Privacy Policy

In short: Sebastian Kuhbach is responsible for the data on winfuture.de. If you have questions, just send an email.

Controller under the General Data Protection Regulation (GDPR):

WinFuture
Sebastian Kuhbach
2449 Shangani Drive
2066 Johannesburg
South Africa
Email: sk@winfuture.de

More details are in our legal notice.

In short: WinFuture is free because we show ads. On your first visit you choose between consent and an ad-free subscription.

Change settings

Your two options

• Consent: You allow us and our partners to use cookies and similar technologies. We use them to show ads, measure reach and improve the site. The window lists every purpose and every partner. You can also switch off single purposes and partners there.
• contentpass: You take out a subscription with Content Pass GmbH. It costs EUR 3.99 per month and works on many partner sites. With contentpass we show no ads. We then load no analytics or advertising services that need your consent.

What still runs with contentpass: the operation of the website (section 3). This includes server logs, Cloudflare, the error log and the VG WORT counting pixels.

The consent window (consentmanager)

The window is provided by consentmanager AB, Torsgatan 26, 113 21 Stockholm, Sweden. It stores your choice in a cookie and in your browser's storage. For this, consentmanager processes your IP address and technical browser data.

• Legal basis: We must be able to prove your consent (Art. 6(1)(c) GDPR together with Art. 7(1) GDPR). Storing your choice is strictly necessary for this (Section 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).
• Retention: Your consent is valid for up to 365 days. If new partners are added, we ask again after 14 days.
• We use the Transparency and Consent Framework (TCF) of IAB Europe. Your choice is passed to the advertising partners as a code.

Withdrawing consent

You can withdraw your consent at any time. Click "Change settings". The withdrawal applies from then on. Processing before the withdrawal remains lawful (Art. 7(3) GDPR).

contentpass

Provider: Content Pass GmbH, Wolfswerder 58, 14532 Kleinmachnow, Germany.
contentpass itself is responsible for the subscription, the login and the payment. Its privacy policy applies there.
To check whether you have a subscription, every page loads a script from cp.winfuture.de. contentpass processes your IP address on our behalf for this.

• Legal basis: your wish to read without ads, and our interest in offering you this option (Art. 6(1)(f) GDPR). The check is strictly necessary for this (Section 25(2) No. 2 TDDDG).

In short: To keep winfuture.de fast and secure, we store technical data. We do not need your consent for this.

Server logs

• IP address
• date and time
• requested address and server
• status code and amount of data
• previous page (referrer)
• browser and operating system (user agent)

Purpose: operation, troubleshooting, protection against attacks and abuse.
Location: servers of our hosting provider ArtFiles in Germany. A copy for analysis is stored on our own server at Strato in Germany.
Retention: 180 days. After that we delete the entries automatically.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

Our own counting of page views and clicks

We count page views and clicks on our teasers ourselves. This runs on our own server. We set no cookie and no user ID for it. The data ends up in the server logs (see above).

• We store clicks on internal teasers with IP address and browser ID for 24 months.

• Only if you accept everything do we also read some features of your browser, for example whether an ad blocker is active.
• Legal basis: Art. 6(1)(f) GDPR (measuring reach, improving the site). For the browser features: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Cloudflare

We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as a content delivery network (CDN) and for protection against attacks. All requests pass through Cloudflare's servers. Cloudflare sees your IP address and the server log data.

• For suspicious requests, Cloudflare checks whether a human is browsing. For login and registration we use Cloudflare Turnstile.
• Legal basis: Art. 6(1)(f) GDPR (secure, fast operation).
• Third country: USA, see section 13.
• Cloudflare privacy policy

Error log (GlitchTip)

To find technical errors, we record error messages of our scripts for some page views. We store only: error text, script file and line, page address without parameters, device group (mobile or desktop) and browser ID. We do not record cookies, user IDs or form input. We store your IP address only in shortened form.

• Location: our own GlitchTip instance at the provider Railway, data centre Amsterdam (Netherlands).
• Retention: 90 days.
• We also analyse errors of our servers. Before that, we remove IP addresses, email addresses and parameters.
• Legal basis: Art. 6(1)(f) GDPR (error-free website).

