Privacy Policy

1. General Information

The protection of your personal data is important to me. I handle your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

This privacy policy explains which personal data is processed when you visit this website and use the contact form, for what purposes this occurs, and what rights you have.

Personal data is generally only processed to the extent necessary to provide this website, to communicate with you, to ensure technical security, or for statistical analysis and improvement of the website.

2. Data Controller

The controller responsible for the processing of personal data on this website is:

Marius Kalder

Obere Nußbreite 2 · 37688 Beverungen · Germany

Email: imprint@mariuskalder.de

3. Hosting and Technical Provision

This website is hosted on a self-managed virtual private server (VPS).

The technical infrastructure consists in particular of:

Nginx as web server and reverse proxy
Node.js / Express as backend
PostgreSQL as database
HTTPS/TLS for encrypted transmission

The server is located at:

Hostinger Server location: Netherlands

To the extent the VPS provider processes personal data on my behalf as part of hosting, this is done on the basis of a corresponding data processing agreement pursuant to Art. 28 GDPR, insofar as such an agreement is required.

4. Website Access and Server Log Files

Every time this website is accessed, technically required information is processed by the web server (Nginx).

This includes in particular:

IP address of the accessing device
date and time of access
requested URL or resource
HTTP status code
amount of data transferred
technical information about the browser and operating system used
referrer information, where applicable

This data is processed by the web server in order to technically provide the website, ensure the stability and security of the system, and detect or defend against misuse.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest lies in the secure, stable, and technically reliable provision of the website as well as the protection of the technical infrastructure used.

Retention period: Server log files are automatically deleted after 7 days (daily rotation, 6 archived files plus the currently active file), unless exceptionally required for longer in order to investigate a security-related incident.

5. Encrypted Transmission

For security reasons, this website uses TLS encryption.

You can recognize an encrypted connection by the use of "https://" in your browser's address bar and the padlock symbol. Encryption serves to protect transmitted content from access by third parties.

6. Web Analytics

This website uses a self-developed, data-minimizing web analytics solution.

The purpose of the web analytics is to statistically evaluate the use of the website and to improve the website, its content, and its user experience. The analytics runs on my own technical infrastructure. No third-party services such as Google Analytics or comparable external tracking tools are used.

Data Collected

Certain interactions with the website result in the following data being transmitted to my own server and stored in a PostgreSQL database:

event type, e.g. pageview, contact_click, project_click, cv_click, send_click, project_detail_click, email_click, linkedin_click, github_click, or home_click
the path visited on the website
a client-side timestamp of the event
the browser's language setting
screen width
screen height
a randomly generated, server-side event ID
a server-side timestamp of processing

No browser identifier (User-Agent) and no referrer information is collected or stored for the purposes of web analytics.

A random technical event ID is generated on the server for each event. No session ID and no persistent user identifier is used for the web analytics. As a result, events cannot be linked to a user profile or a coherent visitor session via an analytics identifier. The event types collected are limited to a fixed, predefined list; free-text input does not occur.

No Cookies or Browser Identifiers for Analytics

For the purposes of web analytics:

no analytics cookies are set,
no persistent analytics identifier is stored in the browser,
no local storage is used,
no session storage is used for analytics purposes,
no comparable persistent identifier is used to recognize returning visitors.

The web analytics serves exclusively for the statistical evaluation of individual events.

No Transfer to Third Parties

Analytics data is not transferred to external analytics, advertising, or tracking providers. The data is processed on my own server and stored in my own PostgreSQL database.

Legal Basis

Processing is carried out on the basis of Art. 6(1)(f) GDPR. My legitimate interest lies in statistically evaluating the use of my website in order to improve its content, technical functionality, and user experience. In designing the web analytics, care was taken to process as little data as possible and, in particular, not to use any persistent user identifier or session ID.

Retention Period

Stored analytics events are automatically deleted after 90 days. Deletion is carried out by a daily, server-side database job.

7. Contact Form

This website offers the option of contacting me via a contact form.

If you use the contact form, the data you enter is processed. This includes in particular:

name
email address
content of your message
any other information voluntarily provided

Processing is carried out exclusively for the purpose of handling and responding to your inquiry.

Legal basis: Art. 6(1)(b) GDPR, insofar as the contact serves to carry out pre-contractual measures or relates to an existing contractual relationship. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR. My legitimate interest lies in processing and responding to inquiries.

Data submitted via the contact form is not used for advertising purposes.

