Privacy
Who runs this site
hendrikjunge.com is my personal website. I'm Hendrik Junge, and I'm responsible for any personal data it handles. For anything about your data, email me at [email protected].
Visiting the site
The site runs on my own server in Germany. On its way to you it passes through Cloudflare (Cloudflare, Inc., USA), which delivers the pages quickly and blocks attacks. To do that, Cloudflare processes your IP address and basic technical details such as your browser and the page you asked for. Cloudflare is certified under the EU-US Data Privacy Framework. My own server notes which page was requested and how fast it answered, but never your IP address. The site sets no cookies.
Legal basis: my legitimate interest in a fast and secure website (Art. 6(1)(f) GDPR).
Visitor statistics
To see which pages people read, I count visits with Umami, which runs on my own server. It records the page, where the visit came from, the type of browser and device, and a rough location (country and city), worked out from your IP address at the moment of the visit. It stores no IP address, sets no cookies, and shares nothing with anyone else.
Legal basis: my legitimate interest in knowing which pages are read (Art. 6(1)(f) GDPR).
Signing up for new posts
If you enter your email address in the signup form, I store it together with the time, the page you signed up on, your browser type and a scrambled, one-way code made from your IP address, which only serves to stop abuse of the form. You then get an email with a confirmation link. Only after you click it do you receive new posts, and I keep the time of your confirmation as proof that you agreed. When someone signs up, I get a notification on my phone through my own notification server.
The emails are delivered by Resend (Resend, Inc., USA), which processes your email address only to send them. Every email has a one-click unsubscribe link, and you can also simply reply and ask.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing. For the scrambled IP code: my legitimate interest in protecting the form (Art. 6(1)(f) GDPR).
Where the data lives
Everything the site stores, from signups to statistics and logs, lives on my own server in Germany. Encrypted backups are kept with Backblaze (Backblaze, Inc.) in its EU data centre in the Netherlands. They are encrypted before they leave my server, so Backblaze cannot read them. Apart from Cloudflare and Resend, as described above, no one else gets your data, and I never sell it or use it for advertising.
Legal basis for the backups: my legitimate interest in not losing data (Art. 6(1)(f) GDPR).
How long data is kept
Your signup stays as long as you're subscribed. If you never confirm it, it's deleted after 7 days.
When you unsubscribe, I keep only your address and the dates you signed up, confirmed and unsubscribed, for 3 years, as proof that you had agreed. Then it's deleted.
Technical logs that can contain your address are deleted after 30 days.
The visitor statistics contain nothing that identifies you and are kept.
Anything deleted disappears from my backups within 30 days.
Legal basis for keeping the proof: my legitimate interest in being able to show your consent (Art. 6(1)(f) GDPR).
Your rights
You can ask me at any time what data I have about you, and have it corrected, deleted, restricted or handed to you in a portable format. You can object to anything I do based on my legitimate interest, and withdraw your consent at any time, for example by unsubscribing. Just email me at [email protected]. You also have the right to complain to a data protection authority.
Changes to this page
If the site starts handling data differently, I'll update this page first.
Last updated: