Privacy policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR):

Email: hello@simon-heistermann.de

No data protection officer has been appointed, because there is no legal obligation to do so (§ 38 BDSG).

This website is hosted by Vercel Inc. (USA). When you open the page, Vercel processes technically necessary access data: IP address, date and time, requested address, referrer URL, browser type and operating system. This data is needed to deliver the page and to protect it against abuse.

The legal basis is Art. 6 (1) (f) GDPR: my legitimate interest in secure and stable operation. I do not combine this data with other data and I do not evaluate it. The logs are deleted automatically after the period set by the provider.

A data processing agreement according to Art. 28 GDPR is in place with Vercel. Vercel also processes data in the USA. The transfer is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and additionally on standard contractual clauses. You can read more in the Vercel privacy policy.

This website sets no cookies and uses no analytics, tracking or advertising services. There is no embedded content from other providers. Fonts and images are loaded from the same server as the page.

So that the page remembers your settings, it stores up to three entries in the local storage (localStorage) of your browser:

• theme: light or dark design
• view: desk or simple view
• sound: sound on or off

An entry is only created once you change the setting in question. The entries stay on your device, are not transmitted to me and can be deleted at any time in your browser settings. The legal basis is § 25 (2) no. 2 TDDDG: the storage is necessary to keep the display you chose.

When you write to me through the contact form (the sticker pad on the desk or the form in the simple view), I process your name, your email address, your message, the language of the page and the time. The form can only be sent with the consent box ticked. Then I also store the consent itself, its time and the version of this policy in force (the date above). On top of that comes a shortened fingerprint of your IP address: the last part of the address is cut off and the rest is converted with a secret key (HMAC). I do not store the IP address itself. With the request I only record whether the two emails were sent. Nothing else is stored.

Purpose: I want to read your message and reply to you. I also need the fingerprint and the address to limit how often the form can be used in an hour. The legal basis for everything the form stores is your consent under Art. 6 (1) (a) GDPR, which you give with the tick in the form. You can withdraw it at any time for the future: a short email to hello@simon-heistermann.de is enough, and I delete your request. If your message leads to a project or working together, our further correspondence about it is based on Art. 6 (1) (b) GDPR.

I need your name, email address and message to be able to reply. Without them and without the tick the form cannot be sent. You are under no legal or contractual obligation to provide them; you can also simply send me an email.

After sending, you usually get a short confirmation at the address you entered. If a great many requests come in within an hour, it is skipped, and the form then does not announce it. It contains neither your name nor your message.

The request is stored in a database at Supabase (Supabase Pte. Ltd., Singapore), in the region eu-west-1 (Ireland). The emails are sent by Resend (Resend, Inc., USA). There is a data processing agreement under Art. 28 GDPR with Supabase and with Resend. Resend processes the data in the USA; the transfer is based on the EU-US Data Privacy Framework and additionally on standard contractual clauses. Where Supabase processes data outside the EU, for example in support, standard contractual clauses apply. The form itself is received by a server function at Vercel that runs in the Frankfurt region (Germany) (see “Hosting and server logs”); the message to me arrives in my mailbox at ALL-INKL.COM (see “Contact by email”).

An hourly job deletes the fingerprint, after one day at the latest; the request itself is deleted after 12 months. I delete the email that reaches me once it is no longer needed for its purpose and no statutory retention period applies.

If you write me an email, I process your address and the content of your message in order to answer you. The legal basis is Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) GDPR for enquiries about a commission. I delete the messages as soon as they are no longer needed for that purpose and no statutory retention periods apply.

My mailbox for hello@simon-heistermann.de is hosted by ALL-INKL.COM (Neue Medien Münnich, Germany). Incoming emails are stored there, including the messages from the contact form. There is a data processing agreement under Art. 28 GDPR with ALL-INKL.COM.

The page links to profiles on LinkedIn, Instagram and YouTube and to project websites. These are plain links. The provider in question only learns of your visit once you click one of them. The privacy policies of those providers apply to the data processing there.

Under the GDPR you have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing that is based on legitimate interests (Art. 21 GDPR)
• withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR)

To do so, write to me at hello@simon-heistermann.de. I will answer within one month.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, ldi.nrw.de.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

If the site or the legal situation changes, I adapt this policy. The version with the date given above applies.