Privacy
WHYZ is based in Vienna, Austria. The General Data Protection Regulation (EU 2016/679) applies, together with the Austrian Datenschutzgesetz and section 165 of the Telekommunikationsgesetz 2021.
No cookies, and no banner
This site sets no cookies at all. It runs no third-party analytics, no advertising pixels, no embeds, no tag manager and no third-party scripts of any kind. Both web fonts are served from this site, so no font provider ever sees your address. WHYZ does count how often each page is opened, on its own server - what that means exactly is the next section.
Section 165(3) TKG 2021 requires consent before information is stored on or read from your device, except where that is strictly necessary for a service you asked for. Because nothing is stored on or read from your device, there is nothing to ask consent for, and this site deliberately shows no cookie banner.
If that ever changes, the banner will offer refusing exactly as prominently as accepting, nothing will be pre-ticked, and no script will run before you choose.
How WHYZ counts
WHYZ counts two things, and both of them are numbers rather than people.
How often each page is opened. When a page finishes loading it tells this site's own server which page it was. What gets stored is a date, the page, and a number that goes up by one - for example 2026-09-09, /vol01, 47. That is the entire record. It holds no address, no identifier, no device information, no referrer and no ordering, so there is no way to tell one visitor from another in it, and no way to follow anyone from one page to the next. It is also why nothing is stored on your device and why there is still no cookie banner: the counting happens on the server, not in your browser.
How many people joined. Counted the same way, after a form is submitted, so a submission that failed is never counted as one.
Together these tell WHYZ how many people arrive and how many end up on the list. Nothing in either number can be traced back to you, and there is therefore nothing in them to correct, export or erase.
What is collected, and when
Community list. Your name, email address and what you do. Instagram and portfolio links only if you type them.
Collaboration requests. Your name, email address, creative field, what you want to do with WHYZ, your message, and optionally Instagram and a portfolio link.
Idea submissions. Your name, email address and the idea.
The date and time of the submission is stored with it.
Your IP address, and what happens to it. To stop one person submitting the form over and over, WHYZ has to remember what an address did in the last minute. It does not store the address. It stores a salted, one-way hash of it - a short string that cannot be turned back into an address by anyone who does not hold the secret salt, which is not in the site's source code. Those rows are deleted on sight: every check first removes everything older than sixty seconds, so what is held is roughly the last minute of activity and no history at all. The row contains nothing else - no email, no name, no page - so it cannot be joined to you or to anything you submitted. This is the only place on this site where anything derived from a person is written down.
Why, and on what legal basis
To tell you about upcoming WHYZ events and to reply to what you sent. Nothing else, and no profiling.
The legal basis is your consent under Article 6(1)(a) GDPR, given when you submit the form. You can withdraw it at any time, and withdrawing it does not affect anything done before you did.
Who processes it
The WHYZ organiser reads it. Two processors handle it on WHYZ's instruction: a hosting provider that runs the site and its database, and an email provider that sends the welcome message. Nothing is sold, rented, or shared for advertising, and there is no automated decision-making.
How long
Until you ask for removal, or until the period below runs out, whichever comes first. These are not intentions - a sweep runs whenever the site is used and deletes anything past its date.
- The community list: 36 months from the day you joined. Roughly three editions, so somebody who joined before Vol. 01 still hears about Vol. 04.
- Collaboration requests: 24 months. Long enough to remember somebody who wrote once.
- Ideas: 24 months, so an idea that gets used can still be credited to the person who had it.
- Registrations for one night: 18 months. Its only ongoing use is knowing who has been before.
Counting data is not on this list because it holds nobody: a day, a page and a number. The rate-limiting hashes are deleted after sixty seconds.
Your rights, and how to use them
You can ask for a copy of your data, a correction, its deletion, a restriction on its use, or a portable export, and you can object to its use. Email the address in the imprint and say which one you want. WHYZ replies within one month.
A copy and a deletion are both carried out by one command against every table that holds an email address, from the same list, so the two can never disagree about where you are. The copy comes back as a machine-readable file rather than a screenshot.
You can also complain to the Austrian Data Protection Authority (Datenschutzbehoerde, Barichgasse 40-42, 1030 Vienna).
Photography
Photographs on this site were taken at WHYZ Vol. 01 by @aminzaazou and sarahdaniskan. If you appear in one and want it removed, email the address below and it comes down.
What is still missing
The operator name, postal address and contact email required by Austrian law are not yet published. Until they are, this page is not a complete legal disclosure and this site is not ready to launch. See the imprint.