Privacy

3. YouTube video

The homepage and the page /eu-ai-act can play an embedded video via YouTube (Google Ireland Limited / Google LLC). The player is not loaded until you click play, and only if you have allowed External media in the privacy settings (see § 6). We use YouTube’s privacy-enhanced domain (youtube-nocookie.com).

On play, Google may process your IP address, device data, and set cookies. Google may process data in the USA.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).
You can withdraw consent anytime via Privacy settings in the footer. Withdrawing also stops a currently loaded player. Google’s policy: policies.google.com/privacy.

Prefer not to allow external media? Use the Watch on YouTube link next to the player. It opens the video on YouTube itself (an external link, see § 8); nothing loads on this site.

7. Visitor statistics

We run our own statistics service on a server we rent from DigitalOcean, LLC (New York, USA) in its Frankfurt data centre (address of the service: aquafire.inblock.io). DigitalOcean processes the data only on our behalf under a data processing agreement (Art. 28 GDPR); access from the USA, for example for support, is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). No other controller receives this data.

7.1 Anonymous visit counting (unless you object). When a page loads, your browser sends us the page address, the address of the page you came from (referrer) and campaign tags in the link (for example from a QR code). Our server also sees your IP address and browser string, as with any request. From these it derives the device type (mobile, tablet, desktop), the browser family, the country (from a local DB-IP database) and a daily visitor number: a hash of IP address, browser string, site and a random value that exists only in our server’s memory and is replaced every day. The IP address and the browser string are discarded immediately and never stored. After each day we keep only the day’s counts and visitor totals per page, source and campaign; the daily visitor numbers are deleted and times are reduced to the date, so the remaining records contain no identifier. We store nothing on your device and read nothing else from it for this. Purpose: to know how many visits our pages and campaigns get and from where. Legal basis: our legitimate interest in measuring the reach of our own website, Art. 6(1)(f) GDPR. Storage: the daily records for up to 25 months. Objection: “Reject all” in the banner, unticking “Anonymous visit counting” under Privacy settings, or Global Privacy Control in your browser; we then send nothing.

7.2 Analytics and visit profile (only with your consent). If you allow “Analytics and visit profile”, we store a random visitor ID in your browser and compute a device fingerprint: a hash of characteristics of your browser and device (such as screen size, time zone, languages, installed fonts, graphics card and how your browser draws a test image). With the ID we recognise your browser on later visits. With the fingerprint we count returning and unique visitors even if your browser storage was cleared; we never use it to merge your profile with another one or to show or delete anyone else’s data. We keep a profile of your visits: pages and time spent, clicks on links such as booking a meeting or downloading a document, first and latest source and campaign, device type, browser family, language, country, the network operator of your IP address (for example a company network; from a local DB-IP database) and interests derived from the pages you read. Authorised staff (management and marketing) can view individual profiles on an internal page behind a login. Purpose: understanding which content and channels work for our marketing, and how visitors return. No decisions with legal or similarly significant effect are based on it (Art. 22 GDPR). Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. Storage: until 13 months after your last visit, or until you withdraw. Withdrawal (Art. 7(3) GDPR) anytime under Privacy settings or My data: we delete your profile at once, block your ID from further use and stop recognising you. We ask again after 12 months. Under My data (/privacy/my-data/) you can see everything we hold for your browser and delete it.

7.3 Proof of your choice. When you choose, we store your choice, the text version, the date and, if you consented, the visitor ID. Legal basis: for a consent, Art. 6(1)(c) GDPR together with Art. 7(1) GDPR (we must be able to prove it); for a refusal or an objection, Art. 6(1)(f) GDPR (respecting your choice). Storage: 3 years. You can ask us for these records at info@inblock.io, also after deleting your profile.

7.4 Internal reports. Authorised staff see totals and, for visitors who consented, individual visit profiles on an internal page behind a login (§ 7.2). Reports in our own Matrix chat server contain totals only, no profiles and no visitor IDs.