Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. Hosting

This website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. The provider processes data on our behalf based on a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

3. Data We Collect

3.1 Server Log Files

When you visit our website, our hosting provider automatically collects the following data, which your browser transmits:

• IP address (anonymised after 7 days)
• Date and time of the request
• Requested URL and HTTP status code
• Browser type, operating system, referrer URL

This data is required for technical operation, security and abuse prevention. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Storage period: 7 days.

3.2 Account Registration

When you register for an UpdateKing account, we process:

• Name, e-mail address, company (optional)
• Hashed password (never stored in plain text)
• API key generated for plugin authentication
• Two-Factor-Authentication secret (if enabled)

Legal basis: Art. 6 (1) (b) GDPR (contract performance). Storage: until account deletion.

3.3 Joomla Site Data

For each Joomla site you connect, we store:

• Site URL and a name of your choice
• Encrypted Secret Key for HMAC authentication
• Joomla version, installed extensions, available updates
• Update log (which extension was updated when, success/error)

This data is necessary to provide the update service. Legal basis: Art. 6 (1) (b) GDPR.

3.4 Cookies / Session

We use only technically necessary cookies. No tracking, no analytics, no third-party cookies, no cookie banner required (§ 25 (2) (2) TTDSG / ePrivacy Directive). Legal basis: Art. 6 (1) (f) GDPR.

Name	Purpose	Lifetime	Type
uk_sess	PHP session (pre-login, CSRF on PayPal return)	Session	strictly necessary
uk_session	Login token after authentication (language preference is stored in the session, no separate cookie)	30 days	strictly necessary

All cookies are set with Secure (HTTPS only), HttpOnly (no JS access) and SameSite=Lax/Strict.

3.5 External content / Fonts

This site loads no external content from third parties. Fonts (Barlow, Barlow Condensed, JetBrains Mono) are served exclusively from our own server hosted at Mittwald in Germany — there is no connection to Google Fonts, Adobe Fonts or any other CDN. QR codes for two-factor authentication are generated entirely in the user's browser and never transmitted to any third party.

4. Payments via PayPal

For paid subscriptions we use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When you choose to pay via PayPal, your data is transferred to PayPal. You can find PayPal's privacy policy at: paypal.com/privacy.

We receive transaction confirmations and subscription status from PayPal via webhooks. Legal basis: Art. 6 (1) (b) GDPR.

5. Transactional E-Mails

We send transactional e-mails (registration confirmation, password reset, update reports, invoices) via SMTP from our hosting provider. No newsletter, no marketing mails without separate consent.

6. Your Rights (GDPR)

You have the right to:

• Access (Art. 15): obtain a copy of your data
• Rectification (Art. 16): correct inaccurate data
• Erasure (Art. 17): delete your data
• Restriction (Art. 18): limit processing
• Portability (Art. 20): receive your data in a structured format
• Objection (Art. 21): object to processing
• Withdraw consent (Art. 7 (3)) at any time
• Lodge a complaint with a supervisory authority

For account deletion, please use the function in your settings or contact us by e-mail.

7. SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the lock icon in your browser's address bar.

8. Changes to This Policy

We reserve the right to amend this privacy policy to reflect changes in legal requirements or in the services we offer. The current version applies to your visit.