This Privacy Policy explains how personal data is handled when you visit clemens.ms (the “Site”), read an article, use the comments, watch an embedded video, or contact me.
The Site is a personal technical blog. It does not offer user accounts, a newsletter, purchases, or a contact form, and it does not sell personal data.
This Policy applies only to clemens.ms. NavaTron B.V.’s website, products, games, and business operations are covered by NavaTron’s separate Privacy Policy.
1. Who is responsible for your data
Clemens Schotte is the data controller for processing carried out through the Site.
- Email: clemens@navatron.com
- Correspondence address: c/o NavaTron B.V., Octavio Pazlaan 5, 2553 DM ’s-Gravenhage, the Netherlands
The Site is operated by Clemens Schotte in a personal capacity. NavaTron B.V. and NavaTron Holding B.V. do not become controllers for the Site merely because the correspondence address or a navatron.com email address is used. Some third-party services described below also process data under their own terms and may act as processors or independent controllers for parts of their processing.
2. Data processed when you use the Site
Site delivery and security
The Site is a static website hosted on Microsoft Azure Blob Storage in the West Europe region and delivered through Azure Front Door’s global edge network. The Site’s origin content is therefore stored in the European Union, although Front Door may process requests at an edge location near the visitor. When your browser requests a page or file, Microsoft and the hosting infrastructure receive technical request data needed to deliver and protect the Site. This may include:
- your IP address;
- the date and time of the request;
- the requested URL and referring page;
- browser and device information, including the user-agent string;
- protocol, response status, performance, and security information; and
- an Azure request identifier.
This data is used to provide the Site, maintain reliability, diagnose errors, prevent abuse, and protect the Site and its visitors. The legal basis is my legitimate interest in operating a secure and reliable website. Azure diagnostic-log retention depends on the hosting configuration; logs are retained only for as long as reasonably needed for security, troubleshooting, and legal obligations. Microsoft may retain limited internal security logs under its own policies.
Google Analytics 4
Production pages include Google Analytics 4 (measurement ID G-4RSBDP58C3). Google Analytics helps me understand aggregate traffic and which content is useful. The tag can process page views and interactions, page URL and title, referrer, approximate location, browser and device characteristics, language, and a pseudonymous client identifier.
Google Analytics normally sets first-party cookies such as _ga and _ga_4RSBDP58C3. The _ga cookie can last up to two years; exact names, expiry dates, and behavior may vary with Google or browser settings. Google states that GA4 uses an IP address at collection time for routing and approximate geolocation and does not log or store the IP address.
User-level and event-level retention in GA4 is controlled by the property setting and is generally two or fourteen months. Some aggregated reports are not subject to the same retention period.
The intended legal basis for non-essential analytics is your consent where applicable law requires it. In jurisdictions where consent is not required, the basis is my legitimate interest in understanding and improving the Site. The Google Analytics tag is currently included when a production page loads; vendor consent controls, browser settings, or extensions may limit what it stores or sends.
For more information, see Google’s explanation of Analytics data safeguards and Google’s Privacy Policy.
Microsoft Clarity
Production pages also include Microsoft Clarity (project ID 8k4z1elga6) to understand how visitors use and experience the Site. Clarity can collect page and navigation data, clicks, scrolling, pointer movement, performance information, browser and device details, approximate location derived from an IP address, and pseudonymous identifiers. It may create heatmaps and session replays. Form fields and other sensitive content are masked by default; the Site does not contain account, payment, or contact-form fields.
Clarity may use first-party cookies such as _clck and _clsk and Microsoft cookies such as CLID, ANONCHK, MR, MUID, and SM. Cookie availability and duration depend on consent, browser settings, region, and Microsoft configuration. Microsoft states that standard playback data is retained for 30 days, while click and heatmap data and labeled or favorited sessions may be retained for up to nine months.
The intended legal basis for non-essential behavioral analytics is your consent where applicable law requires it. In jurisdictions where consent is not required, the basis is my legitimate interest in improving usability and diagnosing problems. Clarity is currently included when a production page loads. Microsoft limits cookie-based functionality in the EEA, United Kingdom, and Switzerland unless it receives a valid consent signal.
For more information, see Clarity’s data collection information, Clarity’s cookie information, and the Microsoft Privacy Statement.
Comments through Giscus and GitHub
Most article pages load a Giscus comment widget from giscus.app. Loading the widget creates a connection to Giscus and uses the page pathname to find the corresponding discussion in the public GitHub repository. Giscus states that it has no advertising or tracking and stores comments in GitHub Discussions.
