Privacy policy
This English version is provided for convenience only. In case of doubt, the German version shall prevail.
Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Karsten Weng
Web design & frontend development
Waldemarstr. 21
10999 Berlin
Germany
Email: karsten@weng.eu
Further details can be found in the imprint.
Overview
I only process personal data where this is technically necessary to run this website or where you provide it to me yourself, for example via the contact form. “Personal data” means any information that can be used to identify you personally, such as your name, email address or IP address.
There is no tracking on this website: no analytics or advertising tools, no social media plugins and no fingerprinting. I deliver fonts, scripts and images from my own server.
Hosting and server log files
This website is hosted by STRATO GmbH (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
When you visit the website, the server automatically processes the following data for technical reasons:
- IP address
- date and time of the request
- requested URL
- referrer URL (previously visited page), if your browser transmits it
- information about your browser and operating system (user agent)
The purpose is to deliver the website and to ensure security and stability, for example to defend against attacks. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in the secure and error-free operation of the website.
This data is collected on the server of my hosting provider STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. For security reasons, and to detect and fend off attacks, STRATO stores visitors’ IP addresses for 7 days at most. In the hosting provider’s customer area I only have access to anonymised access logs of the last 6 weeks, which do not allow conclusions about individual persons. This data is not combined with other data sources that would establish a link to a person.
Cookies and local storage
I do not set cookies for analytics or advertising purposes. Only technically necessary data is stored, for which no consent is required (Sec. 25(2) no. 2 TDDDG):
- Session cookie (PHPSESSID): only set on the contact page, it protects the form against misuse and spam (security token). It contains no personal content, is HttpOnly and SameSite=Lax and is deleted when you close the browser.
- Display mode (light or dark): if you use the switch in the header, your browser stores your choice in local storage (localStorage). The value stays in your browser and is not transmitted to me. You can delete it at any time in your browser settings.
The language (German or English) is derived from the address of the page and is not stored. The legal basis for these processes is Art. 6(1)(f) GDPR.
Contact form and email
If you write to me via the contact form or by email, I process your name, email address and message in order to answer your enquiry. The form is sent to me by email. Name, email address and message are mandatory so that I can reply to you.
To protect against spam, the form contains an invisible additional field (honeypot) and a security token (see the session cookie above). No profiles are created from this. I also limit the number of requests per IP address: for this the server stores only a hash of the IP address with a counter for two hours at most, not the plain IP address.
The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering enquiries).
I delete your details as soon as the enquiry has been dealt with and no statutory retention obligations apply, for example for business correspondence. Your data is not passed on to third parties, apart from the forwarding to my mailbox (see the section “Recipients, third countries and storage period”).
External links
This website contains links to other websites, for example to LinkedIn, GitHub and to projects of my clients. Only when you click a link is data such as your IP address transmitted to the respective operator. Their privacy policy applies to their data processing.
SSL/TLS encryption
This website uses SSL/TLS encryption so that transmitted data cannot be read by third parties. You can recognise an encrypted connection by “https://” in the address bar and the lock symbol in your browser.
Recipients, third countries and storage period
The recipient of your data is the hosting provider (STRATO GmbH) as processor. The email address karsten@weng.eu is also operated at STRATO. Emails to this address, including messages from the contact form, are forwarded by me to my personal mailbox at Google (Gmail). Google is therefore a further recipient of these emails.
Data may be transferred to the USA in the process. The basis is the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework. Beyond that, I do not transfer personal data to countries outside the European Union or the European Economic Area.
IP addresses in the server log files are deleted after 7 days at most (see the Hosting section), contact enquiries as described above. The session cookie ends when you close the browser.
Your rights
You have the following rights against me with regard to your personal data:
- access (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing (Art. 21 GDPR)
Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. To exercise your rights, write to me at karsten@weng.eu.
Right to lodge a complaint
If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for my place of business is the Berlin Commissioner for Data Protection and Freedom of Information (opens in a new window). An overview of all supervisory authorities can be found here (opens in a new window).
Automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
As of: