elven raven symbol
VALTYR
EN | DE
Home
Universe
About
Press / EPK
Contact
EN | DE
Back

Privacy Policy

Last updated: November 4, 2026

1. General information and applicable law

This Privacy Policy explains which personal data we process in connection with the website valtyr.com (the “Website”), for what purposes, on what legal basis, and to whom it is disclosed. The Website is the central online presence of the non-commercial VALTYR project (the brand, the music and the book Valtyr - Legend of the Dark Elf).

This Privacy Policy is based on the Swiss Federal Act on Data Protection (FADP) and the Swiss Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies, in particular because the Website is also aimed at visitors in the EU, this Privacy Policy additionally takes its requirements into account. We use terms such as “personal data” and “processing” in the sense of the FADP; they correspond in substance to the terms used in the GDPR.

2. Controller and contact

The controller responsible for the processing of data on this Website is Thomas Berger (VALTYR project).

For questions about data protection and to exercise your rights, please contact us at the email address above or use the contact form.

3. Provision of the Website and server log files

Our Website is hosted by our hosting provider Hostinger. When you access the Website, the server automatically collects information transmitted by your browser and stores it in so-called server log files. This includes in particular:

  • the IP address of the requesting device,
  • the date and time of access,
  • the page or file accessed, the amount of data transferred, the HTTP status code,
  • the referrer URL (the previously visited page),
  • the browser type, browser version and operating system.

We process this data in order to provide the Website technically, to ensure its stability and security (e.g. to defend against attacks) and to analyze errors. The legal basis is our overriding legitimate interest (Art. 31(1) FADP; Art. 6(1)(f) GDPR). Hostinger processes this data as our processor. The retention period of the log files is determined by Hostinger’s specifications.

The Website is built on WordPress. Further plugins, including Rank Math SEO (search engine optimization), LiteSpeed Cache (caching), Polylang (multilingual content) and an accessibility plugin, run on our server and, based on our review, do not load any content from third-party servers.

4. Content delivery network and security service: Cloudflare

The Website uses services provided by Cloudflare, Inc. (USA) as a DNS service and reverse proxy or content delivery network. Data traffic between your browser and our server is routed through Cloudflare’s network. In doing so, Cloudflare processes in particular your IP address and the technical data listed in section 3 in order to deliver the Website faster, to protect it against attacks (e.g. DDoS) and misuse, and to detect bot traffic. For this purpose, Cloudflare may set technically necessary cookies, e.g. “__cf_bm”, to distinguish between humans and automated access.

To protect our email address from automated harvesting, we also use Cloudflare’s email obfuscation; for this, a small script is loaded via our own domain.

The legal basis is our overriding legitimate interest in a secure and high-performing Website (Art. 31(1) FADP; Art. 6(1)(f) GDPR). Cloudflare acts as a processor. Data may be transferred to the USA and other countries in this context (see section 13).

5. Cookies and consent management

Our Website uses cookies. Cookies are small text files that are stored on your device. We ourselves use only technically necessary cookies; the legal basis is our overriding legitimate interest in operating the Website (Art. 31(1) FADP; Art. 6(1)(f) GDPR or the applicable national rules on storing information on end devices). These include:

  • cookies that store your consent choices (see below),
  • a cookie set by the multilingual plugin Polylang (“pll_language”) that stores the language you are viewing the Website in (English or German) so that pages are shown in that language; retention period 1 year,
  • a cookie set by the caching plugin LiteSpeed Cache (“_lscache_vary”) so that you are served the appropriate cached version of a page,
  • security cookies from Cloudflare (see section 4),
  • cookies set by WordPress when logging in to the administration area; this concerns administrators only.

We only set non-essential cookies with your consent (Art. 6(6) FADP; Art. 6(1)(a) GDPR); the same applies to the images of the Instagram feed loaded from Instagram’s servers (see section 11). The trailer video on the home page, on the other hand, is only loaded when you start it yourself with a click (see section 12).

To manage your consent, we use the WordPress plugin Complianz (free version), which runs on our own server. In the cookie banner, you can choose between the categories “Functional” (always active) and “Marketing”. The “Marketing” category covers external content, currently the images of the Instagram feed (see section 11). Complianz stores your choices in cookies with the prefix “cmplz_” (“cmplz_banner-status”, “cmplz_policy_id”, “cmplz_consented_services” and one cookie per category, e.g. “cmplz_functional” and “cmplz_marketing”). These cookies are stored for up to 365 days.

