Privacy Policy

Controller

The controller under the General Data Protection Regulation (GDPR) is:

Hosting and technical delivery

Hosting recipient and processor is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the site is requested, IONOS processes technical access data. This may include an IP address or anonymized IP address, time, requested URL or file, HTTP method and status, transferred data, referrer, browser and operating-system information, and error or connection data.

Processing delivers the site over HTTPS/TLS, detects attacks and abuse, and resolves technical faults. The legal basis is Art. 6(1)(f) GDPR. The legitimate interests are secure, stable, and economical operation of this portfolio.

Log retention depends on the IONOS product generation. IONOS documents a maximum availability of eight weeks for web-hosting contracts acquired by September 17, 2025; no fixed public period is stated for newer contracts. Logs are deleted or anonymized under IONOS product and security rules. Processing under the IONOS data-processing agreement generally occurs in the EU or EEA. Where a third-country transfer is exceptionally required, IONOS commits to Arts. 44 et seq. GDPR.

IONOS WebAnalytics

IONOS WebAnalytics is enabled. According to IONOS, it evaluates log data or a tracking pixel without cookies. It processes referrer, requested page or file, browser type and version, operating system, device type, access time, and an anonymized IP address. IONOS states that the transmitted IP address is anonymized immediately and that the anonymized address is used for approximate location. IONOS SE is recipient and processor.

The purpose is aggregate usage statistics and technical optimization. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is understanding reach, errors, and usage patterns for this non-commercial recruitment portfolio. IONOS provides reports for the preceding twelve months. That period is not necessarily the final deletion period for every raw or backup record.

Automatically loaded GitHub activity

When the Contact section is opened, your browser automatically makes a direct HTTPS request to github-contributions-api.jogruber.de. The service may receive the IP address, time, requested path, user agent, and origin or referrer information.

The public service is associated with Jonathan Gruber's open-source project. A definitive legal operator identity, serviceable postal address, and service-specific privacy policy are not published. The published source uses the client IP for short-lived rate limiting on uncached requests and keeps GitHub contribution data in server memory for one hour. Errors may appear in server logs. On a cache miss, the service accesses GitHub using the API server's IP rather than directly disclosing the visitor's IP to GitHub.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is presenting public professional activity as part of this recruitment portfolio. If the request fails, the rest of the site remains available. Durable, contractually confirmed information about the operator's hosting, logs, subprocessors, or third-country processing is unavailable.

Email contact and Gmail

If you email me, I process sender and recipient addresses, message content and attachments, and communication metadata such as date, time, and routing information to answer the request. Pre-contractual communication is based on Art. 6(1)(b) GDPR; other inquiries are based on the legitimate interest in handling incoming messages under Art. 6(1)(f) GDPR.

The mailbox is a consumer Gmail account. Recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google operates servers worldwide, so processing outside the EEA, particularly in the United States, may occur. Google relies on the EU-US Data Privacy Framework for certified US organizations and refers to the European Commission's Standard Contractual Clauses where that framework does not apply.

Cookies, browser storage, and language

This website sets no custom cookies. No application data is persisted in localStorage, and no custom navigation history or GitHub cache is stored in sessionStorage. Language, navigation target, GitHub data, and Anki demo settings remain only in the open page's memory and disappear on reload.

The URL path determines the language. Only the unlocalized root URL evaluates the browser language for a one-time redirect without saving it. The web framework may manage technically necessary session state for navigation and scroll restoration. Any terminal access for that purpose relies on § 25(2)(2) TDDDG because it is required for the expressly requested navigation.

External links

Links to GitHub, LinkedIn, Instagram, Anki, or other external sites contact the destination only when followed. The destination's privacy information then applies. The MathJax CDN URL visible in the Anki setup guide is copyable example text and is not requested by this website.

Retention

Unless a more specific period is stated above, I retain personal data only while needed for its purpose. Emails are deleted after an inquiry is finally resolved unless legal retention duties or legitimate interests in establishing, exercising, or defending legal claims require continued retention. Google states that encrypted backups may remain for up to six months after deletion.

Your data-protection rights

Subject to the statutory conditions, you have rights to:

• access under Art. 15 GDPR;
• rectification under Art. 16 GDPR;
• erasure under Art. 17 GDPR;
• restriction under Art. 18 GDPR;
• data portability under Art. 20 GDPR; and
• object under Art. 21 GDPR.

Contact the email address above to exercise your rights.

Right to object under Article 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation. Processing will then cease unless compelling legitimate grounds override your interests, rights, and freedoms, or processing is required for legal claims.

Right to lodge a complaint

Under Art. 77 GDPR, you may complain to a data-protection authority. The authority responsible for my location is the Data Protection Authority of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany. Your right to contact another competent authority remains unaffected.

Requirement to provide data

Using the site and contacting me are voluntary. The IP address and request information are technically necessary to deliver a requested page; without them, delivery is impossible. An email may not be answerable without a sender address and sufficient message content.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Selecting a language route has no legal or similarly significant effect.