Search

Our own search server at Strato in Germany answers your searches. We do not pass search terms to third parties. Like every request, the search appears in the server logs.

Encryption

We transmit all pages encrypted (HTTPS with TLS). You can see this by the lock in the address bar.

In short: For an account we need a user name, an email address and a password. We store comments with your IP address so that we can act on legal violations.

Account

You can create a free account. With it you can comment and use more features.

• Data: user name, email address, password (stored encrypted), newsletter sign-up if you want it.
• Confirmation: We send a link to your email address. Only then is the account active.
• Bot protection: Cloudflare Turnstile (see section 3).
• Legal basis: contract for the use of the account (Art. 6(1)(b) GDPR).
• Retention: as long as the account exists. After that we delete the account data. Legal retention duties remain.
• Delete your account: write to sk@winfuture.de.

Login with Google or Facebook: On desktop you can also log in with Google or Facebook. Your browser then goes to Google or Meta. From there we receive your ID, your name and your email address. Legal basis: your consent (Art. 6(1)(a) GDPR). Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Comments

• the comment and the time
• your user name
• your IP address

Comments appear at once, without prior review. That is why we need the IP address. It lets us act on insults or other legal violations.

• Legal basis: contract of use (Art. 6(1)(b) GDPR). For the IP address: our legitimate interest in protection against legal violations (Art. 6(1)(f) GDPR).
• Retention: Comments remain until you or we delete them, or until the article is deleted.

• Moderation: If a comment breaks the rules, we send you an email. It contains the reason and the comment.

Tips to the newsroom

With "Submit news" you can send us tips. We store your message, the source, your user name (if logged in) and your IP address. The message goes to the newsroom by email. We use Mandrill for sending (see section 5).

• Legal basis: Art. 6(1)(f) GDPR (handling tips, preventing abuse).
• Retention: until we have handled the tip; at most as long as the law requires.

Email to us

If you send us an email, we store your address and your message. We use them only for your request. Legal basis: Art. 6(1)(f) GDPR, for contracts point (b).

In short: You receive the newsletter only if you order and confirm it. Every issue has an unsubscribe link.

Newsletter (Mailchimp)

• Data: your email address. Other details are optional.
• Double opt-in: After signing up you receive an email. Only your click on the link starts the newsletter.
• Sending: via Mailchimp. The provider is The Rocket Science Group LLC d/b/a Mailchimp, 405 North Angier Ave. NE, Atlanta, GA 30308, USA (an Intuit company).
• Analysis: Mailchimp measures whether you open an issue and which links you click. This helps us improve the newsletter.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Unsubscribe: via the link in every issue. We then remove your address from the list. So that we do not write to you again, Mailchimp may keep the address on a block list.
• Third country: USA, see section 13.
• Mailchimp privacy policy

Account emails (Mandrill)

We send emails about your account via Mandrill, the sending service of Mailchimp. These include confirmation links, moderation notices and reminders you order yourself (for example for a deal). Mandrill receives your email address and the content of the email.

• Legal basis: contract of use (Art. 6(1)(b) GDPR). For reminders you order: your consent (point (a)).
• Third country: USA, see section 13.

WhatsApp channel

We run a channel on WhatsApp. winfuture.de only shows a link to it. Only when you follow the channel do WhatsApp's rules apply (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). As channel operator we do not see the phone numbers of followers. WhatsApp privacy policy

In short: With your consent we measure which articles are read and how the site is used. With contentpass these services do not load.

Google Analytics 4 and Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, USA.

• Google Analytics 4 measures page views, source, device and behaviour on the site. Google shortens IP addresses in the EU.
• Google Tag Manager loads Google Analytics and some other services. It does not analyse data itself. We load it through our own address (winfuture.de/wfk/). The data still goes to Google.
• Cookies: _ga and _ga_…, Google's default 2 years.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Third country: USA, see section 13.
• Google privacy policy

Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Clarity shows us how readers use the site: clicks, scrolling, mouse movements. Clarity can record visits as a replay. Clarity masks form input. This helps us find errors and parts that are hard to use.

• Cookies: _clck (1 year) and _clsk (1 day), Microsoft's default.
• We never load Clarity for contentpass subscribers.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Third country: USA, see section 13.
• Microsoft privacy statement

Chartbeat

Provider: Chartbeat, Inc., 701 Tillery Street, Unit 12-1019, Austin, Texas 78702, USA.

Chartbeat shows the newsroom in real time which articles are being read. Chartbeat also tests which headline works better. For this, Chartbeat records IP address, location down to city level and reading time. We receive only aggregated figures.

• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Third country: USA, see section 13.
• Chartbeat privacy policy

VG WORT counting pixels

In articles we load a counting pixel of the Verwertungsgesellschaft WORT (VG WORT), Untere Weidenstraße 5, 81543 Munich, Germany. VG WORT counts views of texts. The statutory payment to authors depends on this. VG WORT receives your IP address and records the view without personal reference.

• Legal basis: Art. 6(1)(f) GDPR (payment of authors under copyright law).
• VG WORT privacy notice

In short: Advertising pays for the newsroom. With your consent we show ads, also based on your interests. With contentpass you see no ads.

How advertising works on winfuture.de

Many pages have ad slots. For each slot, an auction runs within milliseconds. Advertising partners bid for your page view. For this they receive data such as IP address, device, browser, visited page and an ID from cookies. Some partners build interest profiles from this. Others only measure whether an ad was seen, or detect fraud.

You can see all partners and their purposes in the consent window under "Change settings". It also shows their retention periods, their cookies and a link to their privacy policy. Today there are more than 400 partners. Many are based outside the EU.

• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Some partners rely on a legitimate interest for single purposes (Art. 6(1)(f) GDPR). You can object to this in the window.

Our main advertising partners

Google Ad Manager, AdSense and Ad Exchange
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google delivers most ads and runs the auction. Google sets cookies and similar IDs for this.
How Google uses data on partner sites · Google ad settings

Google notice for ad blockers (Funding Choices)
If you use an ad blocker, Google may show a notice. It asks you to allow WinFuture. Provider as above.

Primis
Provider: M.D. Primis Technologies Ltd., 2 Raoul Wallenberg St., Tel Aviv 6971902, Israel.
Primis shows a video player with ads in articles.
Primis privacy policy

AdShield (desktop only)
Provider: AdShield, Inc., Republic of Korea (according to the provider).
For readers with an ad blocker, AdShield makes ads load anyway. The scripts come from html-load.com. If loading fails, the script sends the page address to error-report.com. We never load AdShield for contentpass subscribers.

Why ads despite an ad blocker?

Without ads we cannot pay the newsroom. If you do not want ads, you can use contentpass.

In short: Below articles we show reading tips and paid recommendations from Taboola.

Provider: Taboola.com Ltd., Israel, with subsidiaries such as Taboola, Inc. (USA) and Taboola Europe Limited (London). Representative in the EU: Lionheart Squared (Europe) Ltd., 2 Pembroke House, Upper Pembroke Street 28-32, Dublin, D02 EK84, Ireland.

Taboola selects WinFuture articles and paid content from other sites. For this, Taboola analyses what you read and sets cookies. With your consent this creates interest profiles.

• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Third country: United Kingdom (EU adequacy decision), Israel (adequacy decision), USA, see section 13.
• Taboola privacy policy

In short: Videos and posts from other platforms load only when you click. We show posts from X and Bluesky without connecting to these services.

Posts from X and Bluesky

We store text and images of embedded posts on our own servers. Images load through our server i.wfcdn.de. Your browser does not connect to X or Bluesky. Only when you start a video or follow the link do you connect to the service.

Videos from YouTube

We embed YouTube in privacy-enhanced mode (youtube-nocookie.com). First you see only a preview image. The preview image loads from YouTube's servers, so YouTube receives your IP address. Only your click loads the player. YouTube can then set cookies and link your visit to your Google account if you are logged in.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google privacy policy

Other platforms (click box)

For Reddit and some other platforms you first see a box with the text "Show external content". The content loads only after you agree. The provider then receives your IP address and can set cookies. We store your choice in the cookie wfv4_dsgvo. You can undo it in the box at any time.

• Legal basis: your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Third country: partly USA, see section 13.

