This is a convenience translation. Only the German version is legally binding: Datenschutzerklärung. In the event of any discrepancy, the German wording prevails.

Privacy policy

patchdeb · As of: October 2026

Controller within the meaning of the GDPR

1. Use of this website

1.1 Hosting and server log files

This website runs on servers in Germany. When a page is called up, technically necessary data (IP address, date and time, resource requested, browser type transmitted) is processed for delivery and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR (secure and trouble-free operation). The log data is not merged with other data sources and is not evaluated to analyse usage behaviour.

We ourselves embed no analytics or tracking services. Fonts, style sheets and graphics are delivered exclusively from our own server or taken from your device's system fonts; no fonts or libraries are loaded from third-party servers. The only exception is the home page: there the Paddle checkout script is loaded, which in turn loads an analytics service belonging to Paddle. Details under 1.2.

1.2 Purchase processing through Paddle

Purchases are handled by Paddle.com Market Ltd., Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as the so-called merchant of record. In doing so Paddle is an independent controller for the payment processing; the parties to the purchase contract are you and Paddle.

On the home page the Paddle checkout script (cdn.paddle.com) is loaded when the page is called up, so that the order buttons work immediately. For technical reasons your IP address is transmitted to Paddle in the process; in this context Paddle may store information on your device or read it out. The legal basis is Art. 6(1)(f) GDPR (providing a working purchase option). On all other pages, including this privacy policy, the terms of use and the legal notice, no Paddle script is loaded.

The Paddle script itself automatically loads a further service from the Paddle group (public.profitwell.com, “ProfitWell”), which Paddle uses to evaluate purchases and abandoned purchases. Your IP address and the page called up are transmitted to that service too. Processing by Paddle companies outside the EU, in particular in the United States, is not ruled out; the details and the safeguards for such transfers follow from Paddle's privacy policy. You can prevent both services from loading by blocking scripts from cdn.paddle.com and public.profitwell.com in your browser; the remaining pages are unaffected.

For the purchase itself, Paddle processes the data you enter there (name, company, email address, billing and payment data, country and VAT identification number for VAT purposes). We ourselves do not receive full payment data from Paddle, only the details needed for activation, in particular the email address, the company name, the product booked and the order reference. Further details are set out in Paddle's privacy policy; for the United Kingdom an adequacy decision of the EU Commission is in place.

1.3 No cookies

This website sets no cookies of its own and stores no data in your browser's storage. There is no language cookie and no referral programme. For the behaviour of the Paddle script, see section 1.2.

1.4 Contact by email

If you email us, we process your sender address and the content of your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR (answering enquiries).

2. Repository access

2.1 Activation and credentials

After an order we create your repository access and send the credentials (customer identifier and access token) and the public repository key to the email address given to Paddle. For this we store company name, email address, plan booked, order reference and term. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

2.2 Repository access logs

Every access by your servers to the repository (for example via apt update or apt install) is logged. Recorded are the IP address of the accessing server, date and time, the file requested, the client type transmitted and the customer identifier from the authentication. The logs serve access control, compliance with the number of servers agreed in the plan, the prevention of misuse and trouble-free operation. The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (security and prevention of misuse). Content of your servers or details of the applications running on them are not recorded.

2.3 Repository key

The public repository key contains no personal data about you. apt uses it on your servers to verify the signature of the package index and, through it, the checksums of the packages; no connection to us arises from this.

3. Recipients and processors

Your data is passed on to third parties only to the extent described below:

• Hosting provider for the website and the repository, server location Germany, acting as a processor under Art. 28 GDPR.
• Paddle.com Market Ltd. (United Kingdom) and companies affiliated with it, for purchase processing and its evaluation (including ProfitWell), as independent controllers, see section 1.2.

In so far as a transfer to third countries takes place in the course of purchase processing, Paddle is responsible for it and for the safeguards required (section 1.2). Beyond that we transfer no personal data to third countries.

4. Storage periods

• Website server log files: deleted after 30 days at the latest.
• Repository access logs: deleted after 30 days at the latest; server counts derived from them, without IP addresses, for the duration of the contract.
• Customer and access data: for the duration of the contract and thereafter in so far as commercial and tax retention periods require it.
• Email enquiries: until the matter has been finally dealt with, and beyond that in so far as retention periods exist.

5. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw consent you have given at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected.

To do so please contact info@patchdeb.com. You also have the right to lodge a complaint with a data protection supervisory authority, for example with the State Commissioner for Data Protection of Lower Saxony, who is competent for us.