Privacy Policy
Datenschutzerklärung · How this site handles your data under the GDPR.
1. Controller
The controller responsible for data processing on this website is:
Gerald BathorjaWorthstraße 68
58511 Lüdenscheid, Germany
gerald.bathorja@gmail.com · +49 1520 5438204
Full provider details are in the Impressum.
2. Hosting and server log files
This website is hosted on AWS Amplify Hosting, a service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, delivered via Amazon's global content delivery network. The primary hosting region is eu-central-1 (Frankfurt, Germany).
When you open the site, your browser necessarily transmits technical data that the provider records in server log files:
- IP address of the requesting device
- Date and time of the request
- The file or page requested and the volume of data transferred
- HTTP status code
- Referring URL and the browser / operating system reported by your user agent
This data is processed to deliver the site, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR — my legitimate interest in operating a functioning and secure website. A data processing agreement under Art. 28 GDPR is in place with Amazon Web Services. Where data reaches Amazon entities outside the EU, transfers are covered by the EU Standard Contractual Clauses and Amazon's supplementary measures. Log data is not merged with other sources and is not used to identify you.
3. Website analytics — Cloudflare Web Analytics
To understand roughly how many people visit and where they come from, this site uses Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Cloudflare Web Analytics is privacy-focused by design:
- It sets no cookies and stores nothing on your device.
- It does not use fingerprinting or any persistent identifier, so returning visitors cannot be recognised.
- Your IP address is used only in transit to derive an approximate country and is not stored.
- Reports are aggregated: page views, referrer, country, browser and device type. Nothing that identifies an individual.
Because no information is stored on or read from your device, no consent under § 25 TDDDG is required. The legal basis for the aggregated processing is Art. 6(1)(f) GDPR — my legitimate interest in basic, privacy-preserving reach measurement. Cloudflare acts as a processor under an Art. 28 GDPR agreement; transfers to the USA are covered by the EU Standard Contractual Clauses and Cloudflare's certification under the EU–US Data Privacy Framework.
4. Fonts
The "Inter" typeface used on this site is hosted on this website's own server and loaded from the same domain. No connection to Google Fonts or any other external font provider is established, and no data about you is transmitted to a third party in order to display text.
5. Contacting me
This site has no contact form. If you email me at the address above, or reach me through the LinkedIn or WhatsApp links provided, the data you send — your name, email address, and the content of your message — is processed solely to handle your enquiry and stored for as long as needed for that purpose and any statutory retention periods.
The legal basis is Art. 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR. Note that email is transmitted through your own provider and mine; if your enquiry is confidential, say so and we can arrange a different channel.
6. External links
This site links to external websites (client projects, LinkedIn, WhatsApp). Once you follow such a link, this policy no longer applies and the privacy practices of the destination site govern. I have no control over their content or data handling.
7. Cookies
This website sets no cookies and uses no comparable device storage such as localStorage or sessionStorage for tracking purposes. There is therefore no consent banner, because there is nothing to consent to under § 25 TDDDG.
8. Your rights
Under the GDPR you have the right to:
| Right | What it means |
|---|---|
| Access (Art. 15) | Ask whether and what data about you is processed, and receive a copy. |
| Rectification (Art. 16) | Have inaccurate data corrected. |
| Erasure (Art. 17) | Have your data deleted where no legal ground requires keeping it. |
| Restriction (Art. 18) | Have processing limited instead of deleted. |
| Data portability (Art. 20) | Receive data you provided in a machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interest, on grounds relating to your situation. |
To exercise any of these, email gerald.bathorja@gmail.com. Exercising them is free and has no disadvantage for you.
Right to lodge a complaint
You may complain to a data protection supervisory authority, in particular in the Member State of your residence or workplace. The authority competent for me is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenKavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de
9. Data retention
Server log data is retained only as long as needed for security analysis, then deleted or anonymised. Analytics data is aggregated from the outset and contains no personal data. Correspondence is kept until the enquiry is resolved, subject to statutory commercial and tax retention periods (generally 6 to 10 years under German law where a business transaction results).
10. Automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
11. Changes to this policy
This policy is updated when the site changes or the legal situation requires it. The current version always applies.