RU EN
www.
Technical audit · 29.05.2026

thw.de

German Federal Agency for Technical Relief
DE

German Federal Agency for Technical Relief. 65 requests, 1 domain. BundesSans and BundesSerif served locally. A proprietary cookie banner built on GSB (Gemeinsames Servicezentrum). Matomo via piwik.itzbund.de is declared, inactive in the HAR — cookieless. Set-Cookie — zero. Not a single external domain.

Request timeline

+0 ms · homepage
www.thw.de/DE/Startseite/startseite_node.html — HTML, Apache. The Content-Security-Policy explicitly permits connect-src only to piwik.itzbund.de and itself.
+83 ms · fonts
BundesSchrift-v3-014: BundesSansWeb (Regular, Italic, Bold, BoldItalic) and BundesSerifWeb (Regular, Italic, Bold, BoldItalic) — 8 woff files, all local, from /static/fonts/. No Google Fonts, no Adobe Fonts.
+85 ms · styles and images
Responsive GSB CSS files (small, medium, large, xlarge, xxlarge, custom, addon_usability) and news images, regional-division maps — all from www.thw.de.
+367 ms · cookie banner
www.thw.de/SiteGlobals/Modules/CookieBanner/DE/Allgemein/CookieBanner.html — GSB's proprietary banner implementation, with no external CMP platforms. Not a single request to OneTrust, Cookiebot, or similar.

Declared versus actual

✓ Matomo (piwik.itzbund.de) — mentioned as web analytics based on Art. 6(1)(f), cookieless, IP anonymized — declared
✓ YouTube — mentioned for embedded videos — declared
✓ Facebook Like Button, Twitter — mentioned as social plugins — declared

Context

THW (Technisches Hilfswerk) is Germany’s federal agency for technical disaster and emergency relief. Around 80,000 volunteers, 668 local units. Subordinate to the Federal Ministry of the Interior. Sensitivity is high. HAR: 65 requests, 1 domain, Apache, GSB (Gemeinsames Servicezentrum der Bundesbehörden).

The BundesSchrift state font system

THW uses eight weights from the BundesSchrift-v3-014 family: BundesSansWeb (Regular, Italic, Bold, BoldItalic) and BundesSerifWeb (Regular, Italic, Bold, BoldItalic). All woff files are hosted locally at /static/fonts/. This is Germany’s federal design standard — centrally distributed fonts with no requests to external CDNs.

GSB — the federal platform as an architectural choice

The site is built on GSB (Gemeinsames Servicezentrum der Bundesbehörden) — the shared service platform for federal agencies. The cookie banner is implemented via GSB’s own module (SiteGlobals/Modules/CookieBanner/), with no OneTrust, Cookiebot, or other commercial CMP. Responsive styles (small/medium/large/xlarge/xxlarge) and the JS bundle (global.js) — local.

Matomo via itzbund.de — declared, inactive in the HAR

The Content-Security-Policy explicitly includes piwik.itzbund.de among the permitted sources for connect-src and script-src. piwik.itzbund.de is the centralized Matomo hosting for federal bodies, deployed by ITZBund (Informationstechnikzentrum Bund). The privacy policy describes its use on the basis of Art. 6(1)(f) DSGVO (legitimate interest), a cookieless mode with the last two octets of the IP address anonymized.

There are no requests to piwik.itzbund.de in the homepage HAR — the tracker was not activated on first visit without cookies. Set-Cookie — zero.

Policy vs. HAR: social plugins

The policy mentions the Facebook Like Button and Twitter as social plugins. There is not a single request to Meta’s or X’s (Twitter’s) servers in the HAR. On the public homepage, the plugins are not activated.

Conclusion

www.thw.de does not transmit visitor data to third parties on first visit. One domain, the state font system, a proprietary cookie banner built on GSB, cookieless Matomo via centralized federal infrastructure. No GDPR violations recorded at the time of the audit.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/thw-de-2026-05-29.har
SHA-256: 8123274e958f69982999020166f5843ebea12d217938b6b97ae9dee017e8b337
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — thw.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website thw.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-thw-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]