Data protection information

1. Responsible person and contact

These notes apply to the public information website of the EU AML-Managers including the contact function described here and the protected editorial area for website management. They do not describe any data processing within a separate training software.

2. Visit of the website and hosting

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. STRATO processes the data generated during the operation of the web server as a hosting service provider.

When the website is accessed, technically necessary connection data are transmitted. This includes in particular the IP address, date and time of retrieval, the requested address, the response status and the amount of data transferred. In addition, information about the browser and operating system as well as the previously visited page, insofar as your browser transmits it. Server-side log data is generated during hosting.

This processing serves to deliver the website, to ensure its functionality and to detect technical errors or attacks. The legal basis is Article 6(1)(f) of the DSGVO. Our legitimate interest lies in the reliable and secure operation of the website.

The storage time of log data depends on its necessity for operation, error analysis and security. If the respective purpose does not apply, the relevant data will be deleted or anonymised. In the event of a specific security incident, further storage of the data required for reconnaissance may be necessary until the investigation or enforcement of legal claims has been completed.

Information from the hosting provider can be found in the Privacy Policy of STRATO.

3. Contact form: Design in the browser

You can create a message text with the contact details you entered in the contact area. These inputs are initially processed exclusively in the memory of your browser. Filling out the form and creating the draft do not send a message to us and do not transfer the form entries to our web server.

The website does not place the entries in cookies, localStorage or a server-side database. An automatic recovery of the design by the website is not provided. Your browser can offer its own functions, such as the automatic filling out of forms, regardless of how it works.

Copy Draft

At your request, the text is transferred to the clipboard of your device. The website does not transfer it to us.

Save Draft

On your request, a file is created for download. You determine where to store them and when to delete them. A file or clipboard synchronization you set up can process the data via your own services.

Open Email Program

The draft is passed to the mail program you selected via an e-mail link. The website does not send the message itself. They check and ship them there. Already opening a cloud-based mail program can trigger processing by its provider.

You decide whether to use these functions or leave the contact area. The details in the contact draft are not required for a mere visit to the website.

4. If you send us an e-mail

If you send a message to info@eu-aml.com we process your sender's address, the transmitted contact details, the content of the message and, if applicable, attachments. The purpose is to process and answer your request.

The contact and provision of your information are voluntary and not required by law or contract for visiting this website. For a personal answer we need a contact address. Without these, we cannot answer you.

If your message concerns the initiation or execution of a contract with you, such as a specific training request, Art. 6 para. 1 point b DSGVO is the legal basis. Other requests are processed on the basis of Art. 6 para. 1 letter f DSGVO. Our legitimate interest is to be able to answer incoming questions properly and to understand the correspondence.

The contact address is provided via the e-mail service of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. STRATO processes the data required for the reception, storage and provision of correspondence, including the connection and delivery data. The processing of your request is carried out by the provider and the persons assigned to it.

Contact person for training requests is: Timo Winkelbach. The controller for the data processing described here remains Oliver Michaelis, acting under "KI Akademie" .

We will keep your request as long as necessary for the processing and necessary queries. After that, the data will be deleted insofar as no statutory retention obligations or the assertion, exercise or defence of legal claims require further storage. Whether such reasons exist depends on the content and course of the respective request.

5. Cookies, Analysis and External Content

The public information area does not set analysis or marketing cookies. A technically necessary session cookie is used for the protected editorial area; details are described in section 9. No analysis or marketing services are involved. Fonts and design tools are delivered with the website. External font services, embedded videos, maps and social media plugins are not loaded. The technical protocols resulting from hosting are described in Section 2.

References to other websites are common links. Only when you access such a link do you leave this offer and call up the respective destination. The data protection notices there apply to its processing.

No automated decision with legal or similarly significant effect and no profiling takes place on this information website.

6. Your rights

In accordance with the legal requirements, you have the following rights:

• information about your personal data pursuant to Art. 15 DSGVO;
• correction of incorrect or incomplete data pursuant to Art. 16 DSGVO;
• deletion under Art. 17 DSGVO;
• restriction of processing according to Art. 18 DSGVO;
• data portability in accordance with Art. 20 DSGVO, provided that its requirements are met;
• Objection under Art. 21 DSGVO.

Insofar as processing is based on Article 6(1)(f) of the DSGVO, you may object for reasons arising from your particular situation. We will not process the relevant data further unless we prove compelling legitimate reasons that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

To exercise your rights, you can contact the aforementioned controller. No flat-rate consent is required for the contact draft described here.

