Privacy Policy

Data Protection for WordPress Plugin Sales Platform

Last updated: January 2, 2026

1. Data Controller

The data controller for this website is:

Contact Information
Frank Stemmler (Individual entrepreneur)
Andernacher Strasse 11
56645 Nickenich, Deutschland
Email: kontakt@3task.de
Phone: +49 2632 / 470 00 58

As a small business under German §19 UStG (VAT exemption), we operate with simplified administrative requirements while maintaining full GDPR compliance.

2. Data Protection Officer

As a small business, we are not required to appoint a Data Protection Officer under GDPR Art. 37. For all data protection inquiries, please contact us directly at:

Email: privacy@3task.de

We respond to all data protection requests within 30 days as required by law.

3. Data Collection

Website Visits

When you visit our website, we automatically collect:

  • IP address (anonymized after 24 hours)
  • Browser type and version
  • Operating system
  • Referrer URL
  • Date and time of access
  • Pages visited

Contact Forms

When you contact us, we collect:

  • Name
  • Email address
  • Message content
  • Timestamp
Data Minimization Principle

We only collect data that is necessary for providing our services. We do not use tracking pixels, social media plugins, or unnecessary analytics tools.

5. Plugin Purchases

When you purchase a WordPress plugin from us, we collect and process:

  • Full name and email address
  • Billing information
  • Domain name where the plugin will be used
  • Purchase date and amount
  • Payment method information (processed by Mollie)
  • License key and activation details
International Sales

As a German small business under §19 UStG, we are VAT-exempt for sales up to €100,000 annually within the EU. For customers outside the EU, local tax regulations may apply.

Purpose: Contract fulfillment, license management, customer support, and legal compliance.

Retention: Customer data is retained for 10 years for tax compliance purposes, license data for the duration of the license validity.

6. License Server

Our license server (license.3task.de) processes the following data for license validation:

  • License key
  • Product ID
  • Domain name (hashed with daily rotating salt)
  • Validation timestamp
  • License status and features
Privacy-by-Design

We use domain hashing with daily rotating salts to protect customer privacy. IP addresses are not stored. The license server is hosted in Germany on Hetzner Cloud infrastructure.

Technology Stack: Symfony 7.1 + PostgreSQL 16 + Redis

Data Location: Hetzner Cloud, Germany (GDPR compliant)

Automatic Deletion: License validation logs are automatically deleted after 2 years

7. Payment Processing

We use Mollie (Mollie B.V., Netherlands) for secure payment processing. When you make a payment, Mollie processes:

  • Payment amount and currency
  • Payment method details
  • Transaction timestamp
  • Billing information
  • Transaction status

Legal Basis: Contract fulfillment (Art. 6(1)(b) GDPR)

Data Location: EU (Netherlands)

Mollie Privacy Policy: https://www.mollie.com/privacy

Payment Security: All payment data is processed according to PCI DSS standards. We do not store credit card information on our servers.

8. Cookies & Tracking

We use minimal, essential cookies only:

Essential Cookies

  • Session Cookie: For secure browsing and form submission
  • Language Preference: To remember your language choice
  • Security Token: For CSRF protection

What We DON'T Use

  • Google Analytics or similar tracking
  • Social media tracking pixels
  • Advertising cookies
  • Third-party analytics tools
  • Marketing automation tools
TTDSG Compliance

All our cookies are technically necessary for website functionality. No consent banner is required under German TTDSG §25 as we don't use tracking or advertising cookies.

9. Third Party Services

We work with the following GDPR-compliant service providers:

Hetzner Cloud (Hosting)

Mollie (Payment Processing)

Data Processing Agreements: We have concluded Data Processing Agreements (DPA) with all service providers as required by GDPR Art. 28.

10. Data Retention

We retain personal data only as long as necessary:

  • Customer Data: 10 years (German tax law requirements)
  • License Data: Duration of license validity + 2 years
  • License Validation Logs: Automatically deleted after 2 years
  • Website Logs: 30 days (security purposes)
  • Contact Inquiries: 3 years or until resolved
  • Payment Data: As required by Mollie's retention policy
Automatic Deletion

Our systems are configured for automatic data deletion according to these retention periods. You can request early deletion of your data subject to legal retention requirements.

11. Your Rights

Under GDPR, you have the following rights:

  • Access (Art. 15): Request information about your personal data
  • Rectification (Art. 16): Correct inaccurate or incomplete data
  • Erasure (Art. 17): Request deletion of your data (right to be forgotten)
  • Restriction (Art. 18): Limit processing of your data
  • Portability (Art. 20): Receive your data in a structured format
  • Objection (Art. 21): Object to processing based on legitimate interests
  • Withdraw Consent: Where processing is based on consent
Exercise Your Rights
Email: privacy@3task.de
Response Time: Within 30 days
Required Information: Your name, email, and specific request

Right to Complain: You can file a complaint with your local data protection authority or the German Federal Commissioner for Data Protection (BfDI).

12. Data Security

We implement comprehensive security measures to protect your data:

Technical Measures

  • SSL/TLS encryption for all data transmission
  • Database encryption at rest
  • Regular security updates and patches
  • Firewall and intrusion detection systems
  • Daily automated backups with encryption
  • Domain hashing with rotating salts

Organizational Measures

  • Access controls and user authentication
  • Regular security audits
  • Data breach response procedures
  • Staff training on data protection
  • Incident logging and monitoring
Hosting Security: Our Hetzner Cloud infrastructure includes DDoS protection, 24/7 monitoring, and ISO 27001 certified data centers in Germany.

13. International Transfers

We primarily process data within the EU/EEA. Any data transfers outside the EU are conducted with appropriate safeguards:

  • Primary Processing: Germany (Hetzner Cloud)
  • Payment Processing: Netherlands (Mollie)
  • Backup Storage: EU/EEA only

For any necessary transfers outside the EU, we ensure:

  • Adequacy decisions by the European Commission
  • Standard Contractual Clauses (SCCs)
  • Additional security measures as required
EU Data Residency

All customer data, license information, and payment data remain within the European Union. We do not transfer data to countries without adequate data protection.

14. Policy Updates

We may update this privacy policy to reflect changes in our practices or legal requirements. Updates will be:

  • Published on this page with a new effective date
  • Communicated to customers via email for material changes
  • Highlighted with a clear change summary

We recommend reviewing this policy periodically to stay informed about how we protect your data.

Questions?
If you have any questions about this privacy policy or our data practices, please contact us at:
Email: privacy@3task.de
Response guaranteed within 48 hours

Datenschutz