Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection law is:

I am not required to appoint a data protection officer.

2. General information

Scope

I process personal data only as far as it is needed to provide a working website and to answer messages. I do not ask for consent, because nothing on this website needs it.

Legal bases

Where processing serves to take steps prior to entering into a contract or to perform one, the legal basis is Art. 6(1)(b) GDPR; where it is required by a legal obligation, Art. 6(1)(c) GDPR; where it is necessary for my legitimate interests and your interests, fundamental rights and freedoms do not override them, Art. 6(1)(f) GDPR.

Erasure and storage period

Personal data is deleted or blocked as soon as the purpose for which it was stored no longer applies. It is kept longer only where European or German law requires it; it is then deleted when that retention period ends.

3. Providing the website and log files

Data

This website is hosted and delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”), through its content delivery network. Every time you open a page, your browser sends a request to Cloudflare’s servers, which automatically process:

• your IP address,
• date and time of the request,
• the page or file requested, the HTTP status and the amount of data transferred,
• the page you came from (referrer), if your browser sends it,
• browser type and version, operating system and language setting (user agent).

This data is not combined with other personal data.

Purpose and legal basis

Your IP address has to be processed to deliver the website to your device at all. The other data serves to keep the website working and secure, for example against denial-of-service attacks and other misuse. It is not used for marketing. In these purposes lies my legitimate interest; the legal basis is Art. 6(1)(f) GDPR. In my Cloudflare account I see statistics on the requests and, for requests that Cloudflare blocks as attacks, details such as the IP address; I use them only for the security of the website.

Storage period

The data is deleted as soon as it is no longer needed for these purposes: for delivering the page when the request has been answered; log data is deleted or anonymised by Cloudflare after a short time, as set out in its privacy policy.

Objection

Processing this data is strictly necessary to operate the website, so there is no way to object to it while using the website.

No identification (Art. 11 GDPR)

I cannot link this connection data, nor the reports in section 4, to a person: it does not tell me who you are, and I have no access to individual log entries at Cloudflare. I do not collect additional information in order to identify you. For this data, the rights under Art. 15 to 20 GDPR therefore apply only if you provide me with information that enables me to identify you in it (Art. 11(2) GDPR).

Processor and transfer to third countries

Cloudflare processes the data on my behalf under a data processing agreement (Art. 28 GDPR). It may process data on servers outside the European Union, in particular in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, the data processing agreement contains the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More in Cloudflare’s privacy policy: cloudflare.com/privacypolicy (opens in a new tab).

4. Reports of failed connections (Network Error Logging)

Data

With each response, Cloudflare asks your browser to report connections to this website that fail. Your browser stores this short rule (not a cookie) and, only if a connection actually fails, sends Cloudflare a report with the type of error, the address requested, the time and your IP address. Successful visits are not reported.

Purpose and legal basis

The reports help to detect and fix faults in the delivery of the website. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in a reliable website; storing the rule in your browser is strictly necessary for it (§ 25(2) no. 2 TDDDG).

Storage period and removal

The rule expires in your browser after seven days unless it is renewed by a further visit. You can remove it at any time by deleting this website’s data in your browser settings.

5. Contact by email

Data

If you write to me by email, I process your email address, your name if given, the content of your message including any attachments, and its technical metadata (such as date and time).

Purpose and legal basis

I use this data only to deal with your message and to answer it. If your message concerns a job or a project, the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract); otherwise it is Art. 6(1)(f) GDPR, my legitimate interest in answering enquiries.

Recipients

Emails to contact@jensleuschner.com are received by Cloudflare Email Routing (Cloudflare, see section 3), which forwards them to my mailbox without keeping their content. My mailbox is Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), where your message is stored. Google may also process the data on servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). More in Google’s privacy policy: policies.google.com/privacy (opens in a new tab). The legal basis for receiving your message through these services is Art. 6(1)(f) GDPR, my legitimate interest in reliable email. I do not pass your data on to anyone else.

Storage period

I delete your message once the conversation has ended, that is, when the circumstances show that the matter has been settled, unless statutory retention periods apply (for example for business correspondence).

Objection

You can object to the storage of your data at any time by email. The conversation cannot then be continued, and all data stored in the course of it will be deleted.

6. Cookies, tracking and storage in your browser

This website does not set cookies and, apart from the rule described in section 4, stores nothing in your browser. It uses no analytics, tracking or advertising services and creates no user profiles. The animations run entirely in your browser.

7. Links to other websites

This website links to my profiles on GitHub and LinkedIn and to a publication on IEEE Xplore. These are plain links: no data is sent to these services when you open my website. Only if you follow a link does your browser connect to the other website, whose operator is then responsible for the processing of your data; please see their privacy policies.

8. Encryption

The website is delivered only over an encrypted connection (HTTPS/TLS), so that data on the way between your browser and the server cannot be read by third parties.

9. Your rights

If I process personal data about you, you are a data subject within the meaning of the GDPR and have the following rights. To exercise them, an email to contact@jensleuschner.com is enough. For the connection data of sections 3 and 4, please note what section 3 says on identification.

Access (Art. 15 GDPR)

You can ask me to confirm whether I process personal data about you and, if so, for access to it and to information on the purposes, the categories of data, the recipients, the planned storage period or the criteria for it, your rights, the source of the data, and whether it is transferred to a third country and with which safeguards.

Rectification (Art. 16 GDPR)

You can ask me to correct inaccurate data or to complete incomplete data without delay.

Restriction of processing (Art. 18 GDPR)

You can ask me to restrict the processing of your data, for example while its accuracy is being checked, if the processing is unlawful but you do not want the data erased, if you need it for legal claims, or while it is being determined whether your objection prevails.

Erasure (Art. 17 GDPR)

You can ask me to erase your data without delay, in particular if it is no longer needed for its purpose, if you object and there are no overriding legitimate grounds, or if it has been processed unlawfully, unless it is still needed to comply with a legal obligation or for legal claims.

Notification (Art. 19 GDPR)

If your data has been rectified, erased or restricted, I inform everyone to whom it was disclosed, unless this proves impossible or involves disproportionate effort, and tell you who they are on request.

Data portability (Art. 20 GDPR)

You can receive data you have provided to me, where it is processed by automated means on the basis of a contract, in a structured, commonly used and machine-readable format, or have it transmitted to another controller where technically feasible.

Right to object (Art. 21 GDPR)

Where I process your data on the basis of my legitimate interests (Art. 6(1)(f) GDPR), you may object at any time, on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Automated decisions (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects on you or similarly significantly affects you. I make no such decisions.

Complaint to a supervisory authority (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the GDPR, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for me is the Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany, datenschutz.sachsen.de (opens in a new tab).

10. No obligation to provide data

You are not obliged to provide any personal data. You can read this website without doing so; only your IP address has to be processed to deliver it (section 3).