privacy policy

Controller

In short

This website sets no cookies and loads no content from third parties. For simple visitor statistics I use Vercel Web Analytics, without cookies and without tracking across other websites. I only process personal data as far as it's needed to deliver the website, for these statistics and to answer your requests.

Hosting

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every visit, Vercel processes technically necessary data in server log files: IP address, date and time, the page requested, referrer URL, browser and operating system. This is needed to deliver the website and protect it from abuse.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure and stable website. A data processing agreement under Art. 28 GDPR is in place with Vercel. Vercel is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission's adequacy decision (Art. 45 GDPR), with the Commission's standard contractual clauses in addition. Log files are deleted after one day.

Visitor statistics

To see which pages are read and how visitors find their way here, I use Web Analytics by Vercel, the hosting provider. The script is loaded from this domain. With every page view, the page requested, the referrer URL, the time, browser, operating system and device type, and the location Vercel derives from the IP address (country, region and city) are recorded.

No cookies are set and no identifier is stored in your browser. To group the page views of one visit, Vercel creates a hash from the request, which is discarded after 24 hours. I only see aggregated numbers, not individual visitors, and no profile across websites is created.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is improving the website based on audience numbers. The agreement and the transfer to the USA are covered as described under hosting. You can object to the recording (Art. 21 GDPR); an ad or tracking blocker prevents it as well.

Contact form and email

When you write to me through the contact form or by email, I process your details (name, email address, optionally your company, your message and the time) to answer your request. An automatic confirmation goes to the address you entered.

The legal basis is Art. 6(1)(b) GDPR if your request aims at a contract, otherwise Art. 6(1)(f) GDPR; my legitimate interest is answering requests.

The form emails are sent by Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor under Art. 28 GDPR. Sending runs through servers in the EU (Ireland); Resend stores account and log data in the USA. Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), with the Commission's standard contractual clauses in addition. My email is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany; a data processing agreement is in place with ALL-INKL as well.

Against spam, the form contains a field that people never see and checks how quickly it was sent. No further data is collected for this.

I delete your request once it has been dealt with, unless statutory retention duties apply, for example to tax-relevant business correspondence under § 147 AO.

Storage in your browser

When you switch between the dark and the light design, your browser remembers the choice for the current session (session storage). It isn't sent to me and is deleted when you close the tab. The legal basis is § 25(2) no. 2 TDDDG, as the storage is strictly necessary for the function you asked for.

Fonts

The fonts are stored on this website's server. No connection to Google or any other provider is made.

Links to other services

The links to GitHub, LinkedIn, X and Bluesky are plain links. Data only goes to the provider once you follow a link; from then on, the provider's privacy policy applies.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). A short email to business@tobiashaefermann.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me, the data protection authority of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

Providing data

You're not obliged to give me any data. Without your name, email address and message, though, I can't answer your request. There is no automated decision-making or profiling.