Privacy

Controller

The controller for data processing on this website is Ismail Günay; the address and email address are shown above. This notice covers this portfolio. My apps and games have their own privacy notices.

Hosting and visiting the website

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Whenever you visit, Vercel processes the data this technically requires: your IP address, date and time, the requested address, the status code and information your browser sends, such as browser type and operating system.

This serves to deliver and secure the website and to fix errors. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure and reliable website. Vercel processes the data as my processor under Art. 28 GDPR and keeps this website’s runtime logs for one day. The website does not keep a separate persistent visitor or IP log.

The server functions run in the Frankfurt am Main region. Vercel operates a global network, however, so data may also be processed in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Vercel’s data processing addendum also includes the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Protection against abuse

To keep the website from being flooded with requests, the server briefly counts visits in its memory. Your IP address, or the network prefix (/64) for IPv6, is converted into a pseudonymous identifier using a random key held by the respective server instance; the IP address itself is not stored for this. Devices on the same IPv6 network share a request limit. Counters apply to a one-minute window and are discarded on the first request in the next window. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protecting the website against overload and abuse.

Writing to me

Your name, email address, topic and message initially stay in your browser’s memory as a draft only. Reloading or leaving the contact page discards the draft. “Copy” places it on your device’s clipboard at your request. “Open in email app” hands it to your email application or to the email service you have set up for this in your browser. The website itself neither sends nor stores the message.

Only when you send the email do I receive your sender address, your message and any details you include. I use them to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual steps are concerned, otherwise Art. 6(1)(f) GDPR; my legitimate interest is answering enquiries.

My mailbox is provided by Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google also processes data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). The email providers that deliver your message, such as your own, are involved as well.

If you send me a letter to the address above, the imprint service Online-Impressum.de (Clear-Media UG (haftungsbeschränkt), Europaring 90, 53757 Sankt Augustin, Germany) receives it on my behalf, scans it and makes it available to me digitally. The service acts as my processor under Art. 28 GDPR and processes the data only within the EU or EEA. Letters are handled for the same purposes and on the same legal bases as emails.

I delete messages once your enquiry has been dealt with and I no longer need them. I only keep them longer where statutory retention duties require it, for example for business letters relevant for tax purposes, or where they are needed to establish or defend legal claims.

You don’t have to write to me. Without the details I need to reply, however, I cannot answer your enquiry.

Images, fonts, GitHub and links

Images, videos and fonts are loaded directly from this website, not from third parties such as Google Fonts or YouTube. A scheduled server task updates my public GitHub contribution calendar daily and keeps the last result in the hosting cache. Visitors only read this saved calendar and do not trigger GitHub requests. Your browser does not connect to GitHub for this, and none of your data is passed on to GitHub.

Only when you open an external link, for example to GitHub, LinkedIn or Apple, does your browser connect to that provider. This website’s address is not sent along as the referrer. The respective provider is responsible for processing there, which may also take place outside the European Economic Area.

Cookies, storage and analytics

This website sets no cookies and uses neither Local Storage nor Session Storage or IndexedDB. The cookie notice explains temporary page state in memory, copying at your request and the browser cache. There is no advertising or cross-site tracking. Audience measurement uses Vercel Web Analytics as described below. No profiling or automated decision-making within the meaning of Art. 22 GDPR takes place.

Visitor statistics and performance with Vercel

I use Vercel Web Analytics to understand which public pages people visit and improve my portfolio. It records page views, timestamps, referring website, approximate region, and browser, operating system and device type. I remove query parameters and fragments from the visited URL before sending it. Contact form content and individual click events are not transmitted.

Vercel receives the IP address as part of the technical request. For statistics it uses a hash derived from the request; according to Vercel, the visitor association is discarded after 24 hours. Vercel Web Analytics sets no cookies and stores no persistent identifier on your device. I see aggregate statistics; the Hobby plan used here provides a one-month reporting window.

Vercel Speed Insights also measures loading and response times and layout shifts. It processes page paths, timestamps, performance measurements, connection type, browser, operating system, device type and country. According to Vercel, these measurements are not linked to a person or combined into a browsing history across pages. I remove query parameters and fragments here as well. I use the free base version with an aggregate site performance score.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is privacy-conscious measurement and improvement of this website. The recipient is Vercel; see the hosting section for possible processing in the USA. You may object. This website does not load either measurement service when your browser enables Do Not Track or Global Privacy Control.

Your rights

Subject to the legal requirements, you have the following rights. An email to me is enough to exercise them.

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the alleged infringement (Art. 77 GDPR). The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information.