Privacy Policy
Deutsch · English
This is a courtesy translation. In case of any discrepancy, the German version is the authoritative one.
In short
- This is a static website. There are no user accounts, no forms and no comment section.
- No cookies are set and nothing is stored in your browser (no local storage, no session storage).
- There is no analytics and no tracking — no Google Analytics, no Matomo, no tracking pixels, no ad networks.
- Your IP address is nevertheless transmitted, as a technical necessity, to the host and to a few third parties (fonts, scripts, map tiles). Each of them is listed in detail below.
1. Controller
The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:
Kevin Kreutz
Togostr. 13
13351 Berlin
Germany
Email: kkreutz@acm.org
No data protection officer has been appointed, as the statutory thresholds for doing so (Art. 37 GDPR, § 38 BDSG) are not met.
2. General information on processing
This website is operated as a static site. That means there is no database, no server-side application logic and no way for visitors to submit input. I do not collect any personal data through this website myself and, in particular, I have no access to my hosting provider's server log files.
Personal data — essentially your IP address — is nevertheless processed, because it is technically necessary for your browser to retrieve the page at all. Sections 5 to 8 describe which parties receive this data.
3. Your rights
You have the following rights against the controller regarding your personal data:
- Access (Art. 15 GDPR) — you may request confirmation of whether, and which, data concerning you is being processed.
- Rectification (Art. 16 GDPR) — you may request that inaccurate data be corrected or incomplete data completed.
- Erasure (Art. 17 GDPR) — you may request deletion of your data, unless a statutory retention obligation applies.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR) — you may request your data in a structured, commonly used and machine-readable format.
- Objection (Art. 21 GDPR) — see the highlighted notice below.
- Withdrawal of consent (Art. 7(3) GDPR) — where processing is based on consent, you may withdraw it at any time with effect for the future.
An informal message to kkreutz@acm.org is enough to exercise any of these rights.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority — in the member state of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for the controller is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
www.datenschutz-berlin.de
Where processing is based on a legitimate interest under Art. 6(1)(f) GDPR — on this website that covers hosting and the embedding of the third parties named below — you have the right to object to that processing at any time on grounds relating to your particular situation. The data concerned will then no longer be processed, unless there are compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
4. No cookies, no tracking
This website sets no cookies and stores no information in your browser (neither local storage nor session storage). No analytics services, audience measurement, tracking pixels or advertising networks are used. A cookie banner is therefore not required — not because one has been omitted, but because there is nothing to consent to.
The site's search function runs entirely in your browser: a search index is loaded with the page and queried locally. Your search terms never leave your device and are not logged anywhere.
5. Hosting: GitHub Pages
This website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, a subsidiary of Microsoft Corporation.
When you open a page, your browser transmits technically necessary data to GitHub's servers, where it may be recorded in server log files. This typically includes the IP address, the date and time of access, the file requested, the referrer, and browser and operating system identifiers. I have no access to these log files and do not evaluate them.
- Purpose
- Delivery of the website; ensuring stability and security
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in the secure and efficient operation of the website
- Third-country transfer
- USA. GitHub is certified under the EU–US Data Privacy Framework; the EU Commission's Standard Contractual Clauses apply in addition.
- Retention
- Determined by GitHub; I have no influence over deletion.
- Privacy policy
- GitHub Privacy Statement
6. Google Fonts
Every page embeds the typeface "Inter" via the Google Fonts service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The font files are not served locally but fetched from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Google therefore learns that this website was accessed from your IP address. A transfer to the USA cannot be ruled out. According to Google, font requests are logged separately from other Google services and are not used for profiling.
- Purpose
- Consistent and legible presentation of type
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in a consistent presentation of the website
- Third-country transfer
- Possible (USA). Google LLC is certified under the EU–US Data Privacy Framework.
- Privacy policy
- policies.google.com/privacy · Google Fonts privacy FAQ
7. jsDelivr (search function)
The site search loads the "Fuse.js" library from the jsDelivr content delivery network, operated by Prospect One Sp. z o.o., Kraków, Poland. Your IP address is transmitted to the CDN when the library is loaded.
- Purpose
- Providing the search function
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in a functioning website
- Third-country transfer
- Provider established in the EU; delivery is via globally distributed edge servers.
- Privacy policy
- jsdelivr.com — Privacy Policy
8. Map display on the "Personal" page
The following two services are loaded only on the /personal/ subpage. If you do not open that page, no data is transmitted to them.
Leaflet via unpkg
The "Leaflet" mapping library is loaded from the unpkg content delivery network, which is served by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Your IP address is transmitted to that network in the process.
OpenStreetMap
The map imagery itself consists of tile images loaded from servers of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address is transmitted to the OpenStreetMap Foundation in the process.
- Purpose
- Displaying an interactive map
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in an illustrative presentation
- Third-country transfer
- USA (Cloudflare, certified under the EU–US Data Privacy Framework) and the United Kingdom (covered by an EU Commission adequacy decision).
- Privacy policies
- Cloudflare · OpenStreetMap Foundation
9. Contact by email
This website lists email addresses for getting in touch. There is no contact form. If you write to me, the data you send — your email address, your name if given, and the content of your message — is stored for the purpose of handling your enquiry.
- Legal basis
- Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR — legitimate interest in responding to enquiries
- Retention
- Until the purpose of storage ceases to apply, i.e. the enquiry has been dealt with conclusively, unless statutory retention periods apply
10. External links
This website links to external resources in many places. I have no influence over their content or their data processing; the privacy policy of the respective provider applies to them. A link alone triggers no data transfer — that only happens once you click it.
11. Encryption
This website is served exclusively over a TLS-encrypted connection (HTTPS), which you can verify in your browser's address bar. Requests over HTTP are redirected to HTTPS automatically.
12. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
13. Obligation to provide data
Providing personal data is neither required by law nor by contract. Beyond the transmission of your IP address that is technically necessary to retrieve the page, you do not have to provide any data in order to use this website.
14. Changes to this privacy policy
I update this privacy policy whenever the technology used on this website or the legal situation changes. The version available here is the one that applies.
Last updated: 10 September 2026