Privacy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on this website is:

No data protection officer has been appointed, as the legal requirements for doing so are not met. For any privacy-related question, please use the contact details above.

2. General principles

Personal data is any information relating to an identified or identifiable natural person. I only process your personal data where this is necessary to provide this website and my services, or where you have given your consent.

This website uses no cookies, no analytics or tracking services, no advertising networks, no social media plugins and no external map services. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR.

3. Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The provider processes the data on my behalf; a data processing agreement pursuant to Article 28 GDPR has been concluded.

When you access the website, the server automatically collects information that your browser transmits and that is technically required to deliver the page and ensure its stability and security:

• date and time of access
• page or file requested and volume of data transferred
• notification of successful retrieval (HTTP status code)
• browser type and version used
• operating system and referrer URL
• IP address of the requesting device

The legal basis is Article 6 (1) (f) GDPR. My legitimate interest lies in the technically faultless operation and the security of the website. This data is not merged with other data sources. Log files are deleted as soon as they are no longer required for the purpose for which they were collected, at the latest after 30 days.

All transmission is encrypted via HTTPS (TLS). You can recognise an encrypted connection by the lock icon in your browser's address bar.

4. Contact form

If you send me an enquiry via the contact form, the details you enter are transmitted to me by email and stored for the purpose of processing your enquiry and for any follow-up questions. The following data is processed:

• name (required)
• email address (required)
• message (required)
• phone number and topic selection (optional)

The legal basis is Article 6 (1) (b) GDPR where your enquiry relates to entering into or performing a contract. In all other cases, the legal basis is my legitimate interest in answering enquiries pursuant to Article 6 (1) (f) GDPR.

To protect against automated bulk submissions, the server keeps your IP address in memory for fifteen minutes when you submit and rejects more than five submissions from the same address within that time. After that the address is discarded; it is neither linked to your enquiry nor stored. The legal basis is my legitimate interest in protecting the form from abuse pursuant to Article 6 (1) (f) GDPR.

After submitting, you automatically receive a confirmation of receipt at the email address you provided. In addition to the email, your details are stored in a database of the website, which is located with the hosting provider named in section 3. This ensures an enquiry still reaches me if the email is lost in transit or ends up in a spam folder. Only I have access to that database, and the data there is not used for any other purpose.

The data remains with me until the purpose for storing it no longer applies, you ask me to delete it, or you withdraw your consent. Mandatory statutory retention periods — in particular commercial and tax law periods of six and ten years respectively — remain unaffected.

5. Email delivery and mailbox

For sending the form emails and for my mailbox I use the services of ALL-INKL.COM — Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider processes the content and metadata of your message on my behalf on servers in Germany; a data processing agreement pursuant to Article 28 GDPR has been concluded.

If you write to me directly by email or call me, I process your details — for emails in particular the sender address, subject and message content, for calls your phone number and the content of the conversation — solely to handle your request. The legal basis is Article 6 (1) (b) or (f) GDPR.

6. Cookies and your consent

The first time you open this site, a banner asks whether you consent to analytics. Until you answer, nothing is measured and nothing is loaded beyond what it takes to deliver the page. The banner itself is the open-source solution "Cookie Consent" by Orest Bida, served entirely from my own server, so no connection to a third party is made in the process.

Your answer is stored in your browser as a cookie named "cc_cookie" and kept there for 6 months. It holds which categories you allowed and nothing else. Without that entry the question would have to be asked again on every single page, which is why it needs no consent of its own under section 25(2) no. 2 TDDDG. The legal basis for processing it is Art. 6(1)(c) GDPR, because consent once given has to be demonstrable.

You can change your decision at any time. The "Cookie preferences" entry in the footer of every page opens the selection again, and a withdrawal takes effect the moment you save it.

7. Analytics with PostHog

If you consent in the banner, the analytics tool PostHog is loaded. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. I use the European edition of the service, whose servers are located in Frankfurt am Main, so the data does not leave the European Union. Without your consent PostHog is never loaded and not a single entry is created in your browser.

What I measure with it is which pages get read and which do not, so that I can shape the content around it. Collected are:

• the pages you open, how long you stay and the page you came from
• date and time of the visit
• browser, operating system and approximate window size
• individual events on the page, such as a contact form being sent or a filter being chosen in the portfolio

Your IP address is technically needed for the transfer, but it is explicitly not stored, because every event hands the field to PostHog empty. Advertising identifiers in the address bar, such as "gclid" or "fbclid", are removed before anything is sent.

To recognise a visit within one session, PostHog sets cookies prefixed with "ph_" that live for 12 months. They contain a random identifier and neither your name nor your email address nor anything else that names you directly.

The legal basis is your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. A data processing agreement under Art. 28 GDPR is in place with PostHog. If you withdraw your consent, the cookies that were set are deleted and nothing further is collected, while the lawfulness of the processing carried out until then remains unaffected.

8. Fonts

This website uses web fonts that are served locally from its own server. No connection to servers operated by Google or other third parties is established when the page is loaded, and no data is transmitted to such providers.

9. Recipients of your data

Your data is only passed on to the processors named above (hosting, email, analytics) and to bodies to which transmission is required by law — for instance tax advisors, tax authorities or law enforcement agencies. Your data is never sold or shared for advertising purposes.

10. Your rights

You have the following rights regarding the personal data concerning you:

• access to the data processed (Article 15 GDPR)
• rectification of inaccurate or incomplete data (Article 16 GDPR)
• erasure of your data (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• objection to processing (Article 21 GDPR)
• withdrawal of consent with effect for the future (Article 7 (3) GDPR)

An informal message to the contact details above is enough to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for me is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

11. Right to object

Where your data is processed on the basis of legitimate interests pursuant to Article 6 (1) (f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. In the event of an objection, I will no longer process the data concerned unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

12. Changes to this privacy policy

I update this privacy policy whenever changes to the website or to the services used make it necessary, or when the legal situation changes. The version published on this page at the time of your visit applies.

13. About this translation

This English version is provided for convenience only. In case of any discrepancy, the German version of this privacy policy is legally binding.