Privacy

1. Controller

Max Hartwig
Innsbruck, Austria
Email: hartwig.max@googlemail.com

2. Website access and server logs

When the website is accessed, the hosting infrastructure may process technical connection data such as IP address, date and time, requested resource, referrer, browser information and operating system. This processing is necessary to deliver the website securely and reliably. The legal basis is the legitimate interest in operating and protecting the website under Article 6(1)(f) GDPR.

The website is hosted on Cloudflare Workers. Provider and processor: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Requests are served from Cloudflare’s global edge network, so the processing location depends on where the visitor connects from; for visitors in Europe this is normally a European edge location. Cloudflare acts as a processor under a data processing addendum incorporating the European Commission’s Standard Contractual Clauses, and is certified under the EU/US Data Privacy Framework.

Request logging (Cloudflare Workers Logs) is enabled for operational diagnostics. Cloudflare retains these entries only for the short period provided by the applicable Workers plan and in no case longer than seven days. They are used only to detect and resolve technical faults and misuse, not to analyse individual visitor behaviour.

3. Contact form and email

When you submit the contact form, the name, email address and message you provide are transmitted to the website server and forwarded as an email to Max Hartwig. The email delivery service Resend processes this information for the purpose of delivering the message. The data is not used for newsletters, advertising or profiling.

The information is processed to respond to your enquiry. Depending on the context, the legal basis is Article 6(1)(b) GDPR for pre-contractual communication or Article 6(1)(f) GDPR for other professional communication. Messages are retained only as long as needed for the enquiry and applicable legal obligations.

Providing this information is not a statutory requirement. However, a name, a valid reply address and the content of the enquiry are required if Max Hartwig is to receive and answer the message. No separate consent is requested because the processing is limited to handling the communication initiated by you and relies on the legal bases stated above.

Cloudflare Turnstile protects the form against automated misuse. The widget loads when the contact section is displayed and may process technical browser and connection data; the submitted verification token and IP address are checked by Cloudflare on the server. This is necessary for the security of the form and is based on the legitimate interest in preventing spam and abuse under Article 6(1)(f) GDPR. Turnstile is not used for advertising or visitor analytics.

4. Cookies, analytics and tracking

The website uses one technically necessary first-party cookie named mh_analytics_consent to remember whether you accepted or rejected optional analytics. It stores the value “granted” or “denied” for up to six months. This storage is required to preserve your choice and is based on the legitimate interest in implementing a reliable consent mechanism under Article 6(1)(f) GDPR and the technically necessary storage exception in Section 165(3) of the Austrian Telecommunications Act 2021.

Google Analytics 4 is used only after you explicitly select “Allow analytics”. Google Analytics may then store host-only first-party cookies such as _ga and _ga_* for no longer than six months to distinguish visits and generate aggregated usage statistics. Information may include viewed pages, approximate location, device and browser information, referrer and interaction timestamps. Google states that Analytics does not log or store individual IP addresses.

The legal basis for optional analytics is your consent under Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021. Advertising storage, advertising user data, ad personalisation and Google Signals are disabled in this implementation. Analytics does not load before consent. You can reject analytics without losing website functionality and change your choice at any time through “Cookie settings” in the footer. Withdrawing consent deletes host-only and domain-scoped Analytics cookies accessible to this website and reloads the page without the Google tag, preventing further collection by this implementation.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may involve affiliated companies and infrastructure outside the EEA. Relevant safeguards may include the EU/US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. Google’s data processing terms are accepted for this property. User- and event-level Analytics data is configured for a retention period of two months; aggregated reporting may remain available for longer.

A link to LinkedIn is a normal external link; data is only transferred to LinkedIn when you follow it.

5. Recipients and international transfers

Technical data is processed by Cloudflare, Inc. as the hosting and Turnstile provider. Contact-form data passes through Cloudflare, is delivered by Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA) as the email delivery processor, and is then held by the email provider used by Max Hartwig. If analytics consent is granted, Google Ireland Limited and its processors receive analytics data.

Cloudflare, Resend and Google are based in or transfer data to the United States. Transfers outside the European Economic Area are based on the European Commission’s Standard Contractual Clauses in the respective data processing agreements and, where the provider participates, on the EU/US Data Privacy Framework. Data processing agreements are in place with Cloudflare and with Resend.

6. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interests. You may also lodge a complaint with a supervisory authority.

For Austria: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, www.dsb.gv.at.

7. Updates

This notice will be updated if the website gains additional analytics features or embeds, a different email delivery service or a different hosting setup.