Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

No data protection officer has been appointed, as this is not legally required. You can send any privacy request to the email address above.

2. Overview of processing

Categories of data

• Technical and usage data: IP address, date and time of access, pages requested, browser type and version, operating system, language, referring page, amount of data transferred and HTTP status code.
• Analytics data (only with your consent): pseudonymous online identifiers, pages viewed, interactions, approximate location, device and browser information.
• Contact data and message content if you email or call me, such as your name, email address, phone number and what you write.

Purposes

• Delivering the website and keeping it stable, secure and free of misuse.
• Answering inquiries and communicating with you.
• Statistical analysis to understand and improve the website (only with your consent).
• Complying with legal obligations and establishing, exercising or defending legal claims.

Who is affected

Visitors of the website and people who contact me (“users”).

This website has no user accounts, contact forms, comment function, newsletter, online payments, advertising networks, embedded videos or embedded maps. If that changes, I will update this policy first.

No automated individual decision-making or profiling takes place. You are not obliged to provide personal data to visit this website. The technical data described in section 4 is, however, required to deliver it to your device.

3. Legal bases

• Consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG, for Google Analytics and any other optional technology. You can withdraw consent at any time with effect for the future.
• Contract or pre-contractual measures, Art. 6(1)(b) GDPR, if your inquiry is aimed at entering into a contract with me.
• Legal obligation, Art. 6(1)(c) GDPR, for example statutory retention duties and documenting your consent choice (Art. 7(1) GDPR).
• Legitimate interests, Art. 6(1)(f) GDPR, for secure and reliable delivery of the website and for answering inquiries. My interest is a functioning, secure website and efficient communication, and I have found that your interests and rights do not override it.
• Strictly necessary storage, Section 25(2) no. 2 TDDDG, for local storage that is needed to provide a function you requested, such as your display theme and your consent choice.

4. Hosting and server log files

The website is provided by an external web hosting provider that processes data on my behalf under a data processing agreement (Art. 28 GDPR). When you open the website, your browser automatically transmits data that is recorded in server log files: IP address, internet service provider, date and time of the request, requested content, time zone, HTTP status code, amount of data transferred, referring website, browser type and version, and operating system. This data is not combined with other data about you.

The purpose is secure, stable and user-friendly delivery of the website and defense against attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are kept only as long as needed for these purposes, which is generally a few days to a few weeks depending on the hosting configuration, and are then deleted automatically. They may be kept longer where needed as evidence of an attack or other violation of rights.

5. Cookies, local storage and your choice

Cookies are small text files stored by your browser. Similar technologies, such as the browser’s local storage, store information on your device in the same way. This website sets no cookies of its own. It uses two local-storage entries that are needed for its functions, and Google sets analytics cookies only if you consent.

When you first visit, a banner asks for your choice. Nothing optional is loaded before you decide. “Accept all” and “Reject all” are equally easy to choose. If your browser sends a Global Privacy Control (GPC) signal, analytics stays off.

Change or withdraw your choice at any time with the button below or the “Cookie Settings” link in the footer of every page. Withdrawal does not affect processing that happened before it. If you clear your browser data, you will be asked again. You can also block or delete cookies in your browser settings, although parts of the website may then work differently.

6. Google Analytics

If you consent, I use Google Analytics 4, a web analytics service provided in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (together “Google”). Google acts as my processor.

Analytics measures, for example, which pages are viewed, how long visits last, which country or city (approximate) visitors come from, which referring site they used, and which device and browser they use. It does this with cookies and pseudonymous identifiers. According to Google, Analytics 4 does not log or store individual IP addresses. I have switched off Google Signals and ad personalization, so the data is not used for advertising purposes on this website and is not combined with your Google account data.

Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Retention: analytics data is kept for a maximum of 14 months and then deleted automatically. Transfers: data may be processed in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. In addition, Google uses Standard Contractual Clauses.

You can withdraw your consent at any time under “Cookie Settings”. You can also prevent Google from collecting analytics data by installing the browser add-on from Google. Further information is in Google’s Privacy Policy and the Analytics privacy overview.

7. Contacting me

If you contact me by email or phone, I process your details and message to handle your request. The legal basis is my legitimate interest in answering inquiries (Art. 6(1)(f) GDPR) and, if the contact aims at a contract, Art. 6(1)(b) GDPR. I may keep your message in my email system, which is operated by a service provider acting on my behalf.

I delete the data once your request has been dealt with and there is no reason to keep it. Statutory retention duties under German commercial and tax law may require me to keep business correspondence and records for longer, up to ten years depending on the type of document. Please note that ordinary email is not encrypted end to end and can in principle be read by third parties on its way.

8. Recipients and service providers

I do not sell your personal data. I share it only where needed and lawful:

• IT service providers for web hosting and email, as processors under Art. 28 GDPR. I select them carefully and they are bound by my instructions and by technical and organizational security requirements.
• Google, for analytics, only if you consent (section 6).
• Authorities, courts and professional advisers such as lawyers or tax advisers, where required by law or necessary to establish, exercise or defend legal claims.

