Privacy

Damjan Savić, Overather Straße 64, 51429 Bergisch Gladbach, Germany. Email: info@damjan-savic.com, phone: +49 175 695 0979.

No data protection officer has to be appointed: the conditions of Art. 37 GDPR and § 38 BDSG are not met here.

When you request this site, the server processes technically necessary access data. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure, reliable operation and the defence against attacks.

• IP address
• date and time of the request
• requested address
• HTTP status code and volume of data transferred
• browser type and operating system

Log files are deleted after 7 days. They are kept longer only where a specific incident — an attempted attack, say — makes the entries concerned necessary until the matter is resolved.

This data is not combined with any other source, and no profile is built from it.

Three entries; this site puts nothing else on your device. All three are necessary to operate it and are therefore exempt from consent under § 25(2)(2) TDDDG. None of them builds a profile, and apart from the first none is sent to the server.

• NEXT_LOCALE — cookie, session lifetime. Remembers the language you chose so the home page does not put you back into another one.
• ds-theme — local storage. Light or dark mode. Stays until you clear it.
• ds-consent — local storage. Your answer on the consent card, with a timestamp. Stays until withdrawn.

On your first visit a card appears at the bottom of the screen asking exactly one question: whether external media may be loaded. Refusing is as quick as agreeing — both answers are buttons of the same size in the same row, nothing is pre-selected, and the page stays fully readable either way. “Necessary only” is not a postponement: without your agreement the YouTube player is loaded on no page, not even on a click.

Your answer is stored in the browser with a timestamp (ds-consent) so the question is not repeated on every page. It is not sent to the server.

You can change it at any time through “Privacy settings” in the footer — on every page, in one click. Withdrawing is therefore exactly as easy as giving, which is what Art. 7(3) GDPR requires.

Some articles open with a video. As long as you have not agreed to external media, all that is there is a still image served from this server. No connection to YouTube is made — no script, no cookie, no transfer of your IP address. A click on the play surface makes no connection either: it opens the privacy settings. Under every still is a line saying what playing will do, so the decision is made before the click rather than after it.

Only after your consent does a click on the play surface load the player from youtube-nocookie.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives your IP address along with browser and device details. In this variant YouTube sets no advertising cookies, but does store technical playback details. Inside its own frame the player fetches further files from Google servers — fonts from fonts.gstatic.com, the preview image from i.ytimg.com and the video stream itself from googlevideo.com, among others.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG — given on the consent card or in the privacy settings, and withdrawable there at any time. A withdrawal closes a player that is already open, at once.

Google may transfer data to the USA. Google LLC is certified under the EU–US Data Privacy Framework, so the transfer rests on the European Commission’s adequacy decision of 10 July 2023 under Art. 45 GDPR. The details are in the Google privacy policy.

If you would rather not load the video on this page at all, there is an ordinary link to YouTube under every still. It fetches nothing; it takes you there when you click it.

If you use the contact form, the details you enter — name, email address, optionally the company, the selected topic, your project description and the answer about existing systems — are processed in order to answer your enquiry.

The legal basis is Art. 6(1)(b) GDPR where the enquiry is part of the run-up to a contract. For every other enquiry it is Art. 6(1)(f) GDPR; the legitimate interest is answering a message that was addressed to me.

Providing the data is neither required by law nor by contract. You are under no obligation to provide it. The only consequence of withholding it is that I cannot answer the enquiry.

The data is stored in a PostgreSQL database on a server in the European Union and deleted once the correspondence is complete, unless statutory retention periods apply — for business correspondence those are the periods in § 257 HGB and § 147 AO.

To guard against automated submissions the form checks a field invisible to humans and the time between page load and submission. No external captcha service is used.

The number of submissions is also limited: five per hour at most. What is stored for that is not your IP address but a SHA-256 hash of it, formed with a secret held only on the server. The address itself is never written, the hash cannot be reversed without that secret, and the entries are deleted after two hours. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is protecting a publicly reachable form that writes to a database.

The imprint and the contact page carry an e-mail address and a telephone number. If you write or call, I process what that produces — sender address, name, subject and content, and on a call the number transmitted — in order to answer. The legal basis is Art. 6(1)(b) GDPR where the enquiry is about entering into a contract, and Art. 6(1)(f) GDPR otherwise; the legitimate interest is answering a message addressed to me.

The mailbox behind that address does not sit on this website's server. It is run by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, which is therefore a processor under Art. 28 GDPR for e-mail correspondence; the agreement covering it is part of the contract with them.

E-mail in transit is only as secure as the servers it passes through. For anything confidential the form above is the better route, and a phone call is always available.

Deletion follows the same rule as the form: correspondence is deleted once it is closed and no statutory retention period stands against it.

The search processes your query on this server against an index built when the site was built. The query is not stored permanently and is not linked to a person. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is a search that returns useful results.

Search uses only a locally generated lexical index (BM25). No external AI or embedding service is integrated, and no search query leaves this server.

What you type travels in the body of the request, not in its address. That is what the second sentence above rests on: whatever stands in the address is written to the server's access log line, next to your IP address, until that line is deleted after 7 days. You can see it in your browser's developer tools — the request to /api/search is a POST, and its address does not contain your search term.

All fonts are served from this server. There is no connection to Google Fonts or any other external provider. No maps, social media plugins, advertising networks or external analytics tools are embedded. Apart from the YouTube player described above, this site loads no content from any third-party server.

There is no audience measurement. This site contains no analytics tool — neither Google Analytics nor a self-hosted one — and the log files are not evaluated statistically either.

The site runs on a server in Germany. The infrastructure provider is netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe. A data processing agreement under Art. 28 GDPR is in place with them.

For e-mail correspondence IONOS SE, Elgendorfer Straße 57, 56410 Montabaur is the second one, under an Art. 28 GDPR agreement as well. There are no other recipients. Your data is not sold, not traded and not passed on for advertising. The only transfer to a third country is the YouTube player described above, and that happens only after your consent.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You have the right of access to the data held about you (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20 GDPR).

An informal message to info@damjan-savic.com is enough. I reply within one month.

Where data is processed on the basis of legitimate interests under Art. 6(1)(f) GDPR — here that is the server log files, the search and part of the contact enquiries — you have the right to object to that processing at any time on grounds relating to your particular situation.

After an objection the data concerned will no longer be processed, unless there are compelling legitimate grounds which override your interests, or the processing serves to establish, exercise or defend legal claims. A message to info@damjan-savic.com is enough.

Any consent you have given — here: loading external media — can be withdrawn at any time with effect for the future and without any disadvantage to you. Withdrawal does not affect the lawfulness of processing carried out before it.

The way to do it is “Privacy settings” in the footer, on every page of this site.

Independently of the above, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement.

The competent authority here is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

The site is served over HTTPS only, with HTTP Strict Transport Security enabled, and a Content Security Policy restricts the browser’s connections to this server — with the single exception of the YouTube player, and that only after your consent.