To comment or react, you must sign in to GitHub and authorize the Giscus app, or post directly in GitHub Discussions. Giscus and GitHub may process your GitHub identity, public profile, comment or reaction, authentication data, and ordinary technical request data. Your username, profile image, comment, reaction, and posting time may be public. Do not post personal or confidential information you do not want made public.
The legal basis for loading the discussion feature is my legitimate interest in providing community discussion. Processing involved in signing in or posting occurs at your request. Public comments remain available until they are deleted through GitHub or removed through moderation, although copies may remain in backups or archives for a limited period. See the Giscus project information and GitHub Privacy Statement.
Embedded YouTube videos
Some articles contain YouTube videos. Hugo’s privacy-enhanced mode serves these players from youtube-nocookie.com. When a page containing a player loads, your browser connects to YouTube and shares basic technical data needed to display and protect the player, such as your IP address, browser details, referring site, and the requested video. YouTube may collect additional usage and playback data when you interact with a video. The videos do not autoplay.
The legal basis is your consent where applicable law requires it and, elsewhere, my legitimate interest in presenting relevant video content. Google processes this data under its Privacy Policy.
Theme preference and browser features
If you switch between light and dark themes, the Site stores your choice under the key theme in your browser’s local storage. The value is not transmitted to me and remains until you clear site data. This storage is used only to remember a feature you requested.
The copy, share, and heading-link buttons use your browser’s clipboard or native share feature when you activate them. The Site does not receive the contents of your clipboard or the destination you choose for sharing.
Email and external links
If you email me, I receive your email address, name or other account details supplied by your email provider, your message, and any information you choose to include. I use it to respond, manage the correspondence, protect my legal interests, and take steps you request. I retain correspondence only while it remains relevant, or longer where required for security or legal reasons.
Following an external link takes you to another service. That service receives data directly from your browser and is governed by its own privacy notice. Merely displaying a normal external link does not send the linked service your data.
3. Cookies and your choices
The Site uses browser storage for the theme preference and may use cookies or similar identifiers through Google Analytics, Microsoft Clarity, GitHub/Giscus, and YouTube as described above.
You can delete or block cookies and local storage through your browser settings. Blocking them may reduce analytics or affect comments, embedded videos, and the remembered theme, but the articles remain readable. You can also use the Google Analytics opt-out browser add-on and Microsoft’s privacy choices.
Browser “Do Not Track” signals do not have a single agreed technical meaning, so the Site does not respond to them directly. Individual providers may honor browser or account-level privacy controls, including Global Privacy Control, under their own policies.
4. Sharing and international transfers
I do not sell or rent personal data. Data is shared only as needed with the providers named in this Policy, when you direct a disclosure (for example, by posting a public comment), to protect the Site or others, or when required by law.
The Site’s Azure Blob Storage origin is hosted in Microsoft’s West Europe region. Azure Front Door uses a global edge network, and Microsoft, Google, GitHub, and Giscus may process some data in countries outside the European Economic Area, including the United States. Where the GDPR requires safeguards, providers may rely on an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses, or another lawful transfer mechanism. Their linked privacy notices contain current details.
5. Your privacy rights
Depending on the law that applies to you, you may have the right to:
- obtain information about how your personal data is used and request access to it;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive data you provided in a portable format where applicable; and
- withdraw consent at any time, without affecting processing that occurred before withdrawal.
There is no solely automated decision-making on the Site that produces legal or similarly significant effects.
To exercise a right, email clemens@navatron.com. I may need enough information to verify your identity and locate the relevant data. I normally respond within one month, although applicable law may permit an extension for a complex request. Data controlled directly by Google, Microsoft, GitHub, or Giscus may also need to be requested from that provider.
You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country of residence or work.
6. Children
The Site is intended for a general technical audience and is not directed at children under 16. I do not knowingly ask children for personal data. If you believe a child has provided personal data through a comment or email, please contact me so that appropriate action can be taken.
7. Security
I use reasonable technical and organizational measures appropriate to a static public website. However, no internet transmission or storage system is completely secure. Public comments should be treated as public information.
8. Changes to this Policy
I may update this Policy when the Site, its providers, or the law changes. The lastmod date at the top of this page identifies the latest revision. Material changes will be presented on the Site where appropriate.
9. Contact
For privacy questions or requests, contact clemens@navatron.com.