RU EN
www.
Technical audit · 29.05.2026

kmk.org

Standing Conference of the Ministers of Education and Cultural Affairs of the German Länder
DE

Standing Conference of the Ministers of Education and Cultural Affairs of the German Länder. 71 requests, 1 domain. TYPO3, nginx. Karla Variable Font and Font Awesome served locally. Klaro as the CMP — undeclared. Matomo on the proprietary server — declared, not active in the HAR. The policy cites the outdated DDG instead of TDDDG. Set-Cookie — zero.

Request timeline

+0 ms · homepage
www.kmk.org/ — HTML, nginx, TYPO3. cache-control: private, no-store. Brotli compression.
+801 ms · styles and Klaro
app-D9yU0upQ.css (a Vite bundle), typo3temp CSS, SearchAutocomplete.css — local. klaroConfig.js, klaro.min.js, klaroObserver.js — all three Klaro CMP files from the local _assets/ directory.
+803 ms · fonts
Karla-VariableFont_wght — a variable font (TTF), covering the entire weight range in a single file, local. fa-regular-400 (Font Awesome) — woff2, local. No Google Fonts.
+803 ms · images
KMK logos (SVG/PNG), the hero slider (three webp pairs), section-topic illustrations (Bildung, Wissenschaft, Kultur, etc.) — all from fileadmin/, local.
+989 ms · JS bundles
hero-slider, a11y, effect-fade, topic-slider, navigation, pagination, alignInfoBoxContent — Vite bundles, all local.

Declared versus actual

✓ Matomo (KMK's own server) — declared, opt-out cookies, IP anonymization — declared
+ Klaro (klaro.min.js, klaroConfig.js, klaroObserver.js) — not mentioned — not declared

Context

KMK (Kultusministerkonferenz) is the standing conference of the education and cultural affairs ministers of Germany’s 16 Länder. It coordinates education policy at the federal level. Secretariat: Berlin. TYPO3, nginx, Vite. HAR: 71 requests, 1 domain.

Klaro — an open-source CMP, local, undeclared

The three Klaro files (klaro.min.js, klaroConfig.js, klaroObserver.js) load from TYPO3’s local _assets/ directory. Klaro is an open-source consent-management library (MIT license) that requires no external server requests and transmits no data to third parties. There is not a single request to external Klaro servers in the HAR — all CMP logic runs client-side. The privacy policy makes no mention of Klaro, the consent-management mechanism, or the consent cookies used.

The privacy policy cites DDG (Digitale-Dienste-Gesetz) as the legal basis for data processing. DDG is Germany’s implementation of the EU Digital Services Act, which regulates large platforms. Cookies on websites fall under TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), which replaced TTDSG in May 2023. Matomo is described with a legal basis of “berechtigte Interessen” (legitimate interest), with no reference to TDDDG.

Karla Variable Font — local

KMK uses the Karla Variable Font in TTF format — a variable font covering a continuous weight range in a single file. Font Awesome Regular — woff2, local. No Google Fonts, no Adobe Fonts.

Matomo — declared, not active in the HAR

The policy describes Matomo on KMK’s own server, with IP anonymization and opt-out via cookie. There are no requests to a Matomo server in the homepage HAR — the analytics tool was not activated on first visit.

Conclusion

www.kmk.org does not transmit visitor data to third parties. One domain, local resources, local Klaro as the CMP. The one finding: Klaro is not declared in the privacy policy, which also contains outdated legal references to DDG instead of TDDDG.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/kmk-org-2026-05-29.har
SHA-256: d1f5445deba0bc432dbe9c4d37d26fe719ed13a69e9a3eff22971a2d28526763
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — kmk.org

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website kmk.org.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-kmk-org/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — kmk.org

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kmk.org.

2. Circumstances
I visited the website kmk.org and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

Full technical documentation is published at: https://gdpru.eu/en/audits/de-kmk-org/

3. GDPR provisions I ask you to examine


4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]