Privacy policy

This policy applies to the website chalkaholics-climbing.com. The web application at app.chalkaholics-climbing.com processes account and route data and therefore has its own privacy policy, available there.

This is a translation of the German original. In case of doubt, the German version is the authoritative one.

Controller

Christian Karner 1230 Vienna, Austria Email: christian.karwork@gmail.com

No data protection officer has been appointed; the conditions of Art 37 GDPR are not met.

Principle

This website is built to work without registration, without a user account and without passing data to advertising networks. Only what is technically necessary for operation is collected — anything beyond that happens exclusively with your express consent.

Visiting the website: server log files

On every request your browser transmits technical data which the server logs:

• IP address of the requesting device
• date and time of access
• address requested and volume of data transferred
• HTTP status code
• referring page (referrer), where transmitted
• browser and operating system identifier (user agent)

Purpose: delivering the page, detecting and warding off attacks, and narrowing down technical faults.

Legal basis: Art 6(1)(f) GDPR. The legitimate interest lies in the secure and trouble-free operation of the website.

Retention period: 14 days. After that the logs are deleted automatically. Excepted are entries needed to investigate a specific security incident.

These data are not combined with any other data source.

Hosting

The website is operated by:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Hetzner processes the data named above exclusively on our instructions and on our behalf. The basis is a data processing agreement under Art 28 GDPR. The server is located in a data centre within the European Union; hosting involves no transfer to a third country.

Storage on your device

This website sets no cookies that are not required for operation unless you have consented.

The only thing stored is your decision on the cookie notice. It sits in your browser's local storage (localStorage) under the key chalkaholics.consent and records whether you consented to analytics, when that was and which version of the notice applied. This entry never leaves your device.

Purpose: recording your decision and keeping it in effect, so that you are not asked again on every page view.

Legal basis: Art 6(1)(c) GDPR in conjunction with the obligation to be able to demonstrate consent given or refused. The storage itself requires no consent under § 165(3) of the Austrian Telecommunications Act, because it is strictly necessary for the service you expressly requested.

Retention period: until you change it via “Cookie settings” in the footer or clear your browser's local storage.

Details are set out in the cookie policy.

Audience measurement with Google Analytics 4

Only after your consent. Without consent the script is not loaded, no cookies are set and no transfer to Google takes place at all.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland may pass data on to Google LLC in the United States.

Purpose: analysing which content is read, by what routes visitors reach the site and where they drop off. From that we work out which content should be expanded.

Data processed: truncated IP address, details of device and browser, approximate location at country or city level, pages viewed, time spent, referring page, and a randomly generated identifier used to recognise your browser.

Legal basis: Art 6(1)(a) GDPR — your consent. For storing and reading information on your device additionally § 165(3) of the Austrian Telecommunications Act.

Transfer to a third country: processing in the United States cannot be ruled out. Google relies here on the European Commission's standard contractual clauses and is certified under the EU-US Data Privacy Framework. It should still be pointed out that, in the assessment of the Court of Justice of the European Union, the level of protection in the United States does not match the European one in every respect, and access by authorities there cannot be completely ruled out.

Retention period: according to the retention setting of the Google Analytics property, at most 14 months.

Withdrawal: you can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. On withdrawal, the cookies set by Google Analytics are deleted. The lawfulness of processing carried out up to that point is unaffected.

Contact and feedback form

When you write to us using a form, we process the details you enter.

Contact form: name, email address and message. Feedback form: category, priority, message and — optionally — your email address for follow-up questions.

The details are delivered by email to the controller's mailbox. They are not stored in a database on the web server.

Delivery provider: we use Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA) to deliver these emails. Resend processes the data you enter on our instructions and on our behalf; the basis is a data processing agreement under Art 28 GDPR.

As Resend is based in the United States, this involves a transfer to a third country. It is based on the European Commission's standard contractual clauses. It should be pointed out that, in the assessment of the Court of Justice of the European Union, the level of data protection in the United States does not match the European one in every respect, and access by authorities there cannot be completely ruled out.

If you want to avoid this, write to us directly at the email address given above instead of using the form.

Purpose: handling and answering your request, and improving the application.

Legal basis: Art 6(1)(b) GDPR where your request concerns an existing or prospective use relationship; otherwise Art 6(1)(f) GDPR based on our legitimate interest in answering enquiries. Providing an email address in the feedback form is based on Art 6(1)(a) GDPR.

Retention period: until your request has been settled and no further questions are to be expected, at most six months. Statutory retention obligations are unaffected.

Spam protection: the forms contain a field invisible to you that only automated programs fill in. In addition, the number of submissions per IP address is limited for a short period. A service such as Google reCAPTCHA is deliberately not used, because it would transfer further data to third parties.

Registering interest in the iOS app

If you put your name down to be notified when the iOS app is released, we process your email address exclusively for this one purpose.

Legal basis: Art 6(1)(a) GDPR — your consent.

Retention period: until the notification has been sent, and at most until you withdraw your consent. After sending, the address is deleted. No newsletter beyond that is sent.

Recipients of your data

Beyond the hosting provider named above, the delivery provider for the forms and — after consent — Google, your data are not passed on to third parties. There is no disclosure for advertising purposes and no sale of data.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art 22 GDPR.

Your rights

You have the following rights vis-à-vis the controller:

• Access to whether and which data about you are processed (Art 15)
• Rectification of inaccurate data (Art 16)
• Erasure, unless a retention obligation stands in the way (Art 17)
• Restriction of processing (Art 18)
• Data portability in a commonly used format (Art 20)
• Objection to processing based on a legitimate interest (Art 21)
• Withdrawal of consent with effect for the future (Art 7(3))

An informal message to the email address given above is enough to exercise them.

Right to lodge a complaint

If you believe that the processing of your data infringes the General Data Protection Regulation, you can lodge a complaint with a supervisory authority. The competent one is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Vienna Telephone: +43 1 52 152-0 Email: dsb@dsb.gv.at www.dsb.gv.at

Changes

This policy is adjusted as soon as the actual processing changes — for example because a service is added or dropped. The date given above shows the version in effect.