Privacy Policy

1. Controller

The controller responsible for processing personal data on this site (Art. 4 No. 7 GDPR) is:

No data protection officer is appointed; the obligations under Art. 37 GDPR are not met.

2. Your rights

Under the GDPR you have the right to: access your data (Art. 15), request rectification (Art. 16), request erasure (Art. 17), restrict processing (Art. 18), data portability (Art. 20), and withdraw consent at any time where consent is the legal basis (Art. 7).

You have the right to object to processing based on legitimate interest at any time, on grounds relating to your particular situation (Art. 21 GDPR). Processing based on Art. 6 (1)(f) GDPR is described below in sections 4 and 5.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller named above is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin (mailbox@datenschutz-berlin.de, +49 30 13889-0).

3. No cookies, no local storage

This site does not set cookies, does not write to local storage or session storage, and does not fingerprint your browser. Nothing persists on your device after the page closes. Because no information is stored on or read from your terminal equipment, the consent requirement of § 25 TDDDG does not apply.

4. Hosting (Vercel)

The site is hosted by Vercel Inc. ("Vercel"), 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, your browser sends standard request data to Vercel, including:

This data is processed for the purpose of delivering the site and protecting it from abuse. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in operating a functional, secure website).

Vercel is established in the United States. The transfer is safeguarded by Vercel's certification under the EU-US Data Privacy Framework (Art. 45 GDPR adequacy decision of 10 July 2023) and, as a fallback, by Standard Contractual Clauses (Art. 46 (2)(c) GDPR) included in Vercel's Data Processing Addendum. Request data is retained by Vercel as described in its privacy policy: vercel.com/legal/privacy-policy.

5. Analytics (PostHog, cookieless)

To understand which pages and projects are visited, this site uses PostHog Cloud EU, operated by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, with EU infrastructure in Frankfurt (AWS eu-central-1).

PostHog is configured in cookieless server-hash mode:

The legal basis is Art. 6 (1)(f) GDPR — legitimate interest in measuring aggregate, privacy-preserving usage of a personal portfolio. You can object at any time by emailing hi@christianstrehl.com.

Although PostHog Inc. is established in the United States, the EU project's data resides on EU infrastructure. PostHog is additionally certified under the EU-US Data Privacy Framework and a Data Processing Agreement under Art. 28 GDPR is in place. Further information: posthog.com/privacy and posthog.com/dpa.

6. Contact form and email

When you contact me by email at hi@christianstrehl.com, the information you provide (your message and your email address) is processed solely to respond to your inquiry. The legal basis is Art. 6 (1)(b) GDPR (steps prior to entering into a relationship at your request) or Art. 6 (1)(f) GDPR (legitimate interest in responding to inbound contact).

The contact form on this site submits your message to a serverless function hosted on Vercel (see section 4), which delivers it to my inbox via Resend, the email-sending service operated by Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA. The EU sending region (eu-west-1, AWS Ireland) is used so that message content is processed and delivered from servers within the European Union. As Plus Five Five, Inc. is established in the United States, the transfer is safeguarded by Standard Contractual Clauses (Art. 46 (2)(c) GDPR) included in Resend's Data Processing Agreement (resend.com/legal/dpa) and, additionally, by Resend's self-certification under the EU-US Data Privacy Framework (Art. 45 GDPR). Further information: resend.com/legal/privacy-policy.

Messages are retained for as long as needed to handle the conversation, and for a reasonable archival period afterwards, then deleted. No data is shared with third parties beyond the services named above.

7. Fonts

Typefaces are served from this site's own origin (self-hosted via the @fontsource packages). No connection is made to Google Fonts or any other third-party font CDN, and no IP data leaves your connection to this site for font delivery.

8. Server logs

In addition to the request data Vercel processes, no independent server logs are kept by the controller. Vercel's own log retention applies.

9. Automated decision-making and profiling

No automated decision-making within the meaning of Art. 22 GDPR takes place. No profiling, no special categories of data (Art. 9 GDPR), no data from minors are processed.

10. Updates

This policy may be updated to reflect changes in the site or in applicable law. The current version is always available at this URL.