Privacy notice
Translation for convenience; the German version is binding.
Last updated:
This notice covers the website luminare.tech and e-mail sent to addresses at luminare.tech. It explains, as Article 13 of the General Data Protection Regulation (GDPR) requires, which personal data is processed.
In short
- This website sets no cookies, uses no browser storage and embeds no analytics or tracking tools.
- Every file, including the font, comes from this server. Your browser makes no requests to other providers when you visit.
- Like every web server, the server writes requests to log files. The IP addresses in the website’s log files are shortened after at most 7 days, and the log files are deleted after at most 5 weeks.
- Every night the server compiles access statistics (AWStats) from the log files. Their database holds the full IP addresses of visitors and is not deleted automatically (section 3).
- If you send an e-mail, it is processed so that you can be answered.
1. Controller
The controller is Paul Pasaurek. The place of residence is given in the legal disclosure. For privacy questions, please write to privacy@luminare.tech. No data protection officer has been appointed, because there is no obligation to do so.
2. Hosting
The website and the mailboxes are on a server that Paul Pasaurek rents from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and administers himself. The server is located in a Hetzner data centre in Nuremberg, Germany. Hetzner acts as a processor under Article 28 GDPR; a data processing agreement has been concluded. The data is stored only on this server and in the backups (section 7), both within the European Union. For the spam check of incoming e-mail, see section 6.
3. Visiting the website, server log files and access statistics
Each time a page or file is requested, the web server automatically stores:
- the IP address of the requesting device,
- the date and time,
- the requested address (URL) and the request method,
- the HTTP status code and the amount of data sent,
- the previously visited page (referrer), if your browser sends it,
- the identifier of your browser and operating system (user agent).
On errors, the server also writes an entry with the IP address, the time and the error message to an error log.
Purpose: to deliver the website, keep it secure and stable, find errors, and detect and fend off attacks.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is the secure and working operation of the website.
Retention: the log files are rotated weekly. At rotation, IPv4 addresses are cut to their first three blocks and IPv6 addresses to their first three groups. Full IP addresses are therefore kept for at most 7 days. Rotated log files are deleted after another 4 weeks. Requests over unencrypted HTTP, which the server redirects to HTTPS, are logged with the same details in a general access log; the same periods apply.
Connection errors that the server cannot assign to a website (for example during encryption) are logged with the full IP address in a general error log, which is deleted after at most 15 days.
Access statistics
Every night, and before each rotation of the log files, the server administration software (KeyHelp) compiles access statistics from the access logs with the program AWStats. It reads the log files before the IP addresses in them are shortened. For each calendar month, the statistics database stores:
- for each requesting IP address, in full: the number of pages and files requested, the amount of data sent and the time of the last visit,
- totals by day and hour, by browser and operating system, by page requested, previously visited page (referrer) and search term,
- addresses that were not found (error 404) with the page visited before, and recognised search engine robots.
The statistics can only be viewed after logging in to the server administration and show no list of IP addresses. The data is not passed on to third parties.
Purpose: to see how often which pages are requested and where links lead nowhere.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is improving the operation and the content of the website on the basis of these figures.
Retention: the server administration does not delete the statistics database automatically. It is kept until it is deleted by hand.
4. No cookies, no tracking, no third-party content
This website sets no cookies and uses neither the browser’s local storage nor similar techniques. Your browser stores only what is technically needed: copies of the files in its cache and the instruction to use only HTTPS for this site for one year (HSTS). There are no analytics or tracking tools in the browser, no social media plugins, no embedded videos or maps and no contact forms. The access statistics (section 3) only evaluate the server’s log files. The Sora font is served from this server.
5. Links to other websites
The website contains links, for example to GitHub and to the personal website of Paul Pasaurek. Your browser connects to another website only when you click such a link. That website’s privacy notice then applies.
6. Contact by e-mail
If you write to an address at luminare.tech, for example hello@luminare.tech, security@luminare.tech or privacy@luminare.tech, your e-mail address, your name (if given), the content of your message and technical details such as the time and the sending and receiving mail servers are processed to answer your enquiry. All addresses deliver to the same mailbox on the server named above. Incoming e-mail is checked there automatically for spam and malware.
The mail server logs the sender and recipient addresses, the sending server’s IP address, the time and the delivery result for each e-mail; these logs are deleted after at most 5 weeks. The spam check keeps sender, recipient, subject and result for the last 1,000 e-mails received by the server. It compares the sending server’s IP address and checksums (hashes) of parts of the message with public spam databases; the content itself is not sent.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in answering enquiries and in protecting the mail server from spam and malware).
Retention: as long as needed to handle your enquiry and possible follow-up questions. After that, the correspondence is deleted unless a legal retention obligation applies.
7. Backups
The server is backed up automatically every night at 04:00. The backups are stored in a Storage Box of Hetzner Online GmbH within the European Union; Hetzner acts as a processor for them as well, and the data processing agreement has been concluded. The backups can contain any of the data described in this notice that is stored on the server at the time of the backup, such as e-mail, log files and statistics data.
Purpose and legal basis: to be able to restore data after an outage, an error or an attack; Article 6(1)(f) GDPR.
Retention: after each backup, the backup software deletes older backup versions according to the configured rotation scheme. Only a limited number of the most recent versions is kept, as many as are needed for a restore. Data deleted on the server therefore remains in the backups until the last backup version that contains it has been deleted in this way.
8. Name resolution (DNS)
Name resolution for luminare.tech uses Cloudflare’s name servers. These queries are usually made by your internet provider’s DNS resolver, not by your browser. The website itself is requested directly from the server named above, not through Cloudflare.
9. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). Please write to privacy@luminare.tech.
Right to object (Article 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (sections 3, 6 and 7), informally to privacy@luminare.tech.
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.
10. Obligation to provide data, automated decisions
You are not obliged to provide any data. Without the technically necessary connection data, however, the website cannot be delivered, and without your e-mail address no reply is possible. There is no automated decision-making, including profiling.