Privacy policy
Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
- Christoph Barton
- Engerthstraße 56/4/7
- 1200 Wien
- Österreich
- Email: ChristophBarton@gmx.at
Principle
This website works without cookies. There is no cross-site tracking, and no data is passed to advertising networks.
Personal data is only processed when you actively enter it — that is, when you join the waiting list or use the contact form.
Hosting and server logs
This website is operated on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you access the site, Cloudflare processes technically necessary connection data, including your IP address, the time of the request and the browser used. This is required to deliver the site and to protect it against attacks.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation). A data processing agreement is in place with Cloudflare; transfers to the USA are covered by Standard Contractual Clauses.
No separate server log files are kept.
Waiting list (launch newsletter)
If you join the waiting list, the following data is stored:
- your email address
- the language you selected (so the email arrives in the right language)
- the confirmation status (pending or confirmed)
- a random confirmation token
- a hash of your IP address (see below)
- the time of sign-up and of confirmation
Sign-up uses double opt-in: after submitting, you receive an email containing a confirmation link. Consent is only given once you click that link. If you do not click it, no further email will be sent to you.
The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time — via the unsubscribe link in every email, or informally to ChristophBarton@gmx.at. On withdrawal your entry is deleted entirely, not merely flagged as unsubscribed.
Data is stored until you withdraw. Storage is in a Cloudflare D1 database located in the EU.
IP addresses are stored only as hashes
To prevent automated bulk sign-ups, an identifier derived from the requesting IP address is stored with each entry. What is stored is not the IP address itself, but a SHA-256 hash formed with a secret salt. The original IP address cannot be recovered from that value.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
Contact form
If you use the contact form, your email address and your message are forwarded to the mailbox named above in order to answer your enquiry. They are not stored in a database.
The legal basis is Art. 6(1)(b) or (f) GDPR. The message is deleted once your enquiry has been dealt with.
Email delivery
Confirmation and launch emails are sent using Resend (Resend, Inc., USA) as a processor. Your email address is transmitted to Resend for this purpose.
Processing takes place in the eu-west-1 region (Ireland), so your address does not leave the EU for this. As the provider is a US company, any access from the USA is additionally covered by Standard Contractual Clauses.
Your rights
You have the following rights vis-à-vis the controller:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing (Art. 21 GDPR)
- withdrawal of consent with future effect (Art. 7(3) GDPR)
An informal message to ChristophBarton@gmx.at is enough to exercise them.
You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
Changes to this policy
This privacy policy is updated when the processing described here changes. The version published here is the one that applies.