Last updated: [25 November 2025]
This Privacy Policy describes how Albin’s Cybersecurity Blog (“we”, “us”, “our”) collects, uses, and protects personal data when you visit https://blog.penic.org (the “Site”), in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws.
By using the Site, you acknowledge that you have read and understood this Privacy Policy.
1. Data controller
The data controller for this Site is:
Albin’s Cybersecurity Blog
Albin Penič
Email: [email protected]
If you have questions about this Privacy Policy or our data practices, you can contact us at the email address above.
2. What data we collect
2.1 Data you provide directly
We may collect the following data when you interact with us:
- Contact details – when you contact us (e.g. via email or contact forms), we may collect your name, email address, and the content of your message.
- Account information – if the Site allows user registration, we may collect login credentials and profile information.
- Comments or contributions – if you leave comments, we may collect the name or alias you provide, your comment, and the time of submission.
2.2 Data collected automatically
When you visit the Site, certain information is collected automatically, for example:
- IP address and approximate location (country/region)
- browser type and version
- device type and operating system
- referring URL and pages visited
- date, time, and duration of visits
- interactions with our content and ads
This information is primarily collected via server logs, cookies, and Google Analytics, and is often processed in aggregated or pseudonymised form.
2.3 Cookies and similar technologies
We use cookies and similar technologies to:
- make the Site function securely and reliably
- remember preferences (e.g. language)
- analyse traffic and usage (via Google Analytics)
- display advertising and measure its performance (via Google AdSense and related services)
You can control cookies through your browser settings and, where implemented, through our cookie banner or preferences centre.
3. Legal bases for processing (GDPR)
Depending on the context, we may process your personal data under the following legal bases:
- Legitimate interests – e.g. to secure the Site, prevent abuse, maintain logs, and understand how it is used, provided these interests are not overridden by your rights.
- Consent – for placing non-essential cookies (analytics, advertising) and for personalised ads in the EEA/UK/Switzerland, as required by Google’s EU user consent policy and local law.
- Contract – if you create an account or otherwise enter into an agreement with us.
- Legal obligations – where we must retain or disclose data to comply with applicable laws.
4. How we use your data
We may use personal data to:
- operate, maintain, and secure the Site
- respond to your questions and requests
- analyse usage and improve content and layout
- manage user accounts (if available)
- display ads and measure their effectiveness
- detect, prevent, and respond to security incidents or abuse
- comply with legal obligations and enforce our rights
We do not sell your personal data.
5. Google Analytics
We use Google Analytics to understand how visitors use the Site (for example, which pages are most visited, how users arrive on the Site, and how long they stay). Google Analytics processes information such as:
- pages visited and actions taken
- your truncated IP address and approximate location
- device and browser information
- referrer URL
Google Analytics 4 is designed with privacy controls, including IP address handling, data retention settings, and options to limit data sharing and ad personalisation.
We configure Google Analytics to respect GDPR requirements as far as possible, for example by:
- using data retention settings that limit how long data is stored
- avoiding unnecessary user-ID features or granular location tracking
- controlling data sharing with other Google products
Google acts as our data processor for Analytics data, processing it on our behalf under Google’s standard terms.
You can opt out of Google Analytics by:
- adjusting your cookie preferences (where available), and/or
- using browser tools such as ad/tracking blockers.
6. Google AdSense and advertising
We use Google AdSense to display adverts on the Site. AdSense may use cookies and similar technologies to:
- show ads based on your visits to this and other websites
- limit how often you see the same ad
- measure the effectiveness of advertising campaigns
For users in the EEA, UK and Switzerland, Google requires site owners to:
- obtain valid consent before using cookies or other local storage for personalised ads; and
- disclose clearly that third parties (including Google) may use cookies and data for personalisation and measurement.
Depending on your consent choices:
- you may see personalised ads, based on your activity on this and other sites; or
- you may see non-personalised ads, which are not based on your past behaviour but may still use cookies for basic frequency capping, aggregated reporting and combating fraud/abuse.
Google’s processing of data in connection with AdSense is governed by Google’s own Privacy Policy and terms. You can manage your ad settings directly in your Google account (for example, to turn off personalised ads across Google services).
7. Cookies, consent and control
In line with EU law and Google’s EU user consent policy, non-essential cookies (such as analytics and advertising) should only be set after you have given your consent, except where another legal basis clearly applies.
You can:
- manage your preferences through any cookie banner or settings we provide (where available);
- change your browser settings to block or delete cookies;
- use browser extensions that limit tracking.
Please note that blocking certain cookies may affect functionality or performance.
8. Third-party services and data sharing
We may share personal data with trusted third parties where necessary to operate the Site, including:
- Hosting and infrastructure providers – to host the Site and store server logs.
- Analytics provider (Google Analytics) – to analyse traffic and usage patterns.
- Advertising provider (Google AdSense) – to serve and measure ads.
- Email / communication providers – if we send transactional or newsletter emails.
- Professional advisers and authorities – if required by law or to protect our rights, safety, or property.
We require such third parties to handle personal data in accordance with applicable data-protection laws and to use it only for the purposes we specify.
We do not sell personal data to data brokers.
9. International data transfers
Google and other service providers may process data in countries outside the European Economic Area (EEA), including the United States. In such cases, we rely on appropriate safeguards, such as:
- adequacy decisions by the European Commission; and/or
- standard contractual clauses or equivalent mechanisms adopted by the European Commission.
10. Data retention
We retain personal data only for as long as necessary for the purposes described in this Policy, including:
- Server and security logs – for a limited time, to investigate incidents or abuse.
- Analytics data – in line with our Google Analytics data retention settings and only as long as needed for aggregate statistics.
- Contact and support data – for as long as needed to respond and maintain records.
- Account data – for as long as your account remains active, plus a limited period thereafter where required by law or for legitimate interests.
When data is no longer needed, we will delete or anonymise it in a secure manner.
11. Your rights under GDPR
If you are located in the EEA, UK, Switzerland or another region with similar data-protection laws, you have the right to:
- obtain confirmation whether we process your personal data and access a copy
- request correction of inaccurate or incomplete data
- request deletion of your personal data in certain circumstances
- request restriction of processing in certain situations
- receive personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller (where technically feasible)
- object to processing based on legitimate interests or to direct marketing
- withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)
To exercise these rights, contact us at [email protected] and provide enough information for us to verify your identity.
You also have the right to lodge a complaint with your local data protection authority if you believe our processing violates applicable law.
12. Security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. However, no system can be guaranteed 100% secure, and we cannot guarantee absolute security of information transmitted via the internet.
13. Children’s privacy
The Site is intended for adult professionals and interested readers, not for children. We do not knowingly collect personal data from children under the age required by local law (for example, 16 under the GDPR, unless a different age is specified by a Member State).
If you believe that a child has provided personal data through the Site, please contact us so that we can take appropriate steps to delete such data.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we do so, we will update the “Last updated” date at the top of this page.
Your continued use of the Site after any changes have been posted constitutes your acceptance of the updated Privacy Policy.
15. Contact
If you have any questions about this Privacy Policy, our data practices, or your rights, you can contact us at:
Email: [email protected]
