Data Protection

This privacy policy explains how personal data is processed when you visit allagha.com, in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

2. Principles

We process personal data only where there is a legal basis to do so, and we limit processing to what is necessary. This is a static informational website. We do not use advertising or profiling. The only analytics tool is Hotjar (section 4), and it runs exclusively with your consent. Until you agree, no Hotjar script is loaded and no cookies or browser storage entries for analytics are set. Declining is as easy as accepting, and you can change your choice at any time via “Cookie settings” in the footer. If you switch the language, we store your choice in your browser’s local storage; this is strictly necessary for the function you requested (§ 165(3) TKG 2021). We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.

3. Hosting & server log files

This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, acting as our processor under a data processing agreement (Art. 28 GDPR).

When you access the site, your browser automatically transmits technical data which the hosting infrastructure stores temporarily in server log files:

• anonymised / shortened IP address
• date and time of the request
• the page or file requested and the amount of data transferred
• browser type and version, operating system and referring URL

Purpose & legal basis: ensuring the security, stability and operation of the website. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. These logs are not merged with other data and are retained only for as long as necessary for security purposes, then deleted.

Transfer to a third country: processing may involve a transfer to the USA. This is safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) concluded with the provider and, where applicable, its certification under the EU–US Data Privacy Framework.

4. Web analytics with Hotjar (only with consent)

If you consent, we use Hotjar, a service of Content Square SAS, 7 rue de Madrid, 75008 Paris, France, to understand how visitors use this website and to improve it. Interactions such as page views, clicks, mouse movements and scrolling are recorded and used to create heatmaps and recordings of individual visits.

• Data processed: device and browser information, screen size, approximate location (country), pages visited, interactions on the page and a randomly generated identifier. Your IP address is transmitted for technical reasons when the service loads, but according to the provider it is not stored. Input in form fields is not recorded.
• Cookies & browser storage: cookies such as _hjSessionUser_* (up to 12 months) and _hjSession_* (30 minutes) are set, as well as entries in your browser’s local and session storage.
• Legal basis: your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act (TKG 2021). Without your consent, the service is not loaded. You may withdraw your consent at any time via “Cookie settings” in the footer; the cookies and storage entries in your browser are then deleted and no further data is collected. This does not affect the lawfulness of processing before the withdrawal.
• Processor, storage location & third countries: Content Square SAS acts as our processor under a data processing agreement (Art. 28 GDPR). Data is stored in the EU (Ireland). For support and maintenance, the provider also uses companies outside the EU, for example in the USA and the United Kingdom. These transfers are based on adequacy decisions of the European Commission (Art. 45 GDPR, for the USA the EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses (Art. 46 GDPR).
• Retention: the cookies are deleted after no more than 12 months, the collected usage data after no more than 365 days.

Your choice in the consent notice is stored in your browser’s local storage (key consent) for 12 months so that we do not have to ask again on every visit. The entry contains only your choice, its date and a version number and is not sent to us. This storage is strictly necessary to respect your decision (§ 165(3) TKG 2021).

Further information: contentsquare.com/privacy-center.

5. Fonts

This website uses self-hosted web fonts that are delivered exclusively from our own server. No connection to Google Fonts or any other external font provider is established, and no data is transmitted to third parties for this purpose.

6. Contacting us

If you contact us by email (e.g. via office@allagha.com) or via the addresses shown on this site, the data you provide (such as your name, email address and the content of your message) will be processed solely to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and/or Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). We retain such correspondence only for as long as necessary to process your request and to comply with statutory retention obligations, after which it is deleted.

7. External links

This website contains links to external sites (e.g. LinkedIn and the websites of the ventures listed). We have no influence over the data processing on those sites; please refer to their respective privacy policies. The downloadable essay is served from our own server.

8. Encryption

This site uses TLS/SSL encryption (HTTPS) to protect the transmission of data between your browser and the server.

9. Your rights

Under the GDPR you have the right, at any time, to:

• obtain access to your personal data (Art. 15)
• request rectification of inaccurate data (Art. 16)
• request erasure (Art. 17)
• request restriction of processing (Art. 18)
• receive your data in a portable format — data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw any consent you have given, with effect for the future (Art. 7(3))

To exercise any of these rights, please contact us using the details in section 1.

10. Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

11. Changes to this policy

We may update this privacy policy to reflect changes to the website or to legal requirements. The current version applies.

Last updated: October 2026 · See also our Imprint.