Links to our profiles

On winfuture.de we link to our profiles on Facebook, Bluesky, Mastodon, Threads, Instagram and WhatsApp. These are plain links. Only when you click do you leave our site. The rules of the respective network then apply.

In short: If you buy from a shop through one of our links, we often receive a commission. The price for you does not change.

Many links to shops are affiliate links. They mostly run through our own address (winfuture.de/r…). These clicks appear in our server logs. The shop or affiliate network then sets a cookie or an ID in the link. This tells the shop that you came from WinFuture. We only learn that a purchase took place and the commission. We do not learn your name or address.

• Amazon (Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg). As an Amazon Associate we earn from qualifying purchases. Amazon privacy notice
• notebooksbilliger.de (notebooksbilliger.de AG, Sarstedt, Germany)
• MediaMarkt, Saturn, Otto, eBay and other shops, partly via the network Awin (AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany)
• digidip (digidip GmbH, Linienstraße 98, 10115 Berlin, Germany). digidip automatically turns normal shop links into affiliate links. The script loads only with your consent. digidip privacy policy
• Geizhals (Preisvergleich Internet Services AG, Vienna, Austria). Our price comparison uses data from Geizhals. If you click an offer, your browser goes to the shop via geizhals.at. Geizhals receives IP address, browser and previous page. If you rate a product, Geizhals receives your user name. Geizhals privacy policy

• Legal basis: for cookies on your device: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For counting via our redirect: Art. 6(1)(f) GDPR (commission accounting).

Donations via PayPal

You can support us with a donation. For this we send you to PayPal. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Only PayPal receives your payment data. Legal basis: Art. 6(1)(b) GDPR. PayPal privacy statement

In short: Cookies are small files in your browser. We need some of them to run the site. We set all others only with your consent.

"Similar technologies" are, for example, the browser's local storage, counting pixels and IDs in links.

Strictly necessary (without consent, Section 25(2) No. 2 TDDDG)

Only with consent (Section 25(1) TDDDG)

Analytics, advertising, recommendations, affiliate links and embeds. The consent window lists the cookies of each partner and their duration: "Change settings" → partner → cookies.

Deleting in the browser

You can delete cookies in your browser at any time. The consent window will then ask you again on your next visit.

Legal basis key: C = consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). K = contract (point (b)). L = legal obligation (point (c)). LI = legitimate interest (point (f)).
Third country: DPF = provider certified under the EU-US Data Privacy Framework. SCC = EU standard contractual clauses. AD = EU adequacy decision.

In short: Some partners process data in the USA or other countries. We only use partners with a recognised safeguard.

• USA: The European Commission adopted an adequacy decision for the USA on 10 July 2023 (EU-US Data Privacy Framework). It applies to companies that are certified under it. The EU General Court upheld it on 3 September 2025 (T-553/23). An appeal to the Court of Justice is pending. If the decision falls away, the standard contractual clauses apply. The list is on dataprivacyframework.gov. If a partner is not certified, we use the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• United Kingdom, Israel and South Korea: There is an EU adequacy decision for these countries (Art. 45 GDPR).
• Other countries: The consent window shows for each partner whether it processes data outside the EU.
• South Africa: The controller lives in South Africa. Your data is stored on servers in Germany and the EU. We access it from there.

In short: You may know what we store about you. You can ask for correction, deletion and more. An email to sk@winfuture.de is enough.

• access your data (Art. 15 GDPR)
• rectification of wrong data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common format (Art. 20 GDPR)
• withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)

Your right to object (Art. 21 GDPR)

If we process data based on a legitimate interest (Art. 6(1)(f) GDPR), you can object. Give reasons arising from your particular situation. We will then stop processing the data, unless we have compelling legitimate grounds. You can object to advertising at any time without giving reasons.

We do not make automated decisions about you within the meaning of Art. 22 GDPR.

Do you have to provide data? For reading you do not actively give us any data. Technical data arises when you open a page. For an account and the newsletter we need the stated mandatory details. Without them we cannot offer the account or the newsletter.

You can complain to any data protection supervisory authority in the EU (Art. 77 GDPR). This applies in particular in the country where you live or work. A list of all authorities is available from the European Data Protection Board.

We update this policy when services or laws change. The version on this page applies. The date of the last change is shown at the top.