Back to overview

Privacy Policy

Last updated: 8 September 2026

1. Who is responsible (controller)

This website (“FH Room Checker”, the “Service”) is operated by Seymur Mammadov (“I”, “me”), Graz, Österreich. I decide how and why personal data is processed and am the controller under the General Data Protection Regulation (GDPR). For anything in this policy — including any of the rights in section 8 — write to mseymur2k@gmail.com. Jakob Schnurrer contributed design work but does not operate the Service or decide how personal data is processed.

FH Room Checker is an independent, non-commercial student project. FH JOANNEUM has permitted use of its timetable interface and has discussed possible future adoption of the app. Unless and until that happens, this remains not an official FH JOANNEUM service and is operated independently. The university’s name and logo identify the source and intended university context of the timetable information.

2. Scope

This policy explains what personal data I process when you use the Service, why, on what legal basis, who receives it, and the rights you have. “Personal data” means any information relating to an identifiable person. It also covers people who never use the Service themselves — in particular the lecturers named in the university timetable (section 3.3).

3. What data I process

3.1 Visiting the site. When you open the Service, the hosting provider automatically processes technical data such as your IP address, browser and device type, the page requested, and the time of the request, in order to deliver the site securely and reliably. Legal basis: my legitimate interest in operating and securing the Service (Art. 6(1)(f) GDPR). The site is hosted on Vercel’s Hobby service. Vercel determines the purposes and retention of its service-generated hosting data under its own privacy notice.

3.2 Room & timetable data. The room-availability information shown is public timetable data from FH JOANNEUM and does not identify you. Browsing rooms involves no personal data of yours.

3.3 Lecturer names in the timetable (“Teacher Finder”). The FH JOANNEUM timetable feed I read is an openly accessible source published by the university, and each class in it names the lecturer teaching it. The Service stores those names so students can search for a lecturer and see where and when that person is teaching. Because this is information about identifiable people that I did not obtain from those people themselves, I set out the details required by Art. 14 GDPR here:

  • What I hold: lecturer name, course, room, building, date and time — exactly as the university publishes them. Nothing more: no contact details, no private address, no personal characteristics, and nothing about anyone outside their published teaching schedule.
  • Where it comes from: the university’s own openly accessible timetable interface, which is read automatically and reorganised. I obtain nothing from lecturers directly and add nothing of my own.
  • Why: so students can find the room, class, and lecturer using a simpler interface. Legal basis: my legitimate interest (Art. 6(1)(f)) in reorganising the university’s public timetable for student use. The balancing assessment considers the professional context, the university’s existing person-search function, the limited fields displayed, future-only search results, and the opt-out described below.
  • How long: for as long as the class appears in the university’s feed. When the university removes or changes an entry, my copy follows on the next sync.
  • Your right to object: under Art. 21 GDPR you may object on grounds relating to your particular situation. Independently of that statutory right, I will honour a simple no-reason request to remove your name from Teacher Finder — no explanation needed. Write to mseymur2k@gmail.com. Once you are excluded, your name stops appearing in the search suggestions and searching for it returns no results.
  • One honest limit to that. Where the university publishes a class with more than one lecturer on it, the class is stored as the university sends it. If someone searches for a colleague you teach that class with, your name can still appear as part of that shared entry, because it cannot be separated without losing the class itself. If that affects you, please get in touch and I will do what I can. Since all of this information comes from FH JOANNEUM’s own published timetable, corrections at the source are a matter for the university.

3.4 Feedback form. If you submit feedback, I process the category and description you write and — only if you choose to provide them — your name and email address. Purpose: to read and, where you ask, respond to your feedback. Name and email are optional; without them I cannot reply. Legal basis: my legitimate interest in receiving reports, replying where requested, and improving the Service (Art. 6(1)(f)). Feedback is kept for 12 months and then deleted automatically.

3.5 Optional analytics — Umami. Umami loads only if you select “Allow analytics”. It measures page URL and title, referring site, browser language, screen size, device/browser/operating-system information, approximate location derived from the request IP address, and visit times. Umami does not set cookies or track you across unrelated websites, but it creates a session hash from the request IP address, user agent, and website ID. The IP address is used to derive location and create that hash rather than being shown to me as a stored field. The account region is EU. Legal basis: your consent (Art. 6(1)(a) GDPR and §165(3) TKG 2021). Declining has no effect on the Service. You can change or withdraw your choice at any time through “Analytics settings” in the footer. Analytics is reviewed for continued necessity at least annually and is deleted when the analytics website or Service is closed.

3.6 Spam protection. The feedback form is protected by a hidden form field (a “honeypot”) that only automated bots fill in, together with a short waiting period between submissions. Both run entirely in your browser. I deliberately use no CAPTCHA service, so no information about you or your device is sent to any third party for this purpose.

3.7 Local storage (functional). The Service stores a small amount of information in your browser to make the Service work: your theme preference (light/dark), a timestamp used to rate-limit feedback submissions, and your analytics choice. These values stay on your device, are not used to identify you, and are necessary to provide the requested preference, prevent basic feedback abuse, and ensure analytics respects your choice.

4. Cookies

The Service sets no cookies. It uses only the functional local-storage values described in section 3.7. Cookie-free analytics is still optional and is not loaded until you consent through the analytics choice.

5. Recipients & processors

The Service uses the following recipients and providers. Their legal roles differ:

  • Supabase Pte. Ltd — database and backend hosting, acting as processor under a signed data-processing agreement. Project region: EU (Ireland).
  • Vercel Inc. — website hosting on the Hobby plan. Vercel acts as an independent controller for service-generated data such as end-user IP and request information under its privacy notice; the Pro/Enterprise processor description in Vercel’s DPA does not apply here.
  • Umami Software, Inc. — optional analytics, acting as processor. Account region: EU. Its DPA is automatically incorporated into the current Umami Cloud Terms.

I use no Google services: there is no Google Analytics, no reCAPTCHA, and no Google fonts or scripts loaded from Google servers.

6. International data transfers

Database content is hosted in the EU (Supabase, Ireland), subject to the transfer safeguards in the signed Supabase DPA. The Umami account region is EU, while Umami Software, Inc. is a US company and its incorporated DPA provides transfer safeguards. Vercel is US-based and may process service-generated information in the United States and other jurisdictions; Vercel states that it participates in the EU–U.S. Data Privacy Framework and uses Standard Contractual Clauses or other appropriate mechanisms where required.

7. Retention

Timetable data follows the current source feed and changes on the next successful sync. Feedback is deleted automatically after 12 months. Vercel controls retention of its service-generated hosting data under its privacy notice. Optional analytics is reviewed at least annually and deleted when the analytics website or Service is closed.

8. Your rights

Under the GDPR you may have rights of access, rectification, erasure, restriction, and objection. Data portability applies where its legal conditions are met. You may withdraw analytics consent at any time without affecting earlier lawful processing. No automated decision-making or profiling with legal or similarly significant effects is used. To exercise a right, contact mseymur2k@gmail.com.

9. Right to lodge a complaint

You may complain to a data-protection supervisory authority. The competent authority for me is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — dsb.gv.at.

10. Changes to this policy

I may update this policy as the Service evolves. The current version is identified by the “last updated” date above. See also my Imprint.