Privacy policy

01Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

02At a glance

• No cookies, no analytics or tracking tools, no advertising, no embedded content from other providers.
• Fonts are served by this website itself. Loading the pages opens no connection to any other provider.
• Personal data is only processed when you request the pages (connection data the host needs to deliver them) and when you write to me – by email or through the contact form.

03Hosting and connection data

This website is delivered through Cloudflare Workers: the pages as ready-made files, plus a small program that only receives the contact form (see “Project brief and contact form”). The provider is Cloudflare, Inc., USA.

With every request, Cloudflare processes the connection data it technically needs, in particular your IP address, the date and time of the request, the address requested, the referrer and details of your browser and operating system (user agent). Without this data the page cannot be delivered to your browser. Cloudflare also uses it to protect the website against attacks and abuse.

Logs from Cloudflare Workers (Workers Observability) are also switched on for operations. They may contain details of individual requests and are used to detect and fix errors.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is to provide the website reliably, quickly and securely.

Cloudflare processes this data on my behalf. The data processing agreement (Data Processing Addendum) is part of Cloudflare’s terms. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Cloudflare deletes the Workers Observability logs automatically after seven days at most. It processes the other connection data only for as long as delivering and protecting the website requires; details are in Cloudflare’s privacy policy.

04Cookies and browser storage

This website itself does not set any cookies.

Only if you press “Reduce motion” in the footer does the site store that setting in your browser’s local storage (localStorage, entry “motion”), so that it also applies on the next pages. The entry never leaves your browser and is not transmitted to me. It is strictly necessary for the function you expressly asked for (Section 25(2) no. 2 TDDDG). You remove it by pressing the switch again or by clearing this website’s data in your browser.

When you move between two pages of this website, the site briefly keeps a note in your browser’s session storage (sessionStorage, entry “vt:names”) of which elements travel along in the transition. The entry contains no information about you, never leaves your browser and is deleted on the next page, at the latest when you close the tab.

If a page transition fails, the site also stores an entry “vt:error” there with the browser’s error message. It contains no information about you, never leaves your browser and is deleted when you close the tab.

Both entries are technically required so that the page change you started is displayed as intended (Section 25(2) no. 2 TDDDG).

To protect against automated attacks, Cloudflare may in individual cases set a technically necessary cookie (“__cf_bm”, lifetime 30 minutes) to tell people apart from automated access. The legal basis is Section 25(2) no. 2 TDDDG together with Art. 6(1)(f) GDPR; my legitimate interest is protecting the website.

05Project brief and contact form

The project brief on the home and contact pages (four questions that turn into a letter) runs in your browser. While you answer, nothing is stored and nothing is transmitted. You can send the letter in one of two ways:

• “Open it in your own email app”: your email app opens with a prepared draft. Nothing is transmitted until you send the email yourself – from then on, the section “Contact by email” applies. If you copy the text instead, it only goes to your clipboard.
• “Send directly”: your letter (your answers and your description), your email address and, if you give it, your name are transmitted to this website over an encrypted connection (HTTPS). If JavaScript is switched off in your browser, a simple form takes the place of the brief; the same applies to it.

When you send directly, a small program at my host (Cloudflare Workers, see “Hosting and connection data”) receives your details, turns them into an email and delivers it through Cloudflare Email Routing to my mailbox at Google (Gmail). Your email address is set as the reply address so that I can answer you. The program stores nothing – no database, no file – and it writes neither the content of your message nor your email address or name into the Workers operating logs.

To keep out automated spam, the form contains a field that is invisible to people and checks that at least three seconds have passed between the form appearing and it being sent. Nothing is stored for this and no cookie is set.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps prior to entering into one – which is what the brief is for – and Art. 6(1)(f) GDPR otherwise. My legitimate interest is to answer enquiries.

Only your email address is required: without it I cannot reply to you. Your name is optional.

What then happens to the message in my mailbox – the service providers involved, how long it is kept and when it is deleted – is set out in the next section. It is the same for both ways.

06Contact by email

If you write to me at m.tavakoli@itavakoli.com or use the contact form (“Send directly”), I process your email address, your name if you give it, and the content of your message in order to answer your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps prior to entering into one, and Art. 6(1)(f) GDPR otherwise. My legitimate interest is to answer enquiries.

The following service providers are involved:

• Cloudflare, Inc. (USA) receives emails sent to this address through Cloudflare Email Routing and forwards them; messages from the contact form are delivered by Email Routing the same way. For the transfer to the USA, the hosting section applies.
• Forwarded emails arrive in a Google mailbox (Gmail). For users in the European Economic Area the provider is Google Ireland Limited, Ireland; data may also be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.
• I send replies through the SMTP service of Brevo (Sendinblue SAS, France).

Google processes the emails in this mailbox as an independent controller under its privacy policy.

A data processing agreement under Art. 28 GDPR is in place with Brevo; it is part of Brevo’s terms.

I delete your message once your enquiry has been fully dealt with, unless statutory retention obligations for business correspondence require it to be kept longer. In that case it is kept for that purpose only.

You are under no legal or contractual obligation to provide your data. Without an email address, however, I cannot reply to you.

07Links to other websites

Among other things, the site links to my profiles on LinkedIn and GitHub and to projects I have built. These are plain links: loading this website opens no connection to those services and transmits no data to them. Only when you click a link do you reach the provider’s site, where its own privacy policy applies.

The bachelor thesis is a PDF file on this website. Downloading it is handled like any other page request (hosting and connection data).

08Your rights

You have the following rights towards me regarding the personal data concerning you:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

An informal email to the address above is enough.

Right to object: where I process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

09No automated decision-making

There is no automated decision-making, including profiling (Art. 22 GDPR).