thw.de

Context

THW (Technisches Hilfswerk) is Germany’s federal agency for technical disaster and emergency relief. Around 80,000 volunteers, 668 local units. Subordinate to the Federal Ministry of the Interior. Sensitivity is high. HAR: 65 requests, 1 domain, Apache, GSB (Gemeinsames Servicezentrum der Bundesbehörden).

The BundesSchrift state font system

THW uses eight weights from the BundesSchrift-v3-014 family: BundesSansWeb (Regular, Italic, Bold, BoldItalic) and BundesSerifWeb (Regular, Italic, Bold, BoldItalic). All woff files are hosted locally at /static/fonts/. This is Germany’s federal design standard — centrally distributed fonts with no requests to external CDNs.

GSB — the federal platform as an architectural choice

The site is built on GSB (Gemeinsames Servicezentrum der Bundesbehörden) — the shared service platform for federal agencies. The cookie banner is implemented via GSB’s own module (SiteGlobals/Modules/CookieBanner/), with no OneTrust, Cookiebot, or other commercial CMP. Responsive styles (small/medium/large/xlarge/xxlarge) and the JS bundle (global.js) — local.

Matomo via itzbund.de — declared, inactive in the HAR

The Content-Security-Policy explicitly includes piwik.itzbund.de among the permitted sources for connect-src and script-src. piwik.itzbund.de is the centralized Matomo hosting for federal bodies, deployed by ITZBund (Informationstechnikzentrum Bund). The privacy policy describes its use on the basis of Art. 6(1)(f) DSGVO (legitimate interest), a cookieless mode with the last two octets of the IP address anonymized.

There are no requests to piwik.itzbund.de in the homepage HAR — the tracker was not activated on first visit without cookies. Set-Cookie — zero.

Policy vs. HAR: social plugins

The policy mentions the Facebook Like Button and Twitter as social plugins. There is not a single request to Meta’s or X’s (Twitter’s) servers in the HAR. On the public homepage, the plugins are not activated.

Conclusion

www.thw.de does not transmit visitor data to third parties on first visit. One domain, the state font system, a proprietary cookie banner built on GSB, cookieless Matomo via centralized federal infrastructure. No GDPR violations recorded at the time of the audit.