Privacy Policy
1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Frank Oliver Schmitz
Osenauer Str. 14
51519 Odenthal
Germany
Phone: +49 2202 2704628
Email: foschmitz@gmail.com
The following information explains which personal data is processed when you visit this website, for what purpose, on which legal basis and for how long.
2. Hosting and Delivery (Cloudflare)
This website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. With every request, Cloudflare processes technically necessary connection data, in particular your IP address, date and time of the request, the requested address, the amount of data transferred, browser and operating system information, and the previously visited page (referrer).
The purpose is to deliver the website and protect it against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure, fast and reliable operation of the website. Cloudflare processes the data on my behalf under a data processing agreement (Art. 28 GDPR). I only see aggregated statistics (e.g. number of requests per country), not individual IP addresses. Cloudflare deletes the connection data as soon as it is no longer needed for these purposes.
Cloudflare operates a global server network; data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR); standard contractual clauses apply in addition. More information: https://www.cloudflare.com/privacypolicy/
3. Cookies and Local Storage
Without your consent, only the following technically necessary data is stored in your browser:
- cc_cookie (cookie, 182 days): stores your choice in the cookie banner so that it is respected on future visits and I can demonstrate your consent.
- portfolio_session (cookie, 30 days): only set when you log in to the portfolio area with the password, so you do not have to re-enter it for every page and download. It contains no information about you.
- langChosen (session storage, until the browser tab is closed): remembers that the language has already been selected automatically. This value is not transmitted.
The legal basis for storing this data is Section 25(2) No. 2 TDDDG, as it is strictly necessary for the function you requested. Subsequent processing is based on Art. 6(1)(f) GDPR (providing the function) or, for the consent cookie, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (demonstrating consent). All other cookies and services (sections 5 and 6) are only activated with your consent.
4. Contact by Email or Phone
If you contact me by email or phone, I process your details (e.g. name, email address, phone number, content of your request) to handle your request. If it concerns an assignment or collaboration, the legal basis is Art. 6(1)(b) GDPR; in all other cases Art. 6(1)(f) GDPR, my legitimate interest in responding to your request.
For email I use Gmail provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework, Art. 45 GDPR). I delete your request once it has been fully handled, unless statutory retention obligations (e.g. for business correspondence under commercial and tax law) apply.
5. Google Analytics
With your consent, I use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows me how the website is used, e.g. which pages are visited, how long a visit lasts, which country and type of device visitors come from, and which page referred them. The aim is to improve the website.
For this purpose, the cookies _ga and _ga_1BEWG17KDE are set; they contain a random identifier and are stored for up to 2 years. Google Analytics 4 does not store full IP addresses. Usage data is automatically deleted by Google after 2 months. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Google Analytics is only loaded if you have explicitly consented via the cookie banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie settings and disabling analytics. The Google Analytics cookies are then deleted. More information: https://policies.google.com/privacy
6. YouTube Videos
A YouTube video is embedded on the portfolio page. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video is loaded in privacy-enhanced mode (youtube-nocookie.com) and only after you click “Load video” or enable “External media” in the cookie settings. Before that, no connection to YouTube is made.
When the video loads, Google receives in particular your IP address and technical information about your browser and device. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings. More information: https://policies.google.com/privacy
7. Fonts
The fonts used on this website (Inter and JetBrains Mono) are served directly from this server. No connection is made to Google Fonts or any other external font provider.
8. Your Rights
Subject to the respective legal requirements, you have the right to:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdraw any consent given, with effect for the future (Art. 7(3) GDPR)
An informal message to the contact details above is sufficient.
Right to Object (Art. 21 GDPR)
Where I process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object to this processing at any time on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Right to Lodge a Complaint
You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority responsible for me is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
9. SSL/TLS Encryption
For security reasons, this website uses TLS encryption. You can recognize an encrypted connection by “https://” in the address bar and the lock symbol in your browser.
10. Changes to This Privacy Policy
As of November 2026. I update this privacy policy when the website, the services used or the legal requirements change.