Privacy

1. Controller

The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:

Connor Welge
Grandweg 122c
22529 Hamburg
Germany

Email: [email protected]

More details are in the imprint.

2. The short version

• I set no cookies, do no cross-site tracking and run no ads.
• The site runs on my own server in a data centre in the EU.
• For visitor statistics I use a self-hosted, cookieless Umami instance — nothing is shared with third parties.
• Data from the contact form is used only to answer your enquiry.
• Fonts are currently still loaded from the Fontshare service (details below).

3. Hosting & server log files

I run this website myself using the open-source software Dokploy on a virtual machine rented from:

Tech Tide Portugal Unipessoal LDA (NovaCloud-Hosting)
Rua Daniel Guerreiro Joao 4 4AB, 8125-598 Quarteira, Portugal
novacloud-hosting.com

Server location: Frankfurt am Main, Germany. The provider processes data only on my behalf and according to my instructions (processing on behalf under Art. 28 GDPR). No data is transferred to third countries.

On every visit the web server automatically stores information sent by your browser: IP address, date and time, requested page, referrer URL, browser and operating system (user agent) and HTTP status code. This is technically necessary to deliver the site and keep it secure and stable (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest, unless they are needed to investigate a specific security incident.

The connection is encrypted with TLS (HTTPS).

4. Visitor statistics with Umami

To understand which content gets read, I use Umami, open-source analytics software that I host myself at analytics.cwcodes.de. Umami sets no cookies and builds no cross-site profiles. It records pages visited, referrer, browser, operating system, device type, screen size, language and approximate country. Your IP address is not stored; it is used only briefly, together with a daily rotating random value, to form an anonymous session identifier, so you cannot be recognised across days.

The data never leaves my server and is not shared with third parties. The legal basis is my legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). You can opt out by enabling your browser's Do Not Track setting or using a script or ad blocker.

5. Fonts from Fontshare

To display its typefaces (Clash Display, General Sans, Gambetta), this website loads font files from the Fontshare service of the Indian Type Foundry (Ahmedabad, India) via the servers api.fontshare.com and cdn.fontshare.com. For technical reasons your browser sends your IP address and browser information to these servers. This may involve a transfer to a third country for which the EU Commission has not issued an adequacy decision.

The legal basis is my legitimate interest in a consistent, appealing presentation (Art. 6(1)(f) GDPR). More information: fontshare.com/terms.

6. Contact form & email

If you write to me through the contact form, I process the data you provide (name, email address, optional subject, message and the selected language) to answer your enquiry. You also receive an automatic confirmation at the address you entered. The same applies if you email me directly.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Providing the data is voluntary, but I can't reply without it.

Emails are sent via useSend, which I run myself on my server. useSend delivers messages through Amazon Simple Email Service (SES), provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. I use the AWS region eu-central-1 (Frankfurt). A data processing agreement under Art. 28 GDPR is in place with AWS. As AWS has a US parent company, access from the US cannot be entirely ruled out; AWS is certified under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses also apply.

I delete your enquiry once it has been fully dealt with, unless statutory retention periods apply (e.g. up to 6 or 10 years for business correspondence under German commercial and tax law).

7. Local storage (language setting)

So the site appears in your chosen language next time, I store that setting (“de” or “en”) in your browser's local storage (localStorage, key “portfolio-locale”). The value is never sent to me and contains no personal data. Storing it is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

8. Links to other websites

This site links to client projects and my profiles on GitHub, LinkedIn, Instagram and X. These are plain links, not embedded content: no data is transferred until you click one. From then on, that provider's privacy policy applies.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). An informal email to [email protected] is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

No automated decision-making or profiling takes place.