kst4contest/website/src/privacy/index.njk

---
layout: base.njk
title: Privacy Policy | KST4Contest
description: Privacy policy for the KST4Contest website.
---

<section class="hero">
  <p class="badge">Privacy</p>
  <h1>Privacy Policy</h1>
  <p class="lead">Information about data processing on this website.</p>
</section>

<section class="section narrow">
  <article class="card content-card">
    <h2>Controller</h2>
    <p>
      Marc Fröhlich<br>
      Rheingoldstr. 6<br>
      68199 Mannheim<br>
      Germany
    </p>

    <h2>Access logs</h2>
    <p>
      When this website is accessed, the web server may process technical access data such as
      IP address, requested URL, date and time, user agent and referrer.
      This processing is used to provide the website, maintain security and investigate technical issues.
    </p>

    <h2>Legal basis</h2>
    <p>
      The legal basis is Art. 6(1)(f) GDPR: legitimate interest in secure and reliable operation
      of the website and in understanding the approximate use of its project pages.
    </p>

    <h2>Server-side reach statistics</h2>
    <p>
      The website uses server-side reach statistics to understand approximate demand and which
      project pages are used. Measurement is based on a dedicated, reduced server access log. It
      does not use cookies, an analytics or tracking script, advertising pixels, local storage,
      third-party requests or user profiles.
    </p>
    <p>
      The analytics log contains the server name, IP address, time, HTTP method, normalised path
      without a query string, protocol, response status, transferred size and user agent. It does
      not contain a referrer or authenticated user name. Known crawlers are filtered, and unknown
      browsers or operating systems are treated as crawlers.
    </p>
    <p>
      IP addresses are anonymised before data is stored in the GoAccess statistics aggregates. The
      dedicated analytics raw logs are retained for 14 days. Anonymised GoAccess detail is retained
      on a rolling basis for 395 days. Daily totals for visits and page views, absolute country
      totals per day and page views for each normalised path are retained permanently. No permanent
      table combines an individual page view with both its path and country.
    </p>
    <p>
      A visit is an approximate daily value based on the combination of IP address, date and user
      agent used by GoAccess. It must not be read as a number of unique people. Page views and visits
      remain separate measures. Known bots, monitoring requests, software update checks and static
      assets are excluded from the website page and visit statistics as far as they can be identified.
      Query strings are not included in the recorded page paths.
    </p>

    <h2>Update-information statistics</h2>
    <p>
      Successful <code>GET</code> requests with status <code>200</code> for the exact path
      <code>/kst4ContestVersionInfo.xml</code> are recorded separately from the website statistics.
      They do not increase its page views or the public visitor count. Daily totals and absolute
      country totals per day are retained permanently. Hourly totals and recognisable client groups
      derived from the user agent are retained for no more than 14 days.
    </p>
    <p>
      Browsers and bots can request the update-information file too. Existing KST4Contest versions
      do not send a reliable application-specific user agent. The resulting number therefore does
      not establish a program start, a single user or a particular person.
    </p>
    <p>
      Country information for both statistics is derived locally from the GeoLite2-Country database.
      No visitor address is sent to an external location service. Country assignment is approximate;
      it is not an exact location determination.
    </p>

    <h2>Public visitor count</h2>
    <p>
      The home page displays an element containing the total number of these approximate daily visits
      since the stated activation date. The display loads a same-origin JSON file and remains hidden
      if that file is unavailable or invalid. This request is not included in the statistic.
    </p>
    <p>
      The public file contains only the counter value, activation date, schema version and update time.
      It contains no personal data or daily breakdown. The non-personal daily counter values are kept
      permanently so that the total does not decrease when detailed aggregates reach the end of their
      395-day retention period.
    </p>

    <h2>External links</h2>
    <p>
      This website links to GitHub for source code, releases and downloads. When you follow these links,
      GitHub is responsible for its own data processing.
    </p>

    <h2>

    Support via Ko-fi

    </h2>

    <p>

    This website links to Ko-fi for voluntary financial support.

    Payments are processed entirely by Ko-fi and its payment providers.

    KST4Contest itself never receives or processes payment information.

    </p>

    <h2>Your rights</h2>
    <p>
      You may have the right to access, rectification, erasure, restriction of processing,
      data portability and objection under the GDPR.
    </p>

    <h2>Supervisory authority</h2>
    <p>
      You have the right to lodge a complaint with a competent data protection supervisory authority.
    </p>
  </article>
</section>