Privacy

Controller

Jens-Werner Winkler, Beethovenstraße 11, 32839 Steinheim, Germany. Email: info@winkler-trading.de, phone: +49 5233 9829780. The full details are in the legal notice.

This statement covers this website. What the installed software processes on the user's own machine, and where it connects to, is set out in its own privacy statement for the Winkler Trading Station (version 2.0, October 2026): /docs/wts-datenschutz.pdf.

New in version 2.0: the Strategie Builder's strategy sync (its clause 3e, its time limits in clause 5; in short below under "Transfer to the licence server"); for every account, with or without sync, the time limit for the hub's backup copies: the provider keeps them, account and support data included, for 30 days at most (clause 5); and the picture of "Ai Quick" (clauses 1, 3 and 4): like "AI Scan", "Ai Quick" now gives a picture of the chart to your AI provider – both only the chart area, without the DOM ladder, speed of tape and the Strategie Builder's lines; the station draws a setup only into that chart. If the chart shows "Share Signals" markers at that moment, they are in the picture too, with their label – the first 14 characters of the alert title –, with AI Scan already since 1.9.104. The consents to TradingView and to the Strategie Builder's automatic AI runs stay as they are.

Since 1.9.108 its clause 5 also says (in translation): "AI Analytics was removed with 1.9.108. On the first start of 1.9.108 the station deleted, once, whatever of it was stored on this computer – the reports and switches, the images and all grades; no new ones are created." This refers to the former AI evaluations for the day and the short term. The "AI Analytics" unlock itself remains; the "Analytics" window, the AI and Analytics blocks and the AI Creator of the Strategie Builder depend on it.

What is processed

• Server log: IP address, time, requested address, response status, bytes transferred and user agent. The upstream web server writes this so that faults and attacks can be traced. Legal basis: Art. 6(1)(f) GDPR.

That is all of it, as long as nobody creates an account. There is no contact form, no feedback form, no comments and no search.

Member account

Anyone creating an account for the Trading Station provides: name, email address, login name for the software, a password of their own choosing for this site, and a billing address (street, postcode, city, country; company and VAT ID are optional).

Added to that is the machine-generated password for the software. It has to be displayable in the member area and is therefore held encrypted rather than hashed. The password for this site, by contrast, is stored only as a derivation (PBKDF2) and cannot be recovered.

Also stored: the time of registration, the end of the trial, the plan chosen and a history of what happened to the account (created, plan changed, blocked or released at the licence server, retrieval of a handbook or of the self-study course).

Legal basis: Art. 6(1)(b) GDPR — without these details neither an account nor an invoice is possible.

Session cookie wex_mitglied: technically necessary, HttpOnly, SameSite=Lax, and Secure over an encrypted connection. It holds the account identifier and an expiry time, both signed, and expires after thirty days.

Transfer to the licence server

So that the software can sign in, the website creates an account on the licence server (hub) when the account is created. What is transmitted is the login name and the generated password — nothing else. Neither name nor address nor email address goes there.

If the trial ends or a payment does not arrive, the account there is blocked; after a payment it is released again. What the licence server processes beyond that once the software talks to it — machine identifier, IP address, program version and times of sign-in, the rights check once a minute, the messages of the support chat and, if the user switches on the phone tunnel, everything the phone access exchanges between station and phone, including, where switched on, the alerts and signals of the Strategie Builder and the AI levels from the "Analytics" window with their alerts, but never the Strategie Builder's lines from chart and heatmap, and, if the user switches on strategy sync, a readable copy of the user's strategies — is set out in the privacy statement for the software (/docs/wts-datenschutz.pdf).

In short, for the phone tunnel: the licence server only passes the content of requests and answers through and does not store it; its web servers log each call with IP address, time and the address called, for seven days at most. For an account with the "phone tunnel" right, the licence server creates the account's fixed tunnel address at sign-in.

In short, for strategy sync: it is off by default and runs only for an account the provider has unlocked the "Abgleich" (sync) right for – never on a test seat –, and only on machines where the user switches it on with the account password. Then the licence server holds a copy of the user's strategies – readable, not end-to-end encrypted; whether their alerts are on does not go along. The licence server keeps deleted strategies for up to 30 days for restoring; "Delete my strategies from the hub" in the Strategie Builder deletes the copy at once.

Payment

Paid orders run through CopeCart GmbH, Rosenstraße 2, 10178 Berlin, Germany. CopeCart is not a processor but the seller: the contract of sale is concluded with CopeCart (terms, clause 1), and CopeCart processes your order and payment data on its own responsibility as a controller within the meaning of Art. 4(7) GDPR. CopeCart's own privacy statement applies to that.

What this website gives out. A buy button is a link to the product's order page at CopeCart. That link carries the email address of the account — so that it is already filled in on the order form and so that the later order notice can be matched to the right account. The website gives out nothing more: no name, no address, no payment data. Everything else — card or bank details, billing address, address verification, fraud checks — CopeCart collects itself on its own page; the provider sees no payment data and stores none.

What comes back. CopeCart reports every order to the provider: order and transaction number, product, amount including the VAT shown, means of payment, payment status, for recurring payments the next date, and the buyer's name and email address. From that the provider knows which access to unlock and for how long. Legal basis: Art. 6(1)(b) GDPR. Of this, only the order and transaction number as a record, and the end of the paid term, are stored on the account.

CopeCart is established in Germany; for the payment this website transmits nothing to a third country. Which service providers CopeCart uses in turn is set out in CopeCart's privacy statement.

Anyone who only uses the free trial does not come into contact with CopeCart.

Email

Messages to members (credentials, end of trial, payment received) are sent from an unattended address to the address given. Every message is written to an outbox on the server before it is sent, so that what went out stays traceable; it contains the login name and the generated password for the software.

