This notice explains how personal data is processed when you visit my personal portfolio or contact me. Last updated: 22 October 2026.
1. Controller
The controller is Theodor Steuernagel, Tegeler Straße 38, 13353 Berlin, Germany. For privacy enquiries, please email:
2. Website delivery and hosting
This website is provided using Framer. The provider is Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands. Visits involve the processing of technically necessary connection data, in particular the IP address, date and time, requested page or file, browser and device information and, where applicable, the referring page. This processing delivers the website, enables troubleshooting and prevents abuse. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is the secure and reliable operation of the site. Framer and its infrastructure and content delivery providers receive data to the extent necessary to provide the website. Processing on behalf of the controller is governed by Framer’s Data Processing Addendum.
3. Audience measurement with Framer Analytics
I use Framer’s built-in statistics to evaluate page views, visitor numbers, traffic sources and popular pages. According to Framer, no cookies or persistent identifiers are used. To count daily visitors, the IP address and browser user agent are hashed with a secret value that rotates, resets and is deleted each day. Framer describes the resulting statistics as anonymised. To the extent personal data is processed during the technical collection, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is understanding the use and operation of my portfolio. This is not intended for cross-site advertising tracking or the creation of personally identifiable usage profiles.
4. Cookies and access to your device
The configuration described here does not use marketing cookies or additional tracking services. According to Framer, its analytics work without cookies or persistent identifiers. Any storage of or access to information on your device that is strictly necessary is governed by Section 25(2) of Germany’s TDDDG. Non-essential storage or access would require prior consent under Section 25(1) TDDDG. If services requiring consent are added in future, they must remain blocked until valid consent has been obtained.
5. Contact by email
If you contact me, I process your contact details, message and related communication data to handle your enquiry. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is responding to enquiries. If your enquiry concerns entering into or performing a contract with you, Article 6(1)(b) GDPR applies. Providing information is voluntary; without sufficient contact details, I may be unable to respond. Email is provided by Proton Mail, operated by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Communication providers receive data to the extent necessary to transmit and handle messages. Please do not send particularly sensitive information by unencrypted email.
6. External links
This portfolio links to external websites, such as LinkedIn. No social media plugins or external media are embedded. You access the respective provider’s service only when you follow a link. Your IP address and, where applicable, referral information may then be transmitted. The respective provider is responsible for subsequent processing, which is governed by its own privacy notice.
7. Recipients and international transfers
In addition to the providers described above, legally authorised bodies may receive data where required by law. Framer uses subprocessors, including for its hosting infrastructure. Data may be processed outside the EU or EEA, particularly in the United States. Under Framer’s Data Processing Addendum, transfers rely on an applicable adequacy decision, including for appropriately certified US recipients, or on EU standard contractual clauses and supplementary measures where necessary. An EU Commission adequacy decision applies to Switzerland. Information about the applicable safeguards and a copy may be requested using the contact details above.
8. Retention periods
Personal data is kept only for as long as necessary for its purpose. Communication data is deleted once an enquiry has been resolved, unless legal retention duties or legitimate reasons, such as establishing or defending claims, require otherwise. Technical connection and security data is retained according to what is necessary for delivery, troubleshooting and abuse prevention; data relating to a specific security incident may be kept until it has been resolved. According to Framer, the secret value used for daily visitor counts is deleted each day. Anonymous statistics cannot be attributed to you personally.
9. Your rights
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing relies on consent, you may withdraw it at any time for the future (Article 7(3)). No decisions with legal or similarly significant effects are made solely by automated processing within the meaning of Article 22 GDPR.
Right to object under Article 21 GDPR
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. Processing will then stop unless compelling legitimate grounds are demonstrated that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. You may object to direct marketing at any time without giving reasons. To exercise your rights, please contact me using the details above.
10. Complaints to a supervisory authority
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, work or the alleged infringement. In Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information. You do not need to contact me first before lodging a complaint.