Home

Privacy policy

Last updated: 8 October 2026

1. Controller

Max Polwin

Postal address and phone number: see the legal notice.
Email: moin@maxpolwin.com

I am not required to appoint a data protection officer.

2. Overview

This website runs no analytics or tracking tools and loads no scripts, fonts or embedded content from third parties. The fonts are hosted on this site’s own server. It sets no cookies and stores nothing on your device. Personal data is processed in two cases only: when the hosting provider delivers the pages, and when you contact me.

3. Hosting and server log files

This website is hosted by Netlify, Inc., San Francisco, USA. When you visit it, Netlify automatically records the following data in server log files:

  • IP address
  • date and time of the request
  • requested page (URL)
  • referrer URL
  • browser and operating system (user agent)

Purpose: delivering the website and keeping it stable and secure, for example against attacks.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is a reliable and secure website.

Recipient: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA, processes the data on my behalf as a processor (Art. 28 GDPR). The basis is Netlify’s data processing agreement, which forms part of Netlify’s terms of service. Netlify uses further sub-processors and publishes the current list in its Trust Center.

Transfer to a third country: Netlify is based in the USA. Netlify is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Where the adequacy decision does not apply, Netlify’s data processing agreement provides for the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR). The list of certified companies is available at dataprivacyframework.gov.

Storage period: Netlify keeps the log files only as long as needed for the purposes above. According to Netlify’s data processing agreement, its logs are retained online for 90 days and offline for one year. Netlify shows me aggregated statistics from these logs, such as the number of requests, errors and data volume. I do not use them to identify visitors and do not combine the log files with other data.

4. Language selection

Your browser sends its preferred language with every request. When you open the address maxpolwin.com without a language path, Netlify uses this information to forward you to the German, Spanish or, by default, English version. I do not store it. You can switch languages at any time with the links in the footer. Your choice is reflected in the address (/de/, /en/, /es/) and is not stored on your device.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is presenting the site in your language.

5. Contact by email or phone

If you contact me by email or phone, I process the data you provide (such as name, email address, phone number and the content of your message) to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract or to steps prior to entering into one. Otherwise Art. 6(1)(f) GDPR. My legitimate interest is answering your request.

Recipient: Emails reach me through the email service Proton Mail of Proton AG, Switzerland, which processes them on my behalf. Switzerland has an adequacy decision of the European Commission (Art. 45 GDPR).

Storage period: I delete your data once your request has been fully dealt with, unless statutory retention obligations apply. Business correspondence must be kept for six years and records relevant to accounting for up to eight years (§ 147 German Fiscal Code).

This website links to my LinkedIn profile. No data is sent to LinkedIn when you load a page. Data is only transferred if you click the link. Your browser then tells LinkedIn that you came from this website, and LinkedIn’s privacy policy applies.

7. Your rights

Under the GDPR you have the right to:

  • access your personal data (Art. 15 GDPR)
  • have inaccurate data rectified (Art. 16 GDPR)
  • have your data erased (Art. 17 GDPR)
  • restrict processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing (Art. 21 GDPR, see section 8)

To exercise these rights, contact me using the details in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for me is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163, 65021 Wiesbaden, Germany
datenschutz.hessen.de

8. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). If you object, I will no longer process your data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to the contact details in section 1 is sufficient.

9. Further information

You are not obliged by law or contract to provide personal data. Without the server log data, however, the website cannot be delivered. I do not use automated decision-making or profiling (Art. 22 GDPR).

I will update this notice if the website or the legal requirements change. The current version is always available on this page.