Privacy policy

1. Controller

This privacy policy explains how personal data is processed when you visit this website, when you contact me by email or telephone, and when I handle project offers. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dominik Schott
An der Trave 90
23795 Bad Segeberg
Germany
Email: contact@dominik-schott.com

2. Provision and hosting of the website

This website provides information about my services as a systems engineer. It consists of static pages and is delivered via the Cloudflare Workers service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

The data arising when a page is requested must be processed in order to deliver the website to your device and to ensure its security and stability, for example to defend against attacks and abusive access. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in operating this website securely and reliably.

In doing so, Cloudflare acts on my behalf on the basis of a data processing agreement under Art. 28 GDPR. Where Cloudflare additionally processes connection and security data for its own purposes, in particular to protect and improve its own network, Cloudflare is itself the controller for that processing. Further details are set out in Cloudflare's privacy policy.

3. Technical connection and security data

Each time a page is requested, your browser transmits technically necessary connection data, which Cloudflare processes in order to deliver the pages. This includes in particular your IP address, the date and time of the request, the address requested, information about your browser and operating system and, where applicable, the page previously visited.

I do not analyse the usage behaviour of individual visitors and do not keep logs of my own about visits to this website. In my hosting account I see aggregated operational figures such as the number of requests and, where Cloudflare checks or blocks requests for security reasons, information about those events.

According to the provider, the retention period at Cloudflare depends on how long the data is needed for the respective purpose and to comply with legal requirements. Cloudflare does not state a fixed retention period that applies uniformly to this website.

4. Cookies and access to your device

The code of this website contains no analytics, marketing or tracking tools, no contact forms, no externally loaded fonts and no embedded third-party content such as maps, videos or social media elements. It sets no cookies and stores no information in your browser's storage (local storage, session storage).

As the hosting service, Cloudflare may set technically necessary cookies in individual cases, for example when a security check is triggered to protect against automated or abusive access. According to Cloudflare, such cookies serve to deliver the website securely and are not used for analytics or advertising purposes. The legal basis is Section 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act (§ 25 Abs. 2 Nr. 2 TDDDG) in conjunction with Art. 6(1)(f) GDPR.

5. Contact by email and telephone

If you send me an email, I process your email address, your name, the content of your message including attachments, and the technical details of the email, for example date, time and transmission route. I use this data to handle your enquiry and to clarify follow-up questions. If you call me, I process your telephone number and the information you give me for the same purposes. Providing your data is voluntary; without it I cannot respond to your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at entering into or performing a contract with you. Otherwise, in particular where you write as the contact person of a company, the legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in handling business enquiries and in communicating with prospective clients and business partners.

The email service for my business addresses is operated by Migadu-Mail GmbH, Rohnen 587, 9414 Schachen, Switzerland, as a processor. According to the provider, the servers are located in France. I retrieve messages using email programs on my own devices; local copies and backup copies may be created there in the process. Further details are set out in Migadu's privacy information.

6. Project alerts and project offers

I have subscribed to automatic alerts about new projects from selected project platforms and project intermediaries. These arrive in my business mailbox at Migadu (section 5) and are filed there separately from other correspondence.

The alerts generally contain only project descriptions and links. In individual cases, they or the linked project descriptions may contain details of contact persons, for example name, role, telephone number and business email address. In that case I do not obtain this data from the data subject directly, but from the respective project platform or project intermediary. I use details from linked project descriptions only if I pursue an offer.

I process this data in order to assess project offers and, where appropriate, to make contact. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in handling project offers for my freelance work. Where I do not obtain personal contact data directly from the data subjects, I provide the required information under Art. 14 GDPR within the applicable statutory time limits, unless a statutory exception applies. You may object to this processing (section 10). Sections 7 and 8 apply to recipients and retention.

7. Recipients and transfers to third countries

The recipients of your data are the following service providers. Beyond that, I pass on your data only where this is necessary to handle your request or where I am legally obliged to do so.

• Cloudflare, Inc. (USA) for providing the website (sections 2 to 4). Cloudflare operates a global network; data may therefore also be processed outside the European Union and the European Economic Area, in particular in the USA. According to its own statements, Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). For transfers not covered by it, Cloudflare's data processing addendum provides for the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• Migadu-Mail GmbH (Switzerland) for the email service (sections 5 and 6). An adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR).
• Telefónica Germany GmbH & Co. OHG (O2) as the provider of my telephone connection. It conveys calls as a telecommunications provider under its own responsibility.

8. Retention period and deletion

The following criteria apply to emails, enquiries and project offers:

• I delete general enquiries that do not lead to a business relationship as soon as the matter has been dealt with and, given the content of the enquiry, no further questions are to be expected.
• I delete project alerts and project offers that I do not pursue, or that are evidently no longer current, as part of my regular manual review, unless there is another reason for retaining them.
• I store correspondence relating to the initiation of a business relationship for as long as the initiation is ongoing. If no engagement results, I delete it once the matter has been concluded, unless a statutory retention obligation applies.
• I store correspondence arising from an engagement for its duration and thereafter to the extent that statutory retention obligations apply.
• Statutory retention obligations apply only to documents that are actually subject to retention. They arise in particular from Section 147 of the German Fiscal Code (§ 147 Abgabenordnung): I retain business letters, i.e. correspondence concerning the preparation, performance or reversal of a transaction, for at least six years, and accounting vouchers such as invoices for at least eight years. The period begins at the end of the calendar year in which the document was created, received or sent; it may be extended for as long as the documents remain relevant for taxation. In this respect the legal basis is Art. 6(1)(c) GDPR.

I regularly review manually whether these conditions have ceased to apply. I then delete data I no longer need in the mailbox at Migadu and in the copies on my devices. No automatic deletion after fixed periods has been set up.

Deleted data may still be contained in local backup copies of my devices and in the email provider's backups until the respective backup is overwritten or deleted.

9. External links

This website contains links to external websites, in particular to my LinkedIn profile. These are ordinary links; content from these providers is not embedded in this website. A connection to the respective provider is established only when you click a link. The respective provider is responsible for the processing that takes place there.

10. Your rights

Subject to the statutory requirements, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR): Where I process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. I will then no longer process your data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to the address given in section 1 is sufficient.

11. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for me is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, the data protection authority of the German state of Schleswig-Holstein, Postfach 71 16, 24171 Kiel, email: mail@datenschutzzentrum.de.