Alle Filtermöglichkeiten
Filtern nach
Beta version. This privacy notice applies to the beta phase of the "SHK Auto-Login" browser extension. During the beta phase, a limited test group uses the extension with the SHK portal. The notice will be revised before general availability.
Last updated: 09.11.2026
1. Controller
The controller for the processing of personal data in connection with the extension is the operator of the SHK portal https://shk-einkauf.com:
SHK eG
Zeiloch 13
76646 Bruchsal
Vorstandsvorsitzender: Sven Mischel | Vorstand: Thorsten Renk
Vors. d. Aufsichtsrats: Peter Ullrich
Sitz: Bruchsal | AG Mannheim GnR 700094
Tel.: +49 7251 93245-0
Fax: +49 7251 93245-99
E-Mail: kontakt@daswir-shk.de
The privacy policy of the SHK portal applies in addition: https://shk-einkauf.com/datenschutzerklaerung/
2. What the extension is for
The extension connects your browser with the accounts you have stored in the SHK portal. After activation, it offers three functions:
- Setup: On a website, you record your own sign-in once. The extension remembers which fields you fill in and which buttons you click (section 6).
- Auto-login: When you click an auto-login link in the portal, the extension fills in your credentials on the website and clicks the buttons that were set up (section 7).
- Filling in and copying: On websites for which you have stored an account, you can fill in or copy your username and password with a click (sections 5 and 8).
The extension does not use any external analysis service, advertising, tracking or artificial intelligence. It does not show browser notifications.
3. Activation
After installation, the extension is not active and does not process any data from websites. An introduction page explains the purpose, processed data categories, automatic actions, browser permissions and essential residual risks. Only "Activate extension" enables the functions.
Activation is a technical setting of the extension. It is not consent within the meaning of the General Data Protection Regulation (GDPR). Only the following is stored, on your device: the version of the information you read, the time of confirmation and the address of the portal.
You can switch auto-login off and on again at any time in the extension settings. Filling in, copying and setup remain available.
Legal basis of the processing: Art. 6 Abs. 1 lit. b DSGVO
4. Communication with the portal and active session
The extension communicates exclusively with the SHK portal (https://shk-einkauf.com). For this, it uses your existing sign-in to the portal (session cookie). Without an active portal session, it does not retrieve any credentials. With every retrieval, the portal checks your session and whether the account belongs to you.
The extension exchanges the following with the portal:
- the list of your accounts without usernames and passwords (section 5),
- individual credentials for filling in, copying and auto-login (section 8),
- the query whether auto-login is enabled in the portal and which version of the information applies,
- new or changed accounts with a set-up sign-in flow, but only after your confirmation (section 6),
- reading and deleting a set-up sign-in flow.
So that the portal can show a notice about the extension, the extension sets a technical marker (whether it is installed or activated) exclusively on pages of the portal. Other websites cannot detect the extension through it.
5. Local matching of the website address
After activation, the extension loads a list of your accounts from the portal (website index). For each account, the list contains a label, the website address, technical status information and a version identifier. It contains no usernames and no passwords.
The list is stored unencrypted in the extension's storage on your device. It is reloaded when the browser starts, when you open the extension menu, when you visit the portal, when you start a setup, after saving and every 30 minutes. If the extension detects that your portal session has ended, it deletes the list.
When you open an HTTPS website, the extension compares the address of the page with this list exclusively on your device. The addresses of the websites you visit are not sent to the portal or to third parties for this purpose.
6. Setup (recording) of sign-in flows
A setup starts only when you explicitly choose "Set up account" or "Set up auto-login" in the extension menu. The extension then reloads the page; data already entered on the page is lost. You then sign in once yourself.
During setup, the extension observes on this page your input into username and password fields as well as your clicks on buttons and form submissions up to the sign-in. For each element involved, it remembers narrowly limited characteristics, for example the element type, field name, identifier, label or accessible name (at most 80 characters per characteristic). In particular, the sign-in flow does not store: other page content, HTML, screenshots, cookies, address parts with path or parameters and characteristics that contain your username.
During setup, the username and password are held only briefly in the extension's memory (section 8.3). After submission, a confirmation page opens. Only when you confirm there are the credentials and the sign-in flow sent to the portal and stored:
- Username, password and the sign-in flow with the element characteristics are stored encrypted in the portal.
- The label and website address of the account are stored unencrypted in the portal for display and assignment. The address of the sign-in page is suggested as the website address; you can change it on the confirmation page.
The portal checks the sign-in flow only technically (structure, version, size and website address) and does not evaluate the content of the element characteristics. If you cancel the setup or decline saving, nothing is stored.
7. Auto-login: automatic filling in and automatic clicks
Auto-login starts only when you deliberately click an auto-login link in the portal and auto-login is switched on in the extension and enabled in the portal. The portal redirects you to the website and passes a signed proof that is valid for at most 60 seconds. It is bound to this account and to the exact target address.
The extension verifies the proof on your device, loads the set-up sign-in flow from the portal and recognizes the set-up fields and buttons on the website. Then it:
- automatically fills in the username and password; each value is retrieved individually and only immediately before filling in (section 8.1),
- automatically clicks the set-up buttons, that is, where applicable, a button that opens the sign-in area, a button that continues to the password step and the sign-in button, each exactly once,
- thereby triggers submission of the sign-in form, even across several pages of the same website.
