Privacy policy
Last updated: 27.09.2026
This translation is provided for information only. The legally binding text is the German version.
1. Controller
The controller responsible for processing personal data on this site is:
Marcel DeboutAm Bügelacker 3c
87527 Sonthofen
Germany
Email: datenschutz [at] rsl-list [dot] de
No data protection officer has been appointed for this service; the requirements of Section 38 of the German Federal Data Protection Act (BDSG) are not met. Please send any inquiries to the address above.
2. What this site does
RSL-List calculates rankings from publicly available price data using Robert Levy's relative strength method. The calculation runs once a day on our own server. Your browser never communicates with the data sources — neither with market data services nor with Wikipedia. Everything you see is delivered by our server.
The site does not embed any external fonts, content delivery networks, analytics or tracking services, or social networks. No profiles are created and no data is processed for advertising purposes.
3. When you simply visit the site
Our web server logs every request. The following is recorded:
- IP address of the requesting device
- date and time of the request
- address requested and amount of data transferred
- whether the request was successful
- browser used and its version, and the operating system
- the page visited before, if your browser sends it
- Purpose
- Operation, stability and security of the server, in particular detecting and fending off abusive requests.
- Legal basis
- Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the service securely.
- Retention period
- The logs are deleted after 14 days at the latest. If a specific case of abuse is being investigated, the entries concerned are kept until it has been resolved.
Anonymous visitor count. So that we know how many people use the site, your browser reports once to our own server after loading a page that the page was viewed. From the IP address and the browser identifier, we use a random key that changes daily to form a checksum whose only purpose is to prevent the same visit from being counted twice on the same day. At midnight, all checksums and the key are deleted; all that remains permanently is the number of visitors and page views per day, which can no longer be linked to any person. No cookie is set, nothing is stored on or read from your device, and no third-party service is involved.
- Purpose
- Audience measurement: how many people use the service, and how is that developing?
- Legal basis
- Art. 6(1)(f) GDPR. Our legitimate interest lies in knowing how the service is used so that we can develop it in line with demand.
- Retention period
- Checksums and key until the end of the day; the anonymous daily totals without a time limit.
4. Cookies
This site sets at most two cookies, and neither of them when you simply visit:
-
The session cookie, only after you log in. It keeps you logged in for
the duration of your visit, is set as
HttpOnlyandSecure, restricted toSameSite=Lax, and expires after 12 hours at the latest. -
The cookie
rsl_sprachhinweis, only when you dismiss the notice about the English version of this site. It contains only the valueaus(“off”) and ensures that the notice does not appear again. It is set in the same way as the session cookie and expires after one year.
Both cookies are strictly necessary for a service you have expressly requested: logging in, or hiding the notice. Under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), storing them therefore does not require consent — which is also why you will not find a consent banner here. We do not set tracking, analytics or advertising cookies.
5. Registration and user account
For an account, we process the following data:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Logging in and sending the emails you have requested | Art. 6(1)(b) GDPR |
| Display name | Addressing you in the interface and in emails | Art. 6(1)(b) GDPR |
| Password | Logging in. We store only a cryptographic hash, never the password itself | Art. 6(1)(b) GDPR |
| Time of email confirmation | Proof that the address belongs to you | Art. 6(1)(b) and (f) GDPR |
| Time of registration and of the last login | Account administration, identifying unused accounts | Art. 6(1)(f) GDPR |
| Your watchlist (ticker symbols and date added) | Displaying your personal selection | Art. 6(1)(b) GDPR |
| Settings for the report emails | Controlling delivery | Art. 6(1)(a) GDPR |
| Language (taken from the page on which you registered, and changeable in your account) | Emails in your language | Art. 6(1)(b) GDPR |
To confirm your address, we generate a one-time link. Our database contains only a hash of it; the link itself appears only in the email to you. It expires after 24 hours.
6. Report emails
The daily and weekly summaries of your watchlist are switched off by default. You only receive them if you switch them on yourself. The legal basis is your consent under Art. 6(1)(a) GDPR.
You can withdraw this consent at any time — when logged in, under “Notifications”, with one click, without giving reasons and without any disadvantage. This does not affect the lawfulness of the processing carried out until then.
7. Contact form
Using the contact form, you can reach us without an account. We process:
| Data | Purpose | Legal basis |
|---|---|---|
| Subject (contact or feedback) and your message | Handling your inquiry | Art. 6(1)(b) GDPR where the inquiry concerns an account or a contract, otherwise (f) |
| Name, if provided | Addressing you in the reply | Art. 6(1)(f) GDPR |
| Email address, if provided | Replying to your inquiry | Art. 6(1)(b) or (f) GDPR |
| For logged-in users, the account's address | Linking the inquiry to the account | Art. 6(1)(b) GDPR |
Our legitimate interest within the meaning of (f) lies in answering inquiries and feedback and in improving the service. Name and email address are optional; without an address, however, we cannot reply.
The message is not stored on this site, not even in our database. It is sent as an email to the operator's mailbox; it is sent and delivered via STRATO GmbH, Berlin as a processor (see section 8). We delete it there as soon as your inquiry has been dealt with and no statutory retention obligation applies. We do not send a confirmation email to the address provided.
To protect against misuse, your IP address is briefly counted in memory, and rejected attempts are logged with the IP address. These logs are subject to what is stated in section 3: deletion after 14 days at the latest. The form does not set a cookie.
8. Recipients of your data
We operate the server ourselves; there is no data center and no hosting provider that would have access to the data. Data only leaves our server in these cases:
- Sending emails: STRATO GmbH, Berlin
- To send the confirmation and report emails as well as the messages from the contact form, we use the email provider STRATO GmbH, Berlin. It processes your email address and the content of the email on our behalf, under a data processing agreement pursuant to Art. 28 GDPR.
- Reachability under our address: STRATO GmbH, Berlin
- So that the site can be reached under its name, our connection reports its current IP address to STRATO GmbH, Berlin. No visitor data is transmitted in the process.
Beyond that, we only pass on data where we are legally obliged to do so. No data is transferred to countries outside the EU and the EEA.
9. Links to other sites
The ticker symbols in the rankings link to charts on TradingView. These are ordinary links, not embedded content: as long as you do not click on them, TradingView learns nothing about you. When you click, you leave our site; from then on, the privacy policy of that provider applies.
10. Retention and deletion
We store your account data for as long as your account exists. If you delete your account or have it deleted, the data, including your watchlist, is removed from the live database without delay.
One point we state openly: we back up the database daily and keep up to 14 daily and 8 weekly backups. Deleted data may therefore remain in these backups for up to eight weeks before the backup concerned is automatically overwritten. The backups are stored exclusively on a local storage device and are only restored if data has to be recovered.
11. Your rights
You have the following rights with respect to us:
- Access to the data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a common format (Art. 20 GDPR)
- Objection to processing based on a legitimate interest (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Independently of this, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), usually the authority in the country where you live.
12. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The rankings on this site are calculated automatically, but they relate to securities, not to you.
13. Obligation to provide data
You are not obliged to provide us with any data. Without an email address and password, however, no account can be created; you can view the publicly visible rankings without an account.
14. Data security
The connection to this site is encrypted with TLS throughout. Passwords are stored only as a hash using a modern, deliberately slow method. Access to the server and backups is restricted to the operator.
15. Changes to this policy
If the way the site works changes, we will update this policy. The version published here applies; its date is shown at the top of this page.