Privacy & Policy

The short version

• This website has no advertising and no tracking. We only count visits in an anonymous way that uses no cookies and builds no profile of you (Section 2). Visitors do not receive any cookies. The only thing we remember on your device is your answer to the cookie banner.
• Fonts, pictures and code are served from this website itself, so your browser does not contact Google or any other outside company while you read.
• We only keep personal data that you send us yourself through a form: the contact form, the Witch List (newsletter) or an event RSVP.
• Like every website host, our hosting company technically receives your IP address when you visit.
• You have rights over your data (see "Your rights" below). You can reach us at any time at [still to be added].

1. Who is responsible

The controller under Article 4(7) of the General Data Protection Regulation (GDPR) is Brewed Witches, run by [still to be added], [still to be added]. Email: [still to be added].

We have not appointed a data protection officer. For any question about privacy, please write to the address above.

2. What happens when you visit the website

When you open a page, your browser sends technical data to the server that hosts the site: your IP address, the date and time, the page you asked for, your browser type and the page you came from. Our hosting provider keeps this data in server log files for a short period so that the site can be delivered securely and misuse can be detected. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in running a secure website). We do not combine or analyse this data ourselves.

Our hosting provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes this data on our behalf under a data processing agreement (Article 28 GDPR).

Everything you see, including fonts, pictures, styles and scripts, is loaded from our own website. Nothing is requested from third parties while you browse.

Visitor statistics. To see which pages are read, we count visits ourselves, on our own server, without cookies and without any outside company. When a page loads, a small script sends us the address of the page, the name of the website you came from (for example "instagram.com"), the width of your screen, your device's time zone and the name of your browser. From the time zone we work out the country, and from the screen width whether you use a phone, a tablet or a computer. To count each visitor once per day, the server briefly turns your IP address and browser details into an unreadable value (a hash) using a secret code that changes every day; that value is deleted when the day ends, and your IP address itself is never stored. We keep only daily totals (for example: "the Grimoire page had 12 views, 8 visitors were from Austria") for up to 13 months, and we cannot identify you from them. If your browser sends "Do Not Track" or "Global Privacy Control", we do not count you at all. The legal basis is our legitimate interest in understanding how our website is used, Article 6(1)(f) GDPR.

3. Cookies, your choice and similar technologies

At the moment this website does not set cookies and does not use any outside analytics, advertising, social-media or tracking tools. Our own anonymous visit counting (Section 2) uses no cookies. No optional extras are running.

When you first visit, a small banner asks whether you accept optional extras in case we add them later (for example visitor statistics or embedded videos). You can choose "Accept" or "Decline" with equal ease. Optional extras are only ever loaded after you accept. If you decline, or simply do not answer, they are never loaded. Consent is voluntary and you can withdraw it at any time with "Cookie settings" at the bottom of every page. Legal basis: Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) together with Article 6(1)(a) GDPR. A full list of everything we store, in a table, is on our Cookie Policy page.

To remember your answer we store one small entry named "bw_consent" in your browser's local storage. It contains only your choice ("accepted" or "declined") and the date, is never sent to our server, and is deleted or renewed after 6 months. It is strictly necessary for the banner to work and does not identify you.

If we ever switch on an optional service, we will name it here, together with its provider, its purpose and how long it stores data, before it goes live.

Only the private admin area, which the two of us use to update the website, uses a strictly necessary login cookie, plus a second small cookie that tells our visit counting not to count our own visits. Visitors never receive them.

4. The contact form ("Send the Raven")

What we collect: your name, your email address and your message. We use them to read your message and to reply. The legal basis is your consent under Article 6(1)(a) GDPR, which you give by sending the form. You can withdraw it at any time (Article 7(3)) with effect for the future.

Your message is stored in the password-protected admin area of this website, which is hosted by IONOS, and it may be forwarded to our mailbox by email. Only the two of us have access. We delete your message once your enquiry has been dealt with, and at the latest 12 months later, unless the law requires us to keep it longer.

To protect the form from spam, we remember a scrambled (hashed) version of your IP address for a short time, only to count how many messages come from one place. For the same reason we check how quickly a form is sent after the page loaded, we may briefly remember a scrambled version of a message to spot copies, and when a confirmation email is sent we remember a scrambled version of the email address for up to one day. None of this identifies you.

5. The Witch List (newsletter)

What we collect: your email address. We use it to send you our newsletter about books, cafés and events. The legal basis is your consent under Article 6(1)(a) GDPR and Section 174 of the Austrian Telecommunications Act 2021, which allows electronic mailings only with your prior consent. You give it by entering your address and pressing "Join the Coven", and then confirming it: we immediately send one email with a link (double opt-in), and your address only joins the list once you open that link and press the confirmation button. If you do not confirm within 48 hours, your address is deleted automatically. We keep no other record of an unconfirmed sign-up.

You can withdraw your consent at any time by writing to [still to be added]; we then remove your address. We keep it until you unsubscribe. We do not pass it on and we do not use an outside newsletter service at the moment. If that ever changes, we will update this page first.

6. Event RSVPs

What we collect: your name, your email address, the number of people coming and which event it is for. We use them to organise the gathering, for example to count seats and to tell you about changes. The legal basis is your consent under Article 6(1)(a) GDPR, given by sending the RSVP form. We delete the data automatically 30 days after the event (or, if an event has no date yet, 60 days after you sent the form).

7. Who receives your data

• Our hosting provider IONOS SE in Germany, as our processor (Article 28 GDPR).
• Public authorities, only where the law requires us to hand data over.

We do not sell your data, we do not use it for advertising and we do not build profiles of visitors. There is no automated decision-making or profiling as described in Article 22 GDPR.

8. Transfers outside the EU and EEA

We do not transfer personal data outside the EU/EEA ourselves and we do not use services that do. If you follow a link to another website, such as our Instagram account (run by Meta), that website's own privacy rules apply from the moment you click. Nothing is loaded from Instagram or any other site until you do.

9. How we protect your data

The website uses an encrypted connection (HTTPS). The admin area is protected by a password, wrong passwords are limited, and only the two of us have access. We keep backups of the website content so that nothing is lost by mistake.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have wrong data corrected (Article 16);
• have your data erased, also called the right to be forgotten (Article 17);
• restrict how we use your data (Article 18);
• receive your data in a common, machine-readable format (Article 20);
• object to processing that is based on our legitimate interests (Article 21);
• withdraw a consent you gave at any time, without affecting what happened before (Article 7(3)).

To use any of these rights, write to [still to be added]. We will answer within one month (Article 12(3)).

You are not obliged to give us your data. Without a name and email address, however, we cannot reply to your message, send you the newsletter or register your RSVP.

11. Complaints

If you think we are not handling your data properly, you have the right to complain to a supervisory authority (Article 77 GDPR). In Austria this is the Österreichische Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Wien, Austria, email dsb@dsb.gv.at, website www.dsb.gv.at. If you live in another EU country, you can also complain to the authority there. The European Data Protection Board lists them all: edpb.europa.eu.

12. Children

This website is written for adults. In Austria, a child can only give consent for online services from the age of 14 (Section 4(4) of the Austrian Data Protection Act, DSG). If you are younger than 14, please ask a parent or guardian before you send us anything.

13. Changes to this page

We update this page when the website or the law changes. The date at the top shows when it was last changed.