Privacy notice

Controller

Hosting and server logs

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server-side processing and the contact form are configured to run in Vercel’s Frankfurt, Germany region (fra1). Static content may also be cached and delivered through Vercel’s global edge network.

When you access the website, Vercel processes technical connection data required to deliver and protect it. This may include your IP address, access time, requested page, referrer, browser, operating system and technical security information.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is operating a secure, reliable and efficient website. Technical data is retained only for as long as required for website operation, security and incident investigation and is then deleted or anonymised in accordance with the applicable settings and provider retention rules.

Further information: Vercel Privacy Notice

Aggregate website usage statistics

I use Vercel Web Analytics solely to understand approximately how many people visit this website and the countries from which visits originate. I do not use custom events, advertising measurement or individual visitor profiles.

Vercel may process the time of a visit, page or route viewed, referrer, approximate location, browser, operating system and device type. Vercel may technically derive approximate regional or city information from request data, but I use location statistics only at country level.

Vercel Web Analytics does not use cookies. Visitors are represented by a hash generated from the incoming request. The hash is reset after 24 hours and cannot be used by me to identify a visitor or recognise that person on another day or website. The statistics available to me are aggregated.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is understanding the general reach and use of my business website. Under the Vercel Pro plan, analytics reports are available to me for up to 12 months. Vercel may retain service data for longer in accordance with its contractual terms.

Further information: Vercel Web Analytics privacy and compliance information

Contact form and email

If you contact me through the contact form or by email, I process the information you provide. This normally includes your name, email address, organisation, topic and message, together with technical delivery information.

The information is used only to assess and answer your enquiry and, where relevant, to initiate or manage a business relationship.

The legal bases are:

• Article 6(1)(b) GDPR where your enquiry concerns a contract or requested pre-contractual steps;
• Article 6(1)(f) GDPR for other professional enquiries and correspondence; and
• Article 6(1)(c) GDPR where information must be retained to comply with a legal obligation.

Contact-form messages are delivered using Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France) as an email service provider. Brevo processes the message content and necessary delivery information on my behalf. Contact details submitted through the form are not added to a newsletter or marketing list.

I receive, store and send business email using Google Workspace, provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where the service supports it, data storage is configured for a European data region. This applies to covered data and does not mean that every processing or support operation occurs exclusively within the EEA.

Providing information through the contact form is voluntary. The required contact details and message are necessary for me to process and answer your enquiry. Without them, I may be unable to respond.

Further information: Brevo Privacy Policy · Brevo data-storage information · Google Cloud Data Processing Addendum · Google Privacy Policy

Retention of enquiries

If an enquiry does not result in a business relationship, I normally delete the correspondence no later than six months after it has been finally answered, unless continued storage is necessary to establish, exercise or defend legal claims.

Correspondence connected with a contract or subject to commercial, tax or other legal retention requirements is retained for the applicable statutory period and then deleted.

Processing outside the EEA

The website’s primary server-side processing is configured in Frankfurt, Germany. However, Vercel’s global content-delivery network, Web Analytics, security operations, support services or subprocessors may process certain data outside Germany or the European Economic Area. Google and its subprocessors may also process certain service or support data outside the EEA.

Where required, transfers are based on an adequacy decision, including the EU-U.S. Data Privacy Framework where relevant, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Brevo states that its hosting databases are located within the European Union, although it may also use service providers or subprocessors, including outside the EEA.

Recipients

Personal data is disclosed only where necessary, and only to:

• the hosting, analytics, email-delivery and email-service providers identified above;
• professional advisers or public authorities where required by law or necessary for legal claims; or
• another recipient where you have instructed me to make the disclosure or another lawful basis applies.

I do not sell personal data and do not use contact enquiries for unrelated marketing.

Your rights

Subject to the applicable legal requirements, you may have the right to:

• access your personal data (Article 15 GDPR);
• correct inaccurate data (Article 16 GDPR);
• request erasure (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• receive data you provided in a portable format (Article 20 GDPR); and
• object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).

To exercise these rights, contact me at the address above.

You may also lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for my place of business is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany — poststelle@datenschutz.hessen.de, datenschutz.hessen.de.

Security and automated decisions

Connections to this website are encrypted using TLS. Appropriate technical and organisational measures are used to protect personal data against accidental loss, alteration, unauthorised disclosure or access.

This website does not perform automated decision-making or profiling within the meaning of Article 22 GDPR.

Changes

I will update this notice if the website, its providers or the relevant processing activities change. The current version is published on this page.