Legal

This is a personal photography site, made and maintained by me, Florian Paulus. Information according to §5 DDG (Digitale-Dienste-Gesetz).

Florian Paulus Fruchtallee 130 20259 Hamburg Germany

Email: florianpaulus@outlook.com

Responsible for the content in the sense of §18 (2) MStV: Florian Paulus, address as above.

All photographs on this site are my own and protected by copyright. Please ask before using one.

Very little. This site sets no cookies, has no embedded third-party content and no user accounts, and its only measurement is a cookieless page-view count described below. The fonts are served from this site's own domain, so no request goes to Google. What follows is the complete list of what happens to your data when you visit, as required by Art. 13 GDPR.

The person responsible (controller) is Florian Paulus, address as in the Impressum above, florianpaulus@outlook.com.

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends a request to Vercel's servers, which record the usual server log data: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. That is technically necessary to deliver the site to you and to keep it secure, and is the legitimate interest that justifies it (Art. 6 (1) f GDPR).

Vercel processes this data on my behalf under a data processing agreement. Vercel is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition, so transfers to the United States are covered. Logs are kept briefly for security and operations. I do not access or evaluate them.

The site uses Vercel Web Analytics to see which pages are viewed and roughly where visitors come from. When you open a page, a small script sends the page's address, the referring page and your browser and screen type to Vercel. Vercel derives a hash from your IP address and browser that changes daily and cannot be traced back to you, uses it only to tell one visit from the next, and discards the IP address. No cookies are set, nothing is stored in your browser for this and no profile is built across sites, which is why no consent banner is needed. The interest is knowing which journeys people look at so I can keep the site worth visiting (Art. 6 (1) f GDPR). Vercel processes this data on my behalf under the same agreement and safeguards as the server logs; the aggregated counts are kept while the site runs.

The site also uses Vercel Speed Insights to see how quickly pages load and respond. When you open a page, a small script measures load and interaction times (the Core Web Vitals) and sends them to Vercel together with the page's address and your browser, device and connection type. It sets no cookies, stores nothing in your browser and uses no identifier that could tell you apart from anyone else; the measurements are only ever looked at in aggregate. The interest is keeping the site fast, which matters for a site made of large photographs (Art. 6 (1) f GDPR). Vercel processes this data on my behalf under the same agreement and safeguards as the server logs.

The site sets no cookies. It stores two values in your browser's local storage, and both only remember that a hint has been shown so it doesn't pop up again: "flip-hint-dismissed", set once you have flipped a print or closed the hint that explains it, and "key-legend-dismissed", set once you have closed the small legend of keyboard shortcuts or pressed one of the keys it lists. They contain no personal data, never leave your browser and are not read by anyone. This is strictly necessary for a feature you asked for (§25 (2) TDDDG), so no consent banner is needed. You can delete them at any time by clearing this site's data in your browser.

If you send me an email, I use what you send, including your address, only to answer you (Art. 6 (1) b and f GDPR). I keep the conversation as long as it's ongoing and delete it when it's done, unless a legal obligation says otherwise.

The site links to my Instagram profile. Once you follow that link, Meta's privacy policy applies, not this one.

Under the GDPR you can ask me at any time what data I hold about you (Art. 15), have it corrected (Art. 16) or deleted (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20) and object to processing based on legitimate interest (Art. 21). Given the list above, the honest answer is almost always "nothing", but write to the email address above and I'll answer.

You also have the right to complain to a data protection authority. The one responsible for me is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.