9. International data transfers

I operate this website from Germany, and the GDPR applies to it. If you visit from outside the European Economic Area, for example from the United States, the data described in this policy is transferred to and processed in Germany and, depending on my service providers’ infrastructure, possibly in other countries.

Where data is transferred to a country outside the EU or EEA, this happens only on the basis of Art. 44 ff. GDPR: an adequacy decision (for example the EU-U.S. Data Privacy Framework for certified U.S. companies), Standard Contractual Clauses, or your explicit consent. On request, I will provide a copy of the safeguards used.

10. External links and social media

The website links to my profiles on Instagram, X and LinkedIn, and to my business website. These are plain links. No plugins, share buttons or tracking pixels of these networks are embedded, so no data is sent to them while you only browse this website. When you click a link, you leave this website and the provider’s own privacy policy applies:

• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Privacy policy.
• X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland. Privacy policy.
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy.
• BNP Visuals: bnpvisuals.com, which has its own privacy policy.

If you message or interact with my profiles, I process what you send me to communicate with you (Art. 6(1)(f) GDPR). The networks process your data under their own responsibility.

11. Fonts and other resources

All fonts, images, scripts and the portfolio viewer are served from this website. No fonts are loaded from Google or other third-party servers, so your IP address is not sent to a font provider. The only third-party script, Google Analytics, loads only after you consent.

12. Storage periods

• Server log files: a few days to a few weeks, then deleted automatically (section 4).
• Local-storage entries: until you clear them, the consent entry for up to 12 months (section 5).
• Analytics data: up to 14 months (section 6).
• Emails and messages: until your request is resolved, and longer only where statutory retention duties require it (section 7).

13. Your rights under the GDPR

You have the following rights regarding your personal data:

• Access (Art. 15): confirmation of whether I process your data, and a copy of it with further information.
• Rectification (Art. 16): correction of inaccurate data and completion of incomplete data.
• Erasure (Art. 17): deletion of your data, unless legal duties or rights to keep it prevent this.
• Restriction (Art. 18): restricted processing under the conditions of Art. 18(1)(a) to (d), for example while accuracy is being checked.
• Data portability (Art. 20): receiving data you provided in a structured, commonly used, machine-readable format.
• Withdrawal of consent (Art. 7(3)): at any time with effect for the future, without affecting earlier processing.
• Objection (Art. 21): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. I will then stop the processing unless I can show compelling legitimate grounds that override your interests, or the processing serves legal claims. I do not use your data for direct marketing.
• Complaint (Art. 77): you may lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged violation took place. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

To exercise your rights, email bruno@brunopaschmann.com. If I have reasonable doubts about your identity, I may ask for information to confirm it. I will respond within one month, which can be extended in complex cases as the law allows. Exercising your rights is free of charge.

14. Notice for U.S. residents

This section supplements the rest of this policy for residents of California and other U.S. states with consumer privacy laws, such as the California Consumer Privacy Act as amended by the CPRA (CCPA), and the laws of Colorado, Connecticut, Virginia, Utah, Texas and Oregon. Depending on its size, my website may fall below the legal thresholds of these laws. I nevertheless extend the rights below to all U.S. visitors.

Personal information collected in the last 12 months

Sources: directly from you and automatically from your browser. Purposes: operating, securing and improving the website, responding to you, and legal compliance. I do not knowingly collect personal information of children under 16.

No sale or sharing

I do not sell your personal information, and I do not “share” it for cross-context behavioral advertising, as those terms are defined in the CCPA. Analytics runs only after you opt in, with Google Signals and ad personalization off. Service providers use personal information only to provide services to me.

Your rights

• Know and access the personal information I hold about you, and the categories, sources, purposes and recipients.
• Delete personal information I collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information, and limit use of sensitive personal information (neither takes place here).
• Not be discriminated against for exercising your rights.
• Residents of some states may also appeal a decision about their request by replying to my response, and may then contact their state attorney general if they remain dissatisfied.

How to exercise them: email bruno@brunopaschmann.com or write to the postal address in section 1. I will verify your request by matching information you provide with information I hold, and I will respond within 45 days (extendable once by 45 days where permitted). You may use an authorized agent, in which case I may ask for proof of authorization.

Global Privacy Control and Do Not Track

I honor the Global Privacy Control (GPC) signal: if your browser sends it, analytics is not loaded. Because analytics is anyway off until you opt in, this website does not track you across other sites. There is no uniform industry standard for “Do Not Track” browser signals, so I do not respond to them separately.

California “Shine the Light”

I do not disclose personal information to third parties for their own direct marketing purposes.

15. Children

This website is not directed at children. I do not knowingly collect personal data from children under 16 (EU) or under 13 (U.S.). If you believe a child has sent me personal data, please contact me and I will delete it.

16. Data security

To protect personal data, I use appropriate technical and organizational measures. Among other things, data between your browser and this website is transmitted encrypted over HTTPS (TLS). No method of transmission or storage is completely secure, so I cannot guarantee absolute security.

17. Changes to this policy

I update this policy when the website, my service providers or the law change. The current version is published on this page with the date shown at the top. If a change materially affects consent-based processing, I will ask for your choice again.

Questions about privacy: bruno@brunopaschmann.com.