Privacypolicy.

The controller within the meaning of Article 4(7) GDPR for any personal data processed via this Service is:

Name: [to be filled in]

Address: [to be filled in], Vienna, Austria

Email: [to be filled in]

No Data Protection Officer (DPO) has been appointed because the conditions of Article 37(1) GDPR are not met.

2.1 Server logs. When you visit the Service, the hosting provider automatically records: IP address, request timestamp, requested URL, HTTP status code, referer, browser user-agent string, and approximate geographic region derived from the IP. These data are required to deliver the page and to operate the Service securely.

2.2 Locale preference cookie. The Service sets a single first-party cookie named "NEXT_LOCALE" to remember which language version (en / de) you selected. The cookie contains no identifiers; its sole content is the two-letter language code. Lifetime: 365 days. This cookie is strictly necessary for the user-selected language functionality and is exempt from consent under §165(3) Telekommunikationsgesetz / Article 5(3) ePrivacy Directive.

2.3 Beyond §2.1-2.2 and the consent-based analytics in §2.4, the Service uses no advertising trackers, social-media trackers, embedded fonts that report back, contact forms, comment systems, or user accounts.

2.4 Product analytics (only with your consent). Only if you click "Accept" on the cookie banner does the Service load PostHog, a product-analytics tool, to understand how the Service is used and to improve it. PostHog then processes: the pages you view and your navigation path, your clicks and other interactions with the interface ("autocapture"), an approximate geographic region derived from your IP address, and technical attributes of your device and browser (browser type, operating system, screen size, referring website). For this, PostHog stores first-party cookies (names beginning with "ph_") and entries in your browser's local storage to recognise your browser across page views. If you click "Decline", PostHog is never loaded and no analytics cookies or storage are set. You can change your choice at any time via "Cookie settings" in the footer.

3.1 Server logs are processed for the purpose of delivering the requested content, ensuring the technical operation and security of the Service (defending against attacks, debugging errors). Legal basis: Article 6(1)(f) GDPR (legitimate interest in operating a stable, secure website).

3.2 The locale cookie is processed for the purpose of preserving the user's chosen language across page loads. Legal basis: Article 6(1)(f) GDPR (legitimate interest in providing the requested user experience). No consent is required because the cookie is strictly necessary for a service explicitly requested by the user.

3.3 Product analytics (§2.4) is carried out solely on the basis of your consent. Legal basis: Article 6(1)(a) GDPR (consent) and, for storing and accessing analytics cookies and storage on your device, §165(3) Telekommunikationsgesetz / Article 5(3) ePrivacy Directive. You may withdraw your consent at any time with effect for the future via "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.1 Hosting provider. The Service is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut CA 91789, USA) acting as a data processor under Article 28 GDPR. A Data Processing Addendum is in place. Vercel processes data via servers in multiple regions, including the European Union.

4.2 Product-analytics provider. If you consent (§2.4), analytics are processed by PostHog on its EU Cloud, operated by PostHog, Inc. (2261 Market Street #4008, San Francisco CA 94114, USA), with data stored on servers in the European Union (Frankfurt, Germany). PostHog acts as a data processor under Article 28 GDPR; a Data Processing Agreement is in place. If you do not consent, no data is shared with PostHog.

4.3 No other processors. No advertising network, no other analytics provider, no CDN beyond Vercel's own infrastructure, no email service for transactional mail (there is no contact form), no third-party fonts loaded at runtime (fonts are self-hosted).

5.1 Vercel Inc. is headquartered in the United States. Personal data processed by Vercel may be transferred to or stored in the USA.

5.2 Such transfers are based on Vercel's certification under the EU-US Data Privacy Framework (DPF) and on the Standard Contractual Clauses adopted by the European Commission. A copy of the relevant safeguards can be obtained from the controller (see §1).

5.3 Analytics data (§2.4, §4.2) is stored on PostHog's EU Cloud within the European Union and is not routinely transferred to a third country. To the extent PostHog, Inc. (USA) may access such data for support or maintenance, that transfer is governed by the Standard Contractual Clauses adopted by the European Commission.

6.1 Server logs are retained by the hosting provider for the period set out in Vercel's privacy policy (currently up to 30 days for raw access logs). The controller does not retain server logs separately.

6.2 The locale cookie expires after 365 days or when the user clears their browser cookies, whichever comes first.

6.3 Analytics data collected via PostHog (§2.4) is retained only as long as needed for the analysis purpose or until you withdraw consent, whichever is earlier, and no longer than the retention period configured in PostHog. On withdrawal of consent or on request (§7), the controller deletes the associated analytics data.

Under the GDPR you have the following rights regarding personal data we process about you:

7.1 Right of access (Article 15 GDPR): to obtain confirmation as to whether or not personal data concerning you is being processed and, where this is the case, access to that data and a copy of it.

7.2 Right to rectification (Article 16 GDPR): to have inaccurate personal data corrected and incomplete personal data completed.

7.3 Right to erasure (Article 17 GDPR): to have personal data erased where the conditions of Article 17 are met.

7.4 Right to restriction of processing (Article 18 GDPR).

7.5 Right to data portability (Article 20 GDPR): where processing is based on consent or contract and is carried out by automated means.

7.6 Right to object (Article 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (legitimate interest).

7.7 To exercise any of these rights, contact the controller at the email address in §1. We will respond within one month as required by Article 12(3) GDPR.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Article 77 GDPR).

The competent supervisory authority for the controller is:

Österreichische Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Wien, Austria.

Web: https://www.dsb.gv.at

The Service does not use automated decision-making, including profiling, within the meaning of Article 22 GDPR. No decisions producing legal effects concerning you, or similarly significantly affecting you, are taken on an automated basis.

The Service is not directed at children under 14. Because no personal data beyond what is described in §2 is collected, the Service does not knowingly process data that would require parental consent under Article 8 GDPR or §4(4) Austrian DSG.

11.1 The controller may amend this Privacy Policy to reflect changes in legal requirements or in the way the Service operates. The current version is identified by the Effective Date at the top of this page.

11.2 Material changes that broaden the processing of personal data will be brought to users' attention by a notice on the home page for at least 30 days.