The extension never gives consent on your behalf. It does not set or change checkboxes, radio buttons or selection lists and does not accept cookies, terms of use, tracking or newsletters. If it detects such consent already given at the button or in the form, it stops. If it cannot recognize an element unambiguously or the address changes to a different website, it also stops without any further action.
Remaining risks
- No success detection: The extension does not detect whether the sign-in was successful. "Done" only means that submission was triggered.
- Account switch: If someone is already signed in on the website, auto-login may trigger another sign-in or an account switch.
- Changed websites: If a website changes the meaning of a button without changing its characteristics, the extension cannot detect this.
- Reuse of the link: An auto-login link is valid only briefly, but can be used again in another tab during this time.
8. Handling of credentials
In the extension, credentials are never stored permanently, never logged and never sent anywhere other than to the portal and to the website you opened. Before a value is retrieved, the extension checks that the specific target field is a visible, enabled and permitted username or password field. There are exactly three situations in which credentials are briefly present in the extension.
8.1 Retrieval immediately before filling in
When filling in with a click and during auto-login, the extension retrieves each value individually from the portal, holds it only in memory and discards it immediately after filling in. Filling in with a click never submits automatically; you trigger the sign-in yourself.
During auto-login, the extension sends the signed proof from section 7 and the current address of the opened page to the portal with every retrieval. The portal compares the address only with the target address of the proof and neither stores nor logs it.
8.2 Copying to the clipboard
You copy the username and password with separate clicks. After the password has been copied, the extension holds a comparison value for at most 30 seconds in session-bound storage, which is cleared when the browser closes at the latest. After 30 seconds, it clears the clipboard if it still contains exactly the copied password, and deletes the comparison value.
For this, the extension needs the permissions to read and write the clipboard (section 11). Remaining risk: until the clipboard is cleared, other programs can read it. The extension cannot influence a clipboard history, synchronization between devices or copies made by other programs.
8.3 Setup and confirmed saving
During a setup (section 6), the username and password are held only in the extension's memory, bound to the tab and the website, for at most five minutes. After the sign-in has been submitted, they are kept available for confirmation for at most 60 seconds. If the setup times out or the recording fails, you can save only the credentials without a sign-in flow within these 60 seconds. They are deleted immediately on cancellation, rejection, closing of the tab, a change to a different website or the end of the portal session. They are sent only after your confirmation.
9. Page content stays on your device
Detecting fields and buttons, checking for consent and recognizing set-up elements take place exclusively on your device. Content of the websites you visit is not sent to third parties and not logged. Only the element characteristics of a setup you confirmed (section 6) and, during auto-login, the current page address as proof (section 8.1) reach the portal.
10. Storage in the browser and diagnostic mode
On your device, the extension stores permanently (until uninstallation):
- settings, activation and the status of the introduction page,
- the website index without usernames and passwords (section 5),
- the setting of the diagnostic mode.
Session-bound (deleted when the browser closes at the latest, much of it considerably earlier):
- the security token of the portal session and a non-reversible identifier of the session state,
- the status of running processes per tab, including the element characteristics during a setup or an auto-login,
- a non-reversible identifier of auto-login links already used,
- the chosen account selection (at most ten minutes),
- the clipboard comparison value (at most 30 seconds),
- the credentials for confirming a setup (at most 60 seconds).
Logs of the extension contain only general technical states and times, but no credentials, addresses, page content or account identifiers.
The diagnostic mode is switched off by default. When switched on, it shows additional general technical states in the extension menu. It does not collect, store or export credentials, addresses, page content, element characteristics or identifiers.
11. Browser permissions
- Access to all websites: local address matching, filling in, setup and auto-login on the websites of your accounts; marker on pages of the portal.
storage: settings, website index and session-bound states (section 10).tabs: determining the address of the open tab for local matching, assigning processes to the respective tab, opening the extension pages and reloading when a setup starts.alarms: reloading the website index every 30 minutes.clipboardWrite: copying the username and password when you click.clipboardRead: checking after 30 seconds whether the clipboard still contains the copied password.offscreen: invisible helper document of the extension for this check.
The extension is active on all websites from the start of page loading so that it can detect an auto-login link and remove its proof from the address before scripts of the website read it. Without activation, setup or auto-login, it performs no action on other websites. It does not request a permission for browser notifications.
12. Recipients
The extension sends data exclusively to the SHK portal. There is no transfer to analysis, advertising or AI services. The extension enters your credentials only into the website you opened.
Service providers of the portal: see https://shk-einkauf.com/datenschutzerklaerung/
13. Storage period and deletion
- In the portal: Accounts and sign-in flows remain stored until you delete them in the portal. You can also delete a sign-in flow in the extension menu; the account is then retained.
- On your device: Session-bound data is deleted after the stated periods, at the latest when the browser closes. The browser deletes permanent data when the extension is uninstalled. In addition, the website index is deleted when the portal session ends.
14. Transparency
The source code of the extension is viewable and is built without minification. During the beta phase, the extension is distributed as a package directly to the test group; for general availability, an unlisted publication in the Chrome Web Store is planned.
If the purpose, processed data, automatic actions, permissions or essential risks change, the extension informs you again after an update. Auto-login then remains switched off until you confirm the new information.
15. Your rights
Under the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can also lodge a complaint with a data protection supervisory authority.
Contact for data protection requests: see https://shk-einkauf.com/datenschutzerklaerung/
Competent supervisory authority: see https://shk-einkauf.com/datenschutzerklaerung/