Live trading room

The live trading room in the member area consists of a video stream and a way to send questions to the trader. Both exist only for members with a booked access; anyone who merely reads the site is not touched by it.

Stream. The stream comes from this website's own server (see Hosting). No third-party video service is involved, no cookies are set for it, and no request goes to a foreign server. So that only members with access can fetch it, every member gets an address of their own that is valid for three hours at most. It contains an identifier derived from the account — not the member number — so that an address passed on can be traced to the account. Fetching the video itself is not logged; the request asking whether a session is on appears in the server log like any page request. The stream is not recorded; the server only holds the last few seconds of the session. Legal basis: Art. 6(1)(b) GDPR.

Viewer count. While the stream is actually playing for a member, the browser reports this every 15 seconds. Only one entry per member is stored, holding the time of the last report; each new report overwrites it. This yields the number of viewers the provider sees during the session — as a number, without names. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is to fit the session to its actual audience.

Questions. Questions to the trader are stored with the member's login name, the text, the time and the state of handling (open, being answered, answered, discarded). Only the member and the provider can see them; they are not shown to other members. They are answered in the stream, where the provider may read the question out. Questions are deleted 30 days after receipt, individual ones earlier on request. Legal basis: Art. 6(1)(b) GDPR.

Payment. Access is paid through CopeCart like the plans — on its own or as the combo together with access to the software, then with one payment for both; the Payment section applies.

Mentoring programme

Anyone booking the mentoring programme receives dates and working material by email to the address held in the account — the Email section applies — and further material in the member area. Stored on the account are the end of the programme and the term booked; from that the site derives that the five handbooks and the self-study course are available for the term.

Self-study course. Participants open the self-study course in the member area; it runs as a page of its own in their browser. What the course remembers — lessons completed, the lesson last opened, quiz answers, ticked checklists and, only in the twelve-month edition, the view chosen — it stores only in the browser's local storage (localStorage) on that device, under the key wts-tutorial-v1; entries from earlier versions under wts-orderflow-progress (and, in the twelve-month edition, wts-plan) are read in as well if present. This data is never sent to the website, and the provider does not see it. It applies to everyone who uses the same browser and stays after logging out. It can be deleted through the site data in the browser's settings; "Fortschritt löschen" (delete progress) in the course resets lessons, quiz answers and checklists. Storing it is strictly necessary for the function the member calls up (§ 25(2) no. 2 TDDDG). The server records each retrieval of the course in the account history, as it does for a handbook (section Member account).

The sessions run as video calls over a tool agreed with the member; no tool is prescribed. What is processed there — connection data, picture and sound — is governed by the privacy notice of the chosen provider; this website is not involved in it. The sessions are not recorded unless both sides expressly agree. Legal basis: Art. 6(1)(b) GDPR.

The AI learning platform (WTS AI Coach) is not a service of this website. It consists of a program on the member's own computer and a server of its own; the account, the book knowledge and the learning progress live there, and every question passes through that server to the operator of the language model. What exactly is processed, and for how long it is kept, is described on the AI Coach page. This website learns nothing about the learning progress.

Payment runs through CopeCart; the Payment section applies.

What does NOT happen

No analytics or tracking tools, no advertising cookies, no external fonts, no CDN resources, no social plugins, no profiling, no automated decision-making in individual cases, and no language cookie — the language is in the address.

No transfer to a third country takes place on this website. CopeCart is established in Germany, and the stream of the live trading room comes from the site's own server. The video call of the mentoring programme runs outside this website; whether any data reaches a third country there depends on the tool agreed.

That holds for this website. The installed software itself connects from your machine to third-party services, some of them in the USA: to TradingView's market data feed, to Binance's crypto interface, to Fair Economy's economic calendar and – for the overlays of the "Analytics" window – to Cboe (option data), Wikipedia and the White House (news), each only after your consent and only for a signed-in account, and to the AI provider chosen – on your click or, only after your separate consent, by itself (auto mode of "AI analysis", AI blocks of the Strategie Builder) – and, on your click in the "AI Creator", through your Claude CLI to Anthropic. What is transmitted, and on what basis, is set out in the privacy statement for the software (/docs/wts-datenschutz.pdf).

Serving a page makes no request to a foreign server. The fonts are downloaded at build time and served from this host afterwards. That holds without exception, the stream in the live trading room included.

Retention

• Server logs: seven days at most, then deleted.
• Session cookie wex_mitglied: thirty days from sign-in; "Sign out" deletes it at once.
• Member account: until the account is deleted. A deletion needs no particular form, an email is enough; invoicing data is unaffected while tax retention periods run.
• Outbox: the messages sent are kept as a record until the account is deleted.
• Questions in the live room: 30 days from receipt; after that they are no longer shown and are deleted as soon as the live room is used again.
• Viewer report in the live room: one entry per member, overwritten with every report; it is deleted with the account.
• Mentoring programme: end and term stay on the account until the account is deleted.
• Progress in the self-study course: only in the member's browser until it is deleted there (the browser's site data, or "Fortschritt löschen" in the course); it is not held on the server.

Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). A message to info@winkler-trading.de is enough.

Right to object: where processing rests on Art. 6(1)(f) GDPR — the server log, the viewer report in the live room — you may object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR). A message to info@winkler-trading.de is enough for that as well.

You may lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, your place of work or the place of the alleged infringement. For the provider's registered address that authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Hosting

Operated on a rented server of IONOS SE, Montabaur, in an IONOS data centre in Berlin, Germany. The licence server of the Trading Station (hub) and the stream of the live trading room run on the same server. The upstream web server terminates the encrypted connection and writes the log described above.

A data processing agreement under Art. 28 GDPR is in place with IONOS. Hosting involves no transfer to a third country.

Version

23 October 2026.