Privacy

This policy applies to softwarehansl.at. It describes what the technology actually does, and it changes when the technology changes.

Controller

Manuel Wieser, Softwarehansl
Prinz Solms-Straße 7/1
2500 Baden, Austria
Email: [email protected]
Phone: +43 660 6578122

There is no data protection officer. For a business of this size, Art. 37 GDPR doesn't require one. I answer requests myself.

The most important part first

• No tracking, no analytics tools, no embedded third-party services, no forms. No automated decision-making and no profiling.
• The fonts are served from the same server. Visiting the site opens no connection to Google or any other font service.
• There is one cookie: the delivery service Cloudflare sets a security cookie that detects automated access. It is technically necessary, which is why there is no cookie banner. Details below.
• The connection is encrypted (HTTPS). Unencrypted requests are redirected.
• Nothing is sold, rented out or passed on for advertising purposes.

Hosting and delivery

The files of this site are stored with DigitalOcean (DigitalOcean, LLC, New York, USA) in its Frankfurt am Main data centre. They are delivered through the content delivery network of Cloudflare (Cloudflare, Inc., San Francisco, USA), which DigitalOcean uses as a sub-processor for this. Cloudflare answers your request from the nearest data centre, from Austria usually Vienna.

This unavoidably processes access data: IP address, time, requested address, amount of data transferred, the previously visited page and your browser's identifier. This serves to deliver the site and to defend against attacks. The legal basis is the legitimate interest in a working and secure operation (Art. 6(1)(f) GDPR).

I don't see this access data myself. DigitalOcean provides no access logs for static sites, and I don't analyse anything. How long DigitalOcean and Cloudflare keep the data for operation and security is governed by their terms.

The basis is DigitalOcean's data processing agreement (Art. 28 GDPR), which names Cloudflare as a sub-processor. Both companies are based in the USA, so a transfer there cannot be ruled out. DigitalOcean and Cloudflare are certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Should that decision fall, the EU standard contractual clauses (Art. 46(2)(c) GDPR) contained in both providers' agreements apply.

The __cf_bm cookie

Cloudflare sets the cookie __cf_bm when the site is requested. It contains an identifier Cloudflare uses to tell automated access from humans. It is valid only for softwarehansl.at, cannot be read by scripts on the page and expires 30 minutes after your last request. Its content is encrypted and can only be read by Cloudflare. According to Cloudflare, it is generated separately for each website and is not used for tracking or advertising, so you are not recognised across other sites. I have no access to it.

Because it is strictly necessary for secure operation, it needs no consent (§ 165(3) of the Austrian Telecommunications Act, TKG 2021). The legal basis is Art. 6(1)(f) GDPR. With this hosting it cannot be switched off. You can block or delete it in your browser, and the site still works.

Protected email addresses

Cloudflare obfuscates the email addresses on this site so that programs scanning the web for addresses can't simply harvest them. A small script makes them readable again in your browser. It comes from the same address as the site (softwarehansl.at/cdn-cgi/…), no connection to another server is opened and no data is transferred. Without JavaScript, a placeholder appears instead of the address. In that case you can reach me at +43 660 6578122.

Contact by email or phone

If you write to me or call, I use your details to answer your request. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) or my legitimate interest in replying to you (point (f)). The correspondence is kept as long as the matter requires. If it turns into a job, the statutory retention periods apply, seven years for accounting records (§ 132 of the Austrian Federal Fiscal Code, BAO).

My mailbox is hosted by Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland), on the basis of Google's data processing terms. Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; as a fallback, the EU standard contractual clauses in Google's terms apply.

Recipients

• DigitalOcean: hosting of the site, Frankfurt am Main data centre.
• Cloudflare: delivery of the site, security cookie and protection of the email addresses, on behalf of DigitalOcean.
• Google: email mailbox.

For the operation of this site there are no other recipients. If a request turns into a job, only the bodies the law requires for that are added, such as the tax office.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

The quickest way is an informal email to [email protected]. You can also lodge a complaint with the Austrian Data Protection Authority (Art. 77 GDPR): Barichgasse 40–42, 1030 Vienna, dsb.gv.at. If you live in another EU country, you can also complain to the supervisory authority there.

Right to object

You can object to any processing based on legitimate interests (Art. 6(1)(f) GDPR) on grounds relating to your particular situation (Art. 21(1) GDPR). Here that concerns the access data when the site is requested, the security cookie and the handling of your enquiry. After an objection I no longer process the data, unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal email to [email protected] is enough.