You can change or withdraw your choice at any time with effect for the future by reopening the settings via the “Cookie Settings” link in the footer of the Website. You can also delete or block cookies in your browser; this may limit the functionality of the Website.

6. Visitor statistics with Koko Analytics

To find out which pages are viewed and how often, we use the WordPress plugin Koko Analytics. The plugin runs entirely on our own server; no data is transferred to the plugin’s developer or to any other third party.

We use Koko Analytics in cookieless mode: no cookies are set and no data is stored on your device. In order to recognize repeat page views on the same day, the plugin creates an irreversible checksum (hash) from your IP address, your browser identifier (user agent) and a random value that changes daily. Your IP address and browser identifier themselves are not stored; the temporary data is deleted daily, so visits on different days cannot be linked to one another. Only aggregated figures are stored (e.g. page views per page and day, and referring websites). Visits by logged-in administrators are not recorded.

The legal basis is our legitimate interest in data-minimizing audience measurement to improve our Website (Art. 31(1) FADP; Art. 6(1)(f) GDPR).

7. Performance measurement with Cloudflare Web Analytics

A script from Cloudflare Web Analytics (domain static.cloudflareinsights.com) is loaded on the Website. It collects technical metrics about the page view, such as the address accessed, the referring page, and loading and rendering times, and sends them to Cloudflare via our own domain. According to Cloudflare, it does not set any cookies for this purpose, does not use your browser’s local storage and does not store your IP address for this purpose. When the script is loaded, your IP address is necessarily transmitted to Cloudflare for technical reasons.

The legal basis is our legitimate interest in a stable and fast Website (Art. 31(1) FADP; Art. 6(1)(f) GDPR). Cloudflare acts as a processor; for transfers to the USA, see section 13.

8. Fonts

The fonts used on the Website (including Instrument Sans, Cinzel, Cormorant Garamond, Italianno and Manrope, as well as the theme’s icon fonts) are served exclusively from our own server. No connection to Google Fonts or any other external font service is established when you visit the Website.

9. Contact form (Contact Form 7)

If you send us a message via the contact form, we process the data you enter - name, email address, reason for contact, subject and message - as well as your confirmation that you have read the privacy information. In addition, technical data such as the time of submission is processed. We use this data to handle and respond to your inquiry.

The form is operated with the WordPress plugin Contact Form 7; the message is forwarded to us by email. In addition, we store incoming form messages in our Website’s database (at Hostinger) using the Flamingo plugin, so that no inquiry gets lost.

The legal basis is the handling of your inquiry (Art. 31(1) FADP; Art. 6(1)(b) GDPR where your inquiry is aimed at entering into an agreement with us, otherwise Art. 6(1)(f) GDPR). We keep your message for as long as is necessary to handle your inquiry and delete it afterwards, unless statutory retention obligations apply.

10. Newsletter (email updates about the project)

On the Website, you can sign up with your email address for our newsletter with email updates about the VALTYR project (music, stories, news about the book and upcoming releases). For this, we use the WordPress plugin “Newsletter” (The Newsletter Plugin), which runs on our own server. No external newsletter service is used.

When you sign up, we process your email address, your consent (checkbox), the language of the page on which you signed up, and the time of sign-up and confirmation. We use the double opt-in procedure: after signing up, you will receive an email with a confirmation link. Your subscription is only activated once you click this link. This ensures that no one can sign up someone else’s email address.

Your data is stored in our Website’s database at our hosting provider Hostinger (see section 3). We send the emails via Hostinger’s mail server (SMTP). Hostinger acts as our processor. We use your email address exclusively to keep you informed about the VALTYR project.

The legal basis is your consent, which you give by ticking the checkbox, submitting the form and confirming the link (Art. 6(6) FADP; Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future and unsubscribe by clicking the unsubscribe link included in every newsletter email, or by writing to us via the contact form or at [email protected]. Your data will then be deleted from our list.

11. Instagram feed (Smash Balloon)

We display posts from our Instagram account on the Website. For this, we use the WordPress plugin “Instagram Feed Pro” by Smash Balloon. The plugin retrieves the posts server-side via Instagram’s interface (API).

