What data do we collect?
Server access logs (NGINX): IP address, timestamp, requested path, HTTP status, user agent. Error reports from the browser (Sentry, run on our own servers): technical details of the error, the page and the browser, so we can fix errors. Statistics (PostHog, run on our own servers), at two levels. Always, even without consent, we measure reach anonymously: we count page views with the referrer, browser, operating system, device type and approximate location (country, region, city, postcode); nothing is stored on your device for this, and every page view counts as a new visit. The legal basis is our legitimate interest in understanding how the website is used and improving it (Art. 31(1) FADP, Art. 6(1)(f) GDPR); you can object at any time by switching on «Global Privacy Control» or «Do Not Track» in your browser, and then we measure nothing at all. Only with your consent do we also keep a random identifier in your browser's local storage to recognise returning visits and sessions, and record your session (page layout, mouse movement, clicks, scrolling, page changes), with all text on the page and everything you type replaced by placeholders in your browser; the legal basis is your consent, which you can withdraw at any time with «Cookie settings» in the footer (details in the cookie policy). Company recognition: only with your separate consent do we find out on our server, from your IP address, whether you are connected through an organisation's network (such as your employer, a university or an administration), and store its name, AS number and, where known, domain with your page views, to prepare enquiries from organisations better; internet providers, mobile networks, cloud services, VPNs and networks registered to a private person are discarded. For this we use DB-IP's «IP to ASN Lite» database locally (db-ip.com, licence CC BY 4.0). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw as above. We derive the location and the organisation from your IP address on our own server; we do not store the IP address itself. We do not identify you or build a profile. No cookies. No Google Analytics, no advertising or social-media pixels, no third parties.
For how long?
Server access logs: seven days, then automatic deletion; backup logs are also removed after seven days. Statistics, including the details from company recognition: 180 days, then automatic deletion; if a location cannot be determined, the IP address stays in a technical log for up to 90 days. Session recordings: 90 days, then automatic deletion. Error reports: 180 days, then automatic deletion.
Where is it stored?
On servers in Hetzner Helsinki (HEL1), Finland. Backup to Hetzner object storage in Helsinki. Session recordings are kept in OVH SAS object storage in Paris, France. Never in a US-incorporated entity.
Data processors
Hetzner Online GmbH (hosting, EU). OVH SAS (object storage for session recordings, Paris, EU). Cloudflare is not used.
Your rights
Access, rectification, erasure, data portability, and objection to processing based on our legitimate interest (Art. 21 GDPR). Contact: contact@dxzio.one. Reply within 30 days (FADP requirement).
Supervisory authority
Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.