Privacy policy

Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

For any privacy question, just send me an email.

Hosting and server log files

This website runs on a virtual private server that I rent from Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany (contabo.com). The server is located in Contabo's EU region, so your data is processed inside the EU. I administer the server myself; Contabo provides the hardware and the network and processes the data only on my behalf under a data processing agreement (Art. 28 GDPR). Contabo's own privacy policy is at contabo.com/en/legal/privacy.

Every time a page is requested, the web server automatically writes a log entry: your IP address, date and time, the requested address, the referring page, the HTTP status code, the amount of data transferred and your browser's user agent. This is needed to deliver the website securely and to detect errors and attacks. The legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The log files and the server's system log are deleted automatically after 14 days.

The online mode of the Dragon Voyage game also runs on this server. While you play online, a relay passes the player name you choose, your colour and your ship's position to the other players online at that moment. None of this is stored: once you leave, it is gone. The system log only records that a random session ID joined or left – never your player name. The legal basis is my legitimate interest in offering the multiplayer game you choose to join (Art. 6(1)(f) GDPR).

Cookies and local storage (necessary)

A few small pieces of information are stored in your browser because they are strictly necessary for features you use yourself. They don't need consent (§ 165(3) TKG 2021) and never leave your device – except the language cookie, which is only sent to this website's own server:

• bc_pick (cookie, 1 year): the language you picked in the language switcher, so balazscsorba.at doesn't switch you back to German.
• bc-consent (local storage): your choice in the cookie banner and when you made it.
• bc-theme (local storage): light or dark mode.
• bc-motion (local storage): whether you paused the animations with the “Pause animations” button.
• bc-likes (local storage): how often you clicked the heart in the footer.
• bc-tetris-highscore (local storage): your high score in the hidden console game.

This website also uses a service worker and your browser's Cache Storage to keep copies of its pages, scripts and images on your device, so it loads faster and works offline. No personal data is stored there, and you can remove it at any time by clearing this site's data in your browser.

You can delete them at any time in your browser settings.

Google Analytics (only with your consent)

Only if you choose “Analytics only” or “Accept all” in the cookie banner does this website use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Before that, no connection to Google is made at all.

Google Analytics helps me understand how the website is used – for example which pages are read and for how long, on which kind of device and roughly from which country – so I can improve it. For this, the cookies _ga and _ga_9WM1TQG2PT are set, which store a random, pseudonymous identifier for up to 2 years. GA4 does not log or store IP addresses. Google keeps the analytics data for 14 months.

Only if you choose “Accept all”, Google signals and the advertising consent signals are switched on as well: for visitors who are signed in to a Google account and have allowed ad personalisation there, Google links the visit to that account, so I can see aggregated reports on age, gender, interests and use across devices. I only see aggregated reports that never identify individual people, and I don't run ads on this site; Google may use this data under its own terms, including for advertising. With “Analytics only”, Google signals and the advertising signals stay off. You can switch between the two levels at any time via “Cookie settings” in the footer.

The data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw it at any time with effect for the future via “Cookie settings” in the footer of every page; the Google Analytics cookies are then deleted. More in Google’s privacy policy: policies.google.com/privacy.

Contacting me by email

If you send me an email, I use your email address and the content of your message only to reply and, where relevant, to prepare a possible collaboration (Art. 6(1)(b) and (f) GDPR). I delete the correspondence once it is no longer needed, unless legal retention obligations apply. My emails are handled by Zoho Mail (Zoho Corporation); the data is processed in data centres in the USA.

If you use the contact form, your name, email address, optional company, topic and message are sent over an encrypted connection to a small service on my server, which forwards them as an email to me and stores nothing. To keep spam out without third-party services, your browser solves a small computing task; your IP address is used only briefly in memory to limit repeated submissions and appears in the email only as a one-way hash. Legal basis and deletion are the same as for emails.

External links and fonts

All fonts, images and scripts of this website are served from its own server – there are no third-party fonts, embedded content, social media plugins or tracking pixels. Links to other websites (for example LinkedIn or client websites) are ordinary links: data is only transferred to them once you click, and their own privacy policies apply there.

Your rights

Under the GDPR you have the right to:

• access your data (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3))

To exercise them, just send me an email. If you believe the processing of your data violates data protection law, you can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.