Privacy policy

Protecting your personal data matters to me. KLAUSUR.AT is deliberately built to collect as little data as possible: no user account, no email address, no advertising and no tracking cookies. Anonymous visitor statistics only run if you consent. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), this policy explains which data is processed when you use KLAUSUR.AT, for what purpose and on what legal basis. This is a translation; the German version is legally binding.

1. Controller

Philip P.M. Jansohn, sole proprietor
Canettistraße 1 / 1201, 1100 Wien, Austria
Email: [email protected]

A data protection officer is not required by law and has not been appointed. For any questions about data protection, please contact me using the details above.

2. Summary

• No sign-up, no email address, no advertising or tracking cookies, no profiling.
• Cookieless, anonymous visitor statistics (Umami) are only loaded with your consent. Session content is never recorded.
• Names are optional. Votes, ratings and pulse checks are always evaluated and displayed anonymously.
• Every session is deleted automatically and completely no later than 30 days after it was created.
• The facilitator can delete a session immediately and irrevocably at any time.
• Content is stored on servers in the European Union.

3. Visiting the website (server log data)

When you visit the website, connection data is processed for technical reasons: IP address, date and time, requested address, amount of data transferred, browser and operating system details and the previously visited page (referrer). This data is required to deliver the website, ensure its stability and security and fend off attacks. It is not combined with other data and is not used to identify individuals.

The legal basis is the legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). Log data is processed by the service providers named in section 9 and deleted after a short period, usually a few days, according to their policies.

4. Using the workshop features

When you create or take part in a session, the following data is processed:

• Session details: the name of the session and, optionally, the name of the company and of the facilitator.
• Participation: an optional display name and the time of joining and of the last activity (to show how many people are currently online).
• Content: ideas, comments, topics, votes, ratings, pulse responses, decisions and actions, including the responsible persons and due dates entered. Ideas and comments are only shown with your display name if you explicitly choose this when submitting.
• Technical identifiers: each device is assigned a random, non-descriptive participant ID when joining. It is used solely to prevent multiple votes and to allow you to delete your own contributions, and is never shown to other participants. Access keys for facilitators and participants are stored on the server only as cryptographic hashes.

The purpose is to provide the features you request. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR) and, where you voluntarily provide names, your consent given by entering them (Art. 6(1)(a) GDPR).

For usage statistics, the server also counts how often certain actions occur – for example how many sessions are created or how many votes are cast per day. Only these daily figures are stored, no content, titles, names, IP addresses or identifiers. They cannot be linked to individual people or sessions.

Note for facilitators: you decide which content is recorded in a session. Please do not enter special categories of personal data (e.g. health data) or confidential personnel matters. If you use KLAUSUR.AT for your company, please inform your participants accordingly.

5. Browser storage (no tracking cookies)

KLAUSUR.AT stores in your browser's local storage (localStorage) your access keys for the sessions you take part in, optionally your most recently used display name, your language, the light/dark display setting and your choice regarding visitor statistics. This storage is strictly necessary for the service (§ 165(3) Austrian Telecommunications Act 2021) and only leaves your device insofar as it is sent to the server to access a session. You can delete this data at any time in your browser settings; afterwards you will no longer have access to previous sessions on this device.

KLAUSUR.AT itself does not set any cookies. The security service Cloudflare named in section 9 may set technically necessary cookies to fend off automated attacks (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR).

6. Abuse prevention

To prevent automated attacks and the guessing of join codes, the number of requests is limited. For this purpose, an encrypted, irreversible hash is derived from your IP address and stored together with a counter for no more than 24 hours. KLAUSUR.AT does not store the IP address itself. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR).

7. Retention and deletion

Every session is deleted automatically 30 days after it was created – including all participants, ideas, votes, ratings, decisions and actions. The facilitator can remove a session immediately and irrevocably at any time via “Delete session”. Exports (PDF, CSV) that you download yourself remain solely with you. You can delete your own ideas and topics yourself.

8. Contacting me

If you contact me by email, I process your details to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once the request has been dealt with and no statutory retention obligations apply.

9. Service providers (processors)

• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany – web hosting and storage of all content in data centres in the European Union.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – providing the encrypted connection (HTTPS), delivery and protection against attacks. Connection data (in particular IP addresses) is processed in the process. Processing in the USA cannot be ruled out; Cloudflare is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Standard contractual clauses apply in addition.

Data processing agreements pursuant to Art. 28 GDPR are in place with these providers and with Umami (see section 10). Data is not passed on to any other third parties, sold or used for advertising purposes.

10. Visitor statistics with Umami (only with consent)

To understand which pages are used and to improve the service, I use the statistics tool Umami – only if you click “Accept” in the notice. Without consent, Umami is not loaded. Umami does not set cookies and stores nothing on your device.

The data recorded is the public page visited (without join codes, parameters or facilitator keys), the referring website, browser, operating system, device type, screen size, language and approximate country or region. Your IP address is transmitted for technical reasons but not stored by Umami; an anonymous, irreversible hash is used to distinguish visits. I cannot identify you. Session rooms and their content are never analysed.

The provider is Umami Software, Inc., 1362 42nd Ave., San Francisco, CA 94122, USA, acting as processor (Art. 28 GDPR). Processing in the USA cannot be ruled out; transfers are based on the European Commission's standard contractual clauses (Art. 46 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future via the “Privacy settings” link at the bottom of every page.

10a. No external content

Beyond that, no marketing tools are used and no content is loaded from third parties: fonts and photos are served from this server, QR codes are generated directly in your browser and PDF reports are created using your browser's print function. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Links to other websites

The website contains links to external services. Data is only transferred to the respective provider once you click such a link; that provider's own privacy policy applies to its processing.

12. Data security

The connection between your browser and KLAUSUR.AT is encrypted via HTTPS. Access rights are checked exclusively on the server, access keys are stored only as hashes and the database is protected against direct access from the internet.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw any consent given at any time with effect for the future. As no user accounts are kept, I can only identify data if you tell me which session is concerned (e.g. join code or link).

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

14. Changes

This privacy policy will be updated if the website or the legal requirements change. The version published here applies.

Last updated: October 2026