privacy policy.

What the server records.

Delivering a web page technically requires your IP address, otherwise the server cannot send the page back to you. Our host states that it does not log personal data and does not store IP addresses; its request logs contain the requested URL only.

We therefore keep no access logs of our own, run no server-side statistics and cannot identify you from the delivery of this site.

No cookies, no tracking.

We set no cookies, use no analytics or statistics service, embed no advertising and do not profile visitors. There is nothing to consent to, which is why you will not see a cookie banner.

Fonts, images and code.

All fonts, images, icons and scripts are delivered from this website itself. Nothing is fetched from external providers such as Google Fonts or a CDN, so no data about your visit reaches third parties. The one exception is the video described below, and only after you start it.

Contacting us.

If you write to one of our addresses, we process your email address, your name and the content of your message in order to answer you (Art. 6(1)(b) and (f) GDPR). We keep the correspondence for as long as the matter requires and delete it once it is settled and no retention obligations apply.

The contact form on the "Get involved" page does not send anything to us. It only assembles a message and opens it in your own email program. Nothing is transmitted until you send that email yourself.

Hosting.

The site is published as static files through Grebedoc (grebedoc.dev), a static-site hosting service operated by Catherine “whitequark”, reachable at whitequark@whitequark.org. Grebedoc delivers the files over a content delivery network with locations in Europe, North and South America, East Asia and Australia, with Wasabi as the underlying storage. Your IP address is processed in transit to deliver the page, but according to the operator it is not stored.

When we publish a new version, Grebedoc keeps an audit log for 28 days. It contains the IP address of the machine that uploaded the site, which is our build server, not a visitor.

Video.

The ECER video on our homepage is hosted on YouTube (Google Ireland Limited). We embed it behind a click barrier: on page load you only see a preview image stored on our own server, and nothing is requested from YouTube.

Only when you press play does your browser connect to youtube-nocookie.com and load the player. From that moment Google receives your IP address and can set storage in your browser, and Google’s privacy policy applies. Pressing play is your consent to that (Art. 6(1)(a) GDPR). If you would rather not, simply do not start the video.

Links to other sites.

Our pages link to external services such as ecer.eraa.at, Codeberg, GitHub and our social media profiles. Once you follow such a link, the privacy policy of that provider applies. We have no influence on their data processing.

Outbound links carry parameters (utm_source and similar) that tell the target site the visit came from eraa.at and from which page. They identify the link, not you, and contain no personal data.

Your rights.

You have the right to access your data and to have it rectified, erased or restricted, the right to object to processing based on legitimate interests, and the right to data portability. A short email to contact@eraa.at is enough.

You also have the right to lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.