Privacy Policy

This policy explains what personal data is collected when you visit marcelfelixbaur.com, why it is collected, how long it is kept, and what rights you have over it. It is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

The short version: this site uses no cookies, no advertising trackers, and no cross-site profiling. The only routine data collection is anonymous, aggregated visitor statistics.

1. Who is responsible

The controller for the data described in this policy is:

No data protection officer has been appointed, as the criteria in Article 37 GDPR are not met.

2. Website analytics

This site uses Umami, an open-source analytics tool, to understand how the site is used — which pages are visited, and roughly where visitors come from. Umami runs on the same domain as this website (marcelfelixbaur.com/insights). Analytics data is not sent to any external analytics company.

No cookies are used and no identifier is stored on your device. Instead, Umami creates a temporary, anonymous visitor hash from your IP address, your browser's user agent and a secret value that changes daily. Because that value changes every day, visits cannot be linked together across days, and the hash cannot be reversed to recover your IP address.

The following is recorded for each page view:

• the page visited and the referring page, if any
• browser, operating system and device type
• screen size
• country and language

Your IP address is used only momentarily to determine the country and to generate the anonymous hash. It is not stored in the analytics database.

Legal basis: Article 6(1)(f) GDPR — my legitimate interest in understanding how this website is used and in improving it. Because the measurement is cookieless and stores no information on your device, no consent is required under Article 22.2 of Spanish Law 34/2002 (LSSI-CE).

Retention: aggregated statistics are kept for as long as they remain useful for understanding how the site is used. They are reviewed periodically and deleted once they no longer serve that purpose.

3. Server log files

This site is hosted on Cloudflare Pages, a service of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). All traffic to this site also passes through Cloudflare's content delivery and security network.

Like every web server, Cloudflare's servers record technical information each time a file is requested. This may include your IP address, the time of the request, the file requested, the referring page, and your browser and operating system version. Cloudflare processes this data as a processor on my behalf under Article 28 GDPR, on the basis of its data processing addendum.

Because Cloudflare is a US company, this may involve a transfer of data outside the EEA. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition.

Legal basis: Article 6(1)(f) GDPR — my legitimate interest in operating the site reliably and in detecting and defending against attacks and abuse.

Retention: Cloudflare deletes or anonymises this log data after a short period in accordance with its own retention policy, unless a specific security incident requires it to be kept longer.

4. Contacting me

This site has no contact form. If you email [email protected], I process the content of your message together with your email address, your name and any other details you choose to include, in order to answer you.

Legal basis: Article 6(1)(b) GDPR where your message relates to a possible or existing contract, and otherwise Article 6(1)(f) GDPR — my legitimate interest in responding to enquiries.

Retention: correspondence is kept for as long as needed to deal with your enquiry and any business relationship arising from it. Where commercial or tax law requires records to be retained for longer, they are kept for that period and then deleted.

5. Fonts

This site loads the Inter typeface from Google Fonts, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). When a page loads, your browser connects to Google's servers, which means your IP address is transmitted to Google and may be transferred to Google LLC in the United States.

Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (adequacy decision of 10 July 2023), and Google's standard contractual clauses apply in addition.

Legal basis: Article 6(1)(f) GDPR — my legitimate interest in presenting the site consistently across devices. Google's own privacy policy is available at policies.google.com/privacy.

6. Cookies

This website sets no cookies — no analytics cookies, no advertising cookies, and no cookies for preferences or sessions. For that reason you will not see a cookie banner. If that ever changes, this policy will be updated and consent will be obtained beforehand where the law requires it.

7. Who else receives your data

Your data is not sold, rented or shared for advertising. It is accessible only to:

• Cloudflare, Inc., which hosts and delivers this website, acting as a processor under Article 28 GDPR
• the provider of the server on which the self-hosted analytics instance runs, acting as a processor under Article 28 GDPR
• the email provider used for the marcelfelixbaur.com mailbox
• Google, in the limited way described in section 5
• public authorities, where disclosure is required by law

8. Automated decision-making

No automated decision-making or profiling within the meaning of Article 22 GDPR takes place on this site.

9. Is providing data required?

You are under no statutory or contractual obligation to provide any personal data. You can browse this site without giving me any details, and the analytics described above identify no one individually. If you choose not to contact me, the only consequence is that I cannot reply to you.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data held about you and receive a copy of it (Article 15)
• Rectification of inaccurate or incomplete data (Article 16)
• Erasure of your data, where the conditions are met (Article 17)
• Restriction of processing (Article 18)
• Data portability — to receive your data in a structured, machine-readable format (Article 20)
• Object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, including the analytics described in section 2 (Article 21)

To exercise any of these rights, email [email protected]. I will respond within one month, as required by Article 12(3) GDPR. There is no charge for making a request.

11. Complaints

If you believe your data has been handled unlawfully, you can lodge a complaint with a supervisory authority — in particular in the EU Member State where you live, work, or where the alleged infringement took place (Article 77 GDPR). The competent authority here is:

12. Changes to this policy

This policy may be updated if the site changes or the legal position does. The current version always applies and is dated at the top of this page.