Privacy Policy

1. Controller

The controller responsible for data processing on this website is: Hakan Erdogan (address see Legal Notice), email: hakan@hknx.de.

2. Hosting

This website is hosted by the following provider: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.

The hosting provider processes data on my behalf (data processing under Art. 28 GDPR, covered by a data processing agreement). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of the website).

3. Server Log Files

When you visit this website, the hosting provider automatically records technically necessary information in server log files: IP address, date and time of access, the page requested, browser type and version, and the referrer URL.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technically faultless presentation and security of the website). The log data are rotated daily and deleted automatically after no more than 30 days, unless statutory retention obligations apply. These data are not combined with other data sources.

4. Content Delivery Network and Bot Protection (Cloudflare)

This website is delivered through the content delivery network (CDN) of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF); the transfer is therefore based on an adequacy decision (Art. 45 GDPR).

To protect against automated access, attacks, and abuse, Cloudflare uses JavaScript-based bot detection (JavaScript Detections) in addition to evaluating the IP address and technical connection data. Each time an HTML page is loaded, a script is fetched that sends client-side signals such as browser and device characteristics to Cloudflare. Regardless of the result of the check, Cloudflare sets the cf_clearance cookie, which contains the result and can be stored for up to one year. It serves to recognise the browser to Cloudflare and thereby to defend against automated access; it is not evaluated for advertising or tracking purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in defending against attacks and the security of the website); the storage of the cookie is based on § 25(2) no. 2 TDDDG, as it is strictly necessary for your requested use of the website.

5. Fonts

This website uses exclusively locally hosted fonts (Inter, JetBrains Mono, and Archivo Black). When you visit the website, no connection is made to external font services (in particular Google Fonts); no data are transferred to third parties for this purpose.

6. Language Setting

When you open the homepage, the server evaluates the Accept-Language header sent by your browser to redirect you to the matching language version. This evaluation does not store anything on your device. Your language choice is stored as hknx.lang in your browser’s local storage (localStorage) only after you explicitly select a language, and serves solely to keep the language for your next visit. This storage is technically necessary for the function you requested and is based on § 25(2) no. 2 TDDDG. No data are transferred to third parties.

7. Contact by Email

If you contact me by email, your details (email address, name, content of the message) are stored for the purpose of handling your request and for possible follow-up questions. The legal basis is Art. 6(1)(b) GDPR (initiation of a contractual relationship) or Art. 6(1)(f) GDPR (legitimate interest in answering your request). The data are deleted as soon as they are no longer necessary to achieve the purpose and no statutory retention obligations conflict.

The mailbox hakan@hknx.de is not self-hosted; it is provided by iCloud Mail. The provider and data protection controller for the mailbox is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple processes the email data under its own responsibility; Apple’s privacy policy applies in addition. For transfers of data to third countries, in particular the United States, Apple relies on the standard contractual clauses under Art. 46(2)(c) GDPR.

8. Contact Form and Notifications

If you use the contact form, I process the details you provide (name, email address, subject, and message) as well as the time and version of your consent in order to handle your request. The processing is based exclusively on your consent under Art. 6(1)(a) GDPR, which you must give expressly by ticking the checkbox before sending. Without this consent, the message is not transmitted. You may withdraw your consent at any time with effect for the future; the processing carried out until then remains lawful. The message and the related details are stored on the server named in Section 2 and deleted automatically after no more than 30 days. If I mark a message as “kept” in the admin area to continue an ongoing conversation, it is deleted after no more than 365 days; the legal basis for this longer storage is Art. 6(1)(f) GDPR (legitimate interest in the traceability of ongoing requests). Statutory retention obligations remain unaffected.

In addition, I store technical details of your access with each message so that abuse and automated spam requests can be recognised and traced: the user-agent string sent by your browser, the preferred language (Accept-Language), the referrer URL, the country of origin provided by the CDN, and a hash of your IP address salted with a daily rotating salt. These details are deleted together with the message, i.e. after no more than 30 days, or after no more than 365 days for kept messages. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in defending against abuse and the security of the form).

To protect against automated multiple and replay submissions, the form uses a short-lived, signed one-time token. The associated value is stored server-side for at most 30 minutes and then deleted. It serves exclusively the security of the form (Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG).

Web Push may be set up on the admin devices I use to receive notifications about new messages. The push endpoint and the associated encryption keys are stored on the server until I disable the subscription in the admin settings or the push service reports that the endpoint is no longer valid. When a notification is sent, a preview of the message (name, subject, and up to 140 characters of the message text) is transmitted encrypted to the device through the push service of the respective browser (e.g. Apple, Google, or Mozilla); the connection data required for delivery is transferred to the respective provider. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling requests promptly). Consent to notifications can be withdrawn at any time in the browser settings; subscriptions can also be deleted in the admin settings.

Configured webhooks transmit new messages (name, email address, subject, and message text) to the recipient endpoints I have defined. The recipients are exclusively the endpoints I have determined. The delivery is logged; the stored copy of the transmitted payload is deleted automatically after no more than 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling requests promptly) or Art. 6(1)(b) GDPR where the transmission serves to handle your request.

Beyond the recipients described in this section (push services and webhook endpoints), your form data are not passed on to other third parties or used for advertising purposes. Automated decision-making, including profiling, does not take place.

9. Live Channel

The homepage of this website holds a WebSocket connection to a live channel through which I can publish short announcements. To operate this connection, the server derives a hash value from your IP address using a random salt that exists only in memory. It serves exclusively to limit the number of simultaneous connections per address (at most five) and to count the number of distinct addresses; the hash is not stored on disk and is removed from the connection count at the latest 60 seconds after the connection ends. For the lifetime of the server process it remains stable with the same salt. The IP address itself is not logged. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable live channel and in defending against abusive connections). No cookies or comparable technologies are used for this.

10. Security and Audit Log

I keep a security log in the database for logins to the admin area and administrative changes (e.g. changing the status of or deleting messages, managing API tokens, webhooks, and push subscriptions, publishing live announcements). The log stores the actor, action, affected entity, timestamp, a value hashed from your IP address with a daily rotating salt, the user-agent string, and action details. Failed login attempts are logged as well. The log serves security, the detection and investigation of abusive access, and the traceability of changes; it is deleted automatically after no more than 30 days (the period is configurable on the server). Expired admin sessions are also removed automatically. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and integrity of the website).

11. External Links

This website links to external services (in particular GitHub and LinkedIn). When you click these links, exclusively the privacy policies of the respective provider apply. The respective provider is responsible for the data processing that takes place there.

12. Your Rights

Within the framework of the statutory provisions, you have the right to:
— information about your stored data (Art. 15 GDPR)
— rectification of inaccurate data (Art. 16 GDPR)
— erasure (Art. 17 GDPR)
— restriction of processing (Art. 18 GDPR)
— data portability (Art. 20 GDPR)
— objection to processing (Art. 21 GDPR)
— withdrawal of consent with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for your place of residence or: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.