Privacy Policy
1. Who is responsible for this website
The party responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Mariusz Ginel
Cheruskerstraße 4
58239 Schwerte
“Responsible” means the person or body that decides on the purposes and means of processing personal data — such as names, email addresses, or IP addresses.
If you have any questions about how your data is handled, please feel free to contact me at any time using the details above.
2. In brief: what happens here
Personal data is any information that can be traced back to you as an individual. On this website, such data arises in two ways:
Data you actively provide. For example, when you fill out the contact form, send me an email, or join an online meeting.
Data generated automatically. As soon as you visit a page, your browser automatically transmits certain information — such as the browser version, operating system, or the time of access. This data primarily serves to deliver the page to you correctly.
Some processing is purely technical in nature; other processing serves to statistically evaluate how the site is used. Which services are involved and what each is legally based on is described in the sections below.
3. Legal bases for processing
Depending on the situation, I rely on different legal bases to process your data:
- Your consent (Art. 6(1)(a) GDPR; for special categories of data, Art. 9(2)(a) GDPR). Where consent concerns storing information on your device or accessing information already stored there — for example through cookies or device fingerprinting — Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Where you expressly consent to a transfer to countries outside the EU, Art. 49(1)(a) GDPR additionally applies. You may withdraw consent at any time with effect for the future.
- Contract or pre-contractual measures (Art. 6(1)(b) GDPR), where processing is necessary to perform a contract with you or to take steps at your request prior to entering into one.
- Legal obligation (Art. 6(1)(c) GDPR), for example tax or commercial record-keeping requirements.
- Legitimate interest (Art. 6(1)(f) GDPR), to the extent my interests in the processing — such as a functioning, secure website — are not overridden by your interests.
Which of these applies in a given case is stated alongside the relevant processing activity.
4. How long data is kept
Unless a more specific period is stated elsewhere in this policy, your data is kept for as long as the purpose of processing requires. If you request deletion or withdraw consent, I delete the relevant data — unless a lawful ground for continued retention still exists, in particular a statutory retention period. In that case, deletion takes place once that ground no longer applies.
5. Disclosure to third parties
To operate this website and run my business, I work with external service providers. This may require disclosing personal data to them.
Disclosure only takes place where it is necessary to perform a contract, where I am legally obliged to do so (for example to tax authorities), where a legitimate interest under Art. 6(1)(f) GDPR exists, or where another legal basis permits the transfer.
Where I engage service providers as processors, this is done under a data processing agreement pursuant to Art. 28 GDPR. Such an agreement is a statutory requirement and ensures that the provider processes visitors’ data solely on my instructions and within the bounds of the GDPR. Where joint responsibility applies, a joint controller agreement is concluded instead.
6. Your rights
You have a number of rights concerning your data. An informal message to the contact details above is sufficient to exercise any of them.
Access. You may find out, free of charge and at any time, what data concerning you is stored, where it came from, to whom it has been disclosed, and for what purpose it is processed.
Rectification and erasure. I will correct inaccurate data on your request. You may likewise request erasure of your data, unless a legal obligation prevents this.
Restriction of processing. You may request that your data be stored but no longer otherwise processed. This applies in particular if you contest the accuracy of the data while its accuracy is being verified; if the processing was unlawful and you request restriction instead of erasure; if I no longer need the data but you need it to establish, exercise, or defend legal claims; or while the balancing of interests following an objection is still pending. Once restricted, such data may — aside from storage — only be processed with your consent, to establish, exercise, or defend legal claims, to protect the rights of another person, or for reasons of important public interest.
Data portability. Data that is processed on the basis of your consent or for the performance of a contract, using automated means, will be provided to you or to a third party you designate, in a common, machine-readable format. A direct transfer to another controller will take place where technically feasible.
Lodging a complaint with a supervisory authority. If you believe that the processing of your data violates the GDPR, you may lodge a complaint with a data protection supervisory authority — in the member state of your habitual residence, your place of work, or the place of the alleged infringement, at your choice. Other legal remedies remain unaffected. The authority responsible for me is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2–4, 40213 Düsseldorf, Germany https://www.ldi.nrw.de
Right to object under Art. 21 GDPR
WHERE THE PROCESSING OF YOUR DATA IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. THE APPLICABLE LEGAL BASIS IN EACH CASE CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE PROCESSED FOR THESE PURPOSES — UNLESS I CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS (ART. 21(1) GDPR).
WHERE YOUR DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME WITHOUT GIVING REASONS. THIS INCLUDES ANY PROFILING TO THE EXTENT IT IS RELATED TO SUCH MARKETING. FOLLOWING YOUR OBJECTION, YOUR DATA WILL NO LONGER BE USED FOR MARKETING PURPOSES (ART. 21(2) GDPR).
