docs: list every cookie and storage entry in the cookie policy

The policy only named wabenhain_session, although the site sets ten cookies and three localStorage entries. § 25 TDDDG requires the information for every access to the user's device, so each entry now states purpose, provider, storage period, flags and legal basis. Also adds the legal-basis section (§ 25 Abs. 1/2 TDDDG, Art. 6 DSGVO), third-party cookies (Stripe __stripe_mid/__stripe_sid, Microsoft, Cloudflare Turnstile), browser controls, data subject rights, withdrawal under Art. 7(3) DSGVO and a revision date. Corrects the claim that the cart never leaves the device: it is sent when an order is submitted. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-26 06:34:55 +02:00
1 parent 6950657c91
commit 1ff5f8c722
@@ -433,43 +433,95 @@ export const en: Dictionary = {
  },
  cookieRichtliniePage: {
    title: "Cookie Policy",
+    // Mirrors de.ts entry for entry — see the comment there. Keep both in sync.
    sections: [
      {
-        heading: "What are cookies?",
+        heading: "What are cookies and similar technologies?",
        paragraphs: [
          "Cookies are small text files that are stored on your device when you visit a website. Among other things, they allow us to recognize you during a visit or save your preferences.",
+          "Besides cookies, we use your browser's local storage (localStorage). Legally, both are treated the same: § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to any storage of information on your device and any access to it. This policy therefore lists both in full.",
+          "The controller is the operator of this website named in the legal notice. Further information on how we process personal data can be found in our privacy policy.",
+        ],
+      },
+      {
+        heading: "Legal basis",
+        paragraphs: [
+          "Storing information on your device or reading it from there generally requires your consent (§ 25(1) TDDDG). No consent is needed where the storage is strictly necessary for us to provide a service you have explicitly requested (§ 25(2) No. 2 TDDDG), such as signing in to your customer account or completing an order.",
+          "Where personal data is processed in the process, we rely on Art. 6(1)(b) GDPR (contract and pre-contractual steps, e.g. customer account and order) or Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website). Should we use technologies requiring consent in the future, the legal basis will be your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.",
+        ],
+      },
+      {
+        heading: "Overview",
+        paragraphs: [
+          "We only use technically necessary cookies and storage entries. We do not use analytics, statistics, marketing or tracking cookies, we do not build usage profiles, and we do not pass on data to third parties for advertising purposes.",
+          "Most of the cookies listed below are only created when you use a specific feature (e.g. signing in, paying, switching language). Merely visiting the website sets no cookie.",
        ],
      },
      {
        heading: "Technically necessary cookies",
        paragraphs: [
-          "These cookies are required for the website to function and cannot be disabled. They are only set if you actively trigger them through your actions (e.g. logging into your customer account).",
-          "wabenhain_session: keeps you logged into your customer account after signing in. Expires automatically after 30 days. Legal basis: Art. 6(1)(b) GDPR / § 25(2) No. 2 TDDDG.",
+          "We set all of the following cookies ourselves (first-party cookies). They are only transmitted encrypted (HTTPS) and, unless stated otherwise, are inaccessible to scripts in the browser (HttpOnly). They cannot be deselected because the respective feature does not work without them. Legal basis: § 25(2) No. 2 TDDDG and Art. 6(1)(b) GDPR.",
+          "wabenhain_session – Keeps you signed in to your customer account. Content: a signed identifier of your account, no passwords. Storage period: 30 days, 7 days for administrator accounts; deleted immediately when you sign out.",
+          "wabenhain_2fa_challenge – When signing in with two-factor authentication, remembers that your password has already been checked until you enter the verification code. Storage period: 5 minutes; deleted after successful sign-in.",
+          "wabenhain_2fa_setup – Holds the setup step together while you enable two-factor authentication in your customer account. Storage period: 10 minutes; deleted on completion.",
+          "wabenhain_2fa_backup_display – Shows you your recovery codes exactly once. Storage period: 2 minutes at most; deleted as soon as they are displayed.",
+          "wabenhain_entra_oauth – Only for “Sign in with Microsoft”: protects the redirect to Microsoft and back against tampering (cross-site request forgery protection). Storage period: 10 minutes; deleted on return.",
+          "wh_checkout_ref – Only when paying: links the order just created to your browser so that only you can reopen or cancel the payment. Only sent to pages under /checkout. Storage period: 40 minutes.",
+          "wh_flash – Carries a short confirmation or error message (e.g. “Your email address has been confirmed”) over to the next page. Readable by scripts so the message can be displayed. Storage period: 60 seconds; deleted once displayed. Legal basis: § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR.",
        ],
      },
      {
-        heading: "Local storage without cookies",
+        heading: "Cookies for your settings",
        paragraphs: [
-          "Your cart is not stored via a cookie, but via your browser's local storage (localStorage) on your device, and never leaves your device. Your cookie choice itself is also stored in localStorage.",
+          "These two cookies are only set when you change the respective setting yourself, and they store nothing but your choice. They are readable by scripts but contain no personal data. Legal basis: § 25(2) No. 2 TDDDG (you explicitly triggered saving the setting) and Art. 6(1)(f) GDPR.",
+          "theme – Stores your chosen appearance (light or dark). Storage period: 1 year. Switching back to “System” deletes the cookie.",
