This Privacy Policy explains how personal data is collected, processed, and stored when accessing shapeXT.com, shapeXT.de, shapeIT-software.com, shapeIT-software.de, their respective subdomains, and when using the shapeXT desktop application (Full and Demo versions), in compliance with the General Data Protection Regulation (GDPR / DSGVO) and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

1. Controller

The controller responsible for data processing on this website and within the shapeXT desktop application pursuant to Art. 4 No. 7 GDPR is:

Dr. Michael Böhme Softwareentwicklung
Röhrstraße 66
99423 Weimar, Germany
Email: mail@shapeXT.com
Website: https://www.shapeXT.com

2. Web Hosting & Server Log Files

This website is hosted on servers located within the European Union (Germany). To ensure compliance with data protection regulations, a Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV) has been concluded with the web hosting provider pursuant to Art. 28 GDPR.

When you visit this website, the hosting server automatically collects and temporarily stores technical connection data in server log files:

  • IP address of the requesting terminal device
  • Date and time of the request
  • URL of the retrieved file or page
  • HTTP status code
  • Referrer URL (the previously visited page)
  • Browser type, version, and operating system

Statistical Analysis: For the purpose of understanding website usage and detecting technical errors, these server log files are analyzed using the self-hosted, open-source tool GoAccess. GoAccess runs locally on the same server, processes the log data in place, and does not transmit any data to external third parties or cloud services. Prior to analysis, IP addresses are anonymized (the last octet of IPv4 addresses / equivalent portion of IPv6 addresses is truncated), so that no direct identification of individual visitors is possible. The resulting statistical dashboard is accessible only to the site operator and is not publicly available or shared with third parties.

Legal basis & retention: Processing is carried out pursuant to Art. 6(1)(f) GDPR based on the legitimate interest in maintaining system stability, ensuring data security, and detecting/preventing malicious attacks. Server log files are retained for a maximum of 4 weeks and automatically deleted thereafter, unless retention is required for evidentiary purposes in connection with illegal activity.

3. Cookies & Local Storage

The main website (statically generated via Hugo) operates completely without cookies, tracking scripts, or third-party profiling. I do not embed any third-party cookies and do not use tracking cookies anywhere on my web properties.

Functional session cookies are only used if you actively access one of the following dynamic subsystems:

  • Documentation Wiki (DokuWiki): Uses a technical session cookie required for navigation and wiki functionality.
  • Newsletter System (phpList): Uses a functional session cookie when managing subscriptions (see Section 5).
  • Customer System: Uses strictly necessary session cookies for authentication, form validation, and security controls.

In accordance with § 25 (2) No. 2 TDDDG and Art. 6(1)(f) GDPR, these strictly necessary functional cookies do not require prior user consent. You can configure your browser to block, limit, or automatically delete cookies upon closing.

4. Quote Requests, Orders and Customer Management

Data processed. If you request a quote, order a license or contact me by e-mail, I process the data you provide: the name and address of your institution or company, names and business e-mail addresses (and phone numbers, if given) of contact persons such as the billing and technical contact, your EU VAT ID, the requested license (type, tier, duration, number of licenses, start date), PO or reference numbers, and the content of our correspondence. For customers, I additionally process invoices, payment status and license data (license keys, license term, delivery date).

Source. The data comes from you, via the quote request form or by e-mail. If you provide details of colleagues (e.g. billing or technical contact), please make sure they are aware of this privacy policy. EU VAT IDs are verified using the EU VIES service and the German Federal Central Tax Office (BZSt).

Purposes and legal bases.

  • Preparing quotes, processing orders, delivering licenses, invoicing, payment handling and customer support: Art. 6(1)(b) GDPR where you are the contracting party, otherwise Art. 6(1)(f) GDPR (legitimate interest in conducting business with the employees of my customers).
  • Compliance with legal obligations, in particular bookkeeping, invoicing, VAT ID verification and VAT reporting, and statutory retention: Art. 6(1)(c) GDPR in conjunction with the German tax and commercial law (e.g. UStG, AO, HGB).
  • Establishing, exercising or defending legal claims: Art. 6(1)(f) GDPR.
  • Information about the licensed software, such as security and update notices and license expiry: Art. 6(1)(b) and (f) GDPR. Marketing newsletters are sent only with your separate consent (see Section [5]).

