Data Privacy in the TYPO3 Project
Data protection by default
As an open source CMS, we place a high priority on data protection and privacy. Our protective measures are clear, comprehensive, advanced, and built into every level of our data-gathering process.
Transparency
Know the what, how, why, and who
No obfuscation tolerated. We clearly spell out what data we collect and why, as well as how we use it, process it, and who can access it. Delve into TYPO3 with a confidence rooted in knowledge.
We’re transparent about how TYPO3 collects, processes, and uses data in our comprehensive privacy policy. You’ll learn:
- Your data rights
- How we record data
- Any third-parties and their data privacy policies
- Storage duration
- Non-EU data transfers
Security
Protected and confidential
With robust security measures at technical and organizational levels, TYPO3 expends every effort to ensure the confidentiality of our data. We plan ahead, collaborate, and act with urgency when needed to protect user data from unauthorized access, use, or disclosure.
Your security is protected through:
- Regular security updates. We ensure that the system is up-to-date with the latest security standards.
- Encryption. Data you transmit to us, including transactions, uses SSL and/or TLS encryption.
- Strict access control. Our user roles are configurable to define the scope and impact of activity.
- Security features. We use password hashes, anonymized IP addresses, HTTPS/TL support, and Same-site Cookies.
- Data protection training. All people in official roles, such as team leads and co-leads receive regular data protection trainings.
Data minimization
Data with a purpose
As a membership organization, TYPO3 collects user data through subscriptions, events, purchases, training, and more. However, our commitment to data minimization means we only collect and process operational data. Any data beyond the functional runs a higher risk of compromising our users’ privacy, and that’s a non-starter for us.
We ensure data minimization through:
- Regular process reviews.
- Privacy-friendly default settings.
- An automatic purge of old user data with TYPO3’s Scheduler module.
- Deletion of personal data at user request.
User rights
Your data is yours
As an open source CMS, user rights are inviolable to us. We operate from the premise that all personal data has the right to be protected. With the ability to access, modify, or delete your data through your user account, your control is guaranteed.
User rights are assured through:
- Listening. We collaborate with the community to address privacy-related concerns, including a monthly Consultation Hour.
- Active opt-in. The data-gathering process requires your explicit consent.
- Fine control. Users can object or restrict the processing of their data through their My TYPO3 account.
- Information availability. Access to the source, recipients, and purposes of your archived personal data.
Compliance
Staying right with the law
We align closely with the GDPR, the strongest data privacy and protection law of the land. As regulations are continually added or changed, we keep pace. We regularly assess and update our privacy policy and data processing activities for ongoing compliance.
We ensure compliance through:
- Customized data protection with third-party GDPR extensions.
- TYPO3’s community-driven GDPR Initiative to track our data protection goals.
Data protection officer
Supporting process analysis and control
Under Article 39 of the European General Data Protection Regulation (GDPR), the Data Protection Officer (DPO) is responsible for informing and advising the controller or processor and their staff on data protection obligations. The DPO must also monitor compliance, including overseeing audits, training, and internal policies, as well as advising on data protection impact assessments. Additionally, the DPO serves as the main contact for the supervisory authority and must perform all tasks with consideration of the risks related to specific processing activities.
Tasks of the data protection officer
From Article 39 of the General Data Protection Regulation (GDPR)
- The data protection officer shall have at least the following tasks:
- to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
- to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
- to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
- to cooperate with the supervisory authority;
- to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
- The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.
Karen Falkenberg
Data protection officer
Since 2018, Karen Falkenberg takes care of data protection in the TYPO3 project. She says “data protection should not be an obstacle but a challenge and an opportunity.”
Contact the data protection officer
Phone: +49 2307 80102
Email: karen.falkenberg@typo3.org
Please note: The data protection officer can help you and answer your questions only if you are involved in the TYPO3 Association and community. Consulting for private projects is not possible.
Data protection trainings
Regular
All people in official roles, such as team leads and co-leads, Association Board and Business Control Committee members, receive regular data protection trainings.
Insert trainings from events calendar