// legal
Privacy Policy
Last updated: March 12, 2026
Controller
Morris Zimmermann
What data is collected
Contact form
When you submit the contact form, your name, email address, and message are processed by Netlify and forwarded to me by email. I use this data solely to respond to your enquiry. Contact form submissions are deleted after 90 days. Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication) or Art. 6(1)(f) GDPR (legitimate interest in responding to messages).
Analytics (Google Analytics 4)
This site uses Google Analytics 4 (Google LLC, USA). Analytics is only activated after you explicitly accept cookies via the consent banner. Without consent, no analytics cookies are set and no identifying data is sent to Google.
When consent is given, GA4 collects anonymised usage data (pages visited, session duration, rough geographic region). This data is processed by Google under the EU–US Data Privacy Framework and retained for 14 months. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time by clearing your browser's local storage for this site.
Server logs
Netlify (the hosting provider) may log standard server access data (IP address, browser, request time) for security and operational purposes. I have no direct access to these logs. See Netlify's privacy policy.
Cookies and local storage
This site stores your cookie consent preference in browser local storage (key: cookie_consent). This is not a cookie and does not
leave your device. Google Analytics 4 cookies are only set if you accept
analytics. You can clear all stored preferences by clearing your browser
data for this site.
When analytics consent is granted, Google Analytics 4 sets the following cookies:
| Cookie | Purpose | Expiry |
|---|---|---|
_ga | Distinguishes unique users | 2 years |
_ga_* | Persists session state | 2 years |
_gid | Distinguishes users (short-term) | 24 hours |
_gat | Throttles request rate | 1 minute |
Data processors
The following third-party processors handle personal data on my behalf under Art. 28 GDPR. Each has a data processing agreement in place:
| Processor | Purpose | Privacy policy |
|---|---|---|
| Netlify, Inc. (USA) | Hosting, contact form processing, server logs | netlify.com/privacy |
| Google LLC (USA) | Analytics (GA4) — only with consent | policies.google.com/privacy |
Both processors are located in the USA. Data transfers are covered by the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
Your rights (GDPR)
Under GDPR you have the right to:
- Access the personal data I hold about you
- Correction of inaccurate data
- Erasure of your data ("right to be forgotten")
- Restriction of processing
- Data portability
- Object to processing based on legitimate interest
- Withdraw consent at any time (without affecting prior processing)
To exercise any of these rights, contact me at . You also have the right to lodge a complaint with the Hamburg Commissioner for Data Protection.
Changes to this policy
I may update this policy when the site changes. The date at the top of this page reflects the latest revision.