Without your consent, the feed images are delivered in resized form from our own server; no connection is established between your browser and Instagram’s servers. Only once you consent to the “Marketing” category in the cookie banner does your browser load the images directly from Instagram’s servers (cdninstagram.com). In this case, the provider (for Europe, Meta Platforms Ireland Limited, Ireland; parent company Meta Platforms, Inc., USA) receives in particular your IP address and browser information. If you click a link to Instagram, you will be redirected to Instagram. Meta’s privacy policy applies to processing by Instagram: https://privacycenter.instagram.com/policy.

The legal basis for displaying the feed with images from our own server is our legitimate interest in an appealing presentation of our project (Art. 31(1) FADP; Art. 6(1)(f) GDPR). The legal basis for loading the images from Instagram’s servers is your consent (Art. 6(6) FADP; Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie Settings” in the footer.

12. Links to social networks and platforms, YouTube trailer

On our Website, we link to our profiles and content on platforms such as Spotify, YouTube, Apple Music, Instagram and Facebook, as well as other music and social media services. These are simple links. Data is only transmitted to the respective provider when you click a link and visit the platform. The respective provider is responsible for processing on these platforms, and its privacy policy applies.

The only embedded content is our trailer video on the home page, a YouTube video (provider for Europe: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Nothing is loaded from YouTube before you click. Only when you click “Watch the valtyr Trailer” is the video loaded in YouTube’s privacy-enhanced mode (youtube-nocookie.com). In doing so, data such as your IP address and information about your device and browser is transmitted to Google, possibly also to the USA (Data Privacy Framework, see section 13). YouTube may also store or read information on your device, e.g. in cookies or the browser’s local storage.

The legal basis is your request made by clicking the trailer (Art. 6(1)(b) GDPR) and our legitimate interest in presenting our project with a video (Art. 6(1)(f) GDPR); in Switzerland, processing takes place within the principles of the FADP. Google is responsible for processing by YouTube; for more information, please see Google’s privacy policy: https://policies.google.com/privacy.

13. Disclosure abroad

Some of our service providers process personal data outside Switzerland, namely in EU/EEA countries and in the USA.

  • According to Annex 1 of the Data Protection Ordinance, the EU/EEA countries provide an adequate level of data protection.
  • For the USA, an adequate level of protection exists for companies certified under the Swiss-U.S. Data Privacy Framework (Annex 1 DPO); for transfers from the EU, the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework applies accordingly (Art. 45 GDPR).
  • Cloudflare, Inc. is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework.
  • Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; this concerns any transfers in connection with the YouTube trailer (section 12).
  • Meta Platforms, Inc. is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; this concerns any transfers in connection with the Instagram feed (section 11).

Where a recipient is not certified or is located in another country without an adequate level of protection, the transfer is based on the European Commission’s standard contractual clauses, as recognized by the FDPIC (Art. 16(2)(d) FADP; Art. 46 GDPR), or, in individual cases, on a statutory exception (Art. 17 FADP; Art. 49 GDPR).

The list of certified companies is available at https://www.dataprivacyframework.gov/list.

14. Retention period

We only keep personal data for as long as is necessary for the purposes stated or as required by statutory retention obligations. After that, it is deleted or anonymized. Where known, specific retention periods are stated for the individual processing activities.

15. Data security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss and misuse, including encrypted transmission (HTTPS/TLS), access restrictions and regular updates. However, complete security of data transmission over the internet cannot be guaranteed.

16. Your rights

Within the scope of the applicable data protection law, you have in particular the following rights:

  • the right to information as to whether and which personal data we process about you (Art. 25 FADP; Art. 15 GDPR);
  • the right to have inaccurate personal data corrected (Art. 32(1) FADP; Art. 16 GDPR);
  • the right to have your personal data erased or destroyed, and to prohibit certain processing (Art. 32(2) FADP; Art. 17 GDPR);
  • the right to restriction of processing (Art. 18 GDPR);
  • the right to receive or transfer your personal data (Art. 28 FADP; Art. 20 GDPR);
  • the right to object to processing based on legitimate interests (Art. 30(2)(b) FADP; Art. 21 GDPR);
  • the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, please contact us via the contact form or by email at [email protected]. We may ask for proof of identity. As a rule, we provide information within 30 days and free of charge.

You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch. Individuals in the EU/EEA may also lodge a complaint with the supervisory authority of their habitual residence, their place of work or the place of the alleged infringement (Art. 77 GDPR).

17. Changes

We may amend this Privacy Policy at any time, in particular if the services we use change. The version published on this Website at the relevant time applies.