7. Data security
Encrypted transmission
This website uses SSL/TLS encryption to protect content you send me — such as inquiries submitted through the contact form. You can recognise an encrypted connection by the “https://” prefix in your browser’s address bar and the padlock icon. While encryption is active, third parties cannot read the data being transmitted.
Limits of security on the internet
I treat your personal data confidentially and in accordance with applicable data protection law. However, please note that data transmitted over the internet — including unencrypted email — may be subject to security vulnerabilities. Complete protection against third-party access cannot be technically guaranteed.
8. Data processing when you visit this website
Server log files
The provider of this website automatically collects and stores information that your browser transmits on every visit, including:
- browser type and version
- operating system used
- referrer URL (the page you came from)
- hostname of the accessing device
- time of the server request
- IP address
This data is not combined with data from other sources. The legal basis is Art. 6(1)(f) GDPR: operating a technically sound website and being able to optimise it requires evaluating log files, which constitutes a legitimate interest.
Cookies
This website uses cookies — small data packages stored on your device that cause no harm. Session cookies are deleted automatically once your visit ends; persistent cookies remain stored until you remove them or your browser does so automatically.
Cookies may originate from this website itself (first-party) or from third-party services embedded in it. The latter allow features from external providers to be used within the site.
This website only uses cookies and comparable storage technologies that are technically necessary — for example, to protect the contact form against automated submissions, or to remember volume, quality settings, and playback position during video playback. I do not use cookies for advertising purposes or to track your behaviour across other websites. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in providing this website in a technically sound and secure manner. A consent banner is therefore not displayed.
You can configure your browser to notify you when cookies are set, to allow them only on a case-by-case basis, to reject them generally, or to delete them automatically when you close your browser. Disabling cookies may limit the functionality of this website.
9. Hosting and content delivery
Hetzner
The content of this website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The provider processes all data generated when the site is accessed and operated — in particular the server log files described above.
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the reliable provision of this website.
A data processing agreement is in place with Hetzner.
bunny.net (Content Delivery Network)
To deliver static content — in particular images, video files, fonts, stylesheets, and scripts — I use the Content Delivery Network provided by bunny.net. The provider is BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia.
A Content Delivery Network is a group of geographically distributed servers that hold copies of this content. When a page is accessed, content is delivered from the server closest to your location. This noticeably reduces load times, relieves the origin server, and makes the site more resilient during traffic spikes — an effect that is especially pronounced for larger media files such as videos.
For technical reasons, your request is routed through bunny.net’s infrastructure in the process. This involves processing your IP address, the file requested, the date and time of the request, the amount of data transferred, and information about your browser and operating system. According to the provider, IP addresses in log files are anonymised and are not used for analytics or advertising purposes.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in a fast, stable, and reliable delivery of this website.
A data processing agreement is in place with bunny.net. The provider is based in the European Union. Delivery is restricted, via a routing filter, to locations within the European Union, so no transfer to third countries takes place.
More information: https://bunny.net/privacy/
bunny.net Stream (video playback)
Videos on this website are provided through Bunny Stream, the video service of the same provider. Playback takes place via a player embedded as an inline frame (iframe), loaded from a bunny.net server.
Unlike a plain file request, your browser establishes a separate connection to the player. This involves transmitting your IP address, information about your browser and operating system, the page visited, and playback events — such as starting, pausing, seeking, and the proportion of the video watched. The player also stores information on your device to retain volume, chosen quality level, and playback position across sessions. This information stays on your device and is not used to recognise you across other websites.
Evaluation takes place solely in aggregated form for statistics in the provider’s dashboard. No profiling takes place, no advertising is served, and no data is shared with third parties.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in reliably delivering large video files at a quality suited to your connection, without burdening the origin server. Where information is stored on or read from your device, this serves to provide the playback you have expressly requested (Section 25(2) no. 2 TDDDG).
The data processing agreement in place with bunny.net also covers Bunny Stream; storage and delivery of video files are likewise restricted to locations within the European Union.
More information: https://bunny.net/privacy/
10. Fonts
Adobe Fonts (Typekit)
For a consistent typographic appearance, I use Adobe Fonts — formerly Typekit. The provider for the European market is Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. The parent company is Adobe Inc., 345 Park Avenue, San Jose, CA 95110, USA.
For the fonts to display correctly, your browser establishes a connection to an Adobe server when you visit the page and downloads the font files from there. This transmits your IP address, along with technical details such as browser type, operating system, and the page visited. As a result, Adobe learns that you have visited this website. According to the provider, no cookies are set for the delivery of web fonts, and the data collected is not used to identify individuals.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in a visually consistent presentation of this website, which — as a designer — is also part of my professional presentation. The typeface used cannot be licensed for local hosting. The impact remains limited: no evaluation of your usage behaviour takes place, no profiles are created, and the connection exists solely to retrieve the font files.
Processing in the USA cannot be ruled out. Adobe Inc. is certified under the EU-US Data Privacy Framework; the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 GDPR additionally apply.
