Privacy Policy

Who is responsible

The controller for personal data processed on this website, within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and — for readers in the United Kingdom — the UK GDPR, is:

Haydamax OÜ
Narva mnt 5
10117 Tallinn
Estonia
Registration number 17351554

Contact details for this publication are on its imprint page.

No data protection officer has been appointed; the conditions of Article 37 GDPR do not apply.

The short version

You can read this site without registering and without giving us any personal details. We run no advertising networks, embed no social network buttons, and sell or share no data for advertising.

Hosting and server logs

The site runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The web server is in Nuremberg; images and media files sit in the same provider’s object storage, also in Nuremberg. Hetzner acts as our processor under Article 28 GDPR.

Every request writes one log line containing: the hostname requested, your IP address, the date and time, the path requested, the HTTP status code, the number of bytes sent, the referring address, and your browser’s user-agent string.

The purpose is secure and uninterrupted operation, defence against attacks and automated abuse, and fault diagnosis. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in running and protecting the service. Logs are deleted after 30 days.

Audience measurement with Umami

We measure readership with Umami, open-source analytics software that we run on our own infrastructure. Nothing is sent to an analytics vendor.

The measurement sets no cookies and stores no identifier on your device. What is recorded: the address and title of the page, the referring address, campaign parameters present in the address (such as utm_source, gclid, fbclid), your browser, operating system, device type, screen size and language setting, and the location derived from your IP address at country, region and city level.

The IP address itself is not stored. It is combined with the site identifier and your browser details to compute a session identifier, and the measurements are filed under that. Nothing is joined up across other websites.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in knowing which articles get read. No consent is required under the ePrivacy rules (in the United Kingdom, regulation 6 of the Privacy and Electronic Communications Regulations 2003), because the measurement neither stores information on nor reads information from your device for that purpose.

How to opt out: create an entry called umami.disabled with the value 1 in this site’s Local Storage in your browser. The counting script checks for it and stops. Any browser setting or extension that blocks the script has the same effect.

Contact form and email

Through the contact form you send us a name, an email address, a subject line and a message. We pass these to the publication’s editorial mailbox in order to answer you. We run the mail server ourselves; it is hosted by Hetzner Online GmbH in Helsinki, Finland.

The legal basis is Article 6(1)(f) GDPR for answering readers’ enquiries, and Article 6(1)(b) GDPR where the enquiry concerns a contract. We keep your message for as long as handling it and any follow-up requires, then delete it unless a statutory retention duty applies.

The form is protected against automated abuse by a field invisible to humans, a timestamp, and a limit on submissions per IP address within a time window. A submission judged automated is not delivered by email; instead it is written to an operational log together with the IP address, the sender details and the content. That exists solely so we can check whether a real person was turned away by mistake. The legal basis is Article 6(1)(f) GDPR; the log is continuously overwritten and an entry survives only until newer entries displace it.

A message that contains a link to another website is delivered all the same — the newsroom expressly asks for a link to whatever you are pointing at. Its subject line and one mail header are then marked as external, and the time, your IP address, your email address and the subject are noted in the operational log, so that the sorting is done by the newsroom rather than by the filter.

Cookies

Reading articles sets no cookies. On pages that carry a form — the contact page in particular — the site sets one strictly necessary cookie, csrftoken. It protects the form against requests forged from other sites and holds nothing about you. Details are in our cookie notice.

Third-party content

Some articles display images that remain on the servers of the source and are loaded directly from there when you open the article. In that case the operator of that server learns your IP address, your browser identification and the address of the page the image appears on. We have no control over that processing; it follows the provider’s own terms. Our legal basis for embedding is Article 6(1)(f) GDPR — illustrating reporting while respecting the rights of the copyright holder.

Recipients and transfers

Beyond the processors named above, no one receives personal data. We transfer no data outside the European Union; the servers we use are in Germany and Finland, and the controller is established in Estonia. Where third-party content is embedded, the provider concerned may be established outside the European Union.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing rests on legitimate interests, you may object at any time on grounds relating to your particular situation (Article 21 GDPR).

To exercise any of these, use the contact routes given on the imprint page.

You may also complain to a supervisory authority (Article 77 GDPR). The authority responsible for the controller is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia (www.aki.ee). You may equally approach the authority where you live or work — in the United Kingdom, the Information Commissioner’s Office (ico.org.uk).

Version

This notice applies from 21 August 2026. If the service or the technology behind it changes, we will update it; the version published on this page is the one that applies.