Privacy

1. Controller

Privacy contact: privacy@portdive.com

2. Website delivery

The website is delivered through Cloudflare Pages by Cloudflare, Inc.. The provider processes in particular IP addresses, HTTP headers, and timestamps for delivery, stability, and attack prevention. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

We use no analytics, advertising, or tracking services on portdive.com and load no fonts from third-party CDNs.

3. Local appearance setting

When you explicitly switch appearance, your browser stores the key portdive_theme with the value light or dark in localStorage. It remains on your device, is not sent to us, and can be deleted through browser storage or reset by selecting Auto. It is used solely to provide the appearance you requested (§ 25(2) no. 2 TDDDG).

4. Protected Investor Relations area

After a correct access code is entered, the protected area sets the technically necessary pd_ir session cookie. It contains a version, expiry, and cryptographic signature—not the access code. The cookie is limited to the protected area, HttpOnly, SameSite=Strict, Secure in production, and expires after 30 days. It is used solely for access control (§ 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR).

5. Recipients and international transfer

Cloudflare processes delivery data as our processor. Under our configuration, transfers to the United States rely on the EU-US Data Privacy Framework and, additionally, Standard Contractual Clauses. There are no other recipients for this website unless disclosure is required by law.

6. Retention

We do not keep our own web-server or analytics logs. Cloudflare retains security and delivery data under the periods applicable to its service. The IR session cookie expires after 30 days; the local appearance setting remains until reset or deleted in the browser.

7. Your rights

Subject to the GDPR, you have in particular rights of access, rectification, erasure, restriction, portability, and objection. You may also lodge a complaint with a data-protection supervisory authority.