This policy explains which personal data closedloop.fm processes, why, and what your rights are under the EU General Data Protection Regulation (GDPR). We collect as little as we can.
Controller
- Company
- Orange Hill GmbH
- Address
- Otto-Bauer-Gasse 4/4, 1060 Wien, Austria
- Company register number
- FN 633590a
- [email protected]
No cookies
This site sets no cookies and stores nothing in your browser. Apart from the Cloudflare Web Analytics script described below, it loads no fonts, scripts or other resources from third-party servers while you browse it.
Hosting and server logs
The site runs on a server of Hetzner Online GmbH in a data centre in Finland, set up and managed with Laravel Forge. Cloudflare sits in front of the server as content delivery network and proxy, so every request passes through Cloudflare first.
When you open a page, the server and Cloudflare process technical access data: your IP address, date and time, the requested page, status code, amount of data transferred, referrer and browser user agent. We use this data only to deliver the site, keep it secure and investigate errors. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).
Our server does not keep an access log for the pages of this site. It logs only requests that cause an error and requests that are merely redirected to https://closedloop.fm (for example from http:// or www.), including the IP address. These log files are rotated daily and deleted automatically after at most 15 days. We do not receive or store access logs from Cloudflare.
Cloudflare, Inc. (San Francisco, USA) processes this data as our processor under its Data Processing Addendum, which is part of Cloudflare's Self-Serve Subscription Agreement. Because Cloudflare is based in the United States, the data may also be processed outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR); if that certification lapses, the EU Standard Contractual Clauses in the Data Processing Addendum apply (Art. 46 GDPR).
- Cloudflare Data Processing Addendum
- cloudflare.com/cloudflare-customer-dpa
- Cloudflare and the GDPR
- cloudflare.com/trust-hub/gdpr
- Data Privacy Framework list
- dataprivacyframework.gov/list
Web analytics (Cloudflare Web Analytics)
To see how many people read the site and how fast it loads, we use Cloudflare Web Analytics. Cloudflare adds a small script to each page, which your browser loads from static.cloudflareinsights.com. The script measures page load timing in your browser and sends it, together with the visited page, to closedloop.fm/cdn-cgi/rum, which is also run by Cloudflare.
According to Cloudflare, Web Analytics uses no cookies or other storage in your browser (such as localStorage) and does not fingerprint visitors by IP address, user agent or any other data. It does not track individual visitors across websites and does not record URL query strings.
We only see aggregated statistics: number of page views and visits, pages visited, referring website, country, device type, browser and operating system, and page load times. We cannot identify you from these figures. Cloudflare keeps the detailed beacon data for 7 days and after that only a reduced, aggregated sample.
The legal basis is our legitimate interest in understanding how the site is used and keeping it fast (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR); blocking static.cloudflareinsights.com in your browser or with a content blocker also stops the measurement. Cloudflare processes this data as our processor under the same Data Processing Addendum and transfer safeguards described above.
- Cloudflare Web Analytics
- cloudflare.com/web-analytics
- What the beacon collects
- developers.cloudflare.com/web-analytics
- Data retention and query strings (FAQ)
- developers.cloudflare.com/web-analytics/faq
Email sign-up for new episodes
If you sign up for episode notifications, we process your email address and the record of your sign-up and confirmation (date, time and IP address) to send you one short email per new episode.
The legal basis is your consent (Art. 6(1)(a) GDPR). We use double opt-in: after you submit the form you receive a confirmation email, and you are only added to the list once you click the link in it.
The mailing list is run by Brevo (Sendinblue SAS, Paris, France) as our processor under a data processing agreement. When you submit the form, your browser sends your email address directly to Brevo.
Brevo records whether our emails are delivered, opened and clicked. To do this, each email contains a small invisible image that is loaded from Brevo's server when you open it, and links in the email lead through a Brevo address that records the click before forwarding you to the page. These events are stored with your address in our Brevo account, so we can see that the emails arrive and what is read. This measurement is part of the consent you give when you sign up (Art. 6(1)(a) GDPR); the form says so next to the checkbox. If you do not want it, unsubscribe; turning off image loading in your email program also stops open tracking.
You can withdraw your consent at any time with the unsubscribe link in every email, or by writing to [email protected]. Withdrawal does not affect sign-ups processed before it.
We keep your address until you unsubscribe or ask us to delete it. After you unsubscribe, Brevo keeps your address marked as unsubscribed so that you are not emailed again, unless you ask us to delete it completely.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17) or its processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw your consent at any time, with effect for the future (Art. 7(3)).
Contact and complaints
To exercise your rights or ask about your data, write to [email protected]. You can also lodge a complaint with a supervisory authority; in Austria this is the Datenschutzbehörde.
- Austrian Data Protection Authority
- Datenschutzbehörde, Barichgasse 40–42, 1030 Wien
- Website
- www.dsb.gv.at
Last updated: 14 October 2026.