Privacy Policy

Last updated: 26 May 2025

Responsible person

Owner: George Severnyy

Email: georgenorth.mun@gmail.com

Non-Technical Summary: we collect basic usage data, improve performance through analytics, and use cookies for personalization.You can manage your preferences anytime. We never sell your personal information.

Applicable Legal Bases

Legal Bases According to GDPR Below is an overview of the legal bases on which we process personal data in accordance with the GDPR. Please note that in addition to the provisions of the GDPR, national data protection regulations of your country of residence or habitual location may apply. If more specific legal bases are used in certain cases, we will inform you of them in the relevant section of this privacy statement.

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) – The data subject has given their consent to the processing of their personal data for one or more specific purposes.
• Contract performance and pre-contractual requests (Art. 6 para. 1 sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Applicable national laws: In addition to the GDPR, national data protection laws apply in the country where the controller is established.

Regional Laws – California Privacy Rights (CCPA)

Residents of the State of California are entitled to specific privacy rights under the California Consumer Privacy Act (CCPA). These include:

• The right to know what personal information we collect and how we use it.
• The right to request deletion of personal data we hold about you.
• The right to opt out of the sale of your personal information (note: we do not sell personal data).
• The right to non-discrimination for exercising any of these rights.

If you are a California resident and wish to exercise your rights, you may contact us at [your support email] and we will respond in accordance with applicable laws.

Overview of Processing Activities

The following overview summarizes the types of data processed, the purposes of processing, and the categories of data subjects.

Types of data processed:

• Inventory data
• Contact data
• Content data
• Contract data
• Usage data
• Meta, communication and procedural data
• Log data

Categories of data subjects:

• Interested parties
• Communication partners
• Users

The services are directed at adults aged 16 and over. We do not knowingly collect data from children.

Purposes of processing:

• Communication
• Security measures
• Audience measurement
• Tracking
• Audience targeting
• Affiliate tracking
• Organizational and administrative procedures
• Feedback
• Marketing
• User profiling
• Provision of our online services and user-friendliness
• Information technology infrastructure

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include, in particular, securing the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, availability assurance, and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data threats. We also take data protection into account in the development or selection of hardware, software, and processes, according to the principles of privacy by design and by default.

Securing Online Connections via TLS/SSL Encryption Technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the foundation of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between servers), protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transfers comply with the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL, serving as a signal to users that their data is being transmitted securely.

Transfer of Personal Data

In the course of processing personal data, we may disclose or transmit such data to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include service providers responsible for IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and conclude appropriate contracts or agreements with the recipients to protect your data.

Data Transfers Within the Organization: We may transmit personal data to other departments or units within our organization or grant them access to such data. If data is shared for administrative purposes, it is based on our legitimate business and operational interests, or it is necessary for fulfilling our contractual obligations or is based on the consent of the data subject or legal authorization.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union or the European Economic Area) or this occurs in the context of using third-party services or disclosing or transferring data to other persons, entities, or companies (as identified by the provider’s postal address or where the privacy policy explicitly mentions such transfers), this is always done in compliance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized by an adequacy decision of the EU Commission on July 10, 2023, as a secure legal framework. In addition, we have entered into standard contractual clauses with relevant providers that comply with the EU Commission’s requirements and set contractual obligations for protecting your data.

This dual safeguard ensures comprehensive protection of your data: the DPF provides the primary level of protection, while the standard contractual clauses serve as an additional safeguard. Should changes occur within the DPF framework, the standard contractual clauses act as a reliable fallback. This ensures that your data remains adequately protected even in the event of political or legal changes.

For each individual service provider, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. More information about the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce (english only).

For data transfers to other third countries, appropriate safeguards apply, particularly standard contractual clauses, explicit consent, or legally required transfers. Information on third country transfers and applicable adequacy decisions can be found on the website of the European Commission

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consent is withdrawn or there are no further legal grounds for the processing. This applies in cases where the original purpose of processing no longer exists or the data is no longer needed. Exceptions to this rule exist if legal obligations or specific interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax-related reasons, or is necessary for legal defense or to protect the rights of other natural or legal persons, must be appropriately archived.

