Privacy policy

This website is provided through Amazon Web Services (AWS) in the AWS Europe (Frankfurt) Region. AWS may process technically necessary connection data to deliver the website securely and reliably.

Amazon Web Services EMEA SARL
38 Avenue John F. Kennedy
L-1855 Luxembourg

Where AWS processes personal data on my behalf, this is governed by a data processing agreement. The legal basis for hosting is Article 6(1)(f) GDPR; my legitimate interest is the secure, stable and efficient provision of this website.

When you open this website, technically necessary data is transmitted between your browser and the web server. This may include in particular:

• IP address of the requesting device
• date, time, requested address and HTTP method
• browser, operating system and device information contained in request headers
• previously visited page, if your browser transmits this information

This processing is necessary to deliver content, defend against attacks and maintain technical operation. The legal basis is Article 6(1)(f) GDPR. The application itself does not write permanent access logs; security logs may be created at hosting-infrastructure level.

The website does not set its own analytics or advertising cookies. It stores two entries in your browser's local storage for display options that you explicitly choose:

• maho_theme – selected appearance (Business or Creative)
• i18n_lang – selected language

Storing these entries does not automatically transmit them from your device. You can delete them at any time through your browser settings. The storage provides the function requested by you and is based on section 25(2)(2) TDDDG.

When you use the interactive search, your input is sent to this website's own server API and evaluated there using local rules. The request is not sent to ChatGPT or any other AI service and is not stored permanently by the application.

To protect against misuse, the IP address is processed temporarily in server memory for rate limiting. The corresponding entry expires after approximately five minutes and is not stored in a database.

The legal basis is Article 6(1)(f) GDPR (protection and needs-based provision of the function) and, for a specific project enquiry, Article 6(1)(b) GDPR.

For consistent presentation, the website loads the Inter and Space Mono typefaces from Google servers. In particular, your IP address is transmitted to Google. The provider for users in the European Economic Area is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by other Google companies and in third countries cannot be ruled out.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is a consistent and performant presentation of the website.

Google privacy policy ↗

Project text and images are retrieved from Contentful while the website is built. The public website does not access the Contentful API directly from your browser for this content; the Gatsby image addresses delivered to you are on the same website.

The website contains links to LinkedIn and an external shop. A connection to the relevant provider is established only when you open such a link. The provider's own privacy policy then applies to the subsequent processing.

If you contact me by email or telephone, I process the information you provide in order to answer your enquiry. For emails, this may include the sender address, content and time of the message.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns steps prior to entering into or performing a contract; in all other cases it is Article 6(1)(f) GDPR based on the legitimate interest in responding to your enquiry.

Personal data is retained only for as long as required for its respective purpose or by statutory retention obligations. Local settings remain in your browser until you delete them. Contact enquiries are deleted after they have been handled unless legal or contractual reasons require longer retention.

Subject to the statutory requirements, you have the following rights in particular:

• access to your processed personal data (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure of your data (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
• complaint to a data protection supervisory authority (Article 77 GDPR)

In particular, you may contact the supervisory authority responsible for private entities in Bavaria: