Privacy Notice

Controller and contact Link to heading

I am responsible for the processing of personal data described here:

Aleš Lončar
Mindelheimer Str. 13A
81476 Munich
Germany

Email: [email protected]

I have not appointed a data protection officer. You can contact me directly about your data. My business details are in the Imprint.

Hosting and delivery Link to heading

Cloudflare delivers and protects this website. Amazon Web Services (AWS) hosts its static files in Amazon S3 in Frankfurt (eu-central-1). Requests can include your IP address, the requested URL, time, browser information and security-related request data. These providers process this information to deliver the site, investigate errors and protect it against abuse.

I rely on Art. 6(1)(f) GDPR for this processing. My legitimate interest is secure and reliable operation of the website.

  • Cloudflare request and security logs: this site uses Cloudflare’s Free plan. I do not receive or export raw request logs; the Cloudflare dashboard shows me only aggregated traffic and security statistics. Cloudflare keeps its own operational logs as described in its privacy policy.
  • S3 server access logging: disabled. AWS does not create request logs of this site for me.
  • Cloudflare: Cloudflare, Inc. (USA) processes this data on my behalf under its Data Processing Addendum. Cloudflare is certified under the EU–U.S. Data Privacy Framework; the addendum provides the EU Standard Contractual Clauses if that certification ever lapses.
  • AWS: my contracting party is Amazon Web Services EMEA SARL, Luxembourg, and the files are stored in Frankfurt. For any transfer to the United States, AWS is certified under the EU–U.S. Data Privacy Framework.

Images and other media are also requested from cdn.loncar.net. These requests disclose your IP address, browser information, the requested media and potentially the referring page to the media delivery provider. The purpose and legal basis are the same as for hosting above.

This media delivery is provided by bunny.net, operated by BunnyWay d.o.o., Ljubljana, Slovenia (EU), which fetches the files from the S3 storage above.

  • bunny.net request logs: enabled, with IP addresses anonymised. bunny.net keeps these logs for 3 days; I do not store them permanently.

Email contact Link to heading

When you email [email protected], I process your message, contact details and email metadata to respond and, where relevant, discuss a project. Email is handled through Google Workspace.

The legal basis is Art. 6(1)(b) GDPR for enquiries about entering into a contract. For other correspondence, it is Art. 6(1)(f) GDPR: my legitimate interest in responding to relevant messages. You do not have to contact me, but I need enough information to respond to an enquiry.

  • Retention: enquiries that do not lead to a project are deleted 12 months after the last message. If a project follows, I keep the correspondence for as long as German tax law requires (§ 147 AO), typically up to 8 years for invoices and accounting records; the legal basis for this is Art. 6(1)(c) GDPR.
  • Google Workspace: my contracting party is Google Cloud EMEA Limited, Dublin, Ireland, acting as my processor. For transfers to the United States, Google relies on the EU–U.S. Data Privacy Framework.

Google Analytics 4 Link to heading

If you accept optional analytics, this website loads Google Analytics 4 to help me understand visits and use of the site. Until you accept, the Google tag is not loaded and the site sends no analytics requests to Google. Rejecting analytics does not restrict access to the site.

Google processes usage data such as page views, interactions, approximate location and browser and device information. Google acts as a processor for analytics. Processing can involve transfers to the United States.

The legal bases are your consent under Art. 6(1)(a) GDPR and, for accessing or storing information on your device, § 25(1) TDDDG.

The tag uses these first-party cookies:

  • _ga distinguishes visits using a browser identifier.
  • _ga_<ID> maintains session state.

Both cookies are configured to last two years, refreshed on visits while analytics is enabled.

Browser restrictions can shorten these lifetimes. The six-month consent choice is separate from cookie lifetime: when consent expires, analytics stays off until you accept again, and this site removes its accessible _ga* cookies.

Google states that Analytics uses IP addresses to derive approximate location, and does not log or store individual IP addresses from EU, Swiss or UK visitors. See Google’s regional privacy information and cookie documentation.