Necessity. Without the data marked as required in the form, I cannot issue a quote or conclude a contract.

Recipients. Your data is only passed on where necessary: to my tax advisor and accounting service, who act as processors under Art. 28 GDPR where applicable; to tax authorities and other authorities where legally required; and to the bank used for payments. I do not sell customer data. Customer data is not transferred to countries outside the EU/EEA.

Retention.

  • Quote requests that do not lead to a contract are deleted after 12 months, unless statutory retention applies.
  • Invoices and accounting records are retained for 8 years, and business correspondence (including quotes) for 6 years, as required by tax and commercial law. These periods begin at the end of the calendar year.
  • License records (license file, term, delivery) are kept for as long as the license, including the perpetual fallback right, exists, and then until any claims are time-barred.
  • Afterwards, the data is deleted.

E-mail communication. E-mails are transported with transport encryption where the recipient’s server supports it, but are not end-to-end encrypted. Please do not send confidential information by plain e-mail.

5. Newsletter Subscription via phpList

If you subscribe to the shapeXT release notification or product updates, the email address provided during sign-up is processed to deliver the newsletter.

  • Self-Hosted Infrastructure: The newsletter is managed exclusively through an in-house installation of the open-source software phpList, hosted locally on the same server environment in Germany. No subscriber data is shared with, transferred to, or processed by external third-party email service providers or cloud vendors.
  • Double Opt-In (DOI): Registration uses a double opt-in procedure. After entering your email address, you will receive a verification email containing a confirmation link. Your subscription becomes active only after clicking this link. This prevents unauthorized registrations using third-party email addresses.
  • Logging for Proof of Consent: Pursuant to Art. 7(1) GDPR, each registration is logged. Recorded data includes the email address, IP address, and timestamps of both the initial registration and the double opt-in confirmation. Server log files are retained for a maximum of 4 weeks and automatically deleted thereafter, unless retention is required for evidentiary purposes in connection with illegal activity.
  • Legal Basis: The processing of your data is based entirely on your consent pursuant to Art. 6(1)(a) GDPR.
  • Unsubscribe & Retention: You may withdraw your consent and unsubscribe from the newsletter at any time with future effect by clicking the “Unsubscribe” link included in every newsletter email, or by sending a message to mail@shapeXT.com. Upon unsubscription, your email address is removed from the active mailing list.

6. Social Media & External Links

The page footer of this website contains links to my profiles on external social media platforms (YouTube, Instagram, and X/Twitter).

To protect your privacy, I do not embed any external plugins, scripts, iframes, or tracking pixels from these platforms into my website, and I do not share any user data with these companies. These icons act strictly as standard external hyperlinks. No personal data or browsing information is transmitted to YouTube, Instagram, or X/Twitter when you visit or use this website. Data transfer to the respective platform occurs only if you actively click on a footer link to leave this website and visit the external service.

7. shapeXT Desktop Application (Full & Demo Versions)

Privacy Commitment & Local Data Guarantee: I strictly respect your privacy and will never sell, rent, or monetize your personal data. All scientific and research data you open, create, or analyze within shapeXT (e.g., crystallographic structures) is processed strictly locally on your machine and is never transmitted to my server or to any third party.

