This site sets no cookies of its own and shows no ads. Fonts, images and link previews come from the site itself. Cloudflare delivers the pages and counts visits with a script that sets no cookies. If you write to me or book a call, I use what you send to answer you.
Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
Sebastian Koch
c/o TEAMWORK
Müllerstraße 138D
13353 Berlin
Germany
hi@sbstn.io, or the form in the Impressum
I am not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG).
Delivering the site
The site runs on Cloudflare’s network (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Every request your browser makes carries your IP address, the time, the address requested, the page you came from and your browser’s user agent and language. Cloudflare needs these to send the pages back to you and to protect the site; if its security checks challenge a request, it may set a cookie (cf_clearance, 30 minutes by default) recording that your browser passed, which is strictly necessary for the site you asked for (§ 25 (2) no. 2 TDDDG).
From the same data Cloudflare shows me overall traffic figures and, for security analysis, individual requests with IP address for up to seven days. I keep no access logs myself. Cloudflare processes all of this on my behalf under its data processing addendum (Art. 28 GDPR) and keeps it only as long as it needs to. The legal basis is Art. 6 (1) (f) GDPR: my legitimate interest is a site that loads reliably and stays secure.
Cloudflare processes data in the USA and other countries where it operates. It is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); where no adequacy decision applies, the EU Standard Contractual Clauses in its addendum do (Art. 46 (2) (c) GDPR), and you can get a copy from me.
Counting visits
Cloudflare adds its Web Analytics script to every page. It counts page views and visits and measures how fast pages load. It sets no cookies and stores nothing in your browser, and according to Cloudflare it does not fingerprint visitors or follow them across other websites.
The script sends Cloudflare the page’s address (without any query string), the page you came from, your browser and operating system versions, and timing figures for how the page loaded and responded, along with the data every request carries. I see only aggregated figures, and no IP addresses or visitor IDs. Cloudflare processes this on my behalf under the same addendum and with the same safeguards, and keeps the individual reports for seven days, then only a sample.
The legal basis is Art. 6 (1) (f) GDPR: my legitimate interest is knowing, in aggregate, whether the site is read and whether