Privacy

Controller

The controller under the GDPR is Robin Thüs, Düsseldorf, Germany, email: hello@thues.eu.

Hosting at Vercel

This site runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open the site, Vercel processes technically necessary data such as your IP address, the requested address, the time and your browser’s user agent. This is needed to deliver the site and protect it from attacks. Server logs are kept only for a short time.

Vercel is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in running the site safely and fast.

The domain thues.eu and its DNS are at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. DNS only answers at which address the site can be reached. Your page views do not go through Hetzner.

Analytics

To understand how the site is used, I count page views and some clicks (for example on the contact buttons and on links to other sites). For this I use rt-analytics, my own open source tool, without any third-party analytics service.

It records the page you open, the page you came from, campaign parameters in the link (utm), browser, operating system, device type, window size, country (from the IP address), sessions, page load times (Web Vitals), script errors and your choice in the consent notice.

Without consent nothing is stored in your browser. Your IP address is not stored. The server combines IP address and user agent with a secret value into an ID that changes every day, so visits on different days cannot be linked. The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in improving the site. If you click Decline, your browser only stores that choice (rta_consent in localStorage), so the notice doesn’t come back. Visits are then counted as without a choice.

With consent, that is when you click Accept, your browser stores your choice and a random visitor ID (rta_consent and rta_vid in localStorage) and details of the current session (rta_sid and rta_sla in sessionStorage). This lets me recognize you on later visits. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it here at any time. Then the visitor ID and session details are deleted from your browser, and your choice stays stored as "declined".

The data is stored in Google Cloud BigQuery in the EU. Google Cloud EMEA Limited (Ireland) processes it on my behalf under a data processing agreement. I delete it when I no longer need it for analysis. You can object to the analytics without consent at any time (Art. 21 GDPR), an email is enough.

Cookies and browser storage

There is at most one cookie: NEXT_LOCALE. It only stores the language you chose (English or German) if it differs from your browser’s language setting, and it is deleted when you close the browser. It is technically necessary to keep the site in your language (§ 25 (2) no. 2 TDDDG). If you pick “Light” or “Dark” in the color theme switch at the top, your browser stores that choice (theme in localStorage). Picking “System” deletes it. This is also technically necessary to keep your choice (§ 25 (2) no. 2 TDDDG). What analytics stores in localStorage and sessionStorage is described under Analytics.

Fonts and images come from this site’s own server, not from Google or other providers. Links to LinkedIn, GitHub or other sites only load something from there when you click them.

When you write to me

Emails to thues.eu are received by Hetzner Online GmbH in Germany and forwarded from there to my mailbox at Google (Gmail). Google is certified under the EU-US Data Privacy Framework. I use your message only to reply and delete it when it is no longer needed. The legal basis is Art. 6 (1) (b) GDPR when it is about working together, otherwise Art. 6 (1) (f) GDPR.

Your rights

You have the right to access, correction, deletion, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). An email is enough.

You can also complain to a data protection authority, for example the State Commissioner for Data Protection and Freedom of Information NRW.