This Privacy Policy describes how I process personal data when you visit or use halbleiter.org, including the English-language pages, information articles, contact options, optional financial support, advertising and the purchase and restoration of a shared entitlement to paid knowledge sections and downloadable PDF documents.
Last updated: 4 November 2026
1. Who is responsible for the processing?
Philipp Laube
Christine-Friedlein-Str. 69
93055 Regensburg
Germany
Email: pl@halbleiter.org
Legal notice: www.halbleiter.org/impressum/
I am the controller of the personal data processing described in this Privacy Policy, except where another provider acts as an independent controller, for example in connection with certain PayPal payment services or Google's advertising services.
2. Data categories, purposes and legal grounds
Depending on the service used, I may process contact details (in particular email addresses), order and contract information, payment confirmations and transaction references, the content of correspondence, technical connection and usage data (such as IP addresses, browser information and access times), cookie or access-token identifiers, and search terms supplied by visitors.
The main purposes are to operate and secure the website, deliver requested content and services, communicate with visitors, process payments and donations, provide and restore purchased knowledge and PDF access, administer necessary records, improve the website through internal statistics, and display advertisements subject to applicable consent requirements.
Where applicable, processing is based on Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contractual performance and steps before entering a contract), Article 6(1)(c) GDPR (legal obligations), or Article 6(1)(f) GDPR (legitimate interests, in particular website security, reliable operation, prevention of misuse and improvement of the information service). My specific grounds are explained below. For storing or accessing information on a visitor's device, section 25 of the German TDDDG also applies.
3. Security measures
I use technical and organisational measures designed to protect data against unauthorised access, alteration, loss and misuse. Website connections are protected using HTTPS/TLS. Access to the administration and database is restricted. Customer email addresses for purchased knowledge and PDF access are encrypted in the application database as described below. No online system can guarantee complete security.
4. Hosting, server logs and email hosting
My website and associated email services are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Further information: all-inkl.com and ALL-INKL privacy information.
When you access the website, technical data must be processed to deliver pages and files. Server logs may record the requested resource, date and time, technical response information, the transferred data volume, browser and operating-system details, referrer information and IP addresses. Processing is necessary for delivery, stability, troubleshooting and protection against abusive requests (Article 6(1)(f) GDPR). Server log retention depends on the hosting configuration and technical/security requirements; specific retention may differ for application and error logs. Information that must be preserved to investigate a security incident may be kept until the matter is resolved.
For email communication and for sending access sign-in links, ALL-INKL processes sender and recipient addresses, message content and technical delivery details. Email transport can be encrypted, but messages are not necessarily end-to-end encrypted. Ordinary email services can process email addresses in readable form.
5. Data backups and retention
I make daily database backups for technical recovery and store them outside the public website directory. The automatic backup rotation retains no more than ten daily backup sets. Separate manually created copies may be kept under different security or evidential requirements. Backups may contain personal data; PDF email addresses in the current database are stored encrypted. Data no longer necessary for a specific purpose is deleted or restricted as required by law, subject to applicable retention obligations, contractual requirements and the protection of legal claims.
6. International data transfers
Some providers, including Google and PayPal, may process information in countries outside the European Union or European Economic Area. Where such transfers occur, they are subject to the applicable GDPR rules and safeguards. These may include an adequacy decision (such as the EU–me Data Privacy Framework for suitably certified recipients) or other valid safeguards such as the European Commission's standard contractual clauses, depending on the provider and service. Please also review the data protection information of the individual providers linked in this policy.
7. Cookies and consent management
Cookies and similar technologies store information on, or read information from, your device. Some are strictly necessary to provide a function that you explicitly request. Other technologies, particularly those used for advertising and related analytics, may require your prior consent. The legal framework includes Article 6 GDPR and section 25 TDDDG. If consent is required, it can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Google Privacy & Messaging
I use Google's Privacy & Messaging consent-management functionality in connection with Google AdSense. It records the choices made within the consent message and communicates the relevant consent signals. The message itself provides information about the available purposes and advertising partners.
You can change or withdraw your advertising consent at any time using the “Privacy and cookie settings” link in the footer. The link uses Google's official consent-revocation interface. On pages that do not already load the AdSense tag, the relevant Google script is loaded only after you deliberately click the link. Changing advertising consent does not control the cookies strictly required to maintain purchased knowledge and PDF access.
Strictly necessary knowledge and PDF access cookies
__Host-hl_pdf_checkout is a session cookie used to secure and link requests during the purchase of shared knowledge and PDF access. It normally ends when the browser session ends, unless the browser restores the session.