The shapeXT desktop application only communicates with my server for the four specific functions listed below. The majority of connection data is only stored temporarily in server logs (deleted automatically after a maximum of 4 weeks, see Section 2) and is processed solely to protect the server infrastructure from abuse or to fulfill a direct user request:

a) Automatic Update Check (Full & Demo Versions)

  • Data & Purpose: The application sends an HTTPS POST request to my webserver to check whether a newer software version is available. This request is logged in the webserver log files as described in Section 2.
  • Opt-Out: You can disable automatic update checks at any time within the application via Settings > System > Updates by setting Check Frequency to Never (Manual).
  • Legal Basis & Retention: Processing is based on Art. 6(1)(f) GDPR (legitimate interest in providing secure, up-to-date software and maintaining system stability). Log entries are automatically deleted via standard log rotation after a maximum of 4 weeks (see Section 2).

b) Crystallography Open Database (COD) Structure Retrieval (Full Version)

  • Data & Purpose: The Full version allows direct retrieval of crystal structures from a self-hosted copy of the Crystallography Open Database (COD) on my server. When you request a structure, the query is logged in the webserver log files (see Section 2). Logging is strictly required to protect the server against system abuse, such as automated scraping or Denial-of-Service (DDoS) attacks.
  • Legal Basis & Retention: Processing is carried out pursuant to Art. 6(1)(b) GDPR (providing a core contractual software feature) and Art. 6(1)(f) GDPR (legitimate interest in IT security and abuse prevention). These log files are automatically deleted via standard log rotation after a maximum of 4 weeks (see Section 2).

c) In-App Feedback Form (Full Version)

  • Data & Purpose: The Full version includes a built-in feedback form that can be used anonymously. When submitting feedback, the webserver logs the requesting IP address (see Section 2) strictly to protect the server against spam and DDoS attacks. Your feedback message and any personal data you voluntarily enter (such as your name or email address for a reply) are transmitted to my server and saved in a database solely to process and respond to your feedback or support request.
  • Legal Basis & Retention: Server log processing is based on Art. 6(1)(f) GDPR (system security) and is deleted after 4 weeks (see Section 2). Processing of submitted feedback and voluntary contact details is based on Art. 6(1)(b) GDPR (support fulfillment) or Art. 6(1)(f) GDPR (legitimate interest in improving the software and answering user inquiries). Database entries containing personal data are deleted once your request has been fully resolved, unless statutory retention periods apply (see Section 4).

d) Online License Activation (Full Version)

  • Data & Purpose: Upon first launch, the Full version requires a one-time online activation. The application transmits a cryptographic hash containing a hardware fingerprint to my server to uniquely identify the installation, and the server returns a verification code. This mechanism is strictly necessary to verify valid licenses and prevent license abuse (such as unauthorized company-wide use of a single-seat license or the use of leaked/pirated license files).
  • Legal Basis & Retention: Processing is carried out pursuant to Art. 6(1)(b) GDPR (contract performance and license verification) and Art. 6(1)(f) GDPR (legitimate interest in protecting intellectual property and preventing software piracy). Activation records are retained alongside the corresponding license record for the duration of the license validity (see Section 4).

8. Automated Decision-Making and Profiling

No form of automated decision-making or profiling within the meaning of Art. 22 GDPR is used. No decisions producing legal effects concerning you, or similarly significantly affecting you, are made on this website through automated means alone.

9. Your Rights Under the GDPR

As a data subject, you hold the following statutory rights under Chapter III of the GDPR:

  • Right of Access (Art. 15 GDPR): Request information on whether and what personal data concerning you is processed.
  • Right to Rectification (Art. 16 GDPR): Request the correction of inaccurate or completion of incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): Request the deletion of your personal data (“right to be forgotten”), provided no statutory retention obligations apply.
  • Right to Restriction of Processing (Art. 18 GDPR): Request the restriction of data processing under certain statutory conditions.
  • Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Withdraw Consent (Art. 7(3) GDPR): Revoke any previously granted consent (such as for the newsletter) at any time with effect for the future.
  • Right to Object (Art. 21 GDPR): Object at any time to the processing of personal data based on legitimate interests (Art. 6(1)(f) GDPR).

To exercise any of these rights, contact: mail@shapeXT.com.

10. Right to Lodge a Complaint

If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

The competent supervisory authority for this business location is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8
99096 Erfurt, Germany
Website: www.tlfdi.de

11. Last Update

This Privacy Policy was last updated on 2026-10-30.