Privacy.

Who is responsible.

Nikolas Taschler
Südtiroler Straße 12
2514 Traiskirchen, Austria
nikolas@taschler.net

This notice covers this website and payments to me through Stripe. Where one of my projects has its own notice, that notice applies on its pages.

Visiting this site.

Cloudflare, Inc. (USA) delivers this site and processes technically necessary request data, such as IP address, time and requested page, to deliver it and protect it from misuse (Art. 6 (1) (f) GDPR). For the same purpose, a short-lived security cookie may be set. Transfers to the USA rely on the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 45 and 46 GDPR). The site itself uses no analytics or advertising.

Cloudflare keeps request data only as long as delivery and security need it.

Writing to me.

I use the details in a message only to answer it and, where it applies, to handle an order (Art. 6 (1) (b) and (f) GDPR). I keep messages as long as the matter needs, and business records for the seven years tax law requires.

My mailbox is hosted by Infomaniak Network SA in Switzerland, a country the European Commission recognises as offering adequate data protection (Art. 45 GDPR).

Paying me.

Payments to me run through Stripe. On its secure payment page Stripe collects what the payment needs, usually name, email address, billing address and payment details. I see the details of the payment, such as name, email address, billing address, amount, date and payment method and, for cards, the brand, expiry date and last four digits, but never the full card number.

I use these details to carry out the order, send the receipt and keep my books (Art. 6 (1) (b) and (c) GDPR). Without them a payment isn’t possible. I keep business records for the seven years tax law requires.

Stripe works for me as a processor and, for its own duties such as fraud prevention and financial regulation, as an independent controller. In Europe the controller is mainly Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland. My contract partner and processor is Stripe Payments Europe Limited, and Stripe Technology Europe Limited provides regulated payment services. Stripe uses cookies and device identifiers on its payment page and checks payments automatically for fraud, which can lead to a payment being declined (Art. 6 (1) (f) GDPR). Where data leaves the EU, Stripe relies on an adequacy decision or EU standard contractual clauses (Art. 45 and 46 GDPR). The details are in Stripe’s privacy policy.

Anyone paying with Apple Pay, Google Pay, Klarna, Revolut Pay, EPS or another method also shares the necessary details with that provider, which handles them under its own privacy notice. If the payment page asks for an address, Stripe may show suggestions from Google Maps, and what is typed can reach Google for this. Google may also use collected data for analytics. More on this is in the Google Pay terms and Google’s privacy policy.

Security and disclosure.

Every connection to this site and to Stripe’s payment page is encrypted. Full card details go straight to Stripe and never reach me. Each of my accounts with these providers has its own password and two-step sign-in.

I sell no data. Besides the providers named here, it goes only to IT providers that support me with email and office work, to authorities where the law requires it, and to advisers bound by professional secrecy.

Rights.

Everyone whose data I process has the right to access, rectification, erasure, restriction of processing, data portability, and objection. An email to nikolas@taschler.net is enough. Complaints can go to the Austrian Data Protection Authority at www.dsb.gv.at.

Anyone can object at any time to processing based on legitimate interests.