PRIVACY / POLICY

Last updated: July 12, 2026

Felix Pahlke
Dweerblöcken 4
22393 Hamburg
Email: hello@felixpahlke.de

This policy covers the portfolio website, its contact form, required security services, and optional audience analytics.

When you open the website, the hosting and delivery infrastructure processes the IP address, request time, requested URL, referrer, browser and device information needed to deliver and secure the site. The legal basis is Article 6(1)(f) GDPR; the legitimate interests are reliable delivery, security, abuse prevention and troubleshooting. Infrastructure logs are retained only for operationally necessary periods and are then deleted or anonymised unless an incident or legal obligation requires longer storage. The published site is delivered using Vivd infrastructure and Cloudflare services.

If you use the contact form or send an email, we process your name, email address, message, submission time and technical anti-abuse data to respond to your request. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries and Article 6(1)(f) GDPR for other correspondence and abuse prevention. The form is handled by the Vivd contact-form service and protected by Cloudflare Turnstile. Contact-form submissions are removed from the form database after 30 days; correspondence may be retained longer where needed to handle the request or meet statutory record-keeping obligations.

Analytics is disabled until you select “Allow analytics”. After consent, Vivd Analytics stores a random visitor identifier in local storage and a random session identifier in session storage. It sends the page path (without the query string), source host, referring host, device category, campaign parameters, visitor identifier and session identifier to the Vivd analytics endpoint. The visitor identifier is stored as a one-way hash on the server. We use these data to understand visits and improve the website. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Analytics events are deleted after 180 days. You can withdraw consent at any time through “Privacy settings” in the footer; withdrawal stops future analytics and removes the identifiers from your browser. The lawfulness of prior processing remains unaffected.

The website stores your privacy choice so it can respect it on later visits. This storage is required to provide the privacy setting you requested. Cloudflare Turnstile is loaded for the contact form to prevent automated abuse and may process IP address, browser, device and interaction signals. It is used on the basis of Article 6(1)(f) GDPR and Section 25(2) TDDDG where storage or access is strictly necessary for the requested protected form. Website fonts and icons are served locally and do not require a connection to Google Fonts, CDNJS or unpkg.

Data may be processed by service providers used for content delivery, infrastructure, security, form handling and email delivery. These include Cloudflare and Vivd-operated services. Where a provider processes data outside the European Economic Area, transfers are based on an applicable adequacy decision, including the EU-US Data Privacy Framework where available, or Standard Contractual Clauses with appropriate supplementary safeguards. Further information about the relevant safeguard is available on request.

Subject to the statutory requirements, you have rights to access, rectification, erasure, restriction, data portability and objection. You can withdraw consent at any time. You may also lodge a complaint with a supervisory authority. The competent authority in Hamburg is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit. There is no automated decision-making or profiling with legal or similarly significant effects. Contact hello@felixpahlke.de to exercise your rights.