Privacy policy

We have not appointed a data protection officer; we are not required to by law.

• No access logs for the website. We do not log which pages you view.
• General server log. Requests that we redirect (for example from http to https) or that cannot be assigned to any of our sites are logged with a shortened IP address only: for IPv4 the first two of four blocks are kept, for IPv6 the first two of eight. We also log the time, request, status code, amount of data, user agent and referrer. We do not combine these entries with any other data.
• Errors, blocks and logins. For errors, for rejected requests (for example when a very large number of requests arrives in a short time) and for login attempts on our services, we store the full IP address. Repeated failed logins and a very large number of requests in a short time lead to a temporary block of that address. This serves solely to fend off attacks.
• Retention. We delete all logs containing IP addresses after 14 days. They are not part of our backups.
• Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of our website and services.

If you have not made a choice, the theme follows the time of day in Austria, where we work: light by day, dark at night; the time comes from our server. If your device is set to a dark theme, your browser shows the dark version of its own accord. We do not read anything from your device for this, nor store anything on it – the only thing read is an entry you create yourself using the switch (see below).

If you explicitly choose a light or dark theme using the switch, your browser remembers this choice in its local storage (localStorage, entry “gp-theme”), together with the start of the current day or night period in Austria. Your choice applies until the next change between day and night; after that, we remove the entry the next time you open a page, and the site returns to the theme it shows without your choice. When you click, the site works out in your browser which theme is currently shown. If you switch back before then to the theme the site shows without your choice, we remove the entry straight away; you can also delete it in your browser at any time. It stays on your device and is not sent to us. Nothing is stored without your click. The legal basis is § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021): storage is strictly necessary to provide the service you have explicitly requested.

Our technical services set no cookies either unless you sign in. The software of our Git server keeps the address of the page currently displayed in your browser’s session storage (sessionStorage) so that back navigation works. It stays on your device and is deleted as soon as you close the tab. The legal basis is § 165(3) TKG 2021.

We delete your message once your enquiry has been dealt with, unless statutory retention obligations require longer storage: we keep business correspondence that is relevant for tax purposes for seven years from the end of the calendar year (Art. 6(1)(c) GDPR in conjunction with § 132 of the Austrian Federal Fiscal Code, BAO).

Our email service is Proton (Proton AG, Switzerland). According to Proton, the data is stored on Proton's own servers in Switzerland, Germany or Norway. The European Commission has found that Switzerland ensures an adequate level of data protection (adequacy decision); Norway is part of the European Economic Area (EEA), where the GDPR applies.

These providers process data only on our behalf and on the basis of a contract under Art. 28 GDPR.

Backups: We back up our servers daily. The backups are encrypted before transfer and stored with Hetzner in Helsinki, Finland (EU); we keep a further, likewise encrypted copy offline. The backups contain no server logs and no data of website visitors. Whatever we delete disappears from all backups of our servers within six months at the latest.

We do not transfer our visitors' data to countries outside the EEA (EU, Iceland, Liechtenstein, Norway) – except emails to us: Proton is based in Switzerland and may also store them there (see above).

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR; Art. 21 GDPR).

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.