Skip to content

Privacy Policy

This is a courtesy translation. The legally binding version is the GermanDatenschutzerklärung.

Last updated: 18 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
wep4you
Ing. Peter Weiß
Groß-Enzersdorferstraße 74b/2/30
1220 Vienna, Austria
Email: [email protected]

2. Data we collect

2.1 Visiting this website

This website is delivered through the network of Cloudflare, Inc. (San Francisco, USA). Cloudflare receives every request first, protects the website against attacks and forwards the request to our web server. In doing so, Cloudflare processes your IP address and the technical details of your request: the requested address, date and time, browser identifier and referring page. Cloudflare acts as our processor. How long Cloudflare keeps this data is determined by Cloudflare; details are in Cloudflare's privacy policy at cloudflare.com/privacypolicy. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely and reliably).

Our web server is located in a Hetzner Online GmbH data centre in Germany. For each request it logs only the date and time, the request method, the requested page without any appended parameters, the result, the amount of data transferred and the processing time. It does not store your IP address, your browser identifier or the referring page. These logs are used for troubleshooting.

2.2 Audience measurement (Umami)

We measure the reach of this website with Umami. We run Umami ourselves, on our own server in the EU. The measurement data is not passed on to any third-party provider.

  • Umami sets no cookies and does not track you across other websites.
  • Umami stores neither your IP address nor your browser identifier.
  • If “Do Not Track” is enabled in your browser, no measurement takes place.

For each page view your browser sends the page viewed including any appended parameters (such as campaign identifiers), the page title, the referring page, the screen size and the language. From the browser identifier that your browser sends with every request, Umami determines the browser, operating system and device type. To group several page views into one visit, Umami derives a visit identifier from your IP address and browser identifier; this identifier changes every calendar month. We only evaluate the measurement data in aggregated form. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our offering).

We have not set a fixed deletion period for the measurement data. We keep it for as long as we measure the reach of this website, so that we can compare its development over several years. If we stop the audience measurement or discontinue this website, we delete the measurement data.

The measurement data reaches our Umami server through an upstream server (reverse proxy) in a Hetzner Online GmbH data centre in Germany. This server protects our services against abuse and attacks. For that purpose it logs, for each request, your IP address and port number, the date and time, the requested address including parameters, the result, the amount of data transferred and the processing time. It does not store your browser identifier. These logs are subject to a tiered retention period:

  • For the first 7 days the logs are kept in full so that we can detect and fend off attacks.
  • From day 8 we shorten the IP address and remove the port number. For IPv4 the last of the four number blocks is set to 0; for IPv6 everything after the first 48 bits. We keep the logs in this form so that we can investigate security incidents after the fact. At that point we can no longer reliably attribute the entries to a specific person (Art. 11 GDPR).
  • After 90 days the logs are deleted automatically.

In addition, the reverse proxy's access software keeps its own access log containing the IP address, the date and time and the requested address. It is deleted automatically after 7 days. Legal basis for both logs: Art. 6(1)(f) GDPR in conjunction with Recital 49 (legitimate interest in the security of our networks and services).

An automated detection system (CrowdSec) continuously analyses the reverse proxy's logs. If an IP address shows an attack pattern, such as repeated failed attempts or probing for known vulnerabilities, it is temporarily blocked. The address is then sent, together with the time and the type of pattern, to CrowdSec SAS (France), which uses it to build a shared blocklist for all CrowdSec users. We delete the detected attacks themselves on our server after 7 days. We are joint controllers with CrowdSec for this transfer (Art. 26 GDPR). According to CrowdSec, this data is kept for three months and then the IP address and time are gradually coarsened. Inconspicuous requests are not transmitted. You can exercise your rights with us or with CrowdSec. Under our arrangement, CrowdSec is the first point of contact. CrowdSec also offers a form for having an IP address removed from the blocklist (form: crowdsec.net/remove-ip-crowdsec-blocklist; CrowdSec's privacy policy: crowdsec.net/privacy-policy). Legal basis: Art. 6(1)(f) GDPR in conjunction with Recital 49.

2.3 Contact by email

If you contact us by email, we process the data you provide (email address, name, message content) to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding). The data is deleted once it is no longer required and no statutory retention obligations apply.

3. No cookies

This website does not set cookies and does not use technologies that store or read information on your device in a way that would require consent.

4. Recipients and transfers to third countries

We only pass personal data on to the following recipients, insofar as this is necessary for the purposes described, or where we are required to do so by law:

  • Hetzner Online GmbH, Gunzenhausen, Germany: operation of our servers (including the web server and the reverse proxy, both in Germany) and of our email mailbox, as processor.
  • Cloudflare, Inc., San Francisco, USA: delivery and protection of the website (section 2.1), as processor.
  • CrowdSec SAS, France: shared blocklist (section 2.2), as joint controller with us.

Data only reaches a country outside the EU/EEA via Cloudflare (USA). Cloudflare is certified under the EU-U.S. Data Privacy Framework, so this transfer is covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Cloudflare's data processing addendum incorporates the European Commission's standard contractual clauses.

5. Your rights

Under the GDPR you have the following rights:

  • Access to the data being processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)

An informal email to [email protected] is sufficient to exercise your rights. You also have the right to lodge a complaint with the Austrian data protection authority: www.dsb.gv.at.

6. Changes to this policy

This privacy policy is updated as needed, for example when the services we use change. The current version is always available on this page.