Privacy Policy
This is a courtesy translation. Only the German Datenschutzerklärung is legally binding.
The protection of your personal data matters to us. We process your data exclusively on the basis of the statutory provisions (GDPR, the Austrian Data Protection Act DSG, and the Austrian Telecommunications Act TKG 2021). This policy informs you about the nature, scope and purpose of the processing of personal data on this website (theoreticalphysics.eu, https://theoreticalphysics.eu) and about your rights.
This privacy policy covers this website. If you are also in business or contractual contact with us, additional provisions apply, which we will provide to you separately (for example when a contract is concluded).
Controller
In short: That is us — this is how to reach us if you have questions about your data.
Mag. Dr. Andreas Krassnigg
Neupauerweg 83, 8052 Graz, Austria
Phone: +43 650 2138450
E-mail: [email protected]
For questions about data protection, you can reach us at the e-mail address above. We are not legally required to appoint a data protection officer.
Your rights
In short: You have the right to find out at any time what data we hold about you, and to have it corrected or deleted. An e-mail to us is enough. If you believe we are breaching data protection law, you can also complain to the data protection authority.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Accessing the website, server log files and hosting
In short: Every visit to a website leaves technical traces on the server — this is unavoidable and serves secure operation. These data are stored only briefly and are not analysed to identify you.
Each time the site is accessed, data (including IP address, date and time, file requested, amount of data, browser, operating system, referrer) are automatically stored in server log files. This serves the delivery, security and stability of the website. The legal basis is our legitimate interest in secure operation under Art. 6(1)(f) GDPR. The log files are kept only for a short, technically customary period.
This website is operated on a server within the EU (location: Vienna, Austria). We use the following processor (Art. 28 GDPR): netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The hosting provider’s privacy notice is available here.
The website is served through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which serves as a content delivery network and as protection against attacks, and processes data (in particular the IP address) in doing so. Any transfer to the USA takes place on the basis of the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR. Privacy notice: Cloudflare.
Fonts
In short: The fonts on this website are stored on our own server. Your browser does not have to fetch anything from Google or other providers for them.
Fonts are delivered locally from our server. There is no connection to third-party servers (e.g. Google Fonts); no personal data are transferred to third parties for this purpose.
Cookies and consent management
In short: We set necessary cookies without asking — the site does not work without them. Everything else is loaded only once you have agreed, and you can change your decision at any time.
We use technically necessary cookies on the basis of Art. 6(1)(f) GDPR. For all non-essential services (e.g. analytics, embedded content, spam protection) we obtain your consent in advance under § 165(3) TKG 2021 and Art. 6(1)(a) GDPR. For this we use the consent tool Real Cookie Banner; the associated services are loaded only after you have actively agreed. You can change or withdraw your choice at any time via the cookie settings. You can also manage or delete cookies in your browser.
To document your consent, Real Cookie Banner stores each decision in a consent log on the server of this website: a randomly generated identifier, your choice and the version of the settings shown, the time, the page visited, the size of the browser window, and a hash of your IP address with its last block removed. Your choice itself is stored in a cookie on your device, which expires after 365 days. Entries in the consent log are deleted after 48 months. The legal basis for the log is our obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).
Contacting us
In short: If you write to us by e-mail, we use it to reply to you — and for nothing else.
If you contact us by e-mail, we process the data you submit (e.g. name, e-mail address, message) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual/contractual enquiries) or our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR. Your message is deleted as soon as it is no longer needed and no retention obligations apply. This website offers no contact form, so no form data are stored in our website system.
To receive e-mails sent to the address given on this website, we use the following processors (Art. 28 GDPR): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA — forwards e-mails sent to this address to our mailbox (Cloudflare Email Routing) without storing their content; Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland — provides the e-mail mailbox (Google Workspace) in which your message is stored. Any transfer to Cloudflare in the USA takes place on the basis of the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Any transfer to Google in third countries outside the EU (in particular the USA) takes place on the basis of the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Web analytics with Matomo (without cookies)
In short: We count visits with software that sets no cookies and shortens your IP address. It runs on a server operated by us in Vienna, Austria. The data are not passed on to third parties or transferred to countries outside the EU. We count visits only if you agree in the cookie settings, and only until you withdraw that consent there.
To evaluate the use of this website statistically, we use Matomo, an open-source analytics software. The installation runs on a server operated by us specifically for this purpose at netcup GmbH (Germany) as a processor (Art. 28 GDPR), location Vienna, Austria. The data collected are not passed on to third parties and not transferred to third countries; they are used exclusively to evaluate this website.
Matomo is configured by us so that no cookies are set. Because the tracking script nevertheless reads information from your browser, it is loaded only after your consent.