__Host-hl_pdf is an access cookie used after a successful activation of purchased knowledge and PDF access. It holds a random token and may remain valid for up to 365 days. My server checks a cryptographic hash of that token against the associated entitlement. Once the cookie expires, access can be restored by requesting a new email sign-in link. These functions are strictly necessary for the knowledge and PDF access service requested by the visitor (section 25(2)(2) TDDDG); associated personal-data processing is principally based on Article 6(1)(b) GDPR.
Other consent-related cookies and identifiers may be set by Google or its advertising partners depending on your choices. Their names, purposes and durations depend on the applicable consent message and provider policies.
8. Knowledge and PDF purchases, encrypted email addresses and access restoration
I offer a shared entitlement to paid knowledge chapter sections and all available PDF downloads for a single payment of EUR 1.99. Newly published content is also included if offered; new publications are not guaranteed. Access has no fixed expiry date and remains available while the relevant access service is operated. An email address is necessary to complete the purchase and restore access on another device. A separate user account is not required.
Encrypted database storage: In my access application database, email addresses are stored only in encrypted form using the libsodium library. In addition, I store a secret-key-based HMAC-SHA-256 value that allows me to find an existing order or entitlement when an email address is supplied. Encryption keys are kept separately from the publicly accessible website. This statement concerns storage in the access database: an email address is temporarily processed in readable form when submitted, used to send a message or decrypted to provide a requested service. It is also processed by my email service provider for delivery.
Orders: I store the encrypted email address and lookup value, the PayPal order identifier, information about any PDF download originally requested, the order and payment status, any relevant PayPal payment reference, and timestamps relating to the order and payment confirmation. Bank account and credit card numbers entered with PayPal are not stored in my PDF order database.
Access restoration: After payment confirmation, I associate a shared entitlement to paid knowledge sections and PDF downloads with the encrypted email address. On request, I send a single-use sign-in link to the purchase address through ALL-INKL. The link is valid for 30 minutes. For each link, I store the encrypted email address, its keyed lookup value, a cryptographic hash of the random sign-in token, and the creation, expiry and, where relevant, use timestamps. The usable sign-in token is not stored in plaintext in this database. For active devices, I store a hash of the access-cookie token along with the relevant entitlement and expiry timestamp.
Payment notifications and refunds: I use PayPal webhook notifications to confirm payment events and, where necessary, returns, reversals or refunds. Incoming webhook information and relevant verification details are sent to PayPal for signature verification. Personal data contained in notifications may be processed temporarily. The application does not maintain full webhook message bodies as separate permanent database records. Technical errors may appear in server error logs. A refunded or reversed purchase can result in revocation of the corresponding entitlement.
Deletion: A daily cleanup removes expired or used sign-in link records seven days after expiry or use, removes expired device tokens when their validity ends, and deletes orders that are still pending and unpaid after 30 days. Paid orders and permanent knowledge and PDF access entitlements are retained as necessary to deliver the purchased service, unless deletion is required or requested in accordance with the law; payment and accounting records may remain subject to statutory retention duties. Daily database backups are automatically rotated as described above.
Legal grounds: Article 6(1)(b) GDPR (performing the purchase and providing continuing access), Article 6(1)(c) GDPR (legal record-keeping where applicable), and Article 6(1)(f) GDPR (security, misuse prevention and verification of payment events).
8a. Electronic withdrawal function for knowledge and PDF access purchases
Buyers may use the two-step “Withdraw from contract” function without creating an account. For this purpose, I process the full name supplied, information identifying the contract or order, the email address for acknowledgment, and the selected language.
Storage and security: I store the email address encrypted in my access database and additionally store a keyed HMAC-SHA-256 lookup value for matching and limiting repeated submissions. The name and contract information are stored as ordinary text fields in the withdrawal table. I also record a random request token, the date and time of receipt (UTC), the processing status and, where applicable, timestamps for the acknowledgment sent to the buyer and the notification sent to me. The technically necessary session cookie __Host-hl_pdf_widerruf supports the two-step process and protects form submissions. I do not store a separate IP-address field in the withdrawal table; ordinary server logs remain unaffected.
Acknowledgment and processing: I use these details to document receipt, send an email acknowledgment containing the declaration and its date and time, and assess and process the request. Email delivery and the notification to me require the relevant information to be handled in plaintext and transmitted through my email hosting provider ALL-INKL. Submitting the form does not automatically trigger a PayPal refund or disable the purchased knowledge and PDF access. The legal effectiveness of the withdrawal is considered separately.
Legal grounds and retention: Processing required to comply with consumer withdrawal and documentation duties is based on Article 6(1)(c) GDPR; where necessary for handling the contractual relationship, Article 6(1)(b) GDPR also applies. I retain the information for as long as necessary to handle and document the matter and, where applicable, comply with statutory retention rules or establish, exercise or defend legal claims. There is currently no fixed automatic deletion period for these withdrawal records.
