Privacy policy

1. Controller

The controller responsible for the processing of personal data on this website under the EU General Data Protection Regulation (GDPR) is:

Liv Grete Schupp
Im Grün 3
77886 Lauf
Germany
Email: livgrete.s@outlook.com

THE AGORA is a private, non-commercial essay website without advertising.

2. Hosting and delivery of the website

The website is operated by Render Services, Inc., 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA ("Render"). The application server and the database are located in Render's Frankfurt region (EU). All content of this website, i.e. essays, images and comments, is stored there and delivered from there.

Whenever you visit the website, your browser technically has to transmit certain data, in particular your IP address, the requested address, date and time, and information about your browser and operating system. Render routes all requests through the network of Cloudflare, Inc., USA, for delivery and protection against attacks (DDoS). In the process, your IP address in particular is processed, possibly also on servers outside the EU. Render uses further sub-processors (including Amazon Web Services and Google Cloud); the current list is available at render.com/security.

The purpose is the secure and stable provision of the website. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in offering the website reliably and protected against attacks.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Render (Render Data Processing Addendum, render.com/dpa). Render is a US company; according to this agreement its processing operations mainly take place in the United States. Access from the US is therefore possible despite the Frankfurt storage location. Transfers to the US are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Render is certified, and alternatively on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the agreement mentioned above and can be viewed there.

Render additionally processes certain connection and usage data under its own responsibility, for example to detect and prevent abuse and attacks. Details, including retention periods, can be found in Render's privacy policy: render.com/privacy.

The application itself keeps no access log and does not store your IP address. It only logs start and stop messages as well as error messages; an error message contains the error text and the requested path, but no IP address and no form content. Render deletes these logs automatically after 7 days. Deleted data may remain in Render's database backups for a short time (according to Render, currently up to 3 days for restore points and up to 7 days for database exports).

3. Protection against abuse

When you submit a comment, sign in or set a password via an access link, your IP address is held in the server's working memory for a maximum of 15 minutes in order to limit the number of attempts (protection against spam and password guessing). It is not stored in the database or in logs. The comment form also contains a field that is invisible to humans and helps to detect automated spam programs; no further data about you is collected for this. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in protecting the website and its users against abuse.

4. Contact by email

If you contact us by email, for example with questions, suggestions or deletion requests, your email address, your name if provided and the content of your message are processed in order to handle and answer your request. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in answering your request. Where your request concerns the conclusion or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. Contacting us is voluntary.

Emails to this address are received and stored via the Outlook.com service. For users in the EU, the provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Processing by Microsoft Corporation in the USA is possible; Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Information on data protection at Microsoft: microsoft.com/privacy/privacystatement.

Your message is deleted as soon as your request has been dealt with, unless statutory retention obligations apply.

5. Comments

You can comment on the essays without an account. Only the following is stored: the name or pseudonym you choose, the comment text, the date and time of submission, the essay the comment belongs to, where applicable the comment you are replying to, and the moderation status (pending, approved or rejected). No email address is requested, and your IP address is not stored together with the comment (for the brief processing for abuse protection, see section 3).

Every comment is reviewed before publication. Approved comments are publicly visible below the respective essay together with the chosen name or pseudonym and the date and time. Liv Grete Schupp may reply to comments publicly. Please do not include anything in your name or text that you do not want to be made public.

The purpose is a factual, moderated discussion of the essays. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in enabling a moderated public discussion and filtering out unlawful or inappropriate contributions before publication. Commenting is voluntary; without a name or pseudonym and comment text, no comment can be stored and published.

Pending and approved comments remain stored until you request their deletion, they are removed editorially or the associated essay is deleted. Rejected comments are deleted automatically 30 days after submission. When a comment is deleted, the replies to it are removed as well.

You can request the deletion of your comment at any time by email to livgrete.s@outlook.com. As neither an account nor an email address is stored, please state the essay, the name you used and the approximate time, so that the comment can be identified.