The following are processed: your IP address shortened by at least two bytes (anonymised), the date and time of access, the pages visited, the terms you enter into this website’s search, the previously visited page (referrer), technical information about browser, operating system and screen resolution, and an approximate region derived from the shortened IP address. This does not allow us to identify you, as long as you do not enter details about yourself into the search. We use no user IDs, no cross-site or cross-device tracking, no heatmaps, no session recording, and we create no user profiles.
The legal basis is your consent under § 165(3) TKG 2021 and Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future via the cookie settings. The data collected are deleted automatically once they are older than 13 months.
There is no separate opt-out for this analysis: you end it by withdrawing your consent in the cookie settings, which you can reach via the link on every page of this website. Matomo is then no longer loaded. A “Do Not Track” setting enabled in your browser is additionally respected by our installation; in that case no data are collected even after your consent.
Embedded videos (YouTube)
In short: We load videos from YouTube only when you agree. As soon as you do, Google learns that you are here.
Videos from YouTube (Google Ireland Limited, Dublin, Ireland) may be embedded on this website. They are loaded only after your consent. When they play, data (including IP address and device information) are transmitted to Google, possibly also to the USA (basis: Standard Contractual Clauses / EU-U.S. Data Privacy Framework). The legal basis is your consent under Art. 6(1)(a) GDPR. More information: Google privacy policy.
Protection of the login area
In short: Anyone who repeatedly fails to log in here is temporarily blocked. For this, the IP address the attempts come from is stored; we delete the lockout log after 30 days.
To protect the login area of this website against automated attacks, we use the plugin Limit Login Attempts Reloaded. For a failed login attempt, the IP address it comes from, the username entered, the time and the login route used are processed. After 4 failed attempts the IP address is blocked for 20 minutes, after repeated lockouts for 24 hours. This affects people who try to log in to this website.
The count of failed attempts expires after 24 hours, a lockout when it ends. Lockouts are recorded with IP address and username in a lockout log whose entries are deleted after 30 days; a daily statistic of login attempts with IP addresses and usernames is deleted after 30 days. After repeated lockouts, the administration address registered for this website is notified by e-mail, including IP address and username. Processing takes place on the server of this website; no data are transmitted to the plugin’s vendor or to any other third party. The legal basis is our legitimate interest in the security of this website and in protecting user accounts under Art. 6(1)(f) GDPR.
Technical maintenance of this website
In short: We maintain this website technically ourselves — updates, backups, monitoring. For individual tasks we use service providers, who are named below. In addition, a record is kept of who changed what in the administration area, including the IP address; these entries are deleted after 100 days.
We carry out the maintenance, updating, backup and technical monitoring of this website ourselves. The legal basis is our legitimate interest in a secure, up-to-date and functioning website under Art. 6(1)(f) GDPR.
To make this work traceable, the website keeps an activity log (MainWP Child Reports). It records actions in the administration area, such as updates of WordPress, plugins and themes, changes to content and user accounts, and password reset requests, each with the time, the acting user account and its role, and the IP address from which the action originated. This mainly concerns people with a user account on this website and, for a password reset, also the person who requests it. The log is stored on the server of this website; its entries are deleted automatically after 100 days. It also serves as the basis for the maintenance reports. The legal basis is our legitimate interest in the security of this website and in the traceability of changes under Art. 6(1)(f) GDPR.
For this we use the following processors (Art. 28 GDPR): Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — for storing the backup copies of this website (storage location: Germany); netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany — for operating the maintenance dashboard (MainWP), which controls the maintenance of this website and produces the maintenance reports, and for brief test restores of the website backup in an isolated test environment (storage location: Vienna, Austria). A backup copy contains the complete content of this website, including the personal data stored in it. No transfer to third countries takes place in this context.
Special categories of personal data
In short: We do not collect particularly sensitive data — for example about health, beliefs, origin or the like — via this website.
No special categories of personal data within the meaning of Art. 9(1) GDPR are collected via this website — that is, no data about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and no genetic or biometric data.
Automated decisions and profiling
In short: No computer makes automatic decisions about you here, and we create no profiles.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. We do not analyse your behaviour in order to build personality or usage profiles from it.
Disclosure to third parties
In short: We do not sell your data and pass it on only when this is necessary for the purpose, you have agreed, or the law requires us to.
Your data are disclosed only insofar as this is necessary to perform a contract, you have given your consent, we are legally or officially obliged to do so, or this is necessary to protect legitimate interests. The processors named above act solely on our instructions and on the basis of corresponding data processing agreements.
Minors
In short: Children and young people should talk to their parents before entering any data.
We remind parents and guardians how important it is to handle personal data on the internet responsibly, and we ask visitors who are minors to involve their parents or guardians before entering any data on this website.
Changes to this policy
In short: If something on the website changes, we change this text too. The version you are reading here always applies.
We update this privacy policy as soon as changes to this website or to the underlying data processing make this necessary. The version available at the time of your visit applies.
Last updated: 24 October 2026