Last updated: October 2026
The German version is the legally authoritative one.
The controller for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:
Advanced Technology for Organics GmbHHansestraße 2118182 BentwischDeutschlandVertreten durch: Dr. Mathias SchlegelRegister: Amtsgericht Rostock, HRB 14962USt-IdNr.: DE331098609E-Mail: info@atfo.deThe controller operates the website itself on its own server. No hosting provider or other processor is involved in its operation.
Opening this website establishes no connections to third parties. There is no analytics or tracking, no advertising networks, no social media elements and no content delivery network. Fonts are served from our own server, the charting library ships inside the application bundle, and your IP address is not transmitted to any external service.
The web server records technical details of each request: timestamp, requested path, status code, transferred volume, referrer and browser identification. This is necessary for operation and security; the legal basis is Art. 6(1)(f) GDPR.
IP addresses are not stored in full in the access log. The last eight bits of an IPv4 address, or the last 80 bits of an IPv6 address, are zeroed as the log entry is written, so no complete address ever reaches the access log. Only if a technical error occurs in the web server may the separate error log contain the full IP address of the affected request; it is consulted solely for troubleshooting. Logs are rotated daily and deleted automatically after 14 days.
Up to four strictly necessary cookies are set. The first is ATFO_LOCALE, storing your chosen interface language for 12 months, with the Secure and SameSite=Lax attributes. It holds only a language code such as “en” and no identifier. Because it is strictly necessary for the service you requested, it is exempt from consent under § 25(2) no. 2 TDDDG, which is why no consent banner is shown. You can delete it in your browser at any time.
The second, __Host-atfo_session, is set only after you sign in and keeps you signed in until you sign out — at most 24 hours, and it expires after 1 hour of inactivity (HttpOnly, Secure, SameSite=Strict). It holds a random session identifier that scripts in the browser cannot read. The server stores only a cryptographic hash of it, together with the session’s start, last use and expiry, the sign-in method and a coarse device description (browser and operating system, no versions) so you can recognise and end sessions on your profile page; the entry is deleted immediately when you sign out. This cookie is likewise exempt from consent under § 25(2) no. 2 TDDDG.
For your account we store your email address, a non-reversible hash of your password (Argon2id) and the number of failed sign-in attempts (Art. 6(1)(b) GDPR). To protect against password guessing, your IP address is counted on each sign-in attempt for at most 15 minutes in server memory only and is never written to the database or to logs (Art. 6(1)(f) GDPR). If you change your password on your profile page, the previous hash is overwritten. If master data is stored for your account (name, address, role, company, commercial register, activities, phone, contact email), it is shown only to you on your profile page (Art. 6(1)(b) GDPR).
If you choose to register a security key (FIDO2, e.g. YubiKey), we store its public key, credential identifier, the manufacturer’s model identifier (AAGUID), a signature counter, the name you give it and when it was added and last used (Art. 6(1)(b) GDPR). Biometric data and the key’s PIN never reach the server. To check authenticity during setup, the server may fetch the manufacturer’s revocation list; no data about you is transmitted. For the duration of a sign-in ceremony (at most 3 minutes) a strictly necessary cookie, __Host-atfo_webauthn, is set. You can remove keys on your profile page at any time.
We store which biogas plants your account belongs to and with which role (operator, staff or viewer) in order to show you those plants’ data (Art. 6(1)(b) GDPR). For recorded feedings and changes to the substrate list we store which account made them, so that entries remain traceable (Art. 6(1)(f) GDPR); voided feedings are kept with the time and the account that voided them. If your account belongs to several plants and you switch between them, the cookie ATFO_PLANT remembers the last one for 12 months (HttpOnly, Secure, SameSite=Lax). It holds only the plant’s internal identifier and no information about you; it is also exempt from consent under § 25(2) no. 2 TDDDG.
To protect your account we keep a security log (Art. 6(1)(f) and Art. 32 GDPR): sign-ins and sign-outs, locked or rejected sign-in attempts, security keys added or removed, password changes, ended sessions, changes to your plant assignments and changes you make to plant and fermenter data — each with a timestamp and without IP address. You can view it on your profile page; entries are deleted after 12 months.
Your entries in the planning tools stay on your device, stored under the keys atfo_finance_profil_v1, atfo_finance_spot_v1, atfo_webapp_preise_v2 and atfo_webapp_ration_v1. This data is never transmitted to the server or to third parties and is not visible to us. It is deleted automatically when you sign out – and when the sign-in page appears after an expired session – so nothing is left behind for the next person on a shared device.
The finance module can retrieve day-ahead exchange prices from aWATTar GmbH (Austria). The request is made by our server, not by your browser, so your IP address is not disclosed to aWATTar. Only price figures are retrieved; no personal data is transmitted.
You may upload a profile picture (Art. 6(1)(a) GDPR). The server checks the file, resizes it to 512 × 512 pixels and re-encodes it, removing all metadata such as location (GPS), camera model or capture time. Only the re-encoded image is stored, never the original file, and it can be retrieved only by your own account. You can replace or remove it at any time; removal deletes it immediately, and from backups within 14 days at the latest.
The site runs on the controller’s own server, located in Bentwisch, Deutschland. The domain is registered with webgo GmbH, which only provides name resolution; requests reach the controller’s server exclusively. No transfer to third countries outside the EU/EEA takes place. All connections are TLS-encrypted; HTTP requests are redirected to HTTPS and HSTS is enforced.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). No automated decision-making within the meaning of Art. 22 GDPR takes place. Please contact the address under section 1. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority is Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Schwerin.