How we handle your personal data when you use the TRA Studio Community forum at
community.tra-studio.eu. Last updated: 11 August 2026.
This policy covers the forum only. The TRA Studio application at
tra-studio.eu has its own privacy policy: https://tra-studio.eu/privacy.
1. Controller
Alsensio GmbH, Albert-Einstein-Ring 6, 22761 Hamburg, Germany
Email: mail@alsensio.de · Phone: +49 (0)40 228 6789 10
We are not legally required to appoint a data protection officer. For any
privacy matter, contact us at mail@alsensio.de.
2. What we process and why
Account data (Art. 6 (1)(b) GDPR — performance of a contract, i.e. the
forum’s terms of use). When you register: your chosen username, your email
address, a securely hashed password, and anything you choose to add to your
profile (display name, avatar, bio, location, website). Your username, avatar
and profile are publicly visible; your email address is not.
Content you post (Art. 6 (1)(b) and (f)). Topics, replies, likes, flags,
uploaded images and attachments. Posts in public categories are visible to
everyone on the internet and are indexed by search engines — see section 5.
Technical data (Art. 6 (1)(f) — our legitimate interest in operating a
secure forum and defending against spam and abuse). The forum software records
the IP address used at registration and at your most recent visit, together
with browser and device information, and keeps a moderation log of
administrative actions. Web-server access logs are described in section 6.
Notification email (Art. 6 (1)(b) and (f)). Address confirmation, password
reset, replies, mentions and — if you leave them enabled — activity summaries.
You can turn every non-essential email off under Preferences → Emails.
Private messages and chat (Art. 6 (1)(b) and (f)). The forum supports
personal messages and a chat feature. These are not publicly visible, but they
are stored unencrypted in our database, are included in backups, and are
technically accessible to administrators. Please do not use them for anything
you would not entrust to us as the forum operator.
Multi-factor authentication (Art. 6 (1)(f)), if you enable it: the shared
secret for your authenticator app, or the public key of your security key.
3. Cookies
We use only strictly necessary cookies: an authentication cookie (_t) that
keeps you signed in, and a session cookie (_forum_session). Under § 25 (2)
TDDDG these need no consent, which is why you see no cookie banner.
We use no advertising cookies, no third-party tracking and no
analytics.
4. Avatars and third-party content
Avatars are stored on our own server. The Gravatar service, which would
transmit a hash of your email address to a third party, is disabled.
Links you or other users post may render as a preview. Previews are fetched by
our server, not your browser. Some embeds — for example video players — do load
directly from the third party in your browser and can transmit your IP address
to that provider. Follow such content only if you accept this.
5. Public visibility and search engines
Everything you post in a public category can be read by anyone, without an
account, and will be indexed by search engines. Consider this before posting
your real name, your employer, product details, network information or
anything else you would not publish on your own website.
If you later delete a post, search engines may retain a cached copy for some
time. That is outside our control.
6. Hosting, backups and email delivery
Hosting: the forum runs on a virtual server operated by IONOS SE,
Montabaur, Germany, in a German data centre, acting as our processor under a
data-processing agreement (Art. 28 GDPR). The web server logs technical data
(IP address, timestamp, requested URL, referrer, user agent) on the basis of
Art. 6 (1)(f); these logs are rotated daily and deleted after 7 days.
Backups: automatic backups of the forum database and uploads are created
weekly and stored on the same virtual server at IONOS SE described above. They
are not encrypted at rest and are not currently copied to any separate storage
provider, so no further processor is involved.
Email delivery: notification emails are sent through the mail servers of
IONOS SE, Montabaur, Germany — the same processor that hosts the forum, under
the same data-processing agreement (Art. 28 GDPR).
7. Recipients and third countries
We do not sell your data and we do not pass it to third parties beyond the
processors named in section 6. Processing takes place within the EU/EEA. Any
transfer to a third country would rely on an adequacy decision or EU Standard
Contractual Clauses.
8. Retention
Account data is kept for as long as your account exists. The IP addresses
recorded by the forum software — the one used at registration and the one used
at your most recent visit — are not purged on a fixed schedule; they are
stored on your user record for as long as the account exists and are removed
when the account is deleted or anonymised. Web-server logs are rotated daily
and deleted after 7 days. Backups are taken weekly and the five most recent are
kept, so the oldest backup is roughly 35 days old.
On request we delete or anonymise your account. Anonymising keeps your
posts but detaches them from your identity — this is normally the right
outcome for a discussion forum, where deleting a post would tear holes in
conversations other people contributed to. If you want your posts removed as
well, say so explicitly; we will assess that case by case, balancing your
erasure right against the other participants’ contributions and our legitimate
interest in a coherent public archive.
9. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure
(Art. 17), restriction (Art. 18), data portability (Art. 20) and to object
(Art. 21). Where processing rests on consent, you may withdraw it at any time
with effect for the future (Art. 7 (3)).
You can exercise several of these yourself: edit or delete your posts, edit
your profile, and download a copy of your data under Preferences → Account →
Download all (Art. 20). For anything else, write to mail@alsensio.de.
10. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, in
particular the one for our registered office: Der Hamburgische Beauftragte für
Datenschutz und Informationsfreiheit, Hamburg.
11. Changes
We may update this policy to reflect changes to the forum or the law. The
current version is always at this address, with the date it was last updated.
Substantial changes are announced in the Announcements category.