Privacy policy

1. Controller

2. Overview

This website does not use tracking, analytics tools, advertising cookies or embedded third-party content. Fonts and media are delivered by this website itself. Payment data is neither entered nor stored on this website.

3. Hosting and server logs

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). When you visit, Cloudflare processes technically necessary data such as IP address, time, requested address, browser identifier and referrer in order to deliver the website and protect it against attacks.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and stable provision of the website. A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). We do not analyse these logs for advertising or analytics purposes.

4. Feedback form

If you voluntarily send feedback, we store the text, the selected visibility, a display name and profile photo if you choose them, the page language, the time and the moderation status. We do not ask for an email address or your real name.

The legal basis is your consent under Art. 6(1)(a) GDPR. Public posts are published only after review and only with your consent. You can withdraw your consent at any time with effect for the future; the post will then be deleted.

To prevent abuse, your IP address is hashed together with a secret key and stored as a pseudonymous counter for at most 24 hours. The IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR.

If you choose public display with a name, you can optionally add a profile photo. It is resized to 256 × 256 pixels and re-encoded in your browser, which removes metadata such as location, camera data and capture time. The server checks this again and only accepts cleaned images. The photo is published only with your separate consent (Art. 6(1)(a) GDPR) and after review, and it is deleted together with the post or separately on request.

The data is stored in a Cloudflare database (Cloudflare D1) located in the European Union.

• Unreviewed posts are deleted after 90 days at the latest.
• Rejected posts are deleted after 30 days at the latest.
• Posts intended only for Esa are deleted after 180 days at the latest.
• Published posts remain visible until consent is withdrawn or Esa removes them.

5. Security check with Cloudflare Turnstile

Cloudflare Turnstile is loaded only on pages with the feedback form to prevent automated submissions. Cloudflare processes technical information about your browser and device as well as your IP address. The legal basis is Art. 6(1)(f) GDPR; access to information on your device is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG). More information: https://www.cloudflare.com/privacypolicy/

6. Payments

The website does not process payments itself and stores no payment data. For bank transfers, your bank and Esa's bank process the payment data. If you choose PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, whose privacy policy applies.

As the payment recipient, Esa receives the details transmitted by the bank or PayPal, such as name, amount and, where applicable, the payment reference. These details are used only to allocate and document payments (Art. 6(1)(b) and (f) GDPR), are never published and are deleted once statutory retention periods have expired.

6a. Overview of received payments

For his own overview, Esa imports bank and PayPal statements into a protected internal area of this website. Stored are date, amount, currency, the PayPal fee where applicable, and the payer's name and payment reference. Name and reference are stored encrypted. Only Esa and one technical helper can access this area after signing in with a one-time code.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is documenting and transparently using the donations. The data is never published or shared. Individual imports can be deleted at any time; entries are deleted after three years at the latest unless a retention obligation applies.

7. Links to Instagram

The website contains plain links to the Instagram profile @achi.afg. No Instagram content is embedded. Only when you click a link are you taken to Instagram (Meta Platforms Ireland Ltd.), whose privacy policy applies.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)). You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Because no contact details are stored with feedback, please mention the approximate time and the text of your post in any request so that we can find it.

9. No automated decisions

No automated decision-making, including profiling, takes place.