Privacy policy

1. Overview

This privacy policy informs you pursuant to Art. 13 and 14 GDPR which personal data is processed when you visit schniefs-portfolio.de, for which purposes, on which legal basis, who receives it, how long it is kept and which rights you have.

In short: this website uses no tracking, analytics or advertising services and loads no content from third-party servers (no Google Fonts, no embedded videos or social media plugins). A cookie is only set when you like a project or mark a review as helpful (see section 7). Only server access data, messages sent via the contact form or by email, questions to the help assistant and – if you use them – likes, visit counts and reviews of my projects are processed.

2. Controller

Yves Justin Sven Gildemeister, c/o flexdienst – #21305, Kurt-Schumacher-Straße 76, 67663 Kaiserslautern, Germany

Email: info@schniefs-portfolio.de

Legal notice: https://schniefs-portfolio.de/en/impressum

No data protection officer has been appointed as there is no legal obligation to do so.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Pages are delivered through Vercel's global network from the nearest location; the server functions of this website (contact form, help assistant, feedback) run in the Frankfurt am Main region. A data processing agreement pursuant to Art. 28 GDPR including EU Standard Contractual Clauses is in place with Vercel.

With every request Vercel automatically processes: IP address, date and time, requested URL, HTTP status code, amount of data transferred, referrer URL and browser and operating system information (user agent). This data is needed to deliver the website, ensure its stability and security and detect attacks or errors.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation). The logs are not combined with other data, are kept by Vercel only for a short time and are then deleted automatically.

A transfer to the USA is possible. It is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Vercel is certified, and additionally on the EU Standard Contractual Clauses (Art. 45, 46(2)(c) GDPR).

Vercel's privacy information: https://vercel.com/legal/privacy-policy (opens in a new tab)

The live demos of my projects on subdomains of schniefs-portfolio.de (e.g. join.schniefs-portfolio.de) and my mailbox remain hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (servers in Germany, data processing agreement pursuant to Art. 28 GDPR). The same server access data is processed there; it is deleted or anonymised after 7 days at the latest. Privacy information: https://all-inkl.com/datenschutzinformationen/ (opens in a new tab)

4. Encryption

The website is delivered exclusively via a TLS-encrypted connection (HTTPS). Form, assistant and feedback input is transmitted encrypted, including on the way from Vercel to the backend.

5. Contact form and contact by email

If you use the contact form, your name, email address, message, the selected language and the page you write from are sent to a server function of this website at Vercel and forwarded from there to the Schnief Enterprise backend, which I operate myself. Its servers are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (data processing agreement pursuant to Art. 28 GDPR). The backend sits behind the network of Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), which routes the connections and protects against attacks. In the backend the enquiry is stored in my internal inbox and I am notified by email.

To prevent spam the form contains an invisible field, a signed timestamp and a limit on requests per period. For this your IP address is passed to the backend and only converted there into a daily changing, keyed hash (HMAC); the IP address itself is not stored.

The purpose is to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual measures (e.g. a project or service offer), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and preventing abuse). Name, email address and message are required so that I can reply.

Enquiries are deleted automatically in the backend after 30 days or archived in neutralised form in the internal inbox. Afterwards my reply and your message only exist in my mailbox at ALL-INKL; they are deleted once the enquiry has been fully handled (as a rule after 12 months at the latest). If the enquiry leads to an assignment, business-relevant correspondence is kept in line with statutory tax and commercial retention periods (up to 6 or 8 years, Section 147 AO, Section 257 HGB).

If you email me directly, the email is only stored in my mailbox at ALL-INKL in Germany; the same purposes, legal bases and periods apply.

6. Help assistant (Q&A and AI answers)

This website offers a help assistant. It first answers questions with prepared answers; when you explicitly click “Ask the AI” it can have an answer generated by an AI system, and you can send me an enquiry through a contact form in the assistant.

How it works: your input first goes to a server function of this website at Vercel and is forwarded from there to the Schnief Enterprise backend (IONOS, Germany; behind Cloudflare, see section 5).

Data processed: the text of your question, the selected language, the page you ask on and your rating of an answer. Your IP address is passed to the backend only to derive a daily changing, keyed hash (HMAC) used to limit abuse and costs; the IP address itself is not stored there. Recognisable personal details in questions (e.g. email addresses or phone numbers) are masked before storage. Please do not enter sensitive data in questions to the assistant.

AI answers: only when you choose “Ask the AI” is your (masked) question sent, together with excerpts of this website's approved information, to the AI service OpenAI (for customers in the EEA: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland), acting as processor. OpenAI group companies in the USA may be involved; such transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the recipient is certified, the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). According to OpenAI, data sent via the API is not used for training. AI answers are clearly labelled in the assistant as “AI answer – generated automatically, no guarantee” (Art. 50 EU AI Act); they may contain errors and are not a binding statement.

