Privacy Policy

1. Controller

• Zoran Kalabić
• [POPUNITI: street and number, postal code], Vienna, Austria
• E-mail: kalabic@4m-immo.at
• [POPUNITI: if the controller is a company — name and address; data protection officer, if appointed]

2. Hosting and server logs (Cloudflare)

The site is delivered through the Cloudflare network (Cloudflare, Inc., USA, with infrastructure in the European Union as well). On every visit Cloudflare technically processes your IP address, date and time, the page requested, referrer, browser and operating system type. This data serves content delivery, protection against attacks and troubleshooting, and is kept for a short time in server logs.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and stable website). Cloudflare is certified under the EU–US Data Privacy Framework and applies the EU standard contractual clauses for data transfers.

3. Contact form, e-mail and WhatsApp

When you send a message through the contact form we process your name, e-mail address and the content of the message — solely to reply to you. The message is forwarded as an e-mail to our address via the Resend service (Resend, Inc., USA; transfer based on the EU standard contractual clauses). Your IP address is used only temporarily, in the server’s memory, to limit the number of messages (abuse protection) and is not stored.

Legal basis: Art. 6(1)(b) GDPR (steps at your request prior to entering into a contract) and Art. 6(1)(f) (legitimate interest in communication and abuse protection). We delete the data once your request has been dealt with, unless we are legally required to keep it longer.

If you write to us directly by e-mail or via WhatsApp, the privacy rules of those services also apply (for WhatsApp: WhatsApp Ireland Limited / Meta).

4. Purchases in the shop (Stripe) and waiting list

Payments are processed via Stripe Checkout (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). Card details are entered directly on Stripe’s page; we never see or store them. To process your order we handle your name, e-mail address, shipping address (for the printed edition), the products ordered and the payment status. For digital editions the download link is sent to your e-mail address.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) (statutory obligation to retain accounting records — in Austria generally seven years). For payment data Stripe acts as an independent controller; see Stripe’s privacy policy for details.

Waiting list: if you leave your e-mail address on an edition’s page so that we can tell you when it goes on sale (“Notify me”), we store it together with the chosen edition, the language and the time of sign-up in our database (Cloudflare D1, see section 2) solely for that single notification. We do not use it for advertising or pass it on to third parties; we delete it once the notification has been sent, or earlier at your request. Legal basis: Art. 6(1)(a) GDPR (consent) — you may withdraw it at any time (section 10).

5. Zoki — AI assistant

Zoki is an AI-based assistant that answers questions about the biography, the book, news and contact details. The questions you enter, together with the previous messages of the same conversation, are sent through our server to the language-model provider — Anthropic, PBC (USA) — to generate an answer. The transfer is based on the EU standard contractual clauses; under the commercial terms of the Anthropic API, your input is not used to train models.

The conversation is not linked to an account and we do not store it permanently; your IP address is used briefly to limit the number of requests. Please do not enter sensitive personal data into the chat. If you leave contact details via Zoki (name, e-mail or phone) so that we can get back to you, they are forwarded in the same way as a contact-form message (section 3).

Legal basis: Art. 6(1)(a) GDPR (consent, given by starting a conversation and revocable at any time) and Art. 6(1)(f) (legitimate interest in abuse protection).

6. News

News items are part of the static website: posts from our editorial platform are built into the site when it is generated, so nothing is loaded from other servers while you read. No personal data is passed to third parties in the process, apart from the technical data described in section 2.

7. Embedded video (YouTube)

On the Video page we embed videos from YouTube (Google Ireland Limited, Ireland). When you play a video, YouTube may set cookies and process data about your device and behaviour, including transfers to the USA (Google LLC). Legal basis: Art. 6(1)(a) GDPR — consent given by starting the video. Videos are embedded sparingly: until you click, only the video thumbnail is shown, loaded from Google’s image server (i.ytimg.com) — this discloses your IP address to Google. Only when you press the play button is the YouTube player loaded in privacy-enhanced mode (domain youtube-nocookie.com, without related-video suggestions and without autoplay).

8. Cookies and local storage

The site uses no tracking cookies and no analytics or advertising tools. Technically necessary cookies may be set by Cloudflare (abuse protection), Stripe (during payment) and YouTube (during playback). The site language is determined by the page address (/, /en, /de) without storing a preference in your browser. [POPUNITI: if analytics is added later, e.g. Cloudflare Web Analytics].

9. Social media

The site only contains links to profiles on Facebook and Instagram and to WhatsApp — no embedded plug-ins that would transmit data while you merely view a page. By clicking a link you leave our site and the privacy rules of that service apply.

10. Your rights

Under the GDPR you have the right to:

• access the data we process about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

If you believe that the processing of your data violates the law, you may lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, https://www.dsb.gv.at.

11. Security and retention

The site is delivered exclusively over encrypted connections (HTTPS/TLS). We process only the data necessary for the purposes stated and delete it once the purpose has ceased, unless the law requires longer retention.

12. Privacy contact

For any questions and to exercise your rights, write to kalabic@4m-immo.at. [POPUNITI: postal address; dedicated data-protection contact, if any].

13. Changes

We adapt this policy whenever the site or the legal framework changes. The version published on this page applies.