Controller
The controller for data processing on this website is:
PSG Projekt Service Gesellschaft für Systemberatung und Softwareentwicklung mbH
Neuer Wall 80
20354 Hamburg
Phone: +49 40 3988280
Email: info@psg.de
Hosting and server logs
This website is a static site and is delivered via Cloudflare (Cloudflare, Inc.). When the site is accessed, Cloudflare processes technically necessary connection data, in particular the IP address, the time of access, the requested address, and the identifier of the browser used. This data is needed to deliver the website reliably and to protect it against attacks.
The legal basis is our legitimate interest in providing the website securely and in working order (Art. 6(1)(f) GDPR (DSGVO)). Cloudflare is certified under the EU-US Data Privacy Framework.
No cookies, no visitor profiles
This website sets no cookies and embeds no third-party analytics or tracking services. We measure ourselves which pages and sections are used, without visitor profiles and only if you have given your consent (see Reach measurement with consent). There is no newsletter. Fonts and scripts are hosted on our own web space. The only exception is the Cloudflare Turnstile security check on the contact page (see Contact form); external fonts, videos, or maps are not embedded.
Reach measurement with consent
We want to know which content on this website is used and which is not, so that we can improve it. We measure this only if you agree. On your first visit, a notice at the bottom of the page asks for your choice. You can use the website without any restriction if you decline or leave the notice unanswered; in both cases your visit is not measured. We only count how often the notice is answered with “I agree” or “No, thanks”: when you click one of the two buttons, your browser transmits once the chosen answer, the previous setting, and the language of the page, without any identifier and without the page you are viewing. Only a daily total is stored from this. If you leave the notice unanswered, nothing is transmitted.
Open the reach measurement settings: there you can see your current choice and withdraw your consent at any time with effect for the future. The same link is in the footer of every page. After you withdraw, your visit is no longer measured, with immediate effect; only the withdrawal itself is counted, as described above.
If you have agreed, a small script loaded from this website itself measures the following for each page view:
- which page was viewed, in which language and in which version,
- which sections of the page were visibly reached, and how long the page and its sections were visible and in use,
- how far the page was scrolled at most (one percentage per page view, no scroll history), and which links to a next step (for example contact, email, phone, service or knowledge pages) were visible or chosen,
- whether you copied a code sample, started a quiz, or operated a step-by-step figure or a slider in an article, and up to which step, but not individual clicks or answers,
- whether the contact form was started or submitted, without its content,
- a rough origin class, such as “search engine”, “LinkedIn”, “direct”, or “another page of this website” (in that case also its path), and a campaign code if you followed a link from one of our own posts,
- a rough device class (smartphone, tablet, or desktop) based on the window width.
The script does not transmit the address of external pages you came from, any text, form input, mouse movements, or keystrokes. For each page view, the script creates a random identifier that exists only in your browser’s memory and expires when you leave the page; its only purpose is to combine several transmissions of the same page view. The next page view receives a new identifier. There is no identifier across pages, no visitor profile, and no device fingerprint. The measurements are not linked to quiz or game results or to contact inquiries. IP address and browser identifier are not stored for the measurement; they are used only briefly on receipt to limit abuse and to filter out automated access.
What is stored in your browser: The script sets no cookies. So that we do not ask you again on every page view, your browser remembers your choice in this website’s local storage (entry “psg-messung”: “ja” (yes) or “nein” (no) with the date of your choice). The entry is not transmitted to us. You can change it in the settings or delete it in your browser; we will then ask again on your next visit.
If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we do not ask and do not measure.
For inquiries via the contact form, we additionally count on our server whether an inquiry was received, confirmed, and forwarded to us, together with the reason for the inquiry, language, chosen contact method, and the page it was sent from, but without any details about you and without any link to the measurements of your visit.
The measurements are stored, with the time they were received, in a database of our hosting provider Cloudflare (Cloudflare D1) located in the European Union; Cloudflare processes them on our behalf. We delete the values of individual page views after 30 days and the count of contact inquiries after 90 days. After that, only aggregated daily figures without reference to individual page views remain; we delete them after 13 months.
The legal basis for the measurement is your consent (Section 25 (1) TDDDG for access to your device, Art. 6 (1) (a) GDPR for processing the measurements). You can withdraw it at any time in the settings; this does not affect the lawfulness of processing carried out until then. We base the counting of answers to the notice and the counting of contact inquiries on our legitimate interest in a data-minimizing review of success and reach (Art. 6 (1) (f) GDPR); for this we store only totals without any identifier.
Sharing quiz results
Some articles on this website end with a quiz. At the end, we create a link to your result so that you can share it, for example on LinkedIn. To do this, your browser sends your chosen answers to our server when you finish the quiz. The server calculates the score from them and stores only the quiz, the score, the language, and the date under a random key that appears in the link. We do not store your individual answers, your IP address, or your browser identifier for this. The IP address and browser identifier are used only briefly on receipt to limit misuse and to recognize automated requests.
Anyone who knows the link can open the result page; it contains no details about you. We delete a result after 90 days. If the result page is opened during that time, for example because you shared the link, we delete it two years after it was first opened.
We also count, per quiz and day, how often it was completed, how often “Share on LinkedIn”, “Copy link”, or “Copy text” was chosen, and how often result pages were opened, separately for people, LinkedIn’s preview service, and other automated requests. Only these daily totals are stored, without any link to individual results or people.
