Privacy

Controller

I am the controller within the meaning of the GDPR, as a private individual. There is no data protection officer, because this site does not come close to the thresholds that would require one.

Server logs

When you open a page, your browser sends data that the web server writes to a log file. This happens on every request and cannot be switched off without switching off the server. It is the only processing on this site that runs without your consent.

• Recorded: IP address, date and time, the address requested, the HTTP status code, the amount of data transferred, the referring page and the browser identification.
• Purpose: serving the page, finding faults, and detecting and stopping attacks.
• Legal basis: Art. 6 (1) (f) GDPR. The legitimate interest is a server that stays up and is not abused.
• Retention: the logs live in the container that serves the site. It is rebuilt and replaced on every deployment, at least once a night, and the logs go with it. As a rule an entry therefore does not exist for longer than a day.
• This data is not combined with any other source, and no profile is built from it.

Hosting

The site runs on a server at OVHcloud. The provider processes the data above on my behalf, as a processor under Art. 28 GDPR, and may not use it for any purpose of its own.

Web analytics with Plerdy

Plerdy shows me which posts get read, how far people scroll and what they click. It runs only with your consent: without it the script is never put into the page, nothing is stored on your device, and Plerdy never learns that you exist.

• Recorded: clicks, scroll depth, pages opened and time spent, plus technical details about your browser, device and screen size. Because your browser loads the script from Plerdy directly, Plerdy also sees your IP address.
• Stored: cookies and local-storage entries that Plerdy itself creates in your browser.
• Legal basis: your consent under Art. 6 (1) (a) GDPR, and for storing and reading information on your device, section 25 (1) TDDDG.
• Third country: Plerdy is operated from Ukraine, for which the European Commission has issued no adequacy decision, and its privacy policy still does not say where the data is stored. The transfer rests on your consent under Art. 49 (1) (a) GDPR. The level of protection there can be lower than under the GDPR, authorities may have easier access, and you may not be able to challenge that effectively.
• Retention: Plerdy's privacy policy states up to five years after the end of the business relationship.

Withdrawing consent

You can change your answer at any time. The "Cookie Settings" link in the footer of every page reopens the banner, with the same switches and the same "Reject All". On withdrawal, whatever Plerdy left in your browser’s storage is deleted and the page reloads, so the script actually stops rather than a stored value merely being rewritten. This does not affect the lawfulness of the processing that happened before.

Cookies and local storage

The site itself sets no cookies. It writes two entries to your browser's local storage. Both stay on your device and are sent to no server.

• marceichner_cookie_consent: your answer to the question in the banner, so it is not asked again on every page. Strictly necessary under section 25 (2) no. 2 TDDDG and therefore not itself subject to consent, because without the entry a no could not be remembered.
• preferred-lang: the language you picked in the switcher, so the entry page sends you straight there next time. Written only if you actively switch.
• Everything beyond these comes from Plerdy, and only if you agreed.

If you write to me

Your email lands in my inbox with everything in it: sender, subject, content. I use it to reply. The legal basis is Art. 6 (1) (b) and (f) GDPR. I keep the message while the matter is live and delete it once it is settled and no retention period says otherwise. There is deliberately no contact form, so that nobody sits between you and my inbox.

What this site does not do

• No newsletter, no mailing list, no tracking pixel in any message.
• No embedded video, maps, fonts or social buttons from other people's servers. The fonts are hosted here.
• No sharing of your data beyond what is named above, no sale, no ad networks.
• No automated decision-making in individual cases and no profiling under Art. 22 GDPR.

Your rights

You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent once given can be withdrawn at any time with effect for the future (Art. 7 (3)). An informal email to the address above is enough, and you do not have to say why.

Complaints

If you think something here is wrong, you can complain to a supervisory authority (Art. 77 GDPR). The competent one is the authority where I live, the Portuguese Comissão Nacional de Proteção de Dados (CNPD), or the authority where you habitually reside. I would rather have an email, but that is your right and not my call.

Changes

If what this site loads changes, this text changes with it. If another tool is added or the purpose changes, your previous answer becomes invalid and you are asked again, rather than an old consent being carried over to something new.