Privacy Policy

This policy explains, in plain English, which personal data is processed when you use coinandcortex.com, why, on what legal basis, who receives it and how long it is kept. It is based on the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (Telekommunikationsgesetz, TKG).

Last updated: 27 October

1. Who is responsible (controller)

Maximilian Hölzl
Eich 56, 5310 Mondsee, Austria
Email: coinandcortex@gmail.com

For any question about your data or to exercise your rights, just email the address above. We have not appointed a data protection officer, as we are not required to.

2. The short version

• No cookies are set by this website, there is no analytics, no tracking, no advertising, no social media widgets and no newsletter.
• No user accounts, no forms and no comment section: this website does not ask you for any personal data.
• All fonts and images, including the video thumbnails, are served from our own website. Nothing is loaded from Google or other third parties when you open a page.
• YouTube videos load only after you press play (see section 5).
• Payments run through Stripe's checkout (see section 6). Emails you send us are handled by Google, our email provider (see section 7).

3. Hosting and server logs (GitHub Pages)

This is a static website hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Whenever you open a page or download a file (including the free checklist and, after a purchase, the kit download), your browser sends technical data to GitHub's servers, which deliver the content partly through a content delivery network. This data includes your IP address, date and time of the request, the requested page or file, the referring page, and your browser and operating system (user agent). According to GitHub, visitors' IP addresses are logged and stored for security purposes.

• Purpose: delivering the website and files, and keeping the service secure and stable (e.g. defending against attacks).
• Legal basis: our legitimate interest in providing a secure, functioning website (Art. 6(1)(f) GDPR). Without this data the website cannot be delivered to you.
• Recipient: GitHub, Inc. (USA). We do not have access to these logs ourselves and do not combine them with other data.
• Retention: determined by GitHub according to its privacy statement.
• Third-country transfer: USA; GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

4. Cookies, analytics and fonts

This website itself sets no cookies, uses no local storage and runs no analytics, tracking or advertising scripts. The only script on the site is a few lines that load a YouTube video when you press play. The handwritten-style font is hosted on our own server; we do not use Google Fonts or any other external font service.

5. YouTube videos (click to play)

Some blog posts contain a video. Until you press play, you only see a preview image hosted on our own server, and no connection to YouTube or Google is made. The preview shows the notice "Loads YouTube; Google may set cookies."

When you press play, the YouTube player is loaded from youtube-nocookie.com (YouTube's privacy-enhanced mode). From that moment your browser connects to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google then receives at least your IP address, the address of the page you are on, technical browser information and your interaction with the player. YouTube may store cookies or similar identifiers in your browser (e.g. local storage) once the video plays, for example to count views, remember player settings and prevent fraud. If you are logged in to a Google account, Google may associate this with your account. We have no influence on this processing; it is described in Google's privacy policy.

• Purpose: showing you the video you chose to play.
• Legal basis: your consent, given by pressing play after seeing the notice (Art. 6(1)(a) GDPR; for storing or reading information on your device § 165(3) TKG). You can avoid this entirely by not pressing play, or by watching on youtube.com instead. You can withdraw your consent at any time for the future by not playing further videos and by deleting YouTube cookies and site data in your browser; reloading the page restores the preview without a YouTube connection.
• Recipient: Google Ireland Limited and Google LLC.
• Retention: determined by Google.
• Third-country transfer: USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR).

6. Buying a product (Stripe)

Products are paid for on a checkout page operated by Stripe, which opens when you click the buy button (we use a Stripe Payment Link; no Stripe code is loaded on our pages before you click). Your contract partner for the payment service in the EU is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. On the checkout page you enter your payment details, email address, name and billing country/address as requested by the checkout. Stripe processes your card or other payment details itself; we never see full card numbers. We receive from Stripe your name, email address, billing country/address, the product bought, the amount, and the date and status of the payment. After payment, Stripe shows a confirmation with your download link; the download itself is served from our website (see section 3). Stripe may also send you a payment receipt by email.

• Purpose: processing your order and payment, delivering the digital product, handling support, refunds and complaints, and keeping accounting and tax records.
• Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); keeping invoices and accounting records to meet our legal obligations (Art. 6(1)(c) GDPR in conjunction with § 132 of the Austrian Federal Fiscal Code, BAO). Providing this data is necessary to conclude the contract; without it we cannot sell you the product.
• Recipients: Stripe (as payment service provider; for fraud prevention and its own legal obligations, Stripe acts as an independent controller, see stripe.com/privacy); where necessary, our tax adviser and the tax authorities.
• Retention: order and accounting records are kept for seven years from the end of the calendar year of the purchase (§ 132 BAO), longer only while needed for pending legal or tax proceedings, and then deleted.
• Third-country transfer: Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR); otherwise Stripe uses the EU Standard Contractual Clauses.

7. Contacting us by email

If you email us at coinandcortex@gmail.com, we process your email address, your name if you give it, the content of your message and any data from the related order. Our mailbox is provided by Google (Gmail; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA), so your message is stored on Google's servers.

• Purpose: answering your request.
• Legal basis: where your message concerns an order or a possible purchase, performance of the contract or pre-contractual steps (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
• Recipient: Google, as our email provider.
• Retention: we delete your messages once your request has been fully dealt with and no further questions are expected, unless they must be kept for tax or accounting reasons (e.g. order-related correspondence, seven years under § 132 BAO) or to defend legal claims.
• Third-country transfer: USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR).

8. Free checklist and newsletter

The free checklist is a direct PDF download from our website. No sign-up and no email address are needed, and we do not collect any data for it beyond the server logs described in section 3. There is currently no newsletter and no other way to subscribe on this website. If we introduce one, we will only send it with your explicit consent and will update this policy first.

9. Links to other websites

The site links to our YouTube channel, to Stripe's checkout and to external sources cited in our articles. These are ordinary links: no data is sent to those sites until you click one. Once you are on another website, its operator is responsible for processing your data and its own privacy policy applies.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data rectified (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR), unless we must keep it, e.g. for tax reasons;
• restrict processing (Art. 18 GDPR);
• data portability, i.e. receive data you provided to us in a common machine-readable format (Art. 20 GDPR);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f) GDPR) (Art. 21 GDPR);
• withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).

To exercise these rights, email coinandcortex@gmail.com. We may ask you to confirm your identity before answering.

11. Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority in your EU country of residence.

12. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes to this policy

We update this policy when the website or the services we use change. The current version is always available on this page.