Privacy Policy

Controller

The controller within the meaning of the GDPR is:

Bastian Schöntag
[Address]
Email: hello@bastian-schoentag.de

The short version

By default, this website runs without tracking: no analytics tools, no advertising cookies, no data shared with third parties — unless you explicitly consent. Personal data is processed only to the extent required to operate the website or to answer your enquiry.

Hosting and server log files

This website is hosted by: [hosting provider, address, server location]. When you visit the website, the server automatically processes technical access data: your device's IP address, date and time of access, the requested URL, the amount of data transferred, the referrer URL, and the browser and operating system identifier (user agent). This data is technically required to deliver the pages and to ensure stability, security and error analysis; it is not used to identify individual visitors and is not combined with other data sources.

The legal basis is Art. 6 (1) (f) GDPR — my legitimate interest in the secure and stable operation of the website. Server log files are deleted after [retention period, e.g. 14 days] unless a security-relevant incident requires longer retention. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

Fonts

This website uses self-hosted fonts only. No third-party fonts (e.g. Google Fonts) are loaded; no connection is made to third-party servers to load fonts.

Consent, cookies and local storage

Non-essential cookies and third-party services are only loaded after you agree via the consent banner (Art. 6 (1) (a) GDPR, § 25 (1) of the German TDDDG). Without your consent, no such tracking takes place.

The following categories are distinguished:

• Necessary: required for operation (§ 25 (2) no. 2 TDDDG); stores your language and consent choice in your browser's local storage (localStorage). This data never leaves your device.
• Analytics: No analytics service is currently integrated — no audience measurement takes place. Should a service be activated in the future, I will add the provider, purpose and retention period here before activation; even then, it will only load after your consent.
• Marketing: No marketing or CRM service is currently integrated. The same applies: provider, purpose and retention period will be added here before any activation, and nothing loads without your consent.

Your consent is voluntary and can be changed or withdrawn at any time with effect for the future via the "Privacy settings" link in the footer (Art. 7 (3) GDPR).

Contact by email

If you write to me by email, I process your email address and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at a contract (such as a project enquiry), and otherwise Art. 6 (1) (f) GDPR — my legitimate interest in answering enquiries. Correspondence is deleted once it is no longer required, provided no statutory retention obligations (e.g. under commercial or tax law) apply.

Your rights

With regard to your personal data, you have the following rights against me:

• Access to the data processed (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR),
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

An informal email to the address above is sufficient to exercise these rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example, the authority responsible for your place of residence or my registered office.

Version

This privacy policy is dated July 2026. I will update it when the website or the legal situation changes; the version published here applies.