Retention Period

Contact inquiries are automatically deleted 14 days after receipt. This period applies regardless of the current status of the inquiry. Should a contact request lead to a further business relationship, the relevant data is processed separately, outside the contact-form data set, in accordance with the retention obligations applicable to that relationship. Statutory retention obligations remain unaffected.

8. Email Communication

If you contact me by email, the personal data you transmit is processed to the extent necessary to handle your inquiry.

This includes in particular:

email address
name, if provided
content of the message
any other information you transmit

Processing is carried out on the basis of Art. 6(1)(b) GDPR, insofar as the inquiry relates to a contract or pre-contractual measures. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR.

The data is deleted once communication has concluded and no statutory retention obligations or other legitimate reasons for further storage exist.

9. Theme Setting (Local Storage)

This website offers the option of switching between a light and a dark display mode.

Your selection is stored exclusively locally in your browser (local storage) in order to retain your setting on a future visit. This data is not transmitted to my server and is not accessed or evaluated by me.

Storage is carried out pursuant to Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary to provide the service you explicitly requested (theme switching). Consent is not required for this.

You can remove the stored value at any time via your browser's developer tools or by clearing your browser's website data.

10. Social Media Links

This website may contain links to my profiles on social networks or professional platforms.

These are ordinary external links only. Simply visiting this website does not embed or automatically load any social media content from these platforms.

Data is only transmitted to the respective social network once you click the corresponding external link and visit the linked website. The respective operators' privacy policies apply to the processing of personal data on the platforms subsequently visited.

This website does not use social media plugins, like buttons, or comparable embedded tracking components.

11. Recipients of Personal Data

Personal data is generally only transmitted to third parties to the extent necessary for the technical provision of the website, communication with you, compliance with legal obligations, or the purposes described in this privacy policy.

In the context of technical operations, the following categories of recipients may be relevant in particular:

hosting / VPS provider
technical service providers, insofar as they are engaged in operating the infrastructure
email / mail server service providers, where applicable

The web analytics itself runs on my own technical infrastructure. Analytics data is not transferred to external analytics or advertising providers.

12. Data Transfers to Third Countries

Insofar as personal data is transferred to recipients outside the European Union or the European Economic Area in connection with the use of this website, this only occurs in compliance with the statutory requirements of Art. 44 et seq. GDPR.

Such a transfer does not occur, in particular, in connection with the web analytics operated by me.

13. Retention Periods at a Glance

Personal data is only stored for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Data Category	Purpose	Retention Period	Deletion Mechanism
Server log files (Nginx)	Security and technical operation	7 days	automated log rotation
Analytics events	Statistical web analytics	90 days	automated daily database job
Contact inquiries	Communication	14 days	automated daily database job
Theme setting	Display preference	until manually deleted by the user	local in browser, no server access
Business / contractual records	Statutory obligations	in accordance with statutory retention periods	manual

Once the respective retention period has expired, data is deleted, unless statutory retention obligations or other legal grounds require further storage.

14. No Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place in connection with this website. In particular, no individual user profile is created from the analytics data.

15. Your Rights

Subject to the statutory requirements, you have the following rights:

Right of Access

You have the right to request confirmation as to whether personal data concerning you is being processed, and if so, to obtain information about that data.

Right to Rectification

You have the right to request the correction of inaccurate personal data and, where applicable, the completion of incomplete data.

Right to Erasure

Subject to the statutory requirements, you have the right to request the deletion of your personal data.

Right to Restriction of Processing

Subject to the statutory requirements, you have the right to request the restriction of the processing of your personal data.

Right to Data Portability

Subject to the statutory requirements, you have the right to receive personal data you have provided in a structured, commonly used, machine-readable format, or to request that it be transmitted to another controller.

Right to Object

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data where that processing is based on Art. 6(1)(e) or (f) GDPR. This applies in particular to the web analytics and the server log files, both of which are based on Art. 6(1)(f) GDPR.

16. Withdrawal of Consent

Insofar as processing is based on your consent pursuant to Art. 6(1)(a) GDPR, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent up until withdrawal remains unaffected.

17. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. This right may be exercised in particular with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

18. Requirement to Provide Personal Data

The provision of personal data is generally voluntary. However, certain technical data is processed automatically to the extent technically necessary to provide and secure the website. Using the contact form requires the information needed to process and respond to your inquiry.

19. Changes to this Privacy Policy

I reserve the right to amend this privacy policy where the technical implementation of the website, the services used, or legal requirements change. The version published on this website at any given time applies.

Last updated: September 25, 2026