As a security community, we regard protecting your personal data not only as a legal obligation but as one of our core responsibilities. This policy explains which data are processed when you use pugat.org, for what purposes and on what legal basis, under the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the Telecommunications and Digital Services Data Protection Act (TDDDG).
In brief
- You do not need to provide any personal information to read the site.
- We do not collect data for advertising or user profiling, and we do not sell your data.
- By default we measure visits without cookies and anonymously. Cookie-based statistics and the automatic loading of external content (video, podcast players) only happen with your permission; we do not show a cookie banner when you arrive.
- Messages you send us are used only to reply to you and are not stored on the site.
1. Controller
The controller within the meaning of Art. 4(7) GDPR is Erdal Turna, publisher of PUGAT – Pusula Güvenlik Araştırmaları Topluluğu (North Rhine-Westphalia, Germany). PUGAT is a publishing community without legal personality.
Email: info@pugat.org
As there is no legal obligation to do so, no data protection officer has been appointed. Please send any data protection questions to the address above.
2. Hosting and server logs
The site is hosted by Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus). Each time you visit the site, your browser technically transmits the following information to the server: IP address, date and time of the visit, the page requested, the referring address, and browser and operating system information. These logs are kept briefly to ensure the secure and stable operation of the site, detect attacks and fix technical errors, and are then deleted.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the site). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.
Cached copies of pages are used so that the site loads quickly (LiteSpeed Cache). No personal data are collected from visitors for this purpose.
3. Cookies and similar technologies
You do not need cookies to read this site, and we do not show a cookie banner when you arrive. This is because we do not run any technology that requires consent by default: visit statistics are cookieless (see section 4), and embedded videos and podcast players only load when you click on them (see section 5).
Only information that is strictly necessary for the site to work (e.g. editors’ login sessions, the record of your cookie choice) is stored without consent under § 25(2) TDDDG. The “remember me” cookie in the comment form, cookie-based statistics and the automatic loading of external content are used only on your action and with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can give or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page. For details, see our Cookie Policy.
4. Visitor statistics (Google Analytics)
We use Google Analytics 4 to understand which articles are read. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
By default: cookieless measurement. We have configured Google’s Consent Mode so that statistics consent starts as “denied”. In this state Google Analytics neither places nor reads cookies or persistent identifiers on your device; it only sends cookieless signals containing information such as the page view, a timestamp and the browser and device type, which cannot be used to recognise you again. Google uses the IP address in these signals to derive an approximate location and does not store it. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding how our publications are read). You may object to this processing under Art. 21 GDPR; you can also block it with browser add-ons or content blockers.
With your consent: cookie-based measurement. If you allow statistics under “Cookie settings”, Google Analytics uses cookies (_ga, _ga_*) to distinguish returning visits. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time via the same link.
We do not use advertising features, Google signals or user profiling. The retention period for user- and event-level data is set to 14 months; after that, this detailed data is deleted. Aggregated reports such as visit counts may be kept longer as statistics that cannot be linked to an individual. Data may be transferred to servers in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.
5. Embedded content: YouTube and Spotify
Some articles contain YouTube videos and Spotify podcast episodes. These are not loaded when the page opens; instead you see an information box. Only when you click “Load content” (or if you have allowed external content to load automatically under “Cookie settings”) does your browser connect to the provider’s servers; your IP address and device information are then transmitted to that provider, which may use cookies.
- YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where possible, videos are shown in privacy-enhanced mode (youtube-nocookie.com).
- Spotify: Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). If you prefer not to load this content, you can watch or listen to it directly on the provider’s site.
6. Comments
When you comment on an article, we store the name you enter (you may use a pseudonym), your email address, an optional website address, the content of the comment, your IP address and browser information. Your email address is not published. Comments may be reviewed by the editors before publication. The IP address is stored so that the person responsible can be identified in cases of abuse or unlawful content. Comments are kept until you ask for them to be deleted or until the purpose of publication no longer applies.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to give readers the opportunity to comment on articles, to moderate the discussion, and to prevent abuse or unlawful content and, where necessary, identify the person responsible. You may object to this processing under Art. 21 GDPR and ask for your comment to be deleted.
If you tick the “remember me” box in the form, your name, email and website are stored in a cookie in your browser for your next comment. This cookie is only set if you tick the box (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); you can delete it from your browser at any time.
7. Contact form and email
When you use the contact or article submission form, your name, email address, chosen subject, message and any link you share are forwarded to our editors by email solely in order to respond to your request. Form content is not stored in the site’s database. To prevent abuse, an irreversible value derived from your IP address is kept temporarily for one hour. Your emails are deleted once the correspondence has been completed, unless there is a statutory retention obligation.
Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) and (f) GDPR (responding to your request).
8. Newsletter (Compass of the Month)
If you subscribe to our newsletter, your email address is used solely to send it. Your subscription is completed when you click the confirmation link sent to your email address (double opt-in). The times of registration and confirmation are stored so that we can document your consent. You can unsubscribe at any time via the link at the end of every newsletter, in which case your address will be deleted. The service provider used to send the newsletter will be named in this section when the newsletter launches.
Legal basis: Art. 6(1)(a) GDPR (consent).
9. Social media
We only link to our accounts on Facebook, X, YouTube, Spotify and Telegram; we do not run these platforms’ plugins on the site. When you click a link, the data protection rules of the platform concerned apply.
10. Fonts
The fonts used on the site are loaded from our own server; no connection is made to third-party font servers.
11. Your rights
Under the GDPR you have the following rights: access to your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent with effect for the future (Art. 7(3)). You can send your requests to info@pugat.org or via our contact form.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You may do so with the supervisory authority in the EU country where you live or work. The authority responsible for us is the supervisory authority of the federal state where the publisher is based: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.
12. Data security
The connection between you and the site is encrypted with SSL/TLS. Access to the administration area is restricted to authorised persons.
13. Changes
We update this policy when the services on the site or the law change. The current version is always available on this page.
