--- title: "Privacy" url: https://werthebach.dev/en/privacy/ language: en updated: 2026-11-08 --- # Privacy We use no analytics or tracking tools, set no cookies ourselves and embed no third-party content. This page explains which data is processed nonetheless and what rights you have. ## Controller The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Dr. Stephan Werthebach, Dr. Werthebach Software Engineering Flehbachstraße 12, 51109 Köln, Germany Email: [kontakt@werthebach.dev](mailto:kontakt@werthebach.dev) We have not appointed a data protection officer, as there is no legal obligation to do so. ## Hosting and delivery The website runs on our own server in Germany. It is delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare establishes the encrypted connection to your browser, forwards requests to our server, caches pages and blocks attacks. In doing so, Cloudflare processes the data your browser sends with every request: IP address, date and time, requested address, referrer, browser and operating system. Because Cloudflare terminates the encryption, entries in the contact form also pass through Cloudflare. To protect against attacks and bots, Cloudflare may set a strictly necessary cookie; accessing it is permitted without consent under Section 25 (2) no. 2 TDDDG. Cloudflare also hides email addresses in the page source from spam bots; the small script required for this is loaded from this domain. Our own server does not store access logs containing IP addresses. The legal basis is our legitimate interest in delivering the website securely, quickly and reliably (Art. 6 (1) (f) GDPR). We have a data processing agreement with Cloudflare under Art. 28 GDPR. Cloudflare may also process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers are covered by the European Commission’s adequacy decision (Art. 45 GDPR). In addition, Cloudflare has agreed to the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR). See [Cloudflare’s privacy policy](https://www.cloudflare.com/privacypolicy/) for details. ## Fonts The font used on this website is hosted on our own server. Loading the pages does not connect to Google or any other font provider. ## Contact form When you write to us using the contact form, we process your name, your email address, optionally your company, your message and the time of your request. The data is stored in our content management system on our own server. In addition, the server sends us a notification containing your details to our mailbox at mailbox.org (see “Contact by email”). We do not pass the data on beyond that, apart from transmission via Cloudflare (see above). To protect against spam, the form contains a field that is invisible to people; no additional data is collected for this. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or steps prior to entering into one, otherwise our legitimate interest in answering requests (Art. 6 (1) (f) GDPR). We delete your request once it has been fully dealt with, unless commercial or tax retention obligations require otherwise. Deleted data remains in the backups on our server for up to 14 days and is then deleted automatically. ## Contact by email Emails to kontakt@werthebach.dev are received by Cloudflare (Email Routing; for Cloudflare see “Hosting and delivery”) and forwarded to our mailbox at mailbox.org. The provider is Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany. The data is stored in data centres in Germany. We also reply to your message from this mailbox. This involves processing your email address, the content of your message and the technical header data of the email. See the [mailbox.org privacy policy](https://mailbox.org/en/data-protection) for details. The legal basis and retention period are the same as for the contact form. ## No analytics and no advertising We use no audience measurement tools, no tracking and no advertising networks, and we do not create user profiles. There is no automated decision-making, including profiling, under Art. 22 GDPR. ## Your rights You have the right to - access the data we hold about you (Art. 15 GDPR), - have inaccurate data rectified (Art. 16 GDPR), - erasure (Art. 17 GDPR), - restriction of processing (Art. 18 GDPR), - data portability (Art. 20 GDPR). An informal message to [kontakt@werthebach.dev](mailto:kontakt@werthebach.dev) is sufficient. ## Right to object **Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).** We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. ## Right to lodge a complaint You may lodge a complaint with any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2–4, 40213 Düsseldorf, Germany [www.ldi.nrw.de](https://www.ldi.nrw.de/) ## Obligation to provide data You are not obliged to provide us with any data. However, the website cannot be displayed without the connection data your browser transmits, and we cannot reply to you without an email address. ## Changes We update this privacy policy when the website or the legal situation changes. The version published here applies.