Privacy, accessibility and CSP 

Privacy (DSGVO/GDPR) 

  • Neither the extension nor the embedded charts set cookies or track visitors.
  • The chart is loaded from klimadashboard.de/.at/.org (hosted in the EU). As with any embedded content, the visitor's browser transmits its IP address to Klimadashboard.
  • For sites that want consent first, enable Load on click per element or globally (consent). The chart is then only requested after the visitor clicks the button; the notice links to the privacy policy (privacyUrl).
  • The TYPO3 backend fetches the chart and region lists from the public Klimadashboard API server-side; no visitor or editor data is sent.

Accessibility (WCAG 2.1 AA) 

  • Each iframe gets the chart title as accessible name (title) and the chart's language (lang).
  • The charts provide text alternatives and a table view.
  • The click-to-load button is keyboard-operable and moves focus to the chart after loading; colours meet the AA contrast ratio.

Content Security Policy 

On TYPO3 v12 and later, the extension adds frame-src for the configured Klimadashboard hosts to the frontend policy (Configuration/ContentSecurityPolicies.php). The resize script is a local file, so script-src 'self' is sufficient. For TYPO3 v11 see Installation.