Privacy policy

Controller

Patrick Koss
c/o POSTFLEX PFX-029-062
Emsdettener Strasse 10
48268 Greven
Germany
Email: patrick.koss@mein.gmx

This policy covers the website patrick-koss.com. Separate web applications linked from this site have their own privacy policies, available inside the respective application.

Server log files

When you open this website, the hosting provider records data your browser sends. That covers your IP address, the date and time of access, the page requested, the referrer URL, your browser type and operating system. This data is technically necessary to deliver the page and to keep the service secure.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and technically correct operation of the website.

Cookies and consent

Simply visiting this website sets no cookies of its own. Third-party content, which on this site means YouTube videos, loads only after you agree. Until then a placeholder appears in its place.

Real Cookie Banner obtains and documents your consent. It stores one strictly necessary cookie in your browser recording your choice. Your IP address is not stored. You can change or withdraw your consent at any time using the link in the footer.

The legal basis for services requiring consent is Art. 6(1)(a) GDPR together with Section 25(1) TDDDG. Storing your consent decision relies on Section 25(2) TDDDG.

Analytics with Statify

Statify counts page views. It stores only the date, the page requested and the referrer. It does not store IP addresses, does not set cookies and does not build user profiles. The data stays on this website’s own server.

The legal basis is Art. 6(1)(f) GDPR, the legitimate interest being a data-minimising measurement of site usage.

Jetpack (Automattic)

This website uses the Jetpack plugin by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. It provides protection against unauthorised login attempts (Protect) and the contact form. The statistics feature (Jetpack Stats) is switched off, so no analytics run through Automattic.

As part of the protection feature, IP addresses from failed login attempts are sent to Automattic and checked there. This transfers data to the USA. Automattic is certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision under Art. 45 GDPR.

The legal basis is Art. 6(1)(f) GDPR, the legitimate interest being to keep the website secure. More information: automattic.com/privacy

Fonts (self-hosted)

This website uses typefaces from the Google Fonts library. The font files are stored locally on this website’s own server and delivered from there. Opening a page creates no connection to Google’s servers, and your IP address is not transmitted to Google.

Because no data is transferred to a third party, embedding these typefaces does not require consent.

GitHub repository data

The homepage and the projects page show public information about my GitHub repositories, such as the primary language and the number of stars. This data is fetched by this website’s own server, cached there, and delivered to you from this server. Your browser makes no connection to GitHub when the page loads, so no data about you reaches GitHub unless you click through to a repository yourself.

Contact form

If you write to me using the contact form, the details you enter (name, email address and message) are forwarded to my email address. Jetpack provides the form. The submission is routed through Automattic’s servers in the USA, and a copy of the enquiry is stored in this website’s database.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns entering into a contract, otherwise Art. 6(1)(f) GDPR, the legitimate interest being to respond to enquiries. Your details are deleted once your enquiry has been dealt with and no statutory retention period prevents it.

Comments and spam protection

If you leave a comment, the details entered in the form are stored along with your IP address and your browser’s user agent. Antispam Bee detects spam. It runs the check on this server and does not transmit comment data to third parties.

The legal basis is Art. 6(1)(a) GDPR for publishing the comment and Art. 6(1)(f) GDPR for spam detection.

Login protection

Limit Login Attempts Reloaded protects against automated login attempts. The plugin logs failed logins together with the IP address for a limited period. The legal basis is Art. 6(1)(f) GDPR.

YouTube videos

The Talks page and the homepage embed videos hosted on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

No connection to Google is made when the page loads. In place of each video you first see a preview generated by this site. Only when you click it does the player load, exclusively via the domain youtube-nocookie.com in privacy-enhanced mode. From that point your IP address is transmitted to Google and Google may process further data about your use of the video. This may involve a transfer to the USA. Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR, given by clicking to load the video. Without that click the video is not loaded. More information: policies.google.com/privacy

External content and links

This website links to external services such as GitHub repositories, YouTube videos and my profile on Medium. Following a link means the provider’s own privacy policy applies. Where content from these providers would be embedded directly in a page, it loads only after you consent.

Retention

Server log files are deleted after 30 days at the latest. Comments remain stored until you request their deletion. Consent records are kept for as long as the statutory obligation to demonstrate consent requires. Otherwise data is deleted once the purpose of processing no longer applies and no statutory retention period prevents it.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

You may object to processing based on Art. 6(1)(f) GDPR under Art. 21 GDPR. To do so, contact the email address given above.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestrasse 2-4, 40213 Duesseldorf, Germany.

Encryption

This website is delivered over HTTPS, so the connection between your browser and the server is encrypted.