Privacy Policy

This website is hosted on virtual cloud server instances provided by Hetzner Online GmbH in certified German data centers:

• Server Location & Infrastructure: All computing resources are hosted in Germany (Nuremberg / Falkenstein data center parks). Operations comply fully with the strict provisions of the European GDPR.
• Data Processing Agreement (Art. 28 GDPR): A legally compliant Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner Online GmbH. Only technically unavoidable, transient connection telemetry is processed.
• Autonomous System Administration: The virtual server instances and operating system (Linux) are independently administered and hardened. Hetzner solely provides the physical and virtual compute infrastructure.

Strict enforcement of data minimization principles pursuant to Art. 5 (1) (c) GDPR. The web server is intentionally hardened so that personal data is never recorded:

• Zero Access Logs: HTTP request logging is completely disabled (access_log off;). No client IP addresses, User-Agent strings, referrers, or requested URLs are ever persisted to disk.
• Critical Error Logs Only: Error logging is restricted exclusively to critical system failures (crit level). These diagnostics protect runtime stability and contain no personal identifiers.

End-to-end transport layer encryption ensures data integrity, confidentiality, and tamper-proof transmission:

• SSL/TLS 1.3: The website is exclusively accessible via strongly ciphered TLS connections with modern cipher suites.
• HTTP/3 (QUIC): Modern UDP-based protocol architecture with built-in connection encryption and low latency.
• HSTS Policy: HTTP Strict Transport Security instructs user agents to connect solely through HTTPS, eliminating downgrade attacks.

For anonymous traffic statistics, an isolated self-hosted instance of Umami operates under strict privacy safeguards:

• Fully Self-Hosted: Hosted entirely on local infrastructure. No telemetry is shared with external cloud platforms or data brokers.
• No IP Storing (TRACKING=1): Raw client IP addresses are never logged or stored. Sessions are calculated using transient, rotating hashes.
• Zero Cookies (DISABLE_TRACKING_COOKIE=1): Operates completely cookieless. No tracking cookies or advertising identifiers are stored on your device.
• Do-Not-Track Honored (RESPECT_DNT=1): Client DNT headers are strictly honored and automatically bypass all counting.

This platform does not load any assets, scripts, or fonts from external third-party hosts:

• Local Self-Hosted Fonts: All typography (WOFF2) and interface symbols are delivered directly from the host. Zero connection to Google Fonts.
• Zero External CDNs & APIs: No public content delivery networks (cdnjs, unpkg, jsdelivr) are utilized. Telemetry leakage to cloud networks is eliminated.

When transmitting project requests or messages, submitted data is handled strictly for bilateral communication:

• Purpose Limitation: Data is used exclusively to evaluate and reply to your inquiry. No marketing usage, no sharing with third parties.
• Ephemeral CSRF Tokens: The contact form uses a transient PHP session cookie strictly to prevent cross-site request forgery and brute-force abuse.
• No Automated Profiling: No automated decision-making or behavioral evaluation is performed.

Under European privacy law, you retain the following statutory rights regarding your personal records:

• Statutory Rights: Right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and objection (Art. 21).
• Technical Reality: Because no IP addresses or browser profiles are stored, in general no identifiable data exists on the server. Meaningful disclosures can only relate to actively submitted communications.

If you consider that the processing of personal data relating to you infringes data protection law, you have the right to lodge a formal complaint with a competent supervisory authority.