Privacy
Last updated:
This is an English translation of my German privacy policy. In case of doubt, the German version applies.
Controller
The controller responsible for this website is Dr. Céline Krestel. Address and contact details are given in the legal notice.
No data collection by me
I do not collect any data through this website myself. No cookies, no local storage, no analytics, no tracking, no forms, no fingerprinting. Your choice of language is not stored either. I cannot see who visits this site, how often or from where.
Fonts, icons and images are served from the same server as the site; no content is loaded from third parties. On the contact page and in the legal notice, a small script assembles the email address and the Signal link in your browser to hide them from spam bots. It sends and stores nothing.
Hosting on Codeberg
This site is hosted on Codeberg Pages, a service of the non-profit association Codeberg e. V. in Berlin. Like any web server, Codeberg processes technically necessary access data when a page is requested, such as the IP address, the time and the page requested. According to Codeberg, IP addresses are truncated in logs and technical metadata is stored for no more than seven days. Details can be found in Codeberg’s privacy policy.
The legal basis is Art. 6(1)(f) GDPR: I have a legitimate interest in providing this site securely and reliably.
DNS with Cloudflare
The domain celinekrestel.com is registered with Cloudflare, but the proxy is disabled. Your traffic goes directly to Codeberg, not through Cloudflare’s servers. Cloudflare therefore does not see your page views.
For your browser to find the site, the domain name has to be looked up. This DNS query usually reaches Cloudflare’s name servers via a DNS resolver, such as your internet provider’s, which often caches the answer. At most, Cloudflare learns that the domain was looked up, usually with the resolver’s IP address rather than your own. Insofar as personal data is involved, the legal basis is likewise Art. 6(1)(f) GDPR.
External links
Links to third-party websites are marked with an external link icon (↗). Once you leave this domain, this privacy policy no longer applies.
Anyone who sends me an encrypted email is writing to me alone – at least as far as the content is concerned. Sender, recipient, time and usually the subject line remain visible. Anyone who sends me an unencrypted email is writing to me – and who knows whom else. Unencrypted emails are often described as the postcards of the internet.
If you write to me, your email address and the content of your message are stored with my email provider Runbox for as long as is necessary for our correspondence. Runbox is based in Norway, which, as part of the European Economic Area, is likewise bound by the GDPR. I do not pass this data on. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in answering your message; where a contract or steps prior to entering into one are concerned, Art. 6(1)(b) GDPR.
Signal
For confidential communication I use Signal. The messenger is recommended for secure communication by the EU’s Computer Emergency Response Team (CERT-EU). Messages are end-to-end encrypted; not even Signal itself can read them.
Signal is backed by the non-profit Signal Technology Foundation, based in the United States. If you contact me via Signal, you use your own Signal account; which data Signal processes in doing so is governed by Signal’s privacy policy. The messages on my device are treated in the same way as emails: I keep them for as long as is necessary for our correspondence and do not pass them on.
Your rights
You have the right of access to your data and the rights to rectification, erasure and restriction of processing, as well as the right to data portability (Arts. 15–18 and 20 GDPR). You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). As I store nothing apart from our correspondence, this mainly concerns the messages you send me. A message is all it takes.
Right to object
Where data is processed on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation (Art. 21 GDPR).
Conclusion
There is nothing more to disclose, because that is all that happens.