Privacy
Privacy Policy
This website is built to know as little about you as possible. It has no accounts, no forms, no analytics and no third-party services. This page explains the small amount of data that is still processed — mainly your IP address, because no website can be delivered without it.
Version 1.2 · Last updated
Who is responsible
The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) for this website is:
- Name: Azorel (private individual)
- Country: Romania
- E-mail: contact@azorel.eu
Write to the e-mail address above with any question about your personal data or to exercise your rights. No data protection officer has been designated; this is not required for the processing described here.
In short
- No analytics, advertising, tracking pixels, fingerprinting or social media plug-ins.
- Nothing is stored on your device — unless you choose a language yourself; then one small cookie remembers that choice.
- On your first visit, your IP address is matched against a local country database to show the site in Romanian, German or English. Nothing about this is stored, and your IP address is not sent anywhere.
- Fonts, scripts, images and the Azorel film are served from our own server — your browser contacts no other company when you visit.
- The server keeps short technical logs: access logs with a shortened IP address for 7 days, error and security logs for 14 days.
- Your data is processed on a server in Romania and does not leave the European Union.
Delivering the website
When you open a page, your browser sends a request to our server. To answer it, the server necessarily processes your IP address, the date and time, the address of the requested file, and the technical information your browser sends with every request (such as the browser type, language preferences and, where your browser sends it, the page you came from).
This information is processed in memory to establish the encrypted connection and deliver the requested content, and is then discarded — except for the log entries described below.
The hero film is delivered in two framings. Your browser chooses one based on the shape of its window (landscape or portrait); the server therefore sees which version was requested. This is not stored beyond the logs described below.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to make the website available to you and to operate it securely; without this processing the website cannot be displayed.
Choosing your language
Every page exists in Romanian, German and English, and its address says which (/ro/…, /de/…, /en/…). Such addresses are always shown in that language.
When you open an address without a language — such as azorel.eu itself — the server chooses one:
- your own earlier choice, if you made one with the language selector (see cookies);
- otherwise the country of your IP address: Romania → Romanian, Austria and Germany → German, every other or unknown country → English.
The country is looked up in a local copy of the DB-IP country database on our own server, in memory, in well under a millisecond. The result is used only for this one decision; it is not stored, not logged and not combined with anything else. Your IP address is not sent to DB-IP or anyone else — we only download their public database once a month (IP geolocation by DB-IP, licensed under CC BY 4.0). Using a VPN or proxy simply leads to a different default; you can always switch.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in presenting the website in a language you are likely to understand. You can override the choice at any time with the language selector.
Server logs
The web server keeps two kinds of logs:
| Log | Contents | Purpose | Kept for |
|---|---|---|---|
| Access log | Shortened IP address (IPv4: last block removed; IPv6: only the first three blocks kept), time, requested path without query parameters, HTTP status, response size and response time. No browser identification, no referrer, no country. | Operation and troubleshooting | 7 days |
| Error & security log | Written only when something goes wrong or a request is blocked (for example by rate limiting). May contain the full IP address, the full requested address and the referring page. | Detecting and defending against attacks and abuse; fixing faults | 14 days |
Logs are rotated daily and deleted automatically when the period expires. They are readable only by the server administrator, are not combined with other data, and are not used to identify or profile visitors. The retention periods are the shortest that still allow faults and attack patterns spanning several days to be investigated.
To protect the website against overload and automated abuse, the server limits how many requests a single IP address may make per second. For this, the IP address is held briefly in server memory and is not written to disk unless a request is blocked.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the security and stability of the website, which also serves our obligation under Art. 32 GDPR to protect the data we process. The application that renders the pages does not log individual requests.
Recipients and hosting
We do not sell, share or disclose visitor data to anyone. The website loads no third-party resources, so no other company receives information about your visit through your browser.
The website runs on a server physically located in Romania, operated by the operator themselves — no hosting provider is involved. No processor within the meaning of Art. 28 GDPR is involved in delivering the website. Your data is not transferred to countries outside the European Union or the European Economic Area.
We may have to disclose data to public authorities only where we are legally obliged to do so.
When you contact us
If you write to contact@azorel.eu, we process your e-mail address, any other details you include and the content of your message solely to answer you (Art. 6(1)(f) GDPR — our legitimate interest in replying to enquiries).
E-mail for azorel.eu is received and stored on the operator's own mail server, which runs on the same server in Romania; no e-mail provider is involved. Like every mail server, it automatically checks incoming messages for spam and malware. We delete the correspondence once your request has been dealt with, at the latest after 12 months, unless you ask us to delete it sooner or the law requires a longer retention.
Your rights
Under the GDPR you have the right to:
- obtain access to your personal data (Art. 15);
- have inaccurate data rectified (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format, where applicable (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21).
Because log entries carry only a shortened IP address and no other identifiers, we may be unable to attribute them to you; in that case Art. 11 GDPR applies, and we will tell you so. If you can provide additional information that allows identification, we will take it into account.
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR — choosing a default language from a country has no legal or similarly significant effect and can be changed with one click. Providing data is neither a statutory nor a contractual requirement, but without your IP address the website cannot be delivered to you.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). As the controller is established in Romania, the authority responsible for the controller is the Romanian ANSPDCP. For example:
- Romania — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP): dataprotection.ro
- Austria — Österreichische Datenschutzbehörde (DSB): dsb.gv.at
- Germany — the data protection authority of your federal state, listed by the Federal Commissioner (BfDI): bfdi.bund.de
- All other EU/EEA authorities are listed by the European Data Protection Board: edpb.europa.eu
Security
All connections are encrypted with TLS (HTTPS only, with HTTP Strict Transport Security). The application runs isolated, without privileges and with a read-only file system, behind a reverse proxy that accepts only the request types the website needs and limits request rates. The website contains no third-party code, and a strict Content Security Policy with per-request nonces prevents the browser from running scripts the site did not issue.
Changes to this policy
We update this policy whenever the website's processing changes — for example before introducing any new feature that processes personal data. The version and date at the top of this page always show the current state.