Privacy Policy

1. Controller

The controller responsible for data processing on this public portfolio website within the meaning of the General Data Protection Regulation (GDPR) is:

Julian Schmahl
Am Birkenwäldchen 29
25469 Halstenbek
Germany
color@julianschmahl.com
+49 178 8920411

2. Scope

This policy applies to the public portfolio at julianschmahl.com. It does not govern separate services or platforms that may be made available on other subdomains and that provide their own privacy information.

3. Hosting, delivery and server logs

This website is delivered through Cloudflare. When you visit the website, Cloudflare and the web server process technically necessary connection data, such as your IP address, the requested page or file, the date and time of access, browser and device information, referrer URL and HTTP status information. This processing is necessary to deliver the website reliably, protect it from attacks and diagnose technical faults.

The legal basis is Article 6(1)(f) GDPR; the legitimate interests are the secure and reliable provision of this website. Cloudflare operates a global network, so processing may also take place outside the European Economic Area. Where this involves a transfer to a third country, appropriate safeguards are used as required by applicable law. Further information is available in Cloudflare’s Privacy Policy.

4. Cookies and similar technologies

This public portfolio does not use advertising or marketing cookies. Cloudflare may use strictly necessary technical security measures where required to protect the service or process a request. Such measures are used only for technical operation and security.

5. Cloudflare Web Analytics

I use Cloudflare Web Analytics to understand the technical performance and use of this website. The service is configured to exclude visitors connecting through data centres in the EU/EEA, so the Real User Monitoring (RUM) beacon does not run for those visitors. For visitors outside this excluded region, the RUM beacon processes performance data from the browser’s in-memory performance APIs, including the page and referring URL, a page-load identifier, browser and device categories, country-level information, and page-load and Core Web Vitals metrics. The information is used in aggregated reports to improve the reliability and performance of this website.

According to Cloudflare, the RUM beacon does not store data in, or access data from, cookies, local storage, session storage or other browser storage. Cloudflare receives the source IP address as part of normal HTTP handling, but states that it discards it at the nearest data centre and does not store it in core databases or logs. The legal basis for the analytics processing is Article 6(1)(f) GDPR; my legitimate interest is to operate and improve the performance and usability of this website. Further details are available in Cloudflare’s RUM documentation.

6. Contact by email or telephone

If you contact me by email or telephone, I process the information you provide in order to respond to and handle your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Article 6(1)(f) GDPR based on the legitimate interest in responding to business enquiries. I retain the correspondence only for as long as necessary to handle the enquiry and, where applicable, to comply with statutory retention obligations.

7. External links

This website contains links to external websites, for example Instagram or project-related links. A connection to the external provider is established only after you actively click a link. The external provider is then responsible for its own data processing. Please consult the privacy information of that provider.

8. Fonts and media

This public website uses system fonts supplied with your device and does not load fonts from Google Fonts or another external font service. Portfolio media is delivered from the same website infrastructure; no third-party video player or media analytics service is embedded on this public website.

9. Recipients and retention

Access to personal data is limited to me and to service providers that are necessary for operating the website or handling an enquiry. Data is kept only for as long as needed for the stated purposes or, where applicable, to meet statutory retention obligations.

10. Your rights

Subject to the conditions set out in the GDPR, you have the right to request access to, rectification or erasure of your personal data; restriction of processing; data portability; and to object to processing based on Article 6(1)(f) GDPR. Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for the controller is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein.

11. Updates to this policy

I may update this policy when the website, legal requirements or the way personal data is processed changes. The current version is always available on this page.