Privacy

The controller responsible for the processing described here is Matteo Mozgan, software developer, Vienna, Austria. Any inquiries regarding data collection are handled via privacy@mozgan.dev.

Every request to this site passes through Cloudflare, which provides content delivery, hosting and security. This necessarily processes your IP address, browser and device type, operating system, the address requested, the referring page, a timestamp and standard server log data.

The purpose is to deliver the site, keep it available and defend it against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in a secure, reliable and performant website.

If you write to me, by email or through any channel linked on this site, I process your name, the contact details you provide, the content of your message, any attachments, and the associated email metadata such as sender, recipient and timestamps.

The purpose is to answer you and, where it comes to that, to discuss and carry out a project. The legal basis is Art. 6(1)(b) GDPR where your message concerns a contract or steps taken prior to entering into one, and Art. 6(1)(f) GDPR for every other inquiry, i.e. my legitimate interest in replying to messages addressed to me.

Where processing rests on Art. 6(1)(f) GDPR, the interests pursued are: keeping this website secure, available and fast, and being able to respond to inquiries sent to me.

Personal data is disclosed only as far as the purposes above require, to the following categories of recipients.

Hosting Provider: Content delivery, hosting infrastructure and security for this website.

Workspace Tooling Provider: For business email.

Personal data is not sold, rented, or handed to advertising networks or any other third party.

Both recipients are operated by companies headquartered in the United States, so data may be transferred outside the EU/EEA.

Cloudflare serves requests from the edge location nearest to you, which for visitors in Europe is normally within the EU/EEA. Where a transfer to the US does take place, it relies on the EU–U.S. Data Privacy Framework.

Transfers to Google LLC rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework.

Cloudflare's technical and security logs are kept only as long as operating and protecting the site requires, on a short rolling basis.

Correspondence that does not lead to a contract is deleted after roughly six months, unless it is still needed to establish, exercise or defend legal claims.

Where a message does lead to a project, the periods set out in the privacy notice for clients and project partners apply instead. In particular the seven-year statutory retention of accounting records under Austrian law.

You have the right to request access to the personal data held about you (Art. 15 GDPR), its rectification (Art. 16), its erasure (Art. 17), a restriction of processing (Art. 18) and data portability (Art. 20).

You also have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

None of the processing described in this notice is based on consent, so there is no consent to withdraw. To exercise any right, email privacy@mozgan.dev.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 13(2)(d) GDPR).

The competent authority for the controller is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, dsb.gv.at.

There is no statutory or contractual obligation to provide personal data. Request data such as your IP address is a technical precondition of loading any website — without it, the site cannot reach you.

Contact details are entirely voluntary. Without them I cannot reply to you, and no project can be agreed or carried out.

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Beyond the two activities above, this site records aggregated usage statistics through Umami, a privacy-focused analytics tool run for me by Umami Cloud (Umami Software, Inc.), so I can see which pages and projects are useful and improve them.

Recorded per visit: the page viewed, the referring site, an approximate location at country and region level derived from the request without storing the IP address, and the browser, operating system and device type. Nothing more.

This data is aggregated and non-identifying, it is not personal data. No individual visitor is recognised, nothing is linked across sessions or across sites, and no profiles are built. Only aggregate statistics are kept, for as long as they stay useful.

The analytics script sets no cookies and stores nothing on your device. Enable “Do Not Track” in your browser and your visit is not recorded at all.

This site sets no analytics, advertising or tracking cookies.

The only cookie that may appear is “cf_clearance”, set by Cloudflare when it verifies that a request is genuine rather than automated. It exists solely to keep bots and abuse off the site, carries no identifying information, and is not used to recognise or follow you.

Since nothing here serves marketing or cross-site tracking, this site shows no cookie banner.

This notice is updated whenever the processing, the providers or the legal requirements change. The current version is always the one at mozgan.dev/privacy.

Any question about this notice or the processing of your personal data: Matteo Mozgan, privacy@mozgan.dev. For anything else, hello@mozgan.dev.