Plain-language summary
Public reading does not require a visitor profile.
You can read the public pages without creating an account, filling in a form or intentionally entering personal data. The delivery infrastructure still processes technical request data as described below. The site does not require visitor tracking cookies for normal reading.
- Hosting and security infrastructure may process ordinary request logs.
- Google Fonts may receive technical request data when your browser downloads the site fonts.
- Only the site owner can use the separate administrator sign-in.
The Newsletter page can collect an email address only after you actively consent and confirm the subscription through a separate confirmation email. You can unsubscribe at any time.
01 / Controller
Who is responsible
Where the GDPR applies to processing connected with this website, the controller is David Ďurana. Privacy questions and requests can be sent to [email protected].
02 / Data
What data may be processed
Reading public pages
Vercel and Cloudflare may process an IP address, request time, requested URL, user-agent, network and security events, and related technical logs needed to deliver and protect the site.
Email correspondence
If you email me, the message, your email address, any name or details you provide, and normal email delivery metadata are processed so I can read and answer it.
Email newsletter
If you subscribe, the site processes your email address, consent timestamp, confirmation and unsubscribe status. A keyed pseudonymous IP hash is kept only in short-lived rate-limit records to prevent abuse. The address stays pending until you confirm it through a separate email. Confirmation links expire, and the address is suppressed after you unsubscribe.
Restricted administration
The private administrator area uses Google OAuth to verify an approved owner account. It processes the verified email identity, short-lived OAuth state and verifier values, and a signed administrator session. GitHub receives repository publication actions made through that private workflow.
Published information
The site intentionally publishes selected professional information about David Ďurana and the documented TCS projects. Public information can still be personal data and should be reused with its original context.
03 / Purpose and basis
Why the data is processed
Technical request and security data is processed to deliver the website, prevent abuse and investigate operational problems. The relevant legal basis is normally the legitimate interest in operating a secure and reliable website under Article 6(1)(f) of Regulation (EU) 2016/679.
Email correspondence is processed to respond to your message. Depending on the subject, this may rely on legitimate interests or steps taken at your request under Article 6(1)(b). Newsletter signup and delivery rely on your consent under Article 6(1)(a); you can withdraw it at any time through the unsubscribe link. Restricted administrator data is processed to protect publication access and maintain an auditable content workflow.
durana.dev does not use automated decision-making with legal or similarly significant effects.
04 / Providers
Service providers
- VercelStatic hosting, deployment and request handling.
- CloudflareDNS, content delivery and edge security.
- Google FontsFont delivery from Google-operated endpoints on public pages.
- Google OAuthIdentity verification for the restricted administrator area only.
- Google WorkspaceConfirmation and newsletter delivery from the durana.dev sending mailbox.
- NeonPostgreSQL storage for newsletter subscription consent and unsubscribe status.
- GitHubSource control and administrator-initiated article publication.
These providers may process technical, account or repository data needed for their role. Retention and international transfers are governed by the relevant service configuration and provider terms. Any transfer outside the European Economic Area must follow the transfer rules in Chapter V of the GDPR.
05 / Cookies and retention
Cookies, analytics and storage
Normal public reading does not require a durana.dev account, advertising cookies or site-controlled visitor tracking cookies. Hosting and security providers may still retain technical request logs according to their service configuration and retention rules.
The restricted administrator flow uses essential, HttpOnly, Secure and SameSite=Lax cookies. Temporary Google OAuth state and verifier cookies expire after 10 minutes. A successful administrator session expires after at most 15 minutes. These cookies are not used to track public readers.
Email correspondence is retained only while it is reasonably needed for the conversation, follow-up or a related legal obligation. Newsletter confirmation links expire after 24 hours; expired unconfirmed records are removed by a daily scheduled cleanup, abuse-rate records are removed within 48 hours, and newsletter event records after 90 days. An unsubscribe suppression record is retained for up to two years so the address is not accidentally reactivated. Published repository history may be retained as part of the site's source and audit trail.
06 / Your rights
GDPR rights
Depending on the processing and its legal basis, you may request access, rectification, erasure or restriction; object to processing; request data portability where applicable; and withdraw consent where processing relies on consent.
Requests can be sent to [email protected]. I may need enough information to verify that a request concerns you before disclosing, changing or deleting data.
You can also lodge a complaint with the Úrad na ochranu osobných údajov Slovenskej republiky.
07 / Reference
Legal reference and updates
The governing EU text is Regulation (EU) 2016/679 — General Data Protection Regulation. This notice describes the website's current implementation and does not replace legal advice.
If the site later adds public accounts, analytics or new cookies, this page should be updated when that processing begins.
Effective: