Silviu Bojica

This statement explains which personal data this website processes, why, and which rights you have. It follows the EU General Data Protection Regulation (GDPR).

In short: this website sets no cookies, runs no JavaScript, uses no analytics or tracking tools, and loads nothing from other servers. When you read its pages, the only personal data is what every web server writes into its logs, such as your IP address. The host, DreamHost, deletes these logs after 7 days.

Who is responsible

The controller under the GDPR is:

Name: Silviu-Dumitrel Bojica
Residence: Vienna, Austria
Email: silviu@bojica.com

What this website does not do

It sets no cookies and uses no local storage. Your browser may keep the fonts, drawings and stylesheet in its cache, so that pages load faster. You can empty the cache at any time.
It runs no JavaScript.
It uses no analytics or tracking tools, and no advertising.
It loads nothing from other servers. The fonts and drawings come from this server too. There are no embedded videos, maps or social media buttons.
It has no forms, no comments and no sign-up.

The links to other websites, such as LinkedIn or GitHub, are plain links. Those sites learn of your visit only when you follow a link, and then their own privacy statements apply.

Server logs

When you open a page, your browser asks the web server for it. The server writes each request into a file, the access log. An entry holds:

your IP address
the date and time of the request
the address of the page or file you asked for, and how your browser asked for it (method and protocol)
the status code of the answer, for example 200 for “found” or 404 for “not found”, and the size of the answer
the referrer: the page that linked you here, if your browser sends it
the user agent: the name and version of your browser and operating system

When a request fails, the server also writes an entry into an error log. It can hold your IP address too.

DreamHost also protects the server with a firewall for web requests (mod_security). It checks each request for known patterns of attack. When it blocks a request, it notes this in the logs. It can then block further requests for a short time.

DreamHost’s control panel also makes simple statistics from the access log and shows them to me. They show, for example, which pages were read, on which kind of device and from which country.

Why: to deliver the pages to you, to keep the server safe from attacks, to find errors, and to see which pages people read.

Legal basis: Article 6(1)(f) GDPR. My legitimate interest is a website that works, that is safe, and that I can improve.

How long: DreamHost keeps these logs for 7 days by default and then deletes them. Its documentation says so (see Documents below).

I do not use the logs to find out who you are, and I do not combine them with other data. The one exception is an attack: then I may use the logs to defend the website or to pursue legal claims.

The host: DreamHost

DreamHost, LLC runs the server of this website (PMB #327, 417 Associated Rd., Brea, CA 92821, USA). DreamHost processes the server logs on my behalf, as a processor under Article 28 GDPR. The contract for this is DreamHost’s Customer Data Processing Addendum, which is part of its terms of service.

The server stands in the USA, so the log data leaves the EU. Under the addendum, DreamHost and its sub-processors may also process the data in other countries. No adequacy decision of the EU covers DreamHost, because DreamHost does not take part in the EU-U.S. Data Privacy Framework. So the transfer rests on the EU standard contractual clauses (Article 46(2)(c) GDPR). They are part of the same addendum, and you can read them there (see Documents below).

Email

If you write to me, I receive your email address, your name if you give it, the time and the content of your message. I use them only to answer you.

Legal basis: Article 6(1)(f) GDPR, my legitimate interest in answering messages. If your message is about a contract with me, or a contract you want to make with me, Article 6(1)(b) GDPR.

How long: I keep your message as long as our exchange needs it, and delete it when it is no longer needed. After I delete a message, Google removes it from its systems within 180 days at most.

My email runs on Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google receives and stores the messages on my behalf, as a processor under Article 28 GDPR. The contract for this is Google’s Cloud Data Processing Addendum (see Documents below).

Google can process the messages in data centres outside the EU, for example in the USA. For the USA, the transfer rests on the EU adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), under which Google LLC is certified. If that decision ends, Google’s addendum provides the EU standard contractual clauses instead. For other countries, the transfer rests on these clauses already (Article 46(2)(c) GDPR).

AI assistant

Gemini, part of Google Workspace, can read my mailbox. It helps me sort and answer messages. Here too, Google works as my processor under the same Cloud Data Processing Addendum. Google does not use the content to train its AI models without my permission.

Legal basis: Article 6(1)(f) GDPR, my legitimate interest in handling my email with the help of this tool. You can object to this (see Your right to object below).

Your rights

You have the right to:

get a copy of your data and information about how it is used (Article 15 GDPR)
have wrong data corrected (Article 16)
have your data deleted (Article 17)
have the processing limited (Article 18)
get the data you gave me in a common, machine-readable format, where Article 20 applies

To use these rights, write to me at the email address above. The server logs hold no names. To find your entries in them, I need your IP address and the time of your visit.

You do not have to give me any data, by law or by contract. But without your IP address, the server cannot send you the pages.

There is no profiling, and no automated decision with legal or similar effects on you (Article 22 GDPR).

Your right to object

You can object at any time to the processing that rests on my legitimate interest, on grounds relating to your particular situation (Article 21 GDPR). I then stop it, unless I can show compelling legitimate grounds, or I need the data to pursue or defend legal claims. To object, write to me at the email address above.

Complaints

If you think that I process your data against the law, you can complain to a data protection authority (Article 77 GDPR). In Austria, this is:

Authority: Österreichische Datenschutzbehörde
Address: Barichgasse 40-42, 1030 Wien, Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

Documents

The documents this statement refers to, on the websites of DreamHost and Google:

DreamHost logs: How long DreamHost keeps logs
DreamHost contract: Customer Data Processing Addendum
Google contract: Cloud Data Processing Addendum
Google clauses: Standard contractual clauses
Google Gemini: Gemini in Workspace privacy hub

Changes

I update this statement when the website changes. The date below shows the last change.

Privacy statement