Denes Csaszar · Berlin · Privacy notice

Privacy notice

This is a translation. Where it and the German version differ, the German version applies: Datenschutzerklärung.

What this site processes, and what it does not. Back to the record.

1 · Controller

The controller within the meaning of the GDPR is Denes Csaszar, Britzkestraße 9, 12347 Berlin, reachable at denes@denescsaszar.com. No data protection officer has been designated, and none is required under Section 38 BDSG.

2 · Server log files

When any page is requested, your browser transmits data that are processed on the way: IP address, date and time, the requested file, the referring page, browser and operating system. Transmitting this information is part of the request itself; whether it is logged is a matter of the host’s settings, not a necessity.

What is actually stored here. The site is delivered through Cloudflare Workers. Cloudflare processes the information listed above on its servers to run the site and to defend against attacks. I do not keep any server log files myself and store none of this information. For the request logs that Cloudflare itself holds, Cloudflare’s own documentation states a retention period of three to seven days; after that they can no longer be retrieved.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the technical operation of the site and defending it against attacks. The data are not combined with other sources and are not used to recognise individual people.

3 · Hosting

The site is hosted and delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, through Cloudflare Workers. No other host is involved. Cloudflare processes the information listed in section 2 on my behalf.

The basis for this is Cloudflare’s Data Processing Addendum. Cloudflare incorporates it by reference into its terms of use (Self-Serve Subscription Agreement); Cloudflare does not provide for a separate signature. The terms were accepted when the account was set up. The account was created on 2026-03-26 23:01:52 UTC, which is 27 March 2026, 00:01 CET. This date comes from the created_on field of the Cloudflare account, retrieved on 17 September 2026 through the Cloudflare API. The current version applies at any given time; at present this is version 6.4 of 3 April 2026.

This involves transferring data to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023. If the certification lapses, the Commission’s standard contractual clauses apply under Section 6.2 of the Data Processing Addendum. The certification status was last checked on 10 September 2026 on the list kept by the U.S. Department of Commerce, where it was shown as Active.

What this section said before, and what was wrong with it

Until 2 September 2026 this section said that the processing took place “on the basis of a data processing agreement under Art. 28 GDPR” (translated from the German), and that the transfer was based on an adequacy decision and, in addition, on standard contractual clauses. Both were stated as facts, although no host had been chosen and no separate contract under Art. 28 GDPR had been concluded, and the second statement named two bases without saying which one applied.

A legal page that asserts a contract that does not exist is exactly the error this site argues against. From 2 to 10 September 2026 this section therefore showed a visible placeholder. It was replaced on 10 September by the text above, after the actual text of the Addendum and of the terms of use had been read and the certification status had been looked up in the official list.

One statement above is limited to what the evidence allows. The account’s creation date is exact, from the created_on field. Which version of the Addendum applied at acceptance is not established, which is why the version in force today is named beside the date, and not as the version that was accepted. Until the day of this change, instead of the creation date this section gave only an upper bound, 29 March 2026, supported by an email that turned up and showed that the account existed on that day; according to created_on, the account is about 59 hours older than that email.

4 · Email to me

This site has no contact form, but it publishes two email addresses and in one place explicitly offers to send files on request. If you write to me, I process what your message contains: sender address, subject, content, time and the technical headers every email carries.

The purpose is solely to read and answer your message. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in answering an enquiry addressed to me; where the enquiry concerns steps prior to entering into a contract or the performance of a contract, Art. 6(1)(b). The recipient is the provider of the mailbox, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, where the mailboxes for this site’s domains are held. Storage period: messages are kept while the matter is open and deleted afterwards, unless a retention obligation applies.

You can also write to me by post instead of email. The postal address is in the legal notice.

5 · Storage in your browser

This site sets no cookies. It stores a single item in your browser’s local storage: which colour scheme you chose with the switch at the top right, as the value light, dark or no value at all.

This item does not leave your device, is not transmitted and is not accessible to me. It is stored only if you use the switch yourself. It is therefore strictly necessary, within the meaning of Section 25 (2) no. 2 TDDDG, for the function you explicitly requested, and requires no consent. You can delete it at any time by removing the site data in your browser.

6 · What this site does not do

No audience measurement, no statistics, no tracking pixels. No advertising, no tracking, no profiling and no automated decision-making. No embedded third-party content: no maps, no videos, no fonts from third-party servers; all fonts are your system’s own. No contact form, no newsletter, no registration, no payment. Instead, there are two email addresses, and section 4 describes what happens to a message sent to them. The files offered for download are delivered by the same server as the site; a download is not recorded separately and cannot be distinguished from an ordinary page request.

7 · Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). To exercise them, write to the address in section 1.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

8 · Last updated

This notice was last updated on 22 September 2026, the date of the German version. If what the site processes changes, this notice will be changed, and its date with it. See the legal notice.