9. Payment services: PayPal
Payments for the shared knowledge and PDF access are processed by PayPal. PayPal is responsible for collecting and processing the payment details entered on its own payment pages, including any bank or card data required for the selected payment method. I normally receive payment-related confirmations, transaction references and status information needed to recognise and fulfil an order. The legal grounds for my processing are Article 6(1)(b) and, as applicable, Article 6(1)(c) GDPR.
Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Further details are available in PayPal's privacy statement. PayPal may act as an independent controller and process information under its own legal obligations and rules, including where transfers outside the EEA are involved.
10. Voluntary support through PayPal
Visitors may choose to support halbleiter.org through PayPal. My footer contains an ordinary link to PayPal, not a permanently embedded PayPal iframe or script. Merely displaying the donation link does not load PayPal content. When you click it, you visit PayPal, which processes information in accordance with its own privacy statement.
To recognise and manage a donation, my website processes a PayPal transaction identifier, donation amount, currency and payment status. The transaction identifier helps avoid counting the same payment twice. The amount is used to calculate funds available for periods without advertising. My donation table does not store the donor's name, postal address or email address in this processing flow. PayPal or underlying server and payment records may contain additional information, as described elsewhere in this policy.
The legal basis is my legitimate interest in administering voluntary project support and explaining advertising-free periods transparently (Article 6(1)(f) GDPR); where a contractual relationship is involved, Article 6(1)(b) GDPR may also apply. Applicable record-keeping obligations remain unaffected.
11. Internal website search and link statistics
I operate internal statistics to improve search results, site navigation and editorial content. Search terms entered by visitors may be recorded and evaluated to identify useful subjects and improve the search. A search term may itself contain personal information if a visitor enters it.
For link-click statistics, a locally hosted script sends the originating page path and the destination path or web address to my server without query parameters or URL fragments. I aggregate the number of clicks by calendar day and source/destination combination. A technical hash is used to identify matching combinations, not individual persons or devices.
My link-click recording function does not use analytics cookies or user identifiers and does not store visitors' IP addresses, browser identifiers or referrer headers in the click-statistics database. Technical connection data may nevertheless appear in the ordinary server logs. In exceptional cases, URLs and search terms themselves may contain personal information. To the extent personal data is processed, I rely on my legitimate interest in improving the information service (Article 6(1)(f) GDPR).
12. Articles, publications and external content
I publish articles, technical explanations and news on semiconductor technology. The site processes technical access data as necessary to deliver this information and protect it against abuse. The currently reviewed font, search and formula-rendering components are hosted locally, so merely loading those components does not require a request to a separate font or mathematics provider.
External services may still be used for advertising and the payment flows described above. Where a future article or feature embeds content directly from an external provider, additional data processing may occur; the relevant disclosure should be updated before that feature is used.
13. Contact and enquiries
If you contact me by email or another offered communication method, I process the information you provide, together with technical and correspondence metadata, to respond to your enquiry, administer the correspondence and, where applicable, perform an existing contract. The grounds may be Article 6(1)(b) GDPR for contractual requests and Article 6(1)(f) GDPR for general communication. Legal retention obligations and the need to establish or defend claims may affect the retention period.
14. Google AdSense and online advertising
I use Google AdSense to display advertisements and help finance the website. Depending on the consent choices and settings, Google may provide personalised or non-personalised advertising. Advertising and measurement processes may involve technical information such as IP addresses, device and browser information, usage signals and pseudonymous identifiers, including information stored on devices where applicable. The precise processing and partner list depend on Google's currently applicable services and the choices made in the consent message.
Advertising-related processing that requires consent takes place on the basis of that consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). Where legally permitted, certain contextual or technically necessary advertising activities may be subject to other rules as indicated in the provider's own information. My independent search and link statistics are not Google Analytics.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information: Google Business Safety & Privacy, Google advertising services data and Google Ads data protection terms. Consent may be changed at any time through “Privacy and cookie settings” in the site footer.
15. Your data protection rights
Subject to statutory conditions, you have the right to request access to your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21). You may withdraw consent at any time with effect for the future (Article 7(3)). The lawfulness of processing prior to withdrawal remains unaffected. If processing involves direct marketing, you may object to that processing at any time.
You also have the right to complain to a competent data protection supervisory authority, particularly in the EU member state of your habitual residence, your place of work or the location of a suspected infringement. Contact me at pl@halbleiter.org to exercise your rights with regard to processing for which I am responsible.
16. Changes to this policy
I review and amend this Privacy Policy when my processing activities, service providers or applicable law change. Where a change requires a new choice or consent, the relevant notice or controls will be provided.
Independently worded English version based on the project-specific German privacy notice. Adapted by the website operator.