# privacy

## who is responsible

the controller for data processed on this site is the site owner, qwertyquarty. you can reach them at me@qwerrie.ee. no data protection officer is appointed. that is because none of the triggers apply: the site owner is not a public authority, does not carry out large-scale systematic monitoring, and processes no special-category data (art. 37(1)(a)–(c) gdpr). german law adds § 38 BDSG, which requires one only where at least 20 people are permanently engaged in automated processing, or where the processing is subject to a data protection impact assessment or is carried on a commercial basis — none of which applies to this site.

## why this page exists

you might wonder why a personal site needs a notice like this at all. gdpr does not apply to genuinely private activity: art. 2(2)(c) exempts processing a person does "in the course of his or her personal or household activity". that exemption does not cover this site. it is published openly and is reachable by anyone who finds the address, and it runs traffic measurement and abuse protection on infrastructure operated by a third party, which takes it beyond a purely private sphere. the site owner therefore treats the gdpr as applying in full, and this page is the art. 13 notice that follows from that.

## what data is processed

this site is served through cloudflare, which processes visitor requests on behalf of the site owner. when you visit, the following data may be processed:

the performance metrics come from cloudflare's privacy-first web analytics beacon, loaded from static.cloudflareinsights.com and reported back to a cloudflare endpoint on this site's own domain at /cdn-cgi/rum. this is served by cloudflare, not a further recipient. cloudflare pre-processes these events at the edge, discarding personal identifiers such as ip addresses before storage.

web analytics are enabled for this site and apply to all visitors, including those in the eu. the site owner has enabled cloudflare's real user measurement for this hostname, so the analytics snippet is injected into the page automatically and page views and load times are reported for every visit. it uses no cookies and no local storage, does not track visitors across sites, and stores no ip address, user agent or any other fingerprint; a "visit" is counted from a distinct referral or navigation event rather than from identifying anyone. the site owner does not itself store visitor personal data and sees only totals. you are not asked to provide any personal data; simply visiting the site inherently transmits the technical request data above to our host, which cannot be avoided while browsing.

cloudflare is the only third party that receives data from this site. every other link on the page is an ordinary hyperlink that contacts nothing until you click it yourself. the site uses no advertising, no tracking pixels, no embedded social media widgets, no fonts or scripts from external providers, and no cookies of its own.

providing this data is voluntary in the sense that you are never asked for it and you are not refused anything for withholding it. all processing is automated, and no decision is made about you that produces legal or similarly significant effects. there is no profiling of individuals and no automated decision-making within the meaning of art. 22 gdpr. the one qualification is cloudflare's javascript detection, described below, which inspects your browser to classify it as automated or human; that inspection is not retained in a form that identifies you across visits and is used only to filter bots.

## why and on what legal basis

data is processed to operate and secure the site — delivering content, keeping it available, and mitigating abuse and attacks — and to understand aggregate traffic. the legal basis for all of it is the site owner's legitimate interests under art. 6(1)(f) gdpr, which requires a three-part assessment: a legitimate interest, a necessity test, and a balancing test against your rights.

interest. keeping a personal site online, and knowing whether it is fast and working, are real interests, and recital 47 expressly recognises security and fraud prevention among them. necessity. a web server cannot answer a request without processing the request, so the request data is unavoidable; the same goes for the security logs. the analytics go a step further than that, but only to the extent of counting page views and load times, with no identifier attached that would let a visitor be picked out. balancing. the data is short-lived, aggregated, not combined with anything else, never used for advertising or cross-site tracking, and is visible to the site owner only as totals. no profile of you as a person is built, so the impact on you is minimal, and it does not outweigh the interest above.

two things worth separating. the consent question is a different one from art. 6: it is governed by § 25 TDDDG, which as explained below is not triggered here because nothing is stored on or read from your device. and the analytics basis is the weaker of the two — it holds only while the data stays genuinely aggregate and unidentifiable. if that ever changed, the correct answer would stop being a legitimate interest and become a consent one.