+          "locale – Stores your chosen language (German or English). Storage period: 1 year.",
+        ],
+      },
+      {
+        heading: "Local storage (localStorage)",
+        paragraphs: [
+          "The following entries are kept in your browser's local storage. Unlike cookies, they are not automatically sent to us with every page request and do not expire on their own: they remain until you delete them (via your browser's “clear site data” setting) or the website removes them. Legal basis: § 25(2) No. 2 TDDDG and Art. 6(1)(b) or (f) GDPR.",
+          "wabenhain-cart – Your cart (items, quantities, prices). It is only transmitted to us when you submit an order, and it is emptied after a successful order.",
+          "wabenhain-recently-viewed – The identifiers of up to 6 recently viewed products, so they can be shown to you again on product pages. Only these product identifiers are requested for display; we store no browsing history on our servers.",
+          "wabenhain-cookie-consent – Your choice in the cookie banner (“Essential only” or “Accept all”), so the banner does not reappear on every visit and we can demonstrate your decision. Legal basis: § 25(2) No. 2 TDDDG and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.",
+        ],
+      },
+      {
+        heading: "Third-party cookies",
+        paragraphs: [
+          "Stripe (payment processing): Only in the payment step of checkout does your browser load Stripe's payment form. Stripe sets its own cookies for fraud prevention and secure payment processing, in particular __stripe_mid (storage period 1 year) and __stripe_sid (storage period 30 minutes), as well as further cookies within the payment form on Stripe domains. Stripe determines the names and lifetimes of these cookies. Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Data may be transferred to Stripe, Inc. in the USA on the basis of EU standard contractual clauses (Art. 46 GDPR). Legal basis: § 25(2) No. 2 TDDDG and Art. 6(1)(b) GDPR. More information: stripe.com/privacy and stripe.com/legal/cookies-policy.",
+          "Microsoft (sign-in with a Microsoft account): If you choose “Sign in with Microsoft”, you are redirected to a Microsoft sign-in page. Microsoft (Microsoft Ireland Operations Limited) is responsible for the cookies set there; Microsoft's privacy statement applies. Microsoft sets no cookies on our website.",
+          "Cloudflare Turnstile (form protection): On pages with forms (sign-in, registration, password reset, two-factor verification, checkout, newsletter, business enquiry, back-in-stock notification), your browser loads a script from challenges.cloudflare.com. It distinguishes input made by humans from input made by automated programs. Your IP address and technical characteristics of your browser are transmitted to Cloudflare, Inc. (USA) in the process. According to the provider, Turnstile sets no advertising cookies and builds no cross-site user profile. Cloudflare is certified under the EU-US Data Privacy Framework. Details are in our privacy policy.",
+          "Google reviews: We retrieve the reviews on our homepage server-side via the Google Places API. Your browser does not connect to Google, and Google sets no cookie.",
        ],
      },
      {
        heading: "Cookies requiring consent",
        paragraphs: [
-          "We currently don't use any analytics or marketing cookies. Should we introduce something like audience measurement in the future, it will only be activated after your explicit consent via the cookie banner, and will be named here in advance.",
+          "We currently use no cookies or technologies that require your consent. Choosing “Accept all” in the cookie banner therefore enables nothing additional at present; with “Essential only” you can use the website without any restriction.",
+          "Should we introduce something like audience measurement in the future, we will name it here beforehand with provider, purpose and storage period, and only activate it after your explicit, voluntary consent via the cookie banner. Declining has no disadvantages for you.",
        ],
      },
      {
-        heading: "External content",
+        heading: "Managing and deleting cookies in your browser",
        paragraphs: [
-          "Google reviews on our homepage are retrieved and displayed server-side via the Google Places API. No cookie is set in your browser, and your browser does not connect directly to Google.",
-          "Payments are processed via Stripe. During the payment process, Stripe may set its own cookies necessary for fraud prevention. Stripe's privacy policy applies.",
-          "On pages with forms (sign-in, registration, password reset, checkout, newsletter, business enquiry), your browser loads a script from Cloudflare Turnstile. The service distinguishes input made by humans from input made by automated programs. Your IP address is transmitted to Cloudflare in the process. According to the provider, Turnstile sets no advertising cookies and builds no cross-site user profile. Details are in our privacy policy.",
+          "In your browser settings you can view and delete stored cookies and site data at any time, and block cookies entirely or in part. Instructions can be found in your browser's help (e.g. Chrome, Firefox, Safari, Edge).",
+          "If you block technically necessary cookies, some features will stop working, in particular signing in to your customer account and completing an order.",
+        ],
+      },
+      {
+        heading: "Your rights",
+        paragraphs: [
+          "You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Details and contact options are in our privacy policy.",
        ],
      },
      {
        heading: "Changing your choice",
-        paragraphs: ["You can withdraw or change your cookie choice at any time."],
+        paragraphs: [
+          "You can withdraw or change your cookie choice at any time with effect for the future (Art. 7(3) GDPR). Withdrawing is as easy as giving consent: the button below reopens the cookie banner.",
+          "Last updated: September 2026",
+        ],
      },
    ],
  },