Privacy policy

Controller

Enno Gelhaus, Eichenwald 3, 49624 Löningen, Germany. Email: egelhaus@ennogelhaus.de

The short version

For visitors who are not signed in, this site stores nothing on your device: no cookies, no localStorage entries, nothing left behind to clear. No fonts from someone else's server, no embedded video, no tracking pixels, no ad networks, and no analytics company.

One thing is counted: which pages get read. That is done by software we run ourselves, on our own infrastructure, and it is described under Visit measurement below. It is the only reason your browser contacts a host other than this one.

There is no consent banner because Sec. 25 TDDDG requires consent for storing or reading information on your device, and this site does neither. That is a property of how it is built rather than a statement of intent: pages are rendered to files in advance and served without a session, and the counting script is a copy served from this site with the identifier it would otherwise store on your device removed.

Server log files

When a page is requested, the reverse proxy in front of this site and the web server itself record technical data: IP address, time of the request, the URL requested, the HTTP status code, the amount of data transferred, the referrer and the user agent.

The purpose is operating the service, diagnosing faults and defending against attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is keeping the service working and secure. This data is not combined with other sources and is not used to build profiles.

Visit measurement

Which pages are read, and roughly where readers arrive from. The software is Rybbit, running on our own infrastructure at web-anal.egelhaus.de. No analytics provider is involved, nothing is sent to one, and nothing leaves that infrastructure.

A page view records the path you opened and its query string, the referring URL where there is one, the page title, your screen size and browser language, and the browser, operating system and device type derived from the user agent. Clicking a link that leads off this site records that too. As with any request, your IP address reaches that server; it is used there to derive the country and a server-side session identifier, and it is neither published nor passed on.

What does not happen: nothing is written to or read from your device, no identifier follows you from one visit to the next, nothing is joined up across the two sites, and no profile is built. This is worth stating precisely, because it is not the software's default. The published Rybbit script writes a persistent visitor ID into your browser's localStorage on every page load; the copy served here has that removed before it is deployed, which is the reason this page can still say there is nothing to consent to.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is knowing which pages are read and which are not, in order to decide what to keep and what to rewrite. You can object at any time under Art. 21 GDPR, and an informal email is enough. If you would rather not write to anyone, setting disable-rybbit in this site's localStorage — localStorage.setItem('disable-rybbit', '1') in your browser console — stops the counting in that browser.

Administration area

The non-public administration area sets one technically necessary session cookie and authenticates through a separate identity provider. Visitors to the public pages never receive it.

Getting in touch

Writing by email, or using the form on the contact page, transmits whatever that message contains: the name and address you give, the subject, the message itself and the time it arrived. It is processed in order to deal with the enquiry (Art. 6(1)(b) or (f) GDPR) and kept for as long as that requires, or for as long as a statutory retention period applies.

A message sent through the form is stored on this server as well as being forwarded by email. The address it was sent from is stored with it, and the form counts how many messages one address sends in an hour, in order to detect and limit abuse of it (Art. 6(1)(f) GDPR). Stored messages are deleted after 180 days unless the enquiry is still open or a statutory retention period applies. Writing by email instead avoids the copy on this server altogether.

Hosting and email

The site runs on our own infrastructure in Germany. There is no data processing agreement with an external hosting provider for delivering these pages.

Email is separate. The mailboxes for this domain are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, and this server hands anything sent through the contact form to that provider for delivery. Anything written directly to the address above travels the same way.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and a right to object to processing based on legitimate interests (Art. 21 GDPR). An informal email to the address above is enough.

You also have the right to lodge a complaint with a supervisory authority. The competent authority here is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.