Our data protection notices include additional information on the retention and deletion of data that apply to specific processing activities.

If multiple retention periods or deletion deadlines are specified, the longest period shall apply.

If no specific date is stated for the beginning of a retention period and it is at least one year in length, it shall automatically begin at the end of the calendar year in which the event that triggers the period occurred. In the case of ongoing contractual relationships where data is stored, the triggering event is usually the termination or other ending of the contract.

Data that is no longer required for its originally intended purpose, but is retained due to legal obligations or other justifiable reasons, is processed solely for those retention-related purposes.

Rights of Data Subjects

As a data subject under the GDPR, you are entitled to various rights, particularly as specified in Articles 15 to 21 of the GDPR:

• Right to Object: You have the right to object, at any time and on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) of the GDPR. This includes any profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling related to such direct marketing.
• Right to Withdraw Consent: You have the right to withdraw previously granted consent at any time.
• Right of Access: You have the right to obtain confirmation as to whether your data is being processed and to access that data along with further information and a copy, as required by law.
• Right to Rectification: You have the right to request the completion or correction of inaccurate personal data.
• Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request the deletion or restriction of processing of your personal data.
• Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller, where technically feasible.
• Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority, especially in the EU member state of your habitual residence, place of work, or place of the alleged violation, if you believe that the processing of your personal data violates the GDPR.

Provision of Online Services and Web Hosting

We process user data to deliver our online services. This includes processing the user’s IP address, which is necessary for transferring website content and features to the user’s browser or device.

Types of Processed Data: Usage data (e.g., page views, click paths, usage frequency and intensity, device and operating system used, interactions); meta, communication, and procedural data (e.g., IP addresses, timestamps, identifiers, participants); log data (e.g., login logs or data access logs).

Categories of Affected Individuals: Users (e.g., website visitors and users of online features).

Purpose of Processing: Provision of the online service and improvement of user experience; infrastructure management (IT systems, servers, etc.).

Data Retention and Deletion: See the section “General Information on Data Storage and Deletion”.

Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR).

Further Notes on Processing Activities, Procedures, and Services

Collection of Access Data and Log Files:

When accessing our online offering, data is automatically logged in the form of so-called “server log files.” These may include:

• The address and name of the retrieved web pages and files
• Date and time of access
• Transferred data volume
• Notification of successful access
• Browser type and version
• User’s operating system
• Referrer URL (the previously visited page)
• IP address and the requesting provider

This log data is processed for the purposes of maintaining server performance and security (e.g., identifying abusive traffic, such as DDoS attacks), and ensuring operational stability.

Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR)

Data Deletion: Log files are generally stored for a maximum of 30 days and then deleted or anonymized, unless further storage is required for evidence purposes.

Use of Cookies

We use cookies and similar technologies to store and access information on users’ devices in order to ensure functionality, security, performance, and user experience across our services. Cookies also help us understand how users interact with our website and support the personalization of content.

Cookies may be set directly by us (first-party cookies) or by third-party providers (third-party cookies), such as analytics platforms or social media integrations. Depending on their purpose and legal classification, some cookies require user consent while others are strictly necessary and do not.

We rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) for non-essential cookies (e.g., analytics, advertising, and social media cookies). Consent is obtained via our cookie banner and may be withdrawn at any time.
• Legitimate interests (Art. 6(1)(f) GDPR) for essential cookies required for the functioning of the site, such as those used to maintain secure sessions or save your preferences.

Cookie storage durations vary depending on their type and purpose:

• Session Cookies are temporary and are deleted when you close your browser.
• Persistent Cookies remain stored on your device for up to two years unless manually deleted or otherwise specified during consent.

