44up · Privacy

Privacy.

This statement explains, under Art. 13 GDPR, which personal data is processed when you visit 44up.at and when you use the contact form.

Controller

Florian Tomasin · 44up
Donau-City-Straße 7, 44th floor
1220 Vienna,
Austria
Email: florian@44up.at

Hosting and server logs

44up.at is hosted by Cloudflare (Cloudflare, Inc.) as a processor. When you open the site, Cloudflare processes technically necessary access data — including your IP address, the date and time of access, and the page requested — to deliver the site securely and reliably. The legal basis is the legitimate interest in a functioning service (Art. 6(1)(f) GDPR). A transfer to third countries (USA) cannot be excluded; Cloudflare relies on the EU Standard Contractual Clauses for this.

We additionally review this access data in aggregated form through the Cloudflare dashboard, to see approximate visitor numbers and traffic patterns — for example how often a given page is viewed. This does not create a user profile or link data to an identifiable person; the legal basis is the same legitimate interest as above.

Contact form

If you use the contact form, we process the data you provide — name, email address and your message — together with technical metadata (IP address, browser identifier, country of origin) in order to answer your inquiry. The data is stored in a Cloudflare store (Workers KV) and automatically deleted after twelve months at the latest, unless an ongoing exchange arises from it. The legal basis is Art. 6(1)(b) and (f) GDPR.

If the server is unreachable, the form instead opens your own email client (mailto). Sending then happens through your email provider; in that case no data is stored on our server.

Cookies, tracking and analytics

44up.at uses no tracking cookies, no Google Analytics, and no external fonts or CDN services. For audience measurement, we use Cloudflare Web Analytics: Cloudflare automatically injects a script (static.cloudflareinsights.com/beacon.min.js) into the delivered page and uses it to gather aggregated usage data — such as pages viewed, referring websites, device type, and approximate load times. The script sets no cookie, uses no persistent identifier, and builds no individual user profile. The legal basis is our legitimate interest in audience measurement (Art. 6(1)(f) GDPR); the processor is Cloudflare, as described under “Hosting and server logs” above.

Only your display preference (light/dark mode) is additionally stored locally in your browser (localStorage) — that information never leaves your device.

On the audit pages under /observatory/audits/, a strictly necessary cookie (audit_pin, 30 days, HttpOnly, Secure, SameSite=Strict) is set after a successful PIN entry to identify you as authorized for the duration of your visit. It contains no personal data and is not used for analytics or tracking. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in simple access control) in combination with your explicit request for access.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To exercise these, contact florian@44up.at. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Last updated: August 2026.