Privacy
This is a portfolio site. It has no analytics, no tracking, no advertising and no cookies. The main categories of personal data processed are the technical data your browser sends when loading a page, and whatever you voluntarily provide when contacting me by form, email or post. Everything below explains that in detail, as required by the GDPR.
1. Who is responsible
Paul Michelsen
c/o IP-Management #11584
Ludwig-Erhard-Straße 18
20459 Hamburg, Germany
Email: pauleliasmichelsen@gmx.de
I decide alone why and how personal data is processed on this website, which makes me the controller in the sense of Art. 4(7) GDPR.
2. Hosting and transfer to the USA
This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify delivers the pages through a content delivery network, which means the files may be served from a server geographically close to you. Netlify processes personal data on my behalf in connection with hosting and operating this website. The relationship is governed by Netlify's data processing terms under Art. 28 GDPR, which form part of their terms of service and are pre-signed on their side.
Because Netlify is based in the United States, personal data may be transferred to a third country. Netlify covers such transfers through the EU Standard Contractual Clauses adopted by the European Commission and through its certification under the EU–U.S. Data Privacy Framework. You should be aware that United States authorities may, under certain conditions, be able to access data held by US providers, and that legal remedies against this may be more limited than within the EU.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is the reliable, fast and secure delivery of this website.
3. Server log files
Every time a page is requested, the hosting infrastructure automatically records technical information that your browser transmits: the IP address, the date and time of the request, the file requested, the amount of data transferred, the browser type and version, the operating system and, where applicable, the referring page.
This data is required to deliver the site and to detect faults and attacks. It is not combined with other sources and is not used to identify you personally. Legal basis is Art. 6(1)(f) GDPR. Log data is retained only for as long as necessary for these purposes and is then deleted or anonymised in line with the hosting provider's retention periods.
4. Cookies
This website sets no cookies at all — neither its own nor those of third parties. It uses no local storage, no session storage, no pixels and no fingerprinting. There is therefore no consent banner, because there is nothing to consent to under § 25 TDDDG.
5. No analytics or tracking
No web analytics, statistics tool, heatmap, advertising network or social media pixel is used. Your visit is not measured and no profile is created.
6. Fonts, images and video
All fonts, images and video files are delivered through the hosting infrastructure described in section 2. No additional external service is used to display them — no font service such as Google Fonts, no embedded player from YouTube, Vimeo or any comparable platform. Loading a page therefore establishes no connection to any provider beyond the host, and no data about you is passed on for the purpose of displaying content.
7. Contact form
The contact form on the contact page processes the name, email address and message you enter, along with the technical data that accompanies any submission, such as your IP address. Submissions are received and stored by Netlify Forms within the infrastructure described in section 2, and reach me by email from there.
Spam filtering: according to Netlify's documentation, every submission is automatically checked for spam using Akismet, a service operated by Automattic Inc., USA. For this check, the information contained in your submission is processed through Netlify's spam-filtering infrastructure. The same international transfer considerations described in section 2 may apply. In addition, the form contains a hidden field that only automated scripts fill in; that field itself sets no cookies.
Legal basis is Art. 6(1)(b) GDPR where your message concerns a contract or steps prior to entering into one, and otherwise Art. 6(1)(f) GDPR, my legitimate interest in answering enquiries addressed to me and in keeping the form usable by filtering out automated spam.
Providing the data is voluntary, but without it I cannot reply. Messages are stored only for as long as needed to deal with your enquiry and are deleted afterwards. You may request deletion at any time; I will comply unless I am required or entitled to retain the data under applicable law.
8. Contact by email
If you write to me directly, the data contained in your email is processed solely to handle your request. Legal basis as in section 7.
9. Postal contact
The postal address given in the legal notice is a c/o address provided by IMPRESSUM-PRIVATSCHUTZ GmbH. Letters sent there are received by that company and forwarded to me in accordance with the contractual service arrangement, which includes a data processing agreement pursuant to Art. 28 GDPR. Legal basis is Art. 6(1)(f) GDPR: my legitimate interest in being reachable by post without publishing my private home address.
10. No automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Your data is not used to evaluate you, to predict your behaviour, or to make decisions about you.
11. Links to other sites
This site links to external pages, for example Instagram and the website of a collaborator. These links are plain hyperlinks — no content is loaded from those services and no data is transmitted until you actually click. Once you follow such a link, the privacy policy of that provider applies and I have no influence over it.
12. Encryption
This website uses TLS encryption. Data transmitted between your browser and this website is encrypted in transit. You can tell by the „https://“ in the address bar and the padlock icon in your browser.
13. Your rights
Under the GDPR you have the right to obtain information about the data I hold about you (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to have processing restricted (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise any of these rights, an informal email to pauleliasmichelsen@gmx.de is enough.
14. Right to complain
You may lodge a complaint with a supervisory authority, in particular in the member state of your residence or workplace. As I work from Rostock, the authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania, Lennéstraße 1, 19053 Schwerin, Germany.
15. Changes to this policy
I will update this policy whenever the site changes in a way that affects data processing — for example if analytics or an embedded player were ever added. The current version always applies.