6. Author access

The protected author area is used exclusively to manage the essays and to moderate comments; there are no accounts for readers. For these accounts, the email address, a hash of the password created with the bcrypt method (not the password itself), the role and status of the account, the time of creation and session data are stored. Session data consists of a random session ID, a security token against forged form requests (CSRF protection), the link to the signed-in account and the expiry time.

A session ends when you sign out; the session data is then deleted and the cookie removed. Without signing out, a session expires 14 days after the last activity and is then deleted automatically.

One-time access links are used to set up access and to set a new password. Only a hash of the link is stored, not the link itself. An access link is valid for 72 hours and can only be used once; the entry is deleted automatically 7 days after use or expiry. The accounts themselves remain stored until they are deleted.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in administering the website and protecting the administration area against unauthorised access.

7. Cookies, tracking and external content

This website uses exactly one cookie, named agora.sid. It is only set when you open the sign-in page or an access link to the author area, or when you sign in. It contains nothing but a random, signed session ID; the associated session data (see section 6) is kept in the database on the server. The cookie is protected with the attributes HttpOnly, Secure and SameSite=Lax. It expires 14 days after its last use and is deleted when you sign out. Readers and people who comment without an account do not receive any cookie.

The cookie is strictly necessary to provide the service you have expressly requested, namely signing in to the author area and protecting it against forged form requests. No consent is required for this (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The processing of the session data is based on Art. 6(1)(f) GDPR (see section 6).

There are no analytics, marketing or social media cookies and no comparable technologies such as tracking pixels or local storage, no audience measurement (such as Google Analytics), no advertising and no embedded social media content. Fonts, scripts and images, including uploaded images, are delivered exclusively by this website itself. Apart from the delivery via Render and Cloudflare described in section 2, your browser does not connect to any third-party servers when you visit the pages.

References to other websites, for example in the lists of references, are not loaded automatically. A connection to a third-party website only occurs if you visit it yourself; the respective operator is responsible for the data processing there.

8. Recipients

Personal data can be accessed by Liv Grete Schupp and by the following recipients, in each case only as far as necessary for their task:

• Render Services, Inc. as processor for hosting and the database, including its sub-processors such as Cloudflare, Inc. (see section 2);
• Microsoft for emails to the contact address (see section 4);
• a person who provides technical support for the website on behalf of Liv Grete Schupp, for example for maintenance and troubleshooting, and who is bound by her instructions.

Approved comments are public and therefore visible to all visitors. Personal data is not sold and is not used for advertising, newsletters or profiling. There is no automated decision-making, including profiling (Art. 22 GDPR).

9. Retention periods at a glance

• IP address for abuse protection: a maximum of 15 minutes, in working memory only.
• Application logs (start, stop and error messages, without IP addresses): 7 days, then deleted automatically by Render.
• Pending and approved comments: until deleted on request, by the author or together with the essay.
• Rejected comments: deleted automatically 30 days after submission.
• Session data and cookie: until you sign out, at the latest 14 days after the last activity.
• One-time access links: valid for 72 hours, deleted 7 days after use or expiry.
• Author accounts: until the account is deleted.
• Emails: until the request has been dealt with, unless statutory retention obligations apply.
• Database backups at Render: deleted data for a short time (see section 2).
• Data processed by Render under its own responsibility: according to Render's privacy policy.

The automatic deletions run when the application starts and every 12 hours thereafter; a period may therefore be extended by up to 12 hours.

10. Your rights

Subject to the legal requirements, you have the right of access to the data stored about you (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object to the processing (Art. 21 GDPR, see the following section). An informal email to livgrete.s@outlook.com is sufficient to exercise your rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for the controller is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart), complaint portal.

11. Obligation to provide data

You are under no legal or contractual obligation to provide personal data. You do not need to provide any information to read the website; however, the connection data mentioned in section 2 is technically generated with every visit, and the website cannot be displayed without it. Without a name or pseudonym and comment text, no comment can be published, and without an email address, a request cannot be answered by email.

12. Changes to this policy

This privacy policy will be updated if the functions of the website, the services used or the legal requirements change. The version published on this page applies.