## cloudflare and transfers

cloudflare, inc. (usa) acts as a data processor for the visitor data described above and processes it on the site owner's behalf under cloudflare's data processing agreement. for some of its own purposes — threat intelligence, abuse prevention and security research — cloudflare acts as an independent controller, which is a separate legal role; you can read how cloudflare treats that data in its own privacy policy. the site owner has no access to it.

for visitors in the eu, uk and switzerland, the transfer to the united states relies on cloudflare's certification under the eu–us data privacy framework. the certified entity is cloudflare, inc., which is listed in the public participant register at dataprivacyframework.gov with coverage for both human-resources and non-human-resources data. that framework is recognised by the european commission through implementing decision (eu) 2023/1795, adopted under art. 45(3) gdpr as an adequacy decision. its status in the register is active: the flag shown there, "re-certification under review", is the normal annual administrative cycle for a large share of participants, not a notice of doubt, and the next certification is due on 15 september 2027.

the standard contractual clauses of the commission's implementing decision (eu) 2021/914 are the fallback if that adequacy framework is withdrawn or suspended. for data cloudflare processes as processor, module two of those clauses applies (controller to processor); for the flows where it acts as an independent controller, modules three and four apply. the adequacy decision is currently in force and has not been invalidated by any court, but it is subject to periodic review by the commission and is contested — so the site owner treats it as a live question and keeps the standard contractual clauses in place alongside it rather than relying on the adequacy route alone. a copy of those clauses can be obtained from cloudflare.com/gdpr, or on request from the site owner at me@qwerrie.ee. cloudflare maintains a list of sub-processors at cloudflare.com/gdpr/subprocessors.

three further cloudflare features are enabled on this site, alongside the web analytics described above. each one is visible in the html this page is served as:

none of these three stores anything on your device or reads anything already stored there, and none sets a cookie. that is a verifiable fact about this site rather than an intention: loading it produces no cookies and no local or session storage.

this matters more in germany than in most places. § 25(1) TDDDG — the german implementation of the eprivacy rules — requires consent before information is stored on, or read from, a visitor's terminal equipment, and it has no general exemption for first-party use; the only exception is storage that is absolutely necessary to provide a service the visitor explicitly asked for. because nothing is stored on your device and nothing already stored is read, the site owner's reading is that this provision is not engaged, which is why no consent banner appears. one honest doubt is worth stating: european data protection board guidance is unsettled on whether an ip address sent to the server as part of an analytics beacon counts as an "access" to the terminal. no german court or authority has decided it. if it were ever held to be in scope, the beacon would be the thing that would need consent — everything else described here would be unaffected.

one honest caveat: if cloudflare's bot protection ever decides to challenge a request, it may set a short-lived security cookie as part of that challenge. the site owner does not control that, and does not consider it likely — no cookie was returned when this page was checked — but if it happened, it would exist only to complete the challenge and would not be used to track you. if you would rather not run any of this at all, a content blocker or your browser's tracking protection will stop it.

## retention

the site owner does not retain visitor personal data themselves. cloudflare retains request and security logs as described in its privacy policy (cloudflare.com/privacypolicy). web-analytics beacon data is kept unsampled for 7 days, then aggregated down to roughly 10% of its original volume for long-term storage; security logs are retained for the period stated in that same policy. this applies to all visitors, since the snippet is injected for everyone.

## your rights

if your data is processed through this site, you have the right to access, rectify, erase, restrict and port your data, and to object to its processing. to exercise these rights, contact the site owner at me@qwerrie.ee. where cloudflare processes your data as a processor, you may also contact cloudflare at sar@cloudflare.com.

you also have the right to lodge a complaint with a supervisory authority, without having to go through the site owner first.

the authority with competence over this site is the data protection authority of the german state where the site owner is established. that is not necessarily your own state: a website being reachable from a country does not by itself give the controller an establishment there — see art. 55(1) gdpr and the court of justice's ruling in c-191/15. as a private individual rather than a public body, the site owner is supervised by a land authority, not by the federal one (bfdi), which supervises federal bodies and certain licensed sectors. a directory of all the land authorities is published at bfdi.bund.de.

separately, you may complain to the supervisory authority where you live or work, or in the member state where you believe the infringement occurred — art. 77(1) gdpr. naming the competent authority here is good practice rather than a strict requirement of art. 13.

## changes

last updated: 2026-09-30. this page may be updated if data practices change.