Results and daily totals are stored with our hosting provider Cloudflare (Workers KV and Cloudflare D1) in the European Union. The “Share on LinkedIn” button is a plain link without any LinkedIn script: only when you click it does LinkedIn open with your result link, and LinkedIn’s privacy policy applies.
The legal basis is our legitimate interest in enabling you to share your quiz result and in learning, in aggregated form, how the quizzes are used (Art. 6(1)(f) GDPR).
The game “SQL Server Iceberg”
In the knowledge section you can play the browser game “SQL Server Iceberg”. So that you can share your result, the game fetches a question sequence from our server when you dive in; it carries a random run ID and a signature. At the end, your browser sends this run ID together with your chosen answers, your answer times, and your use of lifelines to our server. The server recalculates score, depth, and outcome itself and stores, under a random result ID that appears in the link: score, depth, final zone, whether Cthulhu was defeated, the number of correct and answered questions, the best streak, game version, language, and the times of completion and of the first visit. To recognize a repeated submission of the same run, we also store a cryptographic check value of the answer log from which the answers cannot be recovered. We do not store your individual answers, a name, your IP address, or your browser identifier. The IP address and browser identifier are used only briefly on receipt to limit misuse and to recognize automated requests. There is no public leaderboard.
Anyone who knows the link can open the result page; it contains no details about you. We delete a result after 90 days. If the result page is opened during that time, for example because you shared the link, we delete it two years after it was first opened.
We also count, per game version, language, and day, how often a dive was started and completed, how often Cthulhu was defeated, how often “Share on LinkedIn”, “Copy link”, or “Copy text” was chosen, how often result pages were opened (separately for people, LinkedIn’s preview service, and other automated requests), and how often “Start your dive” was chosen on a result page. Only these daily totals are stored, without any link to people.
Your previous dives (“Your dives on this device”: score, depth, outcome, and date) are stored only by your browser on your device (local storage); they are not sent to us. You can delete them in the game or in your browser settings.
Results and daily totals are stored with our hosting provider Cloudflare (Cloudflare D1) in the European Union. If our server cannot be reached when you dive in, you keep playing without any transfer; the result then cannot be shared. The “Share on LinkedIn” button is a plain link without any LinkedIn script: only when you click it does LinkedIn open with your result link, and LinkedIn’s privacy policy applies.
The legal basis is our legitimate interest in enabling you to share your game result and in learning, in aggregated form, how the game is used (Art. 6(1)(f) GDPR).
Contact by email or phone
If you contact us by email or phone, we process the data you provide in doing so (for example name, email address, phone number, and the content of the inquiry) in order to handle your inquiry.
The legal basis is Art. 6(1)(b) GDPR, where the inquiry serves to prepare or perform a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).
Contact form
If you write to us via the form on the contact page, we process your details (reason for your inquiry, name, message, an email address or a phone number or both, company or organization) as well as the page of this website from which you accessed the form. We use this data exclusively to answer your inquiry, not for newsletters or advertising. The details are transmitted as an email to our sales team. You do not receive a copy of your message.
Double opt-in: If you provide an email address, we first send you an email with a confirmation link. This is how we ensure that the inquiry comes from the owner of the address. Until you confirm, your details are held for a maximum of 48 hours in the temporary storage of our hosting provider Cloudflare (Workers KV); after confirmation or expiry, they are deleted there. If you have provided only an email address, your inquiry reaches us only after you confirm it. If you provide a phone number, we forward the inquiry immediately and call you back; we reply by email only after confirmation. To limit abuse, we additionally store a checksum (hash value) of your email address for 24 hours and use it to count the confirmation emails sent.
The legal basis is Art. 6(1)(b) GDPR, where the inquiry serves to prepare a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). We delete your inquiry as soon as it has been dealt with and no statutory retention obligations prevent this.
To send the email, we use the service Mailjet (Sinch group, Paris, France) as a processor. According to its own statements, Mailjet processes the data in data centers within the European Union.
To protect against automated requests, we use Cloudflare Turnstile (Cloudflare, Inc.) on the contact page. For this purpose, your browser loads a script from Cloudflare when the contact page is opened. Turnstile evaluates technical characteristics such as IP address, browser identifier, and connection data to distinguish humans from automated access. According to Cloudflare, Turnstile sets no cookies in the process. The legal basis is our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR). Further information: Turnstile Privacy Addendum.
External links
In a few places, this website links to external sites, such as GitHub, Medium, Meetup, and psg.de. Such links open in a new tab. You leave this website only when you click on them; the privacy policy of the respective provider then applies.
Your data subject rights
You have the right to
- access to the data we hold about you and its processing,
- rectification of inaccurate personal data,
- erasure of the data we hold about you,
- restriction of processing, where we are not yet permitted to delete your data due to statutory obligations,
- objection to the processing of your data by us, and
- data portability, where you have consented to the data processing or have entered into a contract with us.
To exercise these rights, please contact the address given above.
Right to lodge a complaint with a supervisory authority
You can lodge a complaint with a data protection supervisory authority at any time, in particular in the German federal state (Bundesland) of your residence, your place of work, or the place of the alleged infringement. A list of the supervisory authorities is maintained by the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit).
Last updated
October 2026