This site’s tag disables Google signals and advertising personalization signals.

  • Analytics user and event data retention: 2 months.
  • Google Analytics is provided by Google Ireland Limited, Dublin, Ireland. For transfers to the United States, Google relies on the EU–U.S. Data Privacy Framework, and on the EU Standard Contractual Clauses where no framework applies.
  • I have accepted Google’s data processing terms. Google signals is turned off for the property, and it is not linked to Google Ads.

Use Privacy settings in the footer to change your choice. Rejecting after accepting stops the tag, removes accessible _ga* cookies for this site and reloads the page. Withdrawal does not affect the lawfulness of processing before withdrawal. It does not itself delete data already processed by Google; contact me if you want to exercise your data rights.

Content you choose to load Link to heading

Comments, videos and X posts remain inactive until you click the button for that item. Each click authorizes that item for the current page only; it does not enable analytics or other embeds. Ordinary links take you to the provider’s website only when you follow them.

  • Giscus and GitHub: loading comments connects to giscus.app and GitHub, disclosing your IP address, browser information and the page address used to identify the discussion. Signing in uses your GitHub account; comments and reactions are associated with it and may be public. See the Giscus privacy policy and GitHub privacy statement.
  • YouTube: playing a video connects to Google’s player at youtube-nocookie.com. Google receives request and device information, including your IP address, and may use browser storage when you interact with the player. The privacy-enhanced domain does not make playback anonymous. See Google’s privacy policy.
  • X: loading a post downloads X’s widget and connects to X. X receives your IP address, browser and device information and may use cookies or associate activity with an existing account. See X’s privacy policy.

The legal basis is Art. 6(1)(a) GDPR and, where optional device storage or access occurs, § 25(1) TDDDG. You can stop further embedded requests by reloading the page without loading the item again. Closing the page has the same effect. This cannot undo data already transmitted or remove cookies stored on providers’ domains.

Who receives the data once you click:

  • Giscus: an independent open-source project, not part of any company. Its privacy policy states that it collects and stores no data. If you sign in with GitHub, it keeps an encrypted sign-in token in your browser’s local storage.
  • GitHub: GitHub B.V. (Amsterdam) or GitHub, Inc. (USA). GitHub is certified under the EU–U.S. Data Privacy Framework and also relies on the EU Standard Contractual Clauses.
  • YouTube: Google Ireland Limited, Dublin, Ireland, is the controller for visitors in the EEA. Google relies on the EU–U.S. Data Privacy Framework for transfers to the United States.
  • X: X Internet Unlimited Company, Dublin, Ireland, has been the controller for users in the EU since April 2025.

Each of these providers decides for itself how long it keeps this data. Their privacy policies, linked above, describe their retention.

Strictly necessary browser storage Link to heading

The following settings are stored locally in your browser:

  • colorscheme remembers your chosen light or dark colour scheme until you clear this site’s browser storage.
  • consent.v1 records only your analytics choice and its date. The choice is valid for six months and is replaced when you choose again.

The consent record does not contain a visitor identifier and is not sent to a server. Expired records are ignored; clearing browser storage also resets your choice. If storage is unavailable, your choice can only apply to the current page.

I rely on § 25(2) no. 2 TDDDG for the storage needed to remember your requested settings, and Art. 6(1)(f) GDPR for the associated processing. My legitimate interest is respecting your preferences without asking on every visit.

Your rights Link to heading

Subject to the conditions in Arts. 15–21 GDPR, you can request access to your personal data, correction, erasure, restriction of processing and data portability. Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. You can withdraw consent at any time.

Contact [email protected] to exercise these rights. You can also lodge a complaint under Art. 77 GDPR with a supervisory authority, including the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.

I do not use your data for decisions based solely on automated processing that produce legal or similarly significant effects.

Version and changes Link to heading

Version: 1 November 2026.

I will update this notice when the site’s processing changes. A future project-enquiry form will need its own description here before it is introduced.