Enquiries via the assistant: if you send an enquiry, your message and the email address you provide are stored in the backend and delivered to me by email and in the internal inbox so that I can reply.

Legal bases: Art. 6(1)(f) GDPR (legitimate interest in answering visitor questions quickly and at limited cost and in preventing abuse) and, for enquiries, Art. 6(1)(b) or (f) GDPR. Transmission to Cloudflare is based on Art. 6(1)(f) GDPR; Cloudflare is certified under the EU-US Data Privacy Framework.

Retention: conversations, questions and enquiries are deleted automatically after 30 days; enquiries in the internal inbox are then archived in neutralised form. Non-personal usage and cost figures are kept.

Privacy information: OpenAI https://openai.com/policies/privacy-policy/ (opens in a new tab) – Cloudflare https://www.cloudflare.com/privacypolicy/ (opens in a new tab) – IONOS https://www.ionos.de/terms-gtc/datenschutzerklaerung/ (opens in a new tab)

7. Likes, reviews and view counts on projects

On the project pages you can give a “like”, write a review (stars and comment), mark reviews as helpful or report them, and have your visit counted. These functions run through a server function of this website at Vercel and the Schnief Enterprise backend (IONOS, Germany; behind Cloudflare, see section 5).

Likes and “helpful” votes: so that each person only counts once, the website sets a cookie “fb_voter” with a random identifier on your first like or vote (httpOnly, this website only, lifetime 1 year). The backend only stores a keyed hash (HMAC) of this identifier, not the identifier itself. The cookie is strictly necessary for the function you explicitly requested (Section 25(2) no. 2 TDDDG); further processing is based on Art. 6(1)(f) GDPR (legitimate interest in counters that are hard to manipulate). You can delete the cookie in your browser at any time.

Visit counter: a visit is only counted when you click “Count my visit” (consent, Art. 6(1)(a) GDPR). Only the total number of visits per project and day is stored; to avoid double counting a daily changing hash (HMAC) is derived from your IP address and deleted after 2 days. Your browser identifier (user agent) is only checked to filter out bots and is not stored.

Reviews: the display name you enter (optional, otherwise a neutral name), the star rating, your comment, the language, the time and a keyed hash for abuse prevention are processed. Comments are checked automatically for insults and personal data; guest reviews are approved by me before publication. Only the display name, stars, comment and date are published, never your IP address. The legal basis for publication is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by emailing info@schniefs-portfolio.de; the review is then deleted. Abuse prevention is based on Art. 6(1)(f) GDPR.

Retention: published reviews are kept until you have them deleted or I remove them; rejected reviews are deleted after 90 days. Likes and counters are stored without real names.

8. Cookies, local storage, tracking

This website sets only one cookie, and only once you like a project or mark a review as helpful (see section 7). Browser storage (localStorage/sessionStorage) only holds entries that are strictly necessary for a function you requested (Section 25(2) no. 2 TDDDG): your colour scheme (light/dark) and whether you hid the help assistant or have it open in the current session. You can delete these entries at any time in your browser settings; you can show the assistant again via “Show help assistant” in the footer.

No analytics, tracking or marketing services are used, so no consent banner is required.

9. Fonts and external content

All fonts, images, scripts and graphics are served by this website itself. No connection to Google or other third-party servers is made when the page loads.

10. Links to GitHub, LinkedIn and project demos

The website contains plain links (no plugins) to my profiles on GitHub (GitHub, Inc., USA) and LinkedIn (LinkedIn Ireland Unlimited Company, Ireland) as well as to live demos and source code of my projects. Only when you click such a link do you leave this website; the privacy policy of the respective provider then applies.

If you contact me via LinkedIn or GitHub, I process your message to reply (Art. 6(1)(b) or (f) GDPR); the platform operator processes the data under its own responsibility.

11. Recipients and transfers to third countries

Personal data is only received by the providers named above: Vercel (hosting of this website), ALL-INKL (email, project demos), IONOS (servers of the Schnief Enterprise backend), Cloudflare (network and protection of the backend) and – only for AI answers – OpenAI. Transfers to the USA may occur with Vercel, Cloudflare and OpenAI; they are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 or on EU Standard Contractual Clauses. Data is not sold or shared for advertising.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent given with effect for the future (Art. 7(3)). An informal message to info@schniefs-portfolio.de is sufficient.

Right to object (Art. 21 GDPR): where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. I will then stop processing the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you may complain to a data protection supervisory authority, in particular in the member state of your residence, place of work or place of the alleged infringement. The authority responsible for me is: Die Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany (postal address: Postfach 11 01 32, 01330 Dresden), email: post@sdtb.sachsen.de, web: https://www.datenschutz.sachsen.de (opens in a new tab)

13. Changes

I update this privacy policy whenever the website's functions, the services used or the law change. The version published here applies.