You can manage or revoke your cookie preferences at any time by:

• Revisiting the cookie banner;
• Adjusting your browser settings to block or delete cookies;
• Using privacy tools (e.g., Google Analytics Opt-Out plugin).

We also honor Global Privacy Control (GPC) signals where applicable, automatically treating them as opt-out requests.

To ensure transparency, detailed information about each type of cookie, the purposes for which they are used, and how you can control them is provided in our full Cookie Policy.

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (referred to as “publication media”). The data of readers is processed only to the extent necessary for the presentation and interaction between authors and readers or for security purposes. For further information on how visitor data is processed, please refer to the specific sections of this privacy policy.

Types of Data Processed: Inventory data (e.g., full name, address, contact details, customer number, etc.); contact data (e.g., postal and email addresses, phone numbers); content data (e.g., text or image messages and posts, including related metadata); meta-, communication, and procedural data (e.g., IP addresses, timestamps, identifiers, participants); usage data (e.g., page views, click paths, interactions, devices used).

Data Subjects: Users (e.g., website visitors, blog readers).

Purposes of Processing: Feedback (e.g., via forms); provision and improvement of our online services; user interaction and communication; security measures; organizational and administrative purposes.

Retention and Deletion: As described in the section “General Information on Data Storage and Deletion.”

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further Information on Processing Activities, Procedures, and Services

Comments and Posts: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interest. This serves security purposes in case someone leaves unlawful content (e.g., hate speech or prohibited political propaganda). In such cases, we may be legally responsible and need to know the author’s identity.We may also process data for spam prevention based on the same legal grounds. Likewise, during user polls or votes, we may store users’ IP addresses temporarily and use cookies to prevent multiple responses.

Any personal or contact information voluntarily submitted as part of a comment or post will be stored until the user objects to such retention.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR); Consent (Art. 6(1)(a) GDPR), where applicable.

Contact and Inquiry Management

When users contact us (via mail, contact form, email, phone, or social media), or as part of existing user or business relationships, we process the data provided for the purpose of handling and responding to their inquiries.

Types of Data Processed: Inventory data (e.g., full name, address, contact details, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); content data (e.g., text or image messages); usage data and meta data (e.g., IP addresses, timestamps).

Data Subjects: Communication partners.

Purposes of Processing: Communication, handling contact inquiries and business correspondence; feedback via forms; provision of user support and services.

Retention and Deletion: See the section “General Information on Data Storage and Deletion.”

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR); Contract-related or pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further Notes on Processing Activities

Contact Form: If you contact us using a form or by email or any other communication method, we will process the data you provide solely for the purpose of handling your request. This typically includes name, email, contact details, and any additional information you voluntarily include.

Legal Basis: Depending on context — Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract inquiries), or Art. 6(1)(f) GDPR (legitimate interest).

Push Notifications

With the consent of users, we may send so-called “push notifications.” These are messages that appear on users’ screens, devices, or browsers — even when our online service is not actively being used.

To subscribe to push notifications, users must confirm the corresponding browser or device prompt. This consent process is documented and stored. The storage is necessary to recognize whether the user has agreed to receive push notifications. For this purpose, a pseudonymous identifier (so-called “push token”) or the device ID is saved on the user’s device.

Push notifications may be used:

• to fulfill contract-related or service-related obligations (e.g., to provide relevant technical or organizational information related to the use of our services), and/or
• for marketing purposes (e.g., product updates, offers, reminders), provided the user has explicitly consented to receiving promotional notifications.

Users can manage or revoke their consent at any time through the settings of their browser or operating system. Once consent is withdrawn, the push token or device ID is deleted accordingly.

Types of Data Processed: Usage data (e.g., pages viewed, click paths, frequency of use, device types, interactions with content); meta, communication, and procedural data (e.g., IP addresses, timestamps, identifiers).

Data Subjects: Communication partners (e.g., users who opted in to receive notifications).

