Privacy.
I'm Bernhard Berger. This is my personal website, and I'm responsible for the personal data it processes. If you have a privacy question or request, email me at bernhard.berger@gmail.com. The imprint has my other legal details.
The website doesn't set cookies of its own. Fonts and images load from this website, not from other services.
Hosting and connection data
Cloudflare hosts this website and processes connection data, including IP addresses and requested resources, to deliver and protect it. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in running a reliable, secure website. Infrastructure processing is separate from optional analytics and from the consent database.
Cloudflare operates internationally, including in the United States. EU-only processing is not promised. Its data processing addendum describes applicable transfer safeguards, including standard contractual clauses and the EU-US Data Privacy Framework where applicable.
Your browser has to send this connection data for the website to load. Cloudflare's privacy policy says it handles the logs it shows me, and the content passing through its network, on my behalf. For other visitor data it collects, Cloudflare is a controller in its own right. It doesn't give a single retention period for connection data; it keeps personal information as long as its stated purposes and legal obligations require.
OVHcloud handles redirects from bernhardberger.at to www.bernhardberger.at, processing connection data to deliver and secure them. The same legitimate-interest basis applies; its hosting terms do not specify raw-log retention.
If Cloudflare's security checks challenge your browser, Cloudflare may set a cookie called cf_clearance. It records that you passed the check.
The consent database described below is an exception to the global setup: it is created in Cloudflare's EU jurisdiction, so Cloudflare runs it and stores its data inside the EU. Requests to it still travel through Cloudflare's global network.
More from Cloudflare: its privacy policy and data processing addendum. More from OVHcloud: data protection.
Optional analytics
If you accept, I use Cloudflare Web Analytics to measure page visits and loading performance. It receives page and referrer information, browser and device information, and performance measurements. Cloudflare's statistics also show which country each visit comes from. This helps me understand which pages are useful and find loading problems. The legal basis is your consent under Article 6(1)(a) GDPR and § 165(3) TKG 2021.
The analytics script loads only after your acceptance has been recorded. Cloudflare says Web Analytics does not use cookies, local storage or fingerprints to track visitors across sites. Your IP address reaches Cloudflare when your browser connects; Cloudflare says its RUM service discards it at the receiving data centre.
Cloudflare keeps unsampled RUM data for seven days, then reduces it for longer-term statistics. The dashboard provides up to six months of statistics; that is not a promise that all provider data is deleted after six months.
You can refuse without losing access to the site. Use privacy choices in the footer to withdraw consent at any time. Withdrawal stops future analytics and reloads the page. It does not change the lawfulness of processing before withdrawal or erase statistics already collected.
More from Cloudflare: how Web Analytics collects data, the Web Analytics FAQ and its privacy policy.
Remembering and recording your choice
I remember either choice in this browser for six months using local storage. This storage serves only your privacy choice. If storage is unavailable, analytics stays off. Clearing site data removes the remembered choice. Your choice applies to this site origin, not to other browsers or devices.
The privacy choices panel also uses session storage, which your browser normally clears when you close the tab. While your acceptance is being recorded, it holds a retry ID so that a lost response does not create a second receipt. When the page reloads to stop analytics, a short-lived flag returns keyboard focus to the privacy choices button.
When you accept, a Cloudflare D1 database records a random receipt ID, a retry ID, the purpose, the notice version, and the server's acceptance and expiry times. If you withdraw, it also records the withdrawal time. The receipt is not used as an analytics identifier. I do not add your IP address, browser fingerprint or browsing history to this database. An initial refusal stays in your browser.
These records help me demonstrate consent under Article 7(1) GDPR; the legal basis for that recordkeeping is Article 6(1)(c) GDPR. Records are scheduled for deletion 30 days after consent expires or is withdrawn, whichever happens first. Daily cleanup may take up to another day, and Cloudflare's D1 recovery copies may retain deleted records for a further seven days on the free plan.
If recording fails, analytics stays off. A withdrawal takes effect in your browser immediately, even if its receipt cannot be updated. The browser keeps that update pending and retries when you next use the site. The privacy choices panel shows your receipt ID, which you can include in a privacy request.
Consent notice version: 2026-10-13.2.
Your rights
You can ask me for access to your personal data and have it corrected or deleted. You can also ask me to restrict processing, and in some cases to give you your data in a portable format. Each right applies under the conditions the GDPR sets for it.
You can object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. Email me at the address above.
If you accepted analytics, you can withdraw your consent at any time under privacy choices in the footer.
I don't use your data for automated decisions that have legal or similarly significant effects on you.
You can also complain to a data protection supervisory authority, such as the Austrian Data Protection Authority.