Data Protection

Controller

Overview

This website is operated as a personal advisory practice. I take the protection of your personal data seriously. This policy explains what data is processed when you visit robertdaniel.consulting, who processes it on my behalf, and what rights you have.

Hosting and transport security

This website is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you visit this site, Netlify may process server log data including your IP address, browser type, referring page, and time of access. This is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in secure and efficient website operation). Netlify's privacy policy: netlify.com/privacy

As Netlify is based in the USA, data may be transferred to the United States. Netlify participates in the EU-U.S. Data Privacy Framework.

This site is served exclusively over an encrypted TLS connection (HTTPS), so the content of your visit cannot be read in transit by third parties.

Analytics

This website uses Umami, a cookieless web analytics service operated by Umami Software, Inc. (San Francisco, California, USA), to understand aggregate visitor trends such as page views and referring sources. Umami sets no cookies and builds no cross-site profile. Your IP address is processed only transiently in order to derive a non-identifying visitor hash; it is not stored. No data is passed to advertising networks. Because no cookies are set and nothing is stored that identifies you personally, no consent banner is required.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding and improving website performance). Umami Software, Inc. is based in the United States and operates server regions in both the USA and the EU, so a transfer to the United States cannot be excluded. Umami's privacy policy: umami.is/privacy

Fonts

The typefaces used on this website (Cormorant Garamond and Inter) are stored on this website's own server and delivered from there. No connection is made to Google servers when you load a page, and no data about you is transmitted to Google.

Contact by email

If you contact me by email, your message, your email address, and any information you provide are processed for the purpose of dealing with your inquiry. Legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Email for this domain is hosted by Migadu-Mail GmbH (Rohnen 10, 9411 Schachen b. Reute, Switzerland; UID CHE-334.933.960), which acts as a processor on my behalf. The mail servers are located at OVH in France, so the processing takes place within the European Union. Switzerland is recognised by the European Commission as providing an adequate level of data protection, so no additional transfer safeguards are required. Migadu's privacy policy: migadu.com/privacy

What this website does not do

• No cookies are set, so no cookie banner is required
• No cross-site tracking and no advertising networks — analytics is cookieless and aggregate only
• No contact forms are used
• No newsletter signups are offered
• No user accounts exist
• No personal data is sold, rented, or passed to third parties for their own purposes

LinkedIn

This website contains a link to my LinkedIn profile. Clicking it takes you to linkedin.com, operated by LinkedIn Ireland Unlimited Company. No LinkedIn content is embedded on this site, so no data is transmitted to LinkedIn unless you follow the link yourself. I have no control over the data LinkedIn then collects. LinkedIn's privacy policy: linkedin.com/legal/privacy-policy

Retention and deletion

• Server log data is retained by the host only as long as needed for security and operation, and is then deleted or anonymised.
• Analytics data is aggregate and contains no personal identifiers.
• Email correspondence is retained for the duration of the business relationship and deleted thereafter — except where it relates to a commercial transaction, in which case statutory retention periods under § 147 AO and § 257 HGB (six or ten years) apply.

Technical and organisational measures (TOMs)

A summary of the technical and organisational measures I maintain to protect personal data in accordance with Art. 32 GDPR is available on request and as a downloadable document. The document itself is in German.

Your rights

Under the GDPR, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Erase your data (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object. Where processing is based on Art. 6(1)(f) GDPR — hosting logs and analytics on this site — you may object at any time on grounds relating to your particular situation. A message to the address above is enough.

You are not obliged to provide any data. Simply visiting this website requires none. If you contact me, the data you provide is used only to answer you; withholding it means only that I cannot reply.

To exercise any of these rights, write to hallo@robertdaniel.consulting. The competent supervisory authority is:

Changes to this policy

This policy may be updated to reflect changes in the legal framework or in how this website works. The current version is always available at this URL, with the date of the last change shown at the top.

This statement is also available in German. The German version governs.