Privacy statement

This privacy statement describes which personal data prismx.eu processes, why, for how long, and what your rights are. I process as little data as possible: the site uses no advertising or tracking cookies, and I do not sell data.

Who is responsible?

PRISMX is a personal website of Hylke Hoogland-Domahidi. I am the controller within the meaning of the General Data Protection Regulation (GDPR). PRISMX is not a business and is not registered with the Dutch Chamber of Commerce (KvK). You can reach me at the email address at the bottom of this page.

What data do I process, and why?

Visiting the website

On every visit the web server receives technical data: your IP address, the time, the page requested, the referring page, and your browser and device type. This ends up in the server logs, which I use to keep the site secure and working and to investigate abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Retention: [NUMBER] days.

Protection against abuse

To prevent mass abuse of search, password resets and forms, the site counts the requests coming from each IP address. It does not store the IP address itself, only an irreversible, encrypted derivative of it (a hash), which is deleted automatically after at most 30 minutes. Forms also use Altcha: your browser solves a small computational puzzle instead of a CAPTCHA. No outside service is involved. Legal basis: legitimate interest.

An account

If you create an account, I process your username, email address, password and, if you fill them in, your first and last name. Your password is only stored hashed. In your profile you can add more details yourself, such as a profile picture; this is optional. I use this data to provide your account, let you log in, confirm your email address and reset your password. Legal basis: performance of a contract (Article 6(1)(b) GDPR). I keep the data for as long as your account exists. To have your account deleted, email me; I will delete it within [NUMBER] days.

Email

Confirmation and password-reset emails are sent through Zoho Mail (European data centre). Zoho processes your email address and the content of the message for this, as a processor on my behalf.

Visitor statistics

For visitor statistics I use Simple Analytics (Simple Analytics B.V., Amsterdam). Simple Analytics sets no cookies, stores nothing on your device, keeps no IP addresses and builds no visitor profiles. It only records data that cannot be traced back to you, such as the page visited, the referring website, the browser and device type, the screen size and the country. If you have enabled 'Do Not Track' in your browser, your visit is not counted. Legal basis: legitimate interest, namely knowing which publications are read.

Cookies and local storage

• SULUSESSID: a session cookie needed to log in and to submit forms securely. It is removed when you close your browser.
• REMEMBERME: only if you tick 'Stay logged in' when logging in. Keeps you logged in for seven days.
• prismx-consent (local storage): remembers your choice in the cookie banner.
• Offline cache: the site stores files such as stylesheets, images and public pages you visited in your browser, so they load faster and also work without a connection. Account and login pages are never stored.

These cookies and this storage are needed for the site to work, so they do not require consent. I use no tracking or advertising cookies.

Third-party services, only with your consent

Some articles contain elements from other parties. They only load after you click 'Accept' in the cookie banner:

• maps from HERE (HERE Global B.V., the Netherlands);
• formula rendering with MathJax, loaded through the jsDelivr CDN;
• videos from YouTube (Google Ireland Limited), through the youtube-nocookie.com domain;
• charts and tables from Datawrapper (Datawrapper GmbH, Germany).

Once these elements load, those parties receive your IP address and browser details, and their own privacy policies apply. Google may transfer data to the United States under the EU-US Data Privacy Framework. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time through 'Cookie settings' at the bottom of every page.

Who do I share data with?

I do not sell your data or share it for marketing. The website runs on a server of IONOS SE in the European Union. IONOS and Zoho process data as processors on my behalf. Beyond that, I only share data when the law requires me to.

Security

The site is only reachable over an encrypted connection (HTTPS), passwords are stored hashed, the admin area is shielded, and login, search and forms are protected against abuse.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interest, and to receive your data in a common format. If you gave consent, you can withdraw it at any time. Send your request to the email address at the bottom of this page; I will respond within one month.

If you are not satisfied with how I handle your data, you can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the supervisory authority in your own EU country.

Automated decision-making

I make no decisions about you based solely on automated processing and do not build profiles.

Changes

I may update this privacy statement, for example when the website changes. The date at the top shows when the latest version took effect.