Privacy

What happens to personal data when you visit this site, under Art. 13 GDPR.

Controller

Setup and Print - Anton Schmidt
c/o Online-Impressum #9737
Europaring 90
53757 Sankt Augustin
Germany
Email: anton@coconutsign.com

Hosting

This site is delivered by Cloudflare (Cloudflare, Inc.). The pages are static and sit in Cloudflare's global network; they are served from the nearest location. On each request Cloudflare processes technically necessary access data, including your IP address, in order to deliver the page and keep it secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and efficient delivery).

A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Processing in third countries, in particular the USA, cannot be ruled out; Cloudflare bases such transfers on the EU Standard Contractual Clauses.

Server logs

No persistent server or access logs are kept. Beyond the brief, technically necessary processing by Cloudflare, no access data is collected or analysed.

Location and weather

The front page shows the weather where you are. Your location is determined in one of the following ways, in this order:

• Your browser's location sharing. Only after you explicitly allow it in the browser. The coordinates stay on your device and are not transmitted to me or stored.
• An approximate location from your IP address viaipwho.is, if you do not allow sharing. Your IP address is transmitted to that service.
• A place you choose yourself, if you enter one.

With those coordinates your browser asksOpen-Meteo (Open-Meteo GmbH, Switzerland) for the weather andBigDataCloud for the place name. Those requests go out from your device; the services named receive your IP address and the coordinates. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing the weather where the visitor is). None of this is stored by me.

On pages under /v/ none of it happens at all: the coordinates are fixed in the page and a location is never requested.

Audience measurement (PostHog, cookieless)

I use PostHog (PostHog Inc.) for audience measurement, in cookieless mode, hosted in the EU (PostHog Cloud EU). No cookies are set and nothing is stored on your device, so no consent and no cookie banner under § 25 TDDDG is required. Events such as page views are recorded. Unique visitors are counted using a server-side hash that changes daily; there is no cross-device tracking and no profiling.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement). A data processing agreement under Art. 28 GDPR is in place with PostHog. You may object at any time (Art. 21 GDPR); your browser's "Do Not Track" setting is respected and switches the measurement off. The embedded version under /embed/ measures nothing.

Contact by email

If you write to me, I process what you send (your email address, your name where given, and the content of the message) solely in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR. I delete this data once it is no longer needed and no statutory retention period applies.

Approaching businesses

I write to hotels and beach bars whose contact details are publicly available. What is processed is the business address, the name of the business, its coordinates and the source those details came from, usually OpenStreetMap or the business's own website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in approaching potential business customers). The source is named in the message itself, as required by Art. 14 GDPR.

Every message carries an unsubscribe link. An unsubscribe is stored permanently so that no further message is sent; only a random token from the message is kept for that, not an address. An objection under Art. 21 GDPR by email works just as well and is acted on the same day.

Your rights

Within the statutory conditions you have the right to:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)

An informal message to the email address above is enough to exercise any of them.

Right to complain

You also have the right to complain to a data protection supervisory authority, in particular in the EU member state where you live, where you work, or where the alleged infringement took place.