Privacy policy

This policy applies to the website chalkaholics-climbing.com. The web application at app.chalkaholics-climbing.com processes account and route data and therefore has its own privacy policy, available there.

This is a translation of the German original. In case of doubt, the German version is the authoritative one.

Controller

Christian Karner 1230 Vienna, Austria Email: christian.karwork@gmail.com

No data protection officer has been appointed; the conditions of Art 37 GDPR are not met.

Principle

This website is built to work without registration, without a user account and without passing data to advertising networks. We collect what is technically necessary for operation, plus privacy-friendly audience measurement on our own server. No cookies are set, and nothing is stored on your device.

Visiting the website: server log files

On every request your browser transmits technical data which the server logs:

• IP address of the requesting device
• date and time of access
• address requested and volume of data transferred
• HTTP status code
• referring page (referrer), where transmitted
• browser and operating system identifier (user agent)

Purpose: delivering the page, detecting and warding off attacks, and narrowing down technical faults.

Legal basis: Art 6(1)(f) GDPR. The legitimate interest lies in the secure and trouble-free operation of the website.

Retention period: 14 days. After that the logs are deleted automatically. Excepted are entries needed to investigate a specific security incident.

These data are not combined with any other data source.

Hosting

The website is operated by:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Hetzner processes the data named above, as well as the audience measurement data, exclusively on our instructions and on our behalf. The basis is a data processing agreement under Art 28 GDPR. The server is located in a data centre within the European Union; hosting involves no transfer to a third country.

Storage on your device

This website sets no cookies and stores nothing else in your browser's storage either, such as localStorage. That is why there is no cookie notice: there is nothing you would need to consent to.

Details are in the cookie policy.

Audience measurement with Umami

To see which content is read and how visitors find the site, we use the open-source software Umami. It runs on our own server at Hetzner (see Hosting) under stats.chalkaholics-climbing.com. The measurement data are not passed to any external provider.

Data processed: the page visited and its title, the referring page (referrer), browser, operating system, device type, screen size, browser language setting and the approximate location (country, region, city) derived from the IP address.

IP address not stored: The IP address itself is not stored. From it, the browser identifier and a random value that changes every month, an encrypted identifier is formed. It allows several visits within one calendar month to be counted as one visitor; after that, recognition is no longer possible. There is no recognition across other websites or devices.

Purpose: analysing which content is used so that we can improve the website in a targeted way.

Legal basis: Art 6(1)(f) GDPR. The legitimate interest lies in a privacy-friendly analysis of usage without disclosure to third parties. Consent under § 165(3) of the Austrian Telecommunications Act is not required, because no information is stored on or read from your device.

Retention period: The measurement data are kept for as long as they are needed to analyse how the website is used.

Objection: You can object to the measurement at any time under Art 21 GDPR. The simplest way to prevent it yourself is to use a content blocker in your browser that blocks stats.chalkaholics-climbing.com — the website keeps working exactly the same.

Contact and feedback form

When you write to us using a form, we process the details you enter.

Contact form: name, email address and message. Feedback form: category, priority, message and — optionally — your email address for follow-up questions.

The details are delivered by email to the controller's mailbox. They are not stored in a database on the web server.

Delivery provider: we use Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA) to deliver these emails. Resend processes the data you enter on our instructions and on our behalf; the basis is a data processing agreement under Art 28 GDPR.

As Resend is based in the United States, this involves a transfer to a third country. It is based on the European Commission's standard contractual clauses. It should be pointed out that, in the assessment of the Court of Justice of the European Union, the level of data protection in the United States does not match the European one in every respect, and access by authorities there cannot be completely ruled out.

If you want to avoid this, write to us directly at the email address given above instead of using the form.

Purpose: handling and answering your request, and improving the application.

Legal basis: Art 6(1)(b) GDPR where your request concerns an existing or prospective use relationship; otherwise Art 6(1)(f) GDPR based on our legitimate interest in answering enquiries. Providing an email address in the feedback form is based on Art 6(1)(a) GDPR.

Retention period: until your request has been settled and no further questions are to be expected, at most six months. Statutory retention obligations are unaffected.

Spam protection: the forms contain a field invisible to you that only automated programs fill in. In addition, the number of submissions per IP address is limited for a short period. A service such as Google reCAPTCHA is deliberately not used, because it would transfer further data to third parties.

Registering interest in the iOS app

If you put your name down to be notified when the iOS app is released, we process your email address exclusively for this one purpose.

Legal basis: Art 6(1)(a) GDPR — your consent.

Retention period: until the notification has been sent, and at most until you withdraw your consent. After sending, the address is deleted. No newsletter beyond that is sent.

Recipients of your data

Beyond the hosting provider named above and the delivery provider for the forms, your data are not passed on to third parties. Audience measurement runs on our own server; no data go to third parties in the process. There is no disclosure for advertising purposes and no sale of data.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art 22 GDPR.

Your rights

You have the following rights vis-à-vis the controller:

• Access to whether and which data about you are processed (Art 15)
• Rectification of inaccurate data (Art 16)
• Erasure, unless a retention obligation stands in the way (Art 17)
• Restriction of processing (Art 18)
• Data portability in a commonly used format (Art 20)
• Objection to processing based on a legitimate interest (Art 21)
• Withdrawal of consent with effect for the future (Art 7(3))

An informal message to the email address given above is enough to exercise them.

Right to lodge a complaint

If you believe that the processing of your data infringes the General Data Protection Regulation, you can lodge a complaint with a supervisory authority. The competent one is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Vienna Telephone: +43 1 52 152-0 Email: dsb@dsb.gv.at www.dsb.gv.at

Changes

This policy is adjusted as soon as the actual processing changes — for example because a service is added or dropped. The date given above shows the version in effect.