Privacy.
Everything this site processes is listed below: what it is, why, on what legal basis, who else sees it and how long it is kept. There is nothing that is not on this page.
atopos GmbH Managing director: Tobias Polly Puch 8a, 3830 Puch, Austria E-mail: tobias@atopos.io No data protection officer is appointed; requests are handled by the controller directly.
IP address, user agent, the page requested, the time it was requested.
- Delivering the site and keeping it up under attack.
- Art 6(1)(f) GDPR – our legitimate interest in an operable, defensible site.
- Hetzner Online GmbH, Germany, as our processor. The servers are in the EU and the logs do not leave it.
- 30 days, then deleted.
Reading statistics on blog.atopos.io: which posts are read and how, where readers come from, the kind of device, and an approximate location derived from the IP address. No cookies, and nothing is stored in your browser.
- Seeing which posts are actually read, so the blog can show and rank the ones that matter.
- Art 6(1)(f) GDPR – our legitimate interest in knowing how our own publication is read.
- Nobody outside atopos. It runs on our servers at Hetzner Online GmbH in the EU, as our processor. The location lookup uses a database on our own server (IP Geolocation by DB-IP), so no address is sent anywhere.
- Indefinitely. The IP address and the full browser string are deleted after 30 days.
Your name, your address and whatever you write in the message.
- Answering you, and carrying out any work that follows.
- Art 6(1)(b) GDPR where you are asking about an engagement, otherwise Art 6(1)(f) – answering someone who wrote to us.
- Microsoft Ireland Operations Ltd, as our processor for the mailbox. Microsoft may process on servers outside the EU under the EU–US Data Privacy Framework and standard contractual clauses.
- As long as the correspondence is live, and up to seven years where Austrian bookkeeping law requires it (§132 BAO).
A cookie-set identifier, the pages you open, and an approximate location derived from your IP address. This is a per-browser identifier, so it is personal data even though we never see your name.
- Counting visits and seeing which pages are actually read.
- Art 6(1)(a) GDPR – your consent. Nothing is loaded before you give it, and you can withdraw it at any time under Cookie settings, with effect for the future.
- Google Ireland Ltd as our processor, with transfer to Google LLC in the United States under the EU–US Data Privacy Framework and standard contractual clauses.
- Up to 14 months in Google's reports; the cookies themselves expire after two years at the latest.
One cookie remembers the choice you made about the others – without it the banner would ask on every visit (Art 6(1)(f)). Analytics cookies are set only once you have consented; withdrawing consent under Cookie settings stops them being set again.
- Access – a copy of what is held about you (Art 15)
- Rectification and erasure (Art 16, 17)
- Restriction and objection (Art 18, 21)
- Data portability (Art 20)
- Withdrawal of consent at any time, without affecting what was lawful before it (Art 7(3))
You can complain to the Austrian supervisory authority at any time: Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.
For any of the above, write to tobias@atopos.io. We answer within 30 days, as the GDPR requires.