Privacy Policy
This privacy policy explains which personal data is processed when you use coloruma.com, why it is processed, on which legal basis, and which rights you have under the General Data Protection Regulation (GDPR). Coloruma is a static website: there are no user accounts, no cookies, no advertising networks and no embedded third-party content. Anonymous web analytics runs only if you explicitly allow it (section 3).
1. Controller
The controller responsible for data processing on this website is Karin Faust, Grazer Straße 29, 3970 Harbach, Austria. Email: hello@coloruma.com. No data protection officer has been appointed, because the legal requirements for an appointment are not met.
2. Hosting and server logs (Cloudflare)
The website is delivered through the global network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For users in the European Economic Area, the contracting entity is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. When you open a page or download a file, your browser automatically sends technical data to Cloudflare so that the page can be delivered: IP address, date and time of the request, requested URL, HTTP status, referrer URL, browser type and version, operating system, and the amount of data transferred.
Cloudflare uses this data to deliver the content, to protect the website against attacks (for example distributed denial of service attacks and bots) and to provide us with aggregated statistics such as the number of requests per country. We see these statistics only in aggregated form and cannot identify individual visitors from them. Request logs are retained by Cloudflare for a short period for security and troubleshooting purposes and then deleted; according to Cloudflare, raw log data is not kept for longer than a few days, while aggregated statistics are kept without personal reference.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, fast and stable delivery of the website. We have concluded a data processing agreement with Cloudflare under Article 28 GDPR. Cloudflare participates in the EU-U.S. Data Privacy Framework and additionally uses the EU standard contractual clauses for transfers to the USA. Cloudflare's own privacy policy is available at https://www.cloudflare.com/privacypolicy/.
3. Web analytics with PostHog and Umami (only with your consent)
If you choose "Allow" in the banner, we measure which coloring pages and pages are used, using PostHog. The provider is PostHog, Inc., San Francisco, California, USA. We use only PostHog's EU cloud with servers in Frankfurt, Germany; the measurement data does not leave the EU. The PostHog script is served from our own domain.
Alongside PostHog we use Umami Cloud, provided by Umami Software, Inc., USA. Its script is loaded from cloud.umami.is, but only after you choose "Allow". Umami counts page views and clicks, referrer, browser, operating system, device type, screen size, language and country. It sets no cookies and stores nothing on your device; your IP address is used to derive the country and a short-lived technical visitor hash and is not stored. Legal basis and withdrawal are the same as for PostHog, see below. Umami's privacy policy is available at https://umami.is/privacy.
The following is collected: page viewed and time, referring page, clicks on links and buttons, browser type and version, operating system, device type, screen size, language, and the country derived from your IP address. The IP address itself is not stored as part of the measurement data; IP capture is switched off in our PostHog project. PostHog stores a randomly generated identifier in your browser's local storage (key starting with ph_) so that the page views of one visit belong together. No cookies are set for this. Person profiles, session recording, heatmaps, surveys and error capture are switched off; we do not link the identifier to a name, an email address or an account, and we do not pass the measurement data on.
Legal basis: Article 6(1)(a) GDPR, your consent, together with Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), which implements Article 5(3) of the ePrivacy Directive. Before consent no analytics script is loaded and no request is sent to PostHog; if you choose "Decline", it stays that way. If your browser sends the Global Privacy Control signal, we treat it as a decline and show no banner. You can withdraw your consent at any time with effect for the future, through "Statistics settings" in the footer of every page. On withdrawal the identifier is deleted from your browser's local storage. We have concluded a data processing agreement with PostHog under Article 28 GDPR. PostHog deletes the measurement data at the end of the retention period of our plan, after one year on the free plan.
4. Local storage for the online coloring tool
On the pages under /en/color-online/ you can color pictures in your browser. So that your picture is still there when you return, the tool saves the list of areas you have colored and the colors you used in your browser's local storage (localStorage) under the key coloruma:online:{picture}. This data never leaves your device and is not transmitted to us or to anyone else. It contains no personal information. You can delete it at any time with the button "Start over" on the page or by clearing the site data in your browser settings. Legal basis for storing this information on your device is Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), which implements Article 5(3) of the ePrivacy Directive, since the storage is strictly necessary to provide the function you have explicitly requested.
5. Share buttons
Coloring pages and collections can be shared via Pinterest, WhatsApp, Facebook, X and email. These buttons are plain links. No code from these services is loaded on our pages, and no data is sent to them until you click a button. After a click, you leave our website and the privacy policy of the respective service applies.
6. Downloads
When you download a PDF or PNG file, the request is processed as described in section 2. We do not track which files you download and we do not require an account or an email address for downloads.
7. Contact by email
If you write to us at hello@coloruma.com, we process your email address, your name if you provide it, and the content of your message in order to answer your request. Legal basis: Article 6(1)(b) GDPR if your request concerns a contract or a licence question, otherwise Article 6(1)(f) GDPR (our legitimate interest in answering requests). We delete emails once the request has been fully dealt with, unless statutory retention obligations require us to keep them longer. Our email is hosted by Proton AG, Schweiz.
8. Children
Coloruma is suitable for children, but it is not directed at children as a data collection service. We do not collect any personal data from children, we do not offer accounts and we do not ask for names, ages or email addresses. If you believe a child has sent us personal data by email, contact us and we will delete it.
9. Recipients of data
Personal data is disclosed only to the processors named in this policy (Cloudflare for hosting, our email provider for email) and, if legally required, to authorities. With your consent, PostHog and Umami are added for web analytics (section 3). We do not sell personal data and do not use it for advertising.
10. Storage periods
Server logs: a few days at Cloudflare, see section 2. Local storage: on your device until you delete it. Emails: until the request is completed, plus statutory retention periods where applicable. Web analytics data: at PostHog until the retention period of our plan ends, currently one year, see section 3.
11. Your rights
Under the GDPR you have the following rights with regard to your personal data:
- Access (Article 15): you can ask which data about you we process.
- Rectification (Article 16): you can ask us to correct inaccurate data.
- Erasure (Article 17): you can ask us to delete your data, unless we are required to keep it.
- Restriction of processing (Article 18).
- Data portability (Article 20).
- Objection (Article 21): you can object to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation.
- Withdrawal of consent (Article 7(3)): where processing is based on consent, you can withdraw it at any time with effect for the future. This concerns the web analytics in section 3; use "Statistics settings" in the footer.
- Complaint (Article 77): you can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.
To exercise these rights, write to hello@coloruma.com. We answer within one month.
12. Security
The website is delivered exclusively over HTTPS. Our hosting provider protects the infrastructure against unauthorised access. We store no user data ourselves; the web analytics data is held by PostHog in the EU (section 3). The risk of a data breach affecting you is therefore limited to the technical log data described above and to that measurement data.
13. Changes to this policy
We will update this policy when the website changes, for example if we introduce advertising or a newsletter. Any such change will be published on this page before it takes effect, together with the new date of revision. The date at the top of this page shows the current version.