1. Controller
Mikko Ristein
Große Wiese 4
22159 Hamburg, Germany
Email: [email protected]
Phone: +49 (0) 176 555 80 928
No data protection officer has been appointed, as none is required by law.
2. Overview
This website is a private project without advertising, without analytics or tracking services and without user accounts. Personal data is only processed as far as necessary to provide the site, the contact form, the advent calendar or – after your click – to play YouTube videos. The details are described below.
3. Hosting and Cloudflare
The website runs on our own server in Germany. All requests to page.ristein.eu and advent.ristein.eu are routed
through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Tunnel).
Cloudflare connects to the server, encrypts the connection (HTTPS) and protects the site against attacks. In doing
so, Cloudflare processes technically necessary connection data such as your IP address, the requested address, date
and time, browser type (user agent) and referrer. To protect against bots, Cloudflare may set technically necessary
cookies (e.g. __cf_bm, lifetime 30 minutes).
The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on this adequacy decision (Art. 45 GDPR). More information: Cloudflare privacy policy.
The web server itself does not keep access logs with IP addresses.
4. Cookies
This website only sets cookies that are technically required for the functions you use. No consent is needed for these (§ 25(2) no. 2 TDDDG); the legal basis for the related processing is Art. 6(1)(f) GDPR.
| Cookie | Purpose | Lifetime |
|---|---|---|
lang |
remembers the selected language (German/English) | 1 year |
advent |
remembers that today's door has been solved | until 2 a.m. the next day |
__cf_bm |
bot protection by Cloudflare (see section 3) | 30 minutes |
You can delete or block cookies in your browser at any time; the site keeps working but will not remember e.g. your language.
5. Contact form
If you use the contact form, we process the data you enter (name, email address, subject, message) to answer your request. The message is sent by email via the Gmail service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to our mailbox and stored there. Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework.
The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). The data is deleted once your request has been fully dealt with, unless statutory retention obligations apply. The same applies if you write to us by email directly.
6. Advent calendar
Answers in the advent calendar are checked in your browser. If you answered correctly, the answers you entered that day are sent to the server together with the date and time and stored there without your IP address or any other information about you, to evaluate how difficult the questions were. Your IP address is only used at the moment of the request to decide whether an unlock code is shown, and is neither logged nor stored. The legal basis is Art. 6(1)(f) GDPR.
7. YouTube videos
Some pages contain videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the page, no connection to YouTube is made – you only see a preview image that is stored on our own server.
Only when you click the preview image is the video loaded in privacy-enhanced mode from youtube-nocookie.com. Data
such as your IP address, device and browser information and the address of the page is then transmitted to Google;
YouTube may also store cookies or similar technologies on your device and, if you are logged in to your Google
account, link the view to your account. Google may also process data in the USA; Google is certified under the EU-US
Data Privacy Framework.
The legal basis is your consent given by clicking the video (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The consent only applies to that page view; without a click no data is transmitted. More information: Google privacy policy.
The links to my YouTube channel and playlists are plain links. Data is only transmitted when you click them and open YouTube.
8. Links to social networks
The footer contains links to Instagram, LinkedIn, Xing, GitHub and Discord. These are plain links, not embedded plugins: no data is transmitted to these providers when you visit this website. Only when you click a link does the privacy policy of the respective provider apply on the target page.
9. Fonts
The fonts used (Open Sans, Font Awesome) are stored on our own server. No connection is made to Google Fonts or other external font providers.
10. Your rights
You have the right of access to your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
For all requests, an email to [email protected] is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.
11. Changes
We update this privacy policy when the website or the legal situation changes. The version published here applies.