More information: https://www.adobe.com/de/privacy/policies/adobe-fonts.html sowie https://www.adobe.com/de/privacy/policy.html
11. Protection against automated access
Cloudflare Turnstile
To protect against spam and automated access, I use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Turnstile checks whether an entry on this website — for example in the contact form — originates from a human or from a program. The check starts automatically as soon as you visit a page with Turnstile enabled. Various signals are evaluated in the process, including your IP address, time spent on the page, and mouse movements. The data collected is transmitted to Cloudflare.
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in protecting this website against abusive automated access and spam. Without this protection, the contact form would be permanently unusable. Where information is stored on or read from your device in this process, this serves to provide the form submission you have expressly requested (Section 25(2) no. 2 TDDDG).
A data processing agreement is in place with Cloudflare. The transfer is based on Standard Contractual Clauses, available at https://www.cloudflare.com/cloudflare-customer-scc/. Further information is available at https://www.cloudflare.com/cloudflare-customer-dpa/.
Cloudflare is certified under the EU-US Data Privacy Framework. The certification can be viewed at https://www.dataprivacyframework.gov/participant/5666.
12. Website analytics
WP Statistics
To statistically evaluate visitor numbers, I use the analytics tool WP Statistics. The provider is Veronalabs, Tatari 64, 10134 Tallinn, Estonia (https://veronalabs.com).
Data collected includes log data — IP address, referrer, browser used, origin of access, and search engine used — as well as interactions on the site, such as page views and clicks. The resulting data is stored exclusively on my own server and is not shared with third parties.
WP Statistics is operated with anonymised IP addresses. Your IP address is therefore truncated so that it can no longer be directly attributed to you.
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the anonymised evaluation of usage behaviour in order to improve this website.
13. Getting in touch
Contact form
If you send me a request via the contact form, I store the information you provide, including any contact details entered, in order to process your request and to be able to refer back to it if you follow up. I do not disclose this data without your consent.
Where your request relates to a contract or its formation, the processing is based on Art. 6(1)(b) GDPR. In all other cases, it is based on my legitimate interest in effectively handling incoming inquiries (Art. 6(1)(f) GDPR) or — where obtained — on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
The data submitted remains with me until you request its deletion, withdraw consent, or the purpose of storage ceases to apply — for example once your request has been fully processed. Statutory retention periods remain unaffected.
SMTP2GO (delivery of form messages)
The contact form itself runs on my own server. To deliver the resulting message to my inbox, I use the email delivery service SMTP2GO. The provider is Sand Dune Mail Ltd, 96–106 Manchester Street, Christchurch 8011, New Zealand.
The service handles the technical delivery of the message and helps ensure it is not flagged as spam or lost in transit. This involves processing the content of your message, the sender address you provided, the recipient address, and technical delivery data such as timestamp, delivery status, and connection information.
The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to a contract or its formation; otherwise, it is based on Art. 6(1)(f) GDPR — the legitimate interest lies in ensuring your inquiry reliably reaches me.
A data processing agreement is in place with the provider. The European Commission has recognised New Zealand as providing an adequate level of data protection (Adequacy Decision 2013/65/EU), so no further safeguards are required for this transfer. Delivery is routed through data centres within the European Union.
More information: https://www.smtp2go.com/privacy/
Inquiries by email or telephone
If you contact me by email or telephone, I store and process your inquiry along with any resulting personal data — such as your name and the subject of your request — in order to handle it. I do not disclose this data without your consent.
The legal bases and retention periods set out in the preceding section apply accordingly.
Microsoft 365 (email)
My business email communication runs through Microsoft 365. The provider for users in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The parent company is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.
In practice, this means: your message to me, and my reply to you, are processed and stored on Microsoft’s servers — including sender and recipient addresses, subject line, message body, any attachments, and technical connection data. Microsoft acts as a processor on my behalf, under the Microsoft Data Protection Addendum.
The legal basis is Art. 6(1)(b) GDPR where the communication relates to the formation or performance of a contract, and Art. 6(1)(f) GDPR otherwise — the legitimate interest lies in reliable business correspondence. Where statutory retention obligations apply to business correspondence, continued storage is based on Art. 6(1)(c) GDPR. I delete your correspondence once its purpose no longer applies and no retention period stands in the way.
Processing in the USA cannot be entirely ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework; the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 GDPR additionally form part of the data processing agreement.
Please note that emails are, as a rule, only encrypted in transit. If you need to send me particularly sensitive information, feel free to get in touch beforehand so we can agree on a more suitable channel.
More information on how Microsoft handles personal data: https://privacy.microsoft.com/en-us/privacystatement
14. Changes to this privacy policy
This policy will be updated whenever the services used on this website, the underlying processing activities, or the applicable legal requirements change. The version published here is always the current one.