Controller
Patrik Kluge, trading as APPIKRothemühleweg 35A
38112 Braunschweig
Germany
Email: privacy@appik.net
The controller determines the purposes and means of the processing described in this notice. Provider information is available in the imprint.
Hosting and server logs
The site is hosted on infrastructure in Germany provided by Hetzner Online GmbH. The web server processes connection data needed to deliver and protect the site.
Log data can include the IP address, date and time, requested URL, HTTP method and status, referrer, and browser or device information.
Processing is used to deliver the site, investigate errors, defend against abuse, and maintain the confidentiality, integrity, and availability of the service.
The legal basis is Article 6(1)(f) GDPR. The legitimate interests are secure, reliable, and abuse-resistant website operation.
Access logs are automatically rotated and retained for no longer than 14 days, unless a specific security incident requires evidence to be kept longer.
Contact form and email
When you contact me, the site processes the information you provide, including your name, email address, inquiry type, message, and the technical submission time. You receive an automatic confirmation email at the address you entered. Your IP address is held briefly in memory for rate limiting and abuse prevention.
The data is used only to deliver, review, and respond to your message and to protect the contact channel against misuse.
The legal basis is Article 6(1)(b) GDPR where the message concerns a contract or pre-contractual steps, and otherwise Article 6(1)(f) GDPR based on the legitimate interest in answering genuine inquiries and protecting the service.
Messages are delivered through the self-operated Mailcow mail infrastructure. For delivery continuity, a configured copy may be sent to a mailbox provided by Google Ireland Limited.
Providing contact data is voluntary. A working email address and a message are required if you want a reply; without them, I may be unable to process or answer your inquiry.
Messages are deleted when the inquiry has been resolved and no contractual, statutory retention, or legal-claims purpose requires continued storage. Relevant correspondence may be retained for the applicable statutory limitation period.
YouTube videos
YouTube videos are blocked by default. No connection to YouTube is created until you actively choose “Load YouTube video”. After that choice, your browser connects directly to YouTube and Google can receive technical data such as your IP address, browser information, and the page you visited. Google may also store or read information on your device.
The legal basis for loading the video is your one-time consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can use the talk description and the external YouTube link without loading the embedded player.
For users in the EEA, the relevant Google service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing can also take place outside the EEA. Google Privacy Policy.
Cookies and local storage
The public site sets no cookies. Your theme and your analytics choice are stored in your browser’s local storage; the analytics choice is valid for 180 days and can be changed at any time. Only after analytics consent does PostHog store a random pseudonymous identifier and session information in local storage and session storage, so that visits and sessions can be recognised. They are deleted when you withdraw consent and at the latest when your choice expires after 180 days. Protected administration areas use strictly necessary security and session cookies.
Theme and consent-choice storage, and protected administration sessions, provide settings or services requested by the user under Section 25(2)(2) TDDDG. The analytics storage requires consent as described below. None of this is used for advertising or cross-site tracking.
Analytics and product improvement
Only after you choose “Allow analytics” does the site load PostHog. It then measures page visits, clicks on links and buttons, and page performance (web vitals), records session replays and heatmaps of how pages are used, and evaluates feature flags so that variants of a page can be compared, so I can see what works and what does not. Rejecting analytics does not restrict access to the site. Before your choice, no PostHog code runs and no connection to PostHog is made.
Collected data includes the page path, time, basic browser and device information, screen size, a random pseudonymous identifier, the referring website’s domain, approved campaign labels, and clicks, scrolling, and mouse movement on a page. Session replays reconstruct the page as you saw it; everything typed into form fields is masked and never recorded. URL queries and fragments, external referrer paths, form contents, names, and email addresses are excluded. IP-based location lookup is disabled; your IP address is necessarily visible to the provider when your browser connects.
Independently of this choice, the server counts successful contact-form submissions by inquiry type and rejected submissions by reason (spam, rate limit, or invalid input). These counts are sent to PostHog without any identifier, cookie, device access, or your IP address. If you have allowed analytics, the count is linked to your pseudonymous identifier instead. The legal basis for the anonymous count is Article 6(1)(f) GDPR, based on the legitimate interest in knowing whether the contact channel works.
The recipient is PostHog, Inc., acting as an analytics processor. The site uses PostHog Cloud EU, whose primary analytics infrastructure is in Frankfurt, Germany. Provider and subprocessor safeguards are described in PostHog’s data processing agreement.
The legal basis for analytics, session replays, heatmaps, and the related browser storage is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time using “Analytics settings” in the footer or below. Withdrawal stops all further collection immediately and deletes the analytics identifier from this browser; it does not retroactively erase events that were already received.
Event history and session replays are used to compare usage over time. PostHog Cloud keeps replays for a limited, plan-dependent period and makes event history available for one year on its free plan and seven years on paid plans. These limits are not an automatic deletion guarantee. To request erasure of already collected data, contact privacy@appik.net; deletion is handled through the provider’s data-deletion controls.
PostHog Privacy Policy · Data processing agreement · Event retention
Newsletter
pkluge.com does not offer a newsletter and does not collect newsletter subscriptions.
International transfers
When you actively load YouTube content, or when a contact message is copied to a Google-provided mailbox, processing may take place outside the EEA. Google states that it relies on applicable adequacy decisions, the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses where required. PostHog is a US provider with EU analytics hosting; processing by its support services or subprocessors may also take place outside the EEA. The applicable processor terms and transfer safeguards are described in the PostHog data processing agreement linked above. Google data-transfer frameworks.
Your rights
Subject to the legal requirements, you have the following rights:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object to processing based on legitimate interests
- Right to data portability
- Right to withdraw consent at any time with effect for the future
- Right to lodge a complaint with a supervisory authority
To exercise a right, contact privacy@appik.net. No automated decision-making or profiling with legal or similarly significant effects takes place.
Supervisory authority
The State Commissioner for Data Protection NiedersachsenPrinzenstraße 5
30159 Hannover
Germany
Email: poststelle@lfd.niedersachsen.de
Website: lfd.niedersachsen.de
You may contact this or another competent supervisory authority if you believe that personal data is being processed unlawfully.