Purpose of Processing: Communication; providing updates or relevant messages to enhance the user experience.

Retention and Deletion: In accordance with “General Information on Data Storage and Deletion.” Deletion also occurs upon revocation of consent.

Legal Basis: Consent (Art. 6(1)(a) GDPR); Legitimate Interests (Art. 6(1)(f) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also known as audience measurement) is used to assess visitor flows within our online offerings and may include information about user behavior, interests, or demographic characteristics (such as age or gender) in pseudonymized form. This analysis allows us to determine, for example, at what times our services and content are most frequently used, which features perform best, or where improvements are needed.

In addition to analytics, we may use testing and optimization methods, such as A/B testing, to compare and enhance different versions of our content and components.

Unless otherwise stated, these processes may involve the creation of user profiles. Such profiles may include aggregated usage data and technical metadata, which can be stored in the user’s browser or device and later retrieved. Collected information may include data about visited websites and usage behavior, as well as browser types, operating systems, and usage times. If users have provided consent, we or our service providers may access location-related data as well.

We also anonymize user IP addresses. This typically involves truncating the IP address to prevent clear identification of individuals. As a result, neither we nor the providers of these tools can identify users by name. The data is processed pseudonymously for analytical purposes only.

Legal Basis: If user consent is required for the use of analytics services, the legal basis is Article 6(1)(a) of the GDPR. Where no consent is required, processing is based on our legitimate interest in optimizing our services and operations in accordance with Article 6(1)(f) of the GDPR.

Types of Data Processed: This includes usage data (such as visited pages, visit duration, click paths, interaction frequency), device and system information, and metadata (such as IP addresses, timestamps, and identifiers). User profiles may be created and evaluated for analytical purposes.

Categories of Data Subjects: The data subjects are visitors and users of our online services.

Purpose of Processing: The primary goals are to improve user experience, ensure performance and functionality, identify usage patterns, and support ongoing development of our digital offerings.

Data Retention: The collected data is deleted or anonymized in accordance with our data retention policy, as described in the section “General Information on Data Storage and Deletion.” Cookies and comparable technologies may be stored for up to two years unless a shorter period is specified.

Security Measures: IP address anonymization, pseudonymization of user profiles, and separation of identifiers from other personal data are among the technical measures employed.

Further Notes on Processing Activities, Procedures, and Services

Google Analytics:We use Google Analytics to measure and analyze how users interact with our online services, based on a pseudonymous user identification number. This identifier does not contain any direct personal information such as names or email addresses. Its purpose is to assign analytical data to a specific device in order to understand which content users have viewed during a session, what search terms they used, how they interacted with our website, and which referring sources led them to us. Additionally, the time and duration of usage are tracked, along with the user’s technical environment (devices and browsers). Pseudonymous user profiles may be created across multiple devices, and cookies may be used for this purpose.

Google Analytics does not log or store identifiable IP addresses for users in the EU. Instead, the system provides only generalized geographical location data based on truncated IP metadata — such as city (and approximated coordinates), continent, country, region, subcontinent (and IP-based equivalents). IP address queries are executed exclusively on EU-based servers and removed before any transmission to Analytics servers for further processing.

Legal Basis: Consent (Art. 6(1)(a) GDPR)

Data Protection Agreement: Click to read more details

Third-Country Transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs)

Security Measures: IP masking (pseudonymization of IP addresses)

Privacy Policy: Click to read more details

Opt-Out Plugin: Click to read more details

Ad Settings: Click to read more details

More Info: Click to read more details

Affiliate Programs and Affiliate Links

Within our online services, we may include affiliate links or other references (such as search boxes, widgets, or discount codes) to offers and services provided by third parties (collectively referred to as “affiliate links”). If users follow these affiliate links or interact with the linked offers, we may receive a commission or other benefit from the third-party provider (referred to as a “commission”).

