1.5 KiB
Legal — imprint, privacy, photos
Not legal advice — but the points where school sites regularly get flagged. The
actual imprint and privacy texts live in Content/pages/impressum.md and
Content/pages/datenschutz.md; filling them in with released, real data is tracked
in tasks/003-echte-inhalte-vor-go-live.md.
Imprint (§ 5 DDG)
If the Elternbeirat has no legal form of its own, the operator is listed personally in the imprint with name and a valid postal address for service. This is a decision, not a formality — the private address becomes public. Alternative: the school's address, but only with its explicit consent and if the school is a co-operator.
Privacy policy
With the move, Tom becomes the controller in the sense of the GDPR. Name the server logs with IP addresses, define the legal basis and the deletion period.
No external resources
Google Fonts, Maps, YouTube embeds, and CDN scripts transmit visitors' IPs to third
parties. Fonts are served by ourselves. This is the reason behind the "no external
resources" rule in CLAUDE.md — data protection, not taste.
Photos of children
Only with the consent of the legal guardians — by far the most common mistake on school sites. When in doubt, no photos of people. Note: the old WordPress backup contained no own images anyway (only URLs in the database), so any photo used is a fresh, consciously released one.
Hosting on a private connection
The public IP of the private connection appears in the DNS of a school site. A deliberate decision, not a side effect.