What this is

You are at https://www.zylstra.org/blog, which since 2002 is the personal weblog of me, Ton Zijlstra, its author. Although personal weblogs aren’t subject to the GDPR (the European personal data protection regulations), I do write about my professional interests here, and one of those is data protection. So I added a data protection policy anyway. My contact info is listed in the right hand column.

What personal data my site collects and why

When you visit this site, some technical data is automatically collected, such as your IP address. This is used for anti-spam, security and a few very basic analytical purposes. When you comment on a posting, a name and email address will be asked. When your own website alerts my website that you link to me (Webmention), your name and website address may appear in my comment section. In some postings other website’s content may be embedded (like a Slideshare presentation, a Youtube video, or an image on Flikcr), that track some of your data themselves.

Comments and Webmentions

When visitors leave comments on the site the data shown in the comments form is collected (name and email address), and also the visitor’s IP address and browser user agent string to help spam detection. The name you use in the comment form is shown publicly on the website once your comment is approved.

The email address you provided will not be published, but will be stored with your comment, for as long as that comment is published. An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your Gravatar profile picture is visible to the public in the context of your comment.

Webmentions are an automatic way in which your own website alerts my website that you link to it. Metadata in your own website’s markup explicitly makes that data available to my website. I only publish metadata, such as your name, url or profile picture of your site, that you yourself submit, underneath my own postings. I only publish a link to your own website along the lines of “this article was mentioned on [your website]“, and no excerpt or fragment of your content will be displayed unless it’s a direct reply. I also use webmention to collect and display social backfeeds, which are mentions and likes on Twitter and Mastodon that are walled gardens and do not themselves support webmention. I use the WordPress plugin Webmention for this.

Subscriptions

You have the option to subscribe by e-mail to new postings. Those subscriptions are managed by WordPress.com. The e-mail addresses are not used for anything else. I do occasionally clean up the list removing e-mail addresses that are connected to spammers.

Contact forms

There is no contact form, so no data is collected there. My contact info is listed on the right hand side.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies stored on your own computer. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year. You can delete these cookies from your browser anytime if you want.

My blog does not set any other cookies.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos from Youtube, images from Flickr, articles and slides from Slideshare, etc.). Embedded content from other websites behaves in the exact same way as if you have visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website. Youtube videos that I embed are embedded in privacy enhanced mode, meaning they use a non-tracking Youtube URL (youtube-nocookie.com). However it is at the discretion of YT/Google if they adhere to their own promises on this. I also strip any script from Flickr embeds, resulting in as far as I can tell in no cookies and tracking being set, except for loading the image from your IP address. I no longer embed content from Slideshare / Scribd, and am self hosting such files.

Analytics

I don’t use specialized analytical tools. However data such as your IP address, and the pages an IP has requested are stored in the server logs of my web hosting company, Your-Webhost. Their data protection policy is at https://www.your-webhost.nl/whois/terms.html. Whenever there are server problems, I may ask my hosting provider to look into their logs to see what happened. The server logs are processed on my webserver into aggregated analytical data with a tool called Awstats, that is available by default from my hosting company. I never look at it, though that may change.

By default WordPress, the tool I use to make this site, does not collect any analytics data. Jetpack is a plugin by Automattic, the creator of WordPress, that is part of WordPress by default and does collect analytics data, but I have uninstalled it.

Who I share your data with

I don’t share your data (the little that I may have) with others, except for the plugins that I use for spam and malicious attack protection.

How I retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. The same is true for Webmentions. This is so I can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

If you subscribe to my blog by e-mail, I retain the e-mail address you used until you unsubscribe.

Aggregated statistics in Awstats are kept for 5 years maximum, although I usually delete them much earlier to free up space on my hosting account.

What rights you have over your data

If you have an account on this site (you don’t, only I do), or have left comments, you can request to receive an exported file of the personal data I hold about you, including any data you have provided to me. You can also request that I correct or erase any personal data I hold about you. This does not include erasure of any data I may be obliged to keep for administrative, legal, security or other legitimate purposes. You can also at any time request the removal of one or all webmentions originating from your website.

Where I send your data

Visitor comments and visitor’s IP addresses are checked through an automated spam and attack detection service. I use Wordfence and Akismet for this.

My contact information

You can contact me using the information on the right hand side. You can use encrypted email to do so.

How I protect your data

All interaction with this website is encrypted traffic, by using https. My webserver, on which all data for this blog is stored, is protected by my web hosting company Your-Webhost. I cannot circumvent or alter their protective measures, nor do so without breaching their terms of service. My own access to this website, the back-end at my hosting company, and the front-end WordPress, is protected with strong passwords and non-standard usernames. I use two plugins, Akismet and Wordfence to shield against spam and attacks.

What data breach procedures I have in place

If you think data on this site may have been breached please contact me. With my web-hosting provider I will look into it, and report back to you.
If I get notified about a breach by my web-hoster I will inform those that have commented, and will post an announcement in my blog itself.
If I suspect there may have been a breach I will notify my web-hosting provider and work with them to prevent futures breaches, inform those who have commented on my site and post an announcement in my blog itself.

What automated decision making and/or profiling I do with user data

If you submit a comment to this site, or if you try to gain access to this website’s controls, you may be automatically classified as spammer or a malicious attacker and automatically blocked or listed as permanently banned. If you submit a comment for the first time, or a comment that contains multiple weblinks, it will be automatically held for moderation, and will not be published until I have looked at it. If you have previously approved comments published on my blog, and I know you, you will be automatically permitted to do so again using the same credentials.