Privacy policy

This site's own code sets no cookies, loads nothing from third-party servers, and does not track you across the web. My hosting provider, Cloudflare, serves the pages, produces aggregate traffic statistics from the requests it already handles, and runs an automated check that tells visitors apart from bots. What follows is the detail behind all of it.

Who is responsible

Shpetim Gashi, Lienz, Austria
contact@shpetimgashi.com

What is collected when you visit

Nothing by me directly. The site is a set of static files with no server-side code, no database, no accounts and no forms.

My hosting provider, Cloudflare, necessarily processes technical data to deliver the pages to you: your IP address, the page requested, the time of the request, and your browser's user-agent string. This happens for every website you visit, and is required to serve a page at all and to defend against attacks.

Legal basis: Article 6(1)(f) GDPR, my legitimate interest in operating and securing the site.
Processor: Cloudflare, Inc., acting under a data processing agreement.
Transfers outside the EU: Cloudflare is a US company. Transfers rest on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and, as a fallback, on the Commission's standard contractual clauses. Cloudflare's data processing addendum covers both, published at cloudflare.com/cloudflare-customer-dpa. Ask me and I will send you a copy.
Retention: Cloudflare keeps request logs under its own retention policy. I do not export, store or analyse them. Email you send me is kept while the conversation is live and deleted within two years of the last message, unless there is a specific reason to keep it longer.

Traffic statistics

Cloudflare produces aggregate statistics for this site: page views, countries, referrers, roughly what a server log summary would show. They are derived from the requests Cloudflare already handles in order to serve you the page, described in the section above.

No script is loaded into your browser for this. It is measured at the server, not on your device, so there is nothing to block and nothing that follows you to another site.
No cookies and no fingerprinting for this. The statistics are counted at the server from requests that already happened, so nothing is written to or read from your browser in order to produce them.
I see totals, not people. The reports are aggregated; I cannot identify a visitor from them, and I do not export, combine or sell them.
Legal basis: Article 6(1)(f) GDPR, my legitimate interest in knowing whether the site works and is being read.

What my hosting provider adds

Cloudflare serves this site and adds a few things to it that are not in my source code. I name them because a privacy policy that lists only what the author wrote is not a description of what a visitor actually receives.

An automated bot check. Cloudflare serves a small script from this domain, at a path beginning /cdn-cgi/, which reads signals from your browser to tell real visitors apart from automated traffic. It comes from this domain rather than a third party, and it exists to keep the site available. Legal basis: Article 6(1)(f) GDPR, my legitimate interest in the security and availability of the site.
Network error reporting. Cloudflare sets a header asking your browser to report failed connections back to a Cloudflare endpoint. Successful requests are not reported. A report carries the same technical data the request itself already carried.
Email address obfuscation. Cloudflare rewrites email addresses in the page so that simple scrapers cannot read them, and serves a small script from this domain to put them back for you. The addresses on this page and on the legal notice are deliberately excluded from that rewriting, because a contact route on a legal page has to work without JavaScript.

Both are Cloudflare acting as my processor, under the same agreement and the same transfer safeguards described above. Neither is analytics, neither builds a profile of you, and neither follows you to another site.

What is stored on your device

I set no cookies of my own. Cloudflare's bot check may set a short-lived cookie when it needs to confirm a request is genuine; that cookie is a security measure and is not used to recognise you across sites. Apart from that, one value may be stored in your browser's local storage, on this device only. It is not transmitted anywhere and does not identify you.

Key	What it holds	When it is written
`theme`	Light or dark preference	Only when you use the theme toggle

It is a preference you set yourself and it is not used for anything else, which is why I take the view that no consent banner is required here. The rule is Article 5(3) of the ePrivacy Directive, implemented in Austria by section 165 of the Telekommunikationsgesetz 2021. You can remove the value by clearing site data for this domain in your browser settings.

Getting in touch

If you email me, the message and your address are processed to reply to you. Mail to contact@shpetimgashi.com is routed through Cloudflare Email Routing to a personal mailbox. Legal basis: Article 6(1)(f) GDPR.

Links to other sites

Links to GitHub, LinkedIn and other sites are ordinary links. Nothing is loaded from those services until you choose to follow a link. There are no embedded badges, buttons, tracking pixels or analytics scripts anywhere on this site.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection under Articles 15 to 21 GDPR. Write to the address above to exercise any of them.

Your right to object

Everything on this site rests on legitimate interests under Article 6(1)(f) GDPR. That means you have the right to object at any time, on grounds relating to your particular situation, to any of it. Write to the address above. If you object I will stop, unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Complaining to a supervisory authority

You also have the right to complain to a data protection supervisory authority, in particular in the EU member state where you live, where you work, or where the alleged infringement took place. I am based in Austria, so the authority responsible for me is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.