Privacy policy

Information on the processing of personal data under Articles 13 and 14 GDPR. Last updated: September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Maximilian Hinz
Germany
Email: jonas@mallek.de

This is a private, non-commercial page. No data protection officer is required by law and none has been appointed. For any question concerning data protection, please write to the email address above — it reaches me directly.

2. How this site is built

This site is deliberately built to process as little personal data as technically possible:

• No cookies are set.
• There is no analytics, no tracking and no audience measurement.
• No external fonts (such as Google Fonts) are loaded — all typefaces come from your own device.
• No external scripts, CDNs, social media plugins, maps or embedded videos are loaded.
• There is no contact form, no registration and no user accounts.
• Nothing is written to or read from your device: no localStorage, no sessionStorage, no tracking pixels, no fingerprinting.
• There is no automated decision-making or profiling within the meaning of Article 22 GDPR.

Because no storage technologies beyond what is strictly necessary are used, no consent under section 25(1) of the German TDDDG is required. For the same reason this site deliberately shows no cookie banner.

3. Server log files

When you open this website, your browser automatically transmits technical information to the hosting provider's server, which stores it temporarily in log files. This typically covers:

Legal basis: Article 6(1)(f) GDPR (legitimate interest). My legitimate interest lies in the technically faultless operation and delivery of this website and in the security of the systems used.

Retention: Log files are stored for a maximum of NUMBER days and are then deleted automatically. This data is never merged with other data sources and never evaluated for marketing purposes.

Provision: Providing this data is neither required by law nor by contract, but it is technically unavoidable in order to display the website at all.

4. Hosting

This website is hosted by an external service provider: regfish GmbH, Bleichstraße 8a, 35390 Gießen, Germany. The provider processes the log data described above exclusively on my behalf and on my instructions. A data processing agreement pursuant to Article 28 GDPR is in place with the provider.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in the secure and reliable provision of this website.

5. Contacting me by email

If you contact me by email, the data you provide — your email address, your name where given and the content of your message — is stored and processed in order to handle your enquiry.

Legal basis: Article 6(1)(f) GDPR for general enquiries (legitimate interest in responding to enquiries), or Article 6(1)(b) GDPR where your enquiry is directed at the conclusion or performance of a contract.

Retention: Your data is deleted once your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion. You may object to storage at any time with effect for the future.

Please note: communication by unencrypted email can have security gaps. Complete protection of the data against access by third parties is not possible on that route.

6. Cookies, tracking and external services

This website sets no cookies, uses no analytics or tracking tools and embeds no third-party content. No information is stored on or read from your device.

The JavaScript used on this site serves presentation only — it fills in the year in the footer and underlines the current navigation entry. It runs entirely locally in your browser and sends no data to me or to anyone else.

7. Transfers to third countries

I do not transfer personal data to countries outside the European Union or the European Economic Area, except where the hosting provider does so as part of technical operations on the basis of appropriate safeguards under Articles 44 et seq. GDPR.

8. Your rights

You have the following rights regarding your personal data:

• Access (Article 15 GDPR) — whether and which data concerning you I process.
• Rectification (Article 16 GDPR) — of inaccurate or incomplete data.
• Erasure (Article 17 GDPR) — unless statutory retention obligations prevent it.
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection (Article 21 GDPR) — to processing based on Article 6(1)(f) GDPR.
• Withdrawal of consent (Article 7(3) GDPR) — with effect for the future.

An informal message to jonas@mallek.de is enough to exercise any of these rights, and doing so is free of charge for you.

Note on the right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR.

9. Right to lodge a complaint

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement. The authority responsible for me is COMPETENT GERMAN STATE DATA PROTECTION AUTHORITY.

10. Data security

This website is delivered over an encrypted TLS connection (HTTPS), which you can recognise by the padlock symbol in your browser's address bar. Data transmitted between your browser and the server therefore cannot be read by third parties. Beyond that, I use appropriate technical and organisational measures to protect data against accidental or deliberate manipulation, loss or unauthorised access.

11. Changes to this policy

This privacy policy will be updated whenever changes to the website or to the legal situation make it necessary. The version published on this page always applies.