In order to track whether users have accessed third-party offers through one of our affiliate links, it is necessary that third-party providers can determine that the user clicked the link within our site. This tracking serves solely for the purpose of commission settlement and is removed once it is no longer required.

For tracking purposes, affiliate links may include technical parameters, which are added directly to the link or stored elsewhere, such as in cookies. These parameters may include the referring website (referrer), the time of access, an online identifier assigned by the affiliate network, the type of link or offer used, and a user-specific online ID.

Legal Basis for Processing: If we ask for the user’s consent to process data via affiliate programs, the legal basis is that consent (Art. 6 para. 1 sentence 1 lit. a GDPR). Otherwise, processing is based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in promoting our services in an efficient, lawful, and user-friendly manner.

Types of Data Processed: This may include transaction data (e.g., transaction ID, item purchased, customer category), usage data (e.g., visited pages, click behavior, visit duration, device/browser info), and metadata (e.g., IP addresses, timestamps, identifiers).

Data Subjects: Interested individuals (e.g., visitors and users of our website who interact with affiliate links).

Purpose of Processing: Affiliate tracking and performance attribution to determine whether a user completed an action that results in commission.

Data Retention and Deletion: Data is deleted in accordance with the section “General Information on Data Storage and Deletion,” unless longer retention is required for billing verification or legal obligations.

Plug-ins and Embedded Features and Content

We integrate functional and content elements into our online services that are retrieved from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include graphics, videos, maps, or other forms of embedded media (hereinafter uniformly referred to as “content”).

The integration of this content always requires that third-party providers process the user’s IP address, as they cannot deliver content to the user’s browser without it. The IP address is therefore necessary to display this content or functionality. We strive to use only those contents where the respective provider uses the IP address solely for the delivery of content. Third-party providers may also use so-called “pixel tags” (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These can be used to analyze visitor traffic, store data in cookies on the user’s device, and obtain technical information such as the browser, operating system, referring websites, visit duration, and user interaction patterns. This information may be combined with data from other sources.

Legal Basis for Processing

If we ask users for their consent to use third-party content, the legal basis is the user’s consent (Art. 6 para. 1 sentence 1 lit. a GDPR). Otherwise, data is processed based on our legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), particularly in providing efficient, economic, and user-friendly services.

Categories of Data Processed

• Usage data such as pages visited, click paths, duration of visits, device types, and browser information
• Meta and communication data, such as IP addresses, timestamps, and identifiers
• Interaction data and tracking information, where applicable

Data Subjects

• Users (e.g., website visitors or users of online services)

Purposes of Processing

• Display and provision of third-party content and functionalities
• Reach measurement (e.g., visitor statistics and analytics)
• Behavioral profiling and marketing segmentation

Retention and Deletion

Data is stored in accordance with our general data retention principles. Cookies and similar identifiers used for these purposes are typically stored for up to two years unless otherwise specified.

Additional Notes on Processing Activities and Providers

Third-Party Software, Scripts, and Frameworks (e.g., jQuery)

We incorporate software into our site that is delivered from the servers of third-party providers (e.g., function libraries or UI components). These providers may collect IP addresses and use them for delivery, security, or performance analytics purposes.

Legal basis: Legitimate interests (Art. 6 para. 1 lit. f GDPR)

X Plug-ins and Content

We embed content from the platform “X” (formerly Twitter), including images, videos, or interactive buttons that allow users to share content.

• Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland
• Legal basis: Legitimate interests (Art. 6 para. 1 lit. f GDPR)
• Privacy Policy
• Settings
• Data Transfer Mechanisms: Standard Contractual Clauses (SCCs), Data Privacy Framework (DPF)
• Data Processing Agreement

YouTube Video Embeds

We embed YouTube videos as part of our content offering.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
• Privacy Policy
• Data Transfer Mechanisms: Data Privacy Framework (DPF), Standard Contractual Clauses
• Opt-out Options:
  • Google Analytics Opt-Out Tool
  • Google Ad Personalization Settings