Privacy
Privacy Policy
This website is built to know as little about you as possible. It has no accounts, no forms, no cookies, no analytics and no third-party services. This page explains the small amount of data that is still processed — mainly your IP address, because no website can be delivered without it.
Version 1.1 · Last updated
Who is responsible
The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) for this website is:
- Name: Azorel (private individual)
- Country: Romania
- E-mail: contact@azorel.eu
Write to the e-mail address above with any question about your personal data or to exercise your rights. No data protection officer has been designated; this is not required for the processing described here.
In short
- No cookies and no other data are stored on your device. No consent banner is needed because nothing requires consent.
- No analytics, advertising, tracking pixels, fingerprinting or social media plug-ins.
- Fonts, scripts, images and the Azorel film are served from our own server — your browser does not contact any other company when you visit.
- The server keeps short technical logs: access logs with a shortened IP address for 7 days, and error and security logs for 14 days.
- Your data is processed on a server in Romania and does not leave the European Union.
Delivering the website
When you open a page, your browser sends a request to our server. To answer it, the server necessarily processes your IP address, the date and time, the address of the requested file, and the technical information your browser sends with every request (such as the browser type, language preferences and, where your browser sends it, the page you came from).
This information is processed in memory to establish the encrypted connection and deliver the requested content, and is then discarded — except for the log entries described below.
The hero film is delivered in two framings. Your browser chooses one based on the shape of its window (landscape or portrait); the server therefore sees which version was requested. This is not stored beyond the logs described below and is not used for any other purpose.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to make the website available to you and to operate it securely; without this processing the website cannot be displayed.
Server logs
The web server keeps two kinds of logs:
| Log | Contents | Purpose | Kept for |
|---|---|---|---|
| Access log | Shortened IP address (IPv4: last block removed; IPv6: only the first three blocks kept), time, requested path without query parameters, HTTP status, response size and response time. No browser identification and no referrer. | Operation and troubleshooting of the website | 7 days |
| Error & security log | Written only when something goes wrong or a request is blocked (for example by rate limiting). May contain the full IP address, the full requested address and the referring page. | Detecting and defending against attacks and abuse; fixing faults | 14 days |
Logs are rotated daily and deleted automatically when the period expires. They are readable only by the server administrator, are not combined with other data, and are not used to identify or profile visitors. The retention periods are the shortest that still allow faults and attack patterns spanning several days to be investigated.
To protect the website against overload and automated abuse, the server limits how many requests a single IP address may make per second. For this, the IP address is held briefly in server memory and is not written to disk unless a request is blocked.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the security and stability of the website, which also serves our obligation under Art. 32 GDPR to protect the data we process.
The application that renders the pages does not log individual requests.
Recipients and hosting
We do not sell, share or disclose visitor data to anyone. The website loads no third-party resources, so no other company receives information about your visit through your browser.
The website runs on a server physically located in Romania, operated by: the operator's own server — no hosting provider is involved. No processor within the meaning of Art. 28 GDPR is involved in delivering the website.
Your data is not transferred to countries outside the European Union or the European Economic Area.
We may have to disclose data to public authorities only where we are legally obliged to do so.
When you contact us
If you write to contact@azorel.eu, we process your e-mail address, any other details you include and the content of your message solely to answer you (Art. 6(1)(f) GDPR — our legitimate interest in replying to enquiries).
E-mail for azorel.eu is received and stored on the operator's own mail server, which runs on the same server in Romania; no e-mail provider is involved. Like every mail server, it automatically checks incoming messages for spam and malware. We delete the correspondence once your request has been dealt with, at the latest after 12 months, unless you ask us to delete it sooner or the law requires a longer retention.
Your rights
Under the GDPR you have the right to:
- obtain access to your personal data (Art. 15);
- have inaccurate data rectified (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format, where applicable (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21).
Because log entries carry only a shortened IP address and no other identifiers, we may be unable to attribute them to you; in that case Art. 11 GDPR applies, and we will tell you so. If you can provide additional information that allows identification, we will take it into account.
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Providing data is neither a statutory nor a contractual requirement, but without your IP address the website cannot be delivered to you.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). As the controller is established in Romania, the authority responsible for the controller is the Romanian ANSPDCP. For example:
- Romania — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP): dataprotection.ro
- Austria — Österreichische Datenschutzbehörde (DSB): dsb.gv.at
- All other EU/EEA authorities are listed by the European Data Protection Board: edpb.europa.eu
Security
All connections are encrypted with TLS (HTTPS only, with HTTP Strict Transport Security). The application runs isolated, without privileges and with a read-only file system, behind a reverse proxy that accepts only the request types the website needs and limits request rates. The website contains no third-party code, and a strict Content Security Policy prevents the browser from loading resources from other origins.
Changes to this policy
We update this policy whenever the website's processing changes — for example before introducing any new feature that processes personal data. The version and date at the top of this page always show the current state.