affiliate links, to the provider’s affiliate network.
What we store when you click
For each click we store one row with: the time, which comparison, entry, product and plan, whether an affiliate link was used (and which one), the page language, where the link was on the page (for example card or table), the page version, whether the request came from a mobile device (yes or no only) and a random twelve-character click ID. We do not store your IP address, your browser identifier (user agent), cookies, your customer number or any other information that identifies you. We do not set cookies for this count and do not read anything from your device. We do not count requests from search engines and other programs, prefetched pages or clicks by our editorial team; for this we evaluate the browser identifier and an existing login only at the moment of the click, without storing them. Independently of this, Plausible counts the views of the comparison pages (not the clicks), as described under “Reach measurement with Plausible Analytics”.
Random ID for commissions
For affiliate links we append the random click ID to the target address so that the affiliate network can match a commission to this click. The ID only refers to the stored click row and does not allow any conclusion about you.
Protection against abuse
To prevent mass automated requests, our server counts for at most one minute how often an IP address (for logged-in users: the customer account) calls these redirects. The counter is stored only as a checksum and then expires automatically. Like every page request, the redirect is also recorded in the server log files (see “Server log files”).
Data reaches providers and affiliate networks only when you click
Only when you click a link does your browser open the provider’s or affiliate network’s website. As with any website request, your browser then transmits technically necessary data such as your IP address and browser identifier to that third party. As the origin, your browser usually transmits only our domain (tutkit.com), not the exact page. From that moment the provider or affiliate network is responsible; cookies may be set there, for example to attribute a commission. We do not embed code, pixels or cookies of affiliate networks on tutkit.com.
Purpose, legal basis and storage period
We count clicks to see which comparisons and entries are used, to settle commissions and to prevent abuse. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in funding the comparisons through commissions, improving them and operating the website securely. Where a stored click row cannot be attributed to a person, it is not personal data. We automatically delete click rows after 760 days (about 25 months) so that we can compare figures with the previous year; the abuse counter expires after one minute. Our host Hetzner processes the data on our behalf (see above).
Your right to object
You can object to this processing at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR), for example by e-mail to info@tutkit.com. If you want to avoid the redirect through our server altogether, open the provider’s website directly instead of using the link on our page.
Rights of data subjects and storage duration
Duration of storage
Once the contract has been fully processed, the data will initially be stored for the duration of the warranty period, then in accordance with statutory retention periods, in particular under tax and commercial law, and then deleted after expiry of the period, unless you have consented to further processing and use.
Rights of the data subject
If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.
You also have the right to object to processing based on Article 6(1)(f) GDPR and to processing for the purposes of direct marketing in accordance with Article 21(1) GDPR.
Right to lodge a complaint with the supervisory authority
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that your personal data is being processed unlawfully.
Right to object
If the personal data processing listed here is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time with effect for the future for reasons arising from your particular situation.
Once you have objected, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.
last update: 31.10.2026