PRIVACY DE

Privacy Policy

Last updated: 18.05.2026

This policy explains how I process personal data when you use this website, contact me, or view embedded media. It is intended to meet the requirements of the EU GDPR.

Controller

Martin Pflug
Zwickauer Straße 10
08112 Wilkau-Haßlau
Germany

E-mail: martin.pflug.it@gmail.com

Supervisory Authority

Sächsischer Datenschutzbeauftragter
Devrientstraße 1
01067 Dresden
Germany

E-mail: saechsdsb@slt.sachsen.de

What data I process

  • Server access logs (IP address, timestamp, URL, user agent) to ensure security and stability of the service.
  • Contact data (e.g., email address, Discord handle) when you contact me; used to reply and handle your request.
  • Embedded media (YouTube): loaded only after your explicit click; once loaded, Google/YouTube may receive data (see below).

Providing contact data is voluntary; you are under no statutory or contractual obligation to provide it. Without contact data, however, I cannot respond to your inquiry.

  • Art. 6(1)(f) GDPR (legitimate interests): security, error diagnosis, preventing abuse.
  • Art. 6(1)(b) GDPR (contract / pre-contract): responding to inquiries and project discussions.
  • Art. 6(1)(a) GDPR (consent): loading YouTube embeds after you click “Play”.

Retention

  • Server access logs are retained for up to 14 days for security and abuse-prevention purposes, then deleted or anonymized (last IP octet stripped), unless required longer to investigate a specific incident.
  • Contact data is stored only as long as necessary to process your inquiry and to comply with statutory record-keeping obligations (e.g., commercial and tax retention periods of up to 10 years under § 147 AO / § 257 HGB where applicable).

Recipients, transfers (processors under Art. 28 GDPR)

This website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. The hosting provider processes server access logs strictly on my instructions.

Inquiries sent to my email address are received via Google (Gmail) operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google therefore acts as a recipient for the content of incoming emails. Further information is available in Google’s privacy policy at policies.google.com/privacy.

When you load YouTube, your browser connects to Google Ireland Limited (and, depending on routing, Google LLC in the United States), which may transfer data to third countries on the basis of the EU Commission’s adequacy decision and/or Standard Contractual Clauses. I use the “privacy-enhanced mode” (youtube-nocookie.com) and a two-click solution so nothing is sent until you consent by clicking play. Your consent is the legal basis for this transfer (Art. 6(1)(a) and Art. 49(1)(a) GDPR) and can be withdrawn at any time with effect for the future. Details of Google’s processing are available in its privacy policy at policies.google.com/privacy.

Joint controllership (Art. 26 GDPR). Once you have given consent and the YouTube player is loaded, Google may use the visit for its own purposes (e.g. video analytics, refinement of recommendations, account-linked features). To the extent Google and I jointly determine the purposes and means of this processing — in particular insofar as the embedded videos relate to channels operated by me and Google’s channel analytics surface aggregate visitor data — we act as joint controllers within the meaning of Art. 26 GDPR. The essence of the joint controller arrangement results from Google’s terms and is summarized in Google’s privacy resources. Google is responsible for fulfilling the information and rights obligations toward you with regard to its share of the processing; you may, however, exercise your data subject rights against either of us. For requests directed at me, please use the contact details in “Controller” above.

Storage on your device (cookies and local storage)

This site does not use analytics, advertising, or marketing cookies. Only the following entries are stored in your browser’s local storage, and only when triggered by your own action; all are considered strictly necessary under § 25 (2) TDDDG:

  • theme — your chosen light/dark mode preference. Set when you toggle the theme switch. Purpose: remember your display choice. Lifetime: until cleared.
  • yt-consent — flag indicating you have ticked “Remember” when activating a YouTube embed. Purpose: avoid re-asking for consent on later visits. Lifetime: until cleared. You can revoke this via the “Reset YouTube choice” button in the footer or by clearing site data.

Automated decision-making / profiling

No automated decision-making within the meaning of Art. 22 GDPR (including profiling) takes place on this website.

Your rights

  • Access, rectification, erasure, restriction, portability (Art. 15–20 GDPR).
  • Withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
  • Lodge a complaint with a supervisory authority (Art. 77 GDPR) — see “Supervisory Authority” above.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interests). If you object, I will no longer process the personal data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. To exercise this right, please contact me using the details in “Controller” above.

Contact

For privacy requests, email martin.pflug.it@gmail.com.