You also have the right to complain to a data protection supervisory authority. State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW) in particular, you can also contact the supervisory authority of your habitual place of residence or workplace.

7. Changes in functions

These references refer to the described information website with local contact draft and protected website editor. If, for example, direct form delivery, additional user accounts, booking functions or embedded services are introduced later, the instructions must be adapted to their actual data processing.

8. Example test for certificates and badges

The current proof test is explicitly marked as an example test. It only uses fictitious datasets delivered to the website. Inputs in the test field are evaluated locally in your browser's memory for this sample check; no real subscriber register is queried. Please do not enter any additional personal data here.

The sample check does not save your input in cookies, localStorage or a database. If a link called up contains a proof ID as URL parameter, it may appear as part of the requested address in technical hosting protocols; Section 2 applies. The proof page does not transmit the address as a referrer to linked pages.

A registry check for evidence actually issued is not yet activated. Before they are put into service, these notes shall be adapted to the actual public evidence, legal bases and retention periods.

9. Protected editorial area

The editorial area serves exclusively for the administration of this website by the authorized super admin. There is no public registration. For registration, the e-mail address and password entered will be transmitted to the server and checked there. The login is protected via HTTPS. The editorial application does not store the password in plain text, but uses a server-side password hash.

Registration session and technically required cookie

The processing for secure website management and the defence against unauthorized registration attempts is carried out on the basis of Art. 6 para. 1 letter f DSGVO. The legitimate interest lies in the protection of editorial access and published website content. § 25 para. 2 No. 2 TDDDG applies to the session cookie required for this purpose. Official basis: DSGVO and § 25 TDDDG.

When calling the editorial area, the application sets the session cookie EUAML_EDITOR. It contains a random session identifier and is needed to assign the login status and protection against foreign form submissions. The cookie is limited to the editorial area, not readable for JavaScript and with SameSite=Strict The HTTPS call only transmits it via the encrypted connection. It is set as a session cookie without a fixed expiry date. The behavior when closing and restoring the browser also depends on its settings.

On the server side, the login state, the super admin role, the associated account email address, the login time, the last access and a random form protection value are processed in the session. A further call after more than 30 minutes of inactivity or after more than four hours since the registration is required. By logging out, the session is terminated and the cookie is instructed to be deleted. The technical cleaning of other PHP session files depends on the hosting configuration.

Limitation of registration attempts

To protect access, login attempts are limited in a time window of 15 minutes. The application processes an identifier derived from the IP address with a secret server-side key, the start of the time window and a test counter. In addition, a common counter for the time window is run. In this separate application file, the IP address is not stored in plain text. The technical hosting protocols of Section 2 are separate from them.

Expired count entries will be cleaned up the next login attempt; an independent timed deletion is not set up. If successful, the counting entry belonging to the requesting address will be removed. This processing serves the secure assignment of legitimate access and protection against repeated unauthorized registration attempts.

Editorial statuses and published contents

When publication is confirmed, the application stores the approved texts, links, image assignments, layout and design settings, custom translations, a sequential version number, the time, the identifiers of changed fields and any optional change note. The last 30 previous editorial versions are retained in protected editorial storage for restoration. Further publications remove older versions beyond this limit from the application history. The currently published version remains available until it is changed or removed. The application uses files in the hosting package for this purpose; no separate database is used.

Approved website texts, contact details, links, image assignments, design settings and custom translations become publicly accessible after publication. A read-only content endpoint provides these public values and their version number. It does not expose password hashes, login credentials, session protection values or previous editorial versions. Previewing unsaved changes requires authentication and a valid form protection token; the preview does not change the published version.

Images uploaded through the editorial area are stored on the web server and can be accessed publicly through their image URLs. An image’s assignment to a location on the website is stored with the editorial version. Replacing an image later or restoring an earlier version does not automatically delete uploaded image files. Those files are removed through the webspace administration.

10. Language selection and locally provided language versions

The language versions of this website have already been prepared and are delivered as separate files from the same web server. Selecting a language loads the corresponding language file and displays the text directly on this website. No external translation service is called.

The selected language is stored as a language code in the page address and, where your browser permits, in local browser storage (localStorage). This preserves your selection when you move between pages and return later. You can change your selection at any time using the language selector, or remove it by clearing this website’s data in your browser. Contact form data and login credentials are not stored for this purpose.

Language selection does not transmit data to an external translation provider. Retrieving the locally provided language files generates the technical hosting data described in section 2. The foreign-language texts are provided for information; the original German version remains authoritative. Original graphics, Badges and expressly marked quotations from German legislation remain unchanged. Training and examinations take place exclusively in German.