datenschutz
Privacy notice (Datenschutzerklärung) under Art. 13 GDPR (DSGVO).
controller (Verantwortlicher)
Maurice Weissenböck, Zieglergasse 94/5, 1070 Wien, Österreich. Email: maurice@weissenboeck.xyz
hosting
This website is a set of static files served by Cloudflare Pages, a service of Cloudflare, Inc. (USA). When you open a page, your browser sends technical data that Cloudflare needs to deliver the page and to protect it against attacks: your IP address, the time, the page requested, the referring page and your browser's user agent.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is a website that works and stays secure.
Cloudflare processes these data on my behalf under its data processing agreement, which is part of its terms of service (Art. 28 GDPR). It keeps them only as long as it needs them to deliver and protect the site and does not name a fixed period. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, its data processing agreement includes the EU standard contractual clauses (Art. 46 GDPR).
no cookies, no tracking
This site itself sets no cookies, stores nothing in your browser and uses no analytics or tracking. Fonts and images come from this site itself. The only script from another server is Cloudflare Turnstile, which the contact page loads once you start to fill in the form (see contact form below). The LinkedIn link leads to LinkedIn only when you click it.
If you write to me, I process your email address, your message and anything else you send, in order to answer. Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a possible contract, otherwise Art. 6(1)(f), the legitimate interest being to answer you.
Mail to weissenboeck.xyz addresses passes through the mail forwarding of Porkbun, LLC (USA), the registrar of this domain, and arrives in my Google Mail mailbox, a service of Google Ireland Limited. Both act as providers in their own right, not on my instructions. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Porkbun is not; according to its privacy policy it uses the EU standard contractual clauses for transfers to the USA.
I keep enquiries for three years after our last contact. If an enquiry leads to a contract, the records are kept as long as Austrian tax law requires (seven years, § 132 BAO).
contact form
If you use the form on the contact page, I process your name, your email address and your message in order to answer you. The legal basis is the same as for email above, and so is how long I keep it.
When you send the form, a small program on Cloudflare's servers checks it and passes it on without keeping it. It goes to Brevo, a service of Sendinblue SAS (Paris, France), which delivers it to my mailbox on my behalf under a data processing agreement (Art. 28 GDPR). From there it takes the same path as an email. Brevo keeps no copy of the message; its delivery log records the time, the sender, the recipient (me) and a subject line that contains nothing about you. Brevo uses subprocessors, some of them in the USA, under the EU-US Data Privacy Framework and the EU standard contractual clauses.
Cloudflare Turnstile checks that a person and not a bot is using the form. The check starts once you click into the form or press send: the page then loads a script from challenges.cloudflare.com, and Cloudflare processes your IP address and technical data about your browser and connection, such as the user agent. Turnstile does not read what you type into the form. Cloudflare acts as my processor for this check and as a controller of its own when it uses the data to improve its bot detection. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest being a contact form that is not flooded with spam. The transfer to Cloudflare in the USA is covered as described under hosting.
Giving your name, email address and message is voluntary, but without them I cannot answer you. There is no automated decision-making under Art. 22 GDPR: Turnstile only keeps bots out, and email always works as well.
your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to the email address above.
Right to object (Widerspruchsrecht, Art. 21 GDPR). Where I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. I will then stop, unless I can show compelling legitimate grounds that override your interests.
You can also complain to the Austrian data protection authority (Datenschutzbehörde), www.dsb.gv.at.
last updated October 2026