Privacy policy

Controller

The controller for personal data processed on this website is:

Server logs

This site is served by Cloudflare. On every request Cloudflare processes the connection data delivery requires: IP address, time of the request, the path asked for, browser and operating system identifiers, and the referring page where one is sent.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is serving the site, keeping it running, and defending it against attack.

Traffic measurement

Traffic is measured with Cloudflare Web Analytics. The service sets no cookies, stores nothing on your device and reads nothing from it. Nor does it build a recognisable identifier out of your IP address or browser string.

Because nothing is stored on or read from your device, the consent requirement in § 25 TDDDG is not triggered. That is also why this site carries no cookie banner: there would be nothing for you to consent to.

What is recorded is the page view, the path, the referring page, the country and the device type, evaluated in aggregate. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is knowing which pages get read.

Measurement runs on espadat.com only. Preview addresses under workers.dev send nothing.

Contact by email

If you write to me, I process your address and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR where the exchange concerns a prospective contract, and Art. 6(1)(f) otherwise.

WhatsApp

The small-business pages carry a link to WhatsApp. Following it takes you off this site: from that point Meta Platforms Ireland Ltd. processes your data on its own terms, over which I have no influence. The link alone transmits nothing — that happens only once you open it.

Typefaces

The typefaces on this site sit on the same server as the page. No connection is made to Google Fonts or any other font service, and your IP address reaches no third party merely because a typeface loaded.

Recipients and transfers outside the EU

The processor is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — for hosting and traffic measurement, under a processing agreement per Art. 28 GDPR.

Data may therefore be transferred to the United States. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; the Standard Contractual Clauses apply in addition.

There are no other recipients. Your data is not sold and not used for advertising.

Retention

Cloudflare retains connection data and measurements for the periods set out in its own documentation; I keep no copies of my own. Email I keep for as long as the matter requires, and beyond that only where commercial or tax law obliges me to.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on a legitimate interest (Art. 21).

This site asks for no consent, because no processing rests on one. There is accordingly none to withdraw.

An informal email is enough to exercise any of these.

Right to complain

Independently of the above you may complain to a supervisory authority (Art. 77 GDPR). The competent one is:

No automated decision-making

There is no automated decision-making and no profiling. Providing your data is required by neither statute nor contract; without the connection data delivery requires, however, the page cannot be served to you.