Privacy Policy
1. Responsible parties and scope
Judith Samen
Erkrather Str. 103
40233 Düsseldorf
Germany
Email:mail@judithsamen.com
This privacy policy applies to:
https://www.judithsamen.com
2. Provision and protection of the website
When you access our website, we process, in particular, your IP address, the time of access, the requested address, browser and operating system information, and, if applicable, the previously visited page transmitted by your browser. This serves the purpose of delivering content, ensuring reliable operation, and preventing misuse and technical malfunctions. The legal basis for this processing is Article 6(1)(f) GDPR; our legitimate interest lies in the secure and functional provision of our website.
For technical operations, we use atlasure GmbH, Lorettostraße 33, 40219 Düsseldorf, Germany. Within our technical service provider chain, we utilize Vercel for the website application, Cloudflare for delivery and security, R2 for media and font files, and Supabase as the database service.
The website application and database are configured for Frankfurt. Regional settings do not preclude other processing locations, for example, for operational data and support access. The R2 location indicator Western Europe (WEUR) is not a binding restriction to the European Union.
Vercel retains technical runtime logs with Observability Plus for 30 days for error analysis. Regular Supabase project backups have a seven-day retention/restore period. Deleted data may temporarily remain in backups. This is not a guarantee of complete physical deletion of all data copies after seven days.
The transmission of technically necessary connection data is a prerequisite for accessing the website.
3. Cloudflare Network Error Reports (NEL)
Supporting browsers can send additional technical reports to Cloudflare in case of connection errors. These reports can include the affected URL, the type of error, and details about the failed connection attempt. The configuration does not request reports of successful connections (success_fraction: 0). This feature is for investigating accessibility issues and is distinct from Cloudflare Web Analytics and ad tracking.
Upon receiving a request, Cloudflare processes the connection's IP address and derives information about the network operator, country, and approximate region. According to Cloudflare, the client IP address in this NEL processing path is only held in volatile memory for the duration of the request and is not stored in NEL logs. This does not apply to all other Cloudflare logs.
The browser can retain a reporting policy for seven days at a time. This validity period does not constitute a retention period for error reports at the provider. Further information:https://developers.cloudflare.com/network-error-logging/
4. Contact via email
When you contact us, we process your email address, the message content, and any other information you provide for the purpose of processing and responding to your inquiry. The legal basis for this processing is Article 6(1)(b) GDPR for contract-related inquiries, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in processing your inquiry.
The email address mail@judithsamen.com is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Judith Samen is STRATO's direct contractual partner for the domain and email address. These services are not considered a subcontract of atlasure GmbH. STRATO's privacy policy can be found here: https://www.strato.de/datenschutz/.
Correspondence will be retained as long as it is necessary for processing your request and, if applicable, subsequently to comply with legal retention obligations or for the establishment, exercise, or defense of legal claims. Afterward, it will be deleted. Contacting us is voluntary; however, we require a valid contact address to reply.
5. Contact form
When you use the contact form, we process the contact and message information you enter to handle your request via our technical service provider network. The information regarding the legal basis, voluntary nature, and duration of this processing is outlined in the guidelines for contacting us via email.
6. Newsletter
For voluntary newsletter registration, we process your email address and language preference, confirmation and unsubscribe tokens, registration status, and the registration, confirmation, and, if applicable, unsubscribe times. Your newsletter subscription will only be activated after you confirm the double opt-in link. The legal basis for this is your consent pursuant to Art. 6 para. 1 lit. a GDPR.
You can withdraw your consent at any time with effect for the future via the unsubscribe link or by sending a message to mail@judithsamen.com. The lawfulness of the processing carried out up to that point remains unaffected. We cannot send the newsletter without an email address; registration is not required to visit the website.
Confirmation links are valid for seven days. Unconfirmed registrations are deleted from the active database, including list memberships, during the next daily cleanup run, or within the following 24 hours if the system is functioning correctly. A new registration generates a new link with a new expiration date; older links become invalid.
Confirmation emails and newsletters are sent via Resend; registration data is managed in Supabase. Open and click tracking are deactivated. However, technical connection and delivery data may still be collected. In the Resend Free plan, email/log retrieval for error analysis is retained for 30 days; the provider specifies seven days for backups. These are not blanket deletion periods for all provider data, consent forms, or registration data.
After unsubscribing, your address will no longer be used for newsletter distribution. A separate, purpose-specific blocking notice contains the normalized email address, its association with this website offer, and the initial blocking date; no additional contact profiles are stored. This prevents accidental resubmissions due to subsequent imports and remains in effect even after contact deletion or an unconfirmed, expired resubscription.
Only a new, confirmed double opt-in subscription will lift the sending block; neither an import nor manual confirmation will. Blocked data is retained only as long as necessary to honor the unsubscribe request. This is determined by the continued operation of the newsletter and the risk of resentment through imports. If the purpose ceases to exist, particularly upon the permanent discontinuation of the newsletter service, the data will be deleted after our deletion process. Deletion does not constitute authorization to send further mail. Your statutory rights remain unaffected.
7. Protection against misuse of newsletter subscriptions
To limit automated or excessively frequent logins, a shortened checksum derived from the IP address and a request counter are processed. The server first receives the IP address; the counter key contains the checksum, not the plaintext IP address. The checksum is not anonymous.
The counters are stored in the shared Upstash Redis resource in Frankfurt (fra1), without additional read regions. Counter keys technically expire after 20 minutes; this is not a deadline for all provider logs or backups. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the protection of the registration process from misuse.
8. Fonts, visitor analysis and device storage
Font files are self-hosted and delivered via the same website infrastructure. No connection is established to Google Fonts or Fontsource during loading. We do not use visitor analytics with Google Analytics, Cloudflare Web Analytics, Plausible, or Umami, nor do we use advertising pixels. Technical operational and security protocols, as well as NEL, are separate from this.
No automatic language or random sorting cookies are set. The language is determined by language links, browser language preference, and website configuration. Random sorting is stable per UTC day and does not require a visitor-specific sorting cookie.
Access to a device that is absolutely necessary for providing an explicitly requested service may fall under Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TDDDG). The processing of personal data additionally requires a GDPR legal basis. This is not a blanket statement regarding the freedom of consent for all functions used.
9. Your rights
Under the legal conditions, you have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw your consent at any time with effect for the future; the previous lawfulness remains unaffected.
Right to object
For processing based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation pursuant to Article 21(1) GDPR. We will then cease processing your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. You may object to direct marketing at any time; your data will then no longer be processed for this purpose.
To exercise your rights, please contact mail@judithsamen.com. You have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 of the GDPR, in particular at your habitual residence, place of work, or the place of the alleged infringement. In North Rhine-Westphalia, the contact point is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, P.O. Box 20 04 44, 40102 Düsseldorf, https://www.ldi.nrw.de/.