Last updated: 19 September 2026

1. Controller

Max Heilmann, Matix Media, Dieselstraße 26, 22307 Hamburg, Germany
Email: [email protected]

I only process personal data as far as needed to run this website and answer enquiries. Data is only passed on as described below.

2. Hosting and server log files

This website and its content management system are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under a data processing agreement.

When you visit the site, the server processes technically necessary data in log files (IP address, date and time, requested page, amount of data, browser and operating system). It is only kept as long as needed for operation and security.
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure and stable operation).

3. Cookies

This website does not set cookies and uses no tracking technology that would require consent. That is why there is no cookie banner.

4. Analytics with Plausible

I use Plausible Analytics, a privacy-friendly analytics tool that runs on my own server. Plausible sets no cookies, stores no IP addresses and builds no profiles of individual visitors. Only aggregated statistics are collected (for example pages viewed, country, browser, device type). The data is not shared with third parties.
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in improving the website). You can object at any time (see section 10).

5. Contact form and email

If you use the contact form, I process your name, email address and message to answer your request. The details are stored in the content management system on my server and delivered to me by email. They are deleted once your request has been dealt with and no statutory retention duties apply.
Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures or performance of a contract) or Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries).

If you email me directly, the same applies to the data in your email.

6. Spam protection with Cloudflare Turnstile

The contact form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (EU representative: Cloudflare Germany GmbH, Munich). It is only loaded when you click into the form. Technical data such as your IP address and browser and device details are sent to Cloudflare to tell real users from automated bots.
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in protection against spam and abuse). Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA relies on the European Commission's adequacy decision. More information: https://www.cloudflare.com/privacypolicy/

7. Donation form (Donorbox)

The donation page may embed a form from Donorbox (Donorbox, USA). It is only loaded after you click "Load form", and only then is your IP address sent to Donorbox. Data you enter in the form (for example payment details) is processed by Donorbox as an independent controller; please see their privacy notice: https://donorbox.org/privacy
Legal basis: Art. 6 (1)(a) GDPR (your consent by clicking) and, for the donation itself, Art. 6 (1)(b) GDPR.

8. External links and fonts

Links to GitHub, LinkedIn and other sites are plain links. Data is only sent to those providers once you follow a link; their privacy policies then apply.
The fonts used are served from my own server. No fonts are loaded from Google or other providers.

9. Recipients and third-country transfers

Recipients of your data are only the service providers named in this policy (Hetzner as host and, if you use them, Cloudflare and Donorbox). There is no further disclosure. There is no automated decision-making or profiling.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7 (3)). Contact [email protected] for this.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, https://datenschutz-hamburg.de.

11. Changes

I will update this policy when the website or the law changes. The version published here applies.

This English version is a convenience translation; the German version is authoritative.