Privacy Notice

Information pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR). English translation; the German version prevails.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

2. Key points

This website is a static information site. It uses no analytics, advertising or tracking tools, sets no tracking cookies and contains no forms or login functions. The “Add contact” function also generates the vCard locally in the browser; no data is transmitted. Personal data is essentially limited to technical connection data when the page is accessed.

Infrastructure notice: When you access this website, the hosting provider Cloudflare processes technically necessary connection data, in particular your IP address. Details and the data processing agreement with Cloudflare are in section 3.

3. Hosting via Cloudflare and server logs

This website is provided and delivered via the content delivery network and security services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Transmission is encrypted via HTTPS/TLS.

When the website is accessed, Cloudflare processes technically necessary connection data. This includes in particular:

• the IP address of the requesting device,
• the date and time of access,
• the URL accessed and, where applicable, the previously visited page (referrer),
• browser, operating system and device information, and
• technical log and error data.

Processing serves exclusively the secure and reliable delivery of the website, system security, defence against attacks and abuse, and the analysis of technical faults. I do not combine this data with other sources or create user profiles.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of the website). Where Cloudflare processes the data to defend against attacks, processing is based on the same legitimate interest.

Data processing: Cloudflare acts as a processor. A data processing agreement pursuant to Art. 28 GDPR exists on the basis of the Cloudflare Data Processing Addendum (DPA): Cloudflare Customer DPA.

Transfers to third countries: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795); in addition, the Standard Contractual Clauses (SCCs) under the DPA apply.

Retention: Connection data is stored only for as long as necessary for the purposes stated and is deleted afterwards. The specific periods follow from Cloudflare's technical and contractual requirements. I do not operate my own web server with my own server log files.

4. Local storage of the language preference

When you use the language switch to choose between English and German, the website stores your choice in your browser's local storage (localStorage, key mh.lang). This information remains on your device, is not transmitted to me or third parties, and serves solely to retain the selected language on your next visit. You can delete this storage at any time by clearing the website data in your browser settings.

The language can also be selected via the URL parameter ?lang=de or ?lang=en; this parameter is not stored.

Legal basis: § 165(3) Austrian Telecommunications Act 2021 (TKG 2021) (storage strictly necessary to provide the service expressly requested) and/or Art. 6(1)(f) GDPR.

5. Cookies

The website itself sets no cookies. Cloudflare may set technically necessary cookies as part of its security functions, for example to distinguish humans from bots. These serve exclusively the secure delivery of the website, not analysis, advertising or profiling. No marketing or analytics cookies are used.

6. Contact by email or phone

If you contact me by email or phone, I process the data you provide (name, email address, phone number and the content of the message) to handle your inquiry and for possible follow-up questions. Providing this data is neither legally nor contractually required; however, I cannot handle an inquiry without it.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Retention: The data is deleted once it is no longer necessary for handling the inquiry and no statutory retention obligations (in particular tax and company law periods) prevent deletion.

Recipients: Email is received via Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes emails as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum). Transfers to third countries are governed by this DPA, including the Standard Contractual Clauses.

7. Recipients and processors

Cloudflare, Inc. (hosting, delivery and security) and Microsoft Ireland Operations Limited (email communication via Microsoft 365) process data as processors on the basis of agreements pursuant to Art. 28 GDPR. Data is not disclosed to other third parties unless I am legally obliged to do so or you have expressly consented.

8. Your rights

You have the right at any time to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), and
• object to processing (Art. 21 GDPR).

To exercise your rights, a message to michael@hoebling.com is sufficient.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority:

9. No automated decision-making

No automated decision-making, including profiling pursuant to Art. 22 GDPR, takes place.

10. Changes to this privacy notice

I reserve the right to adapt this privacy notice if the technical or legal situation changes. The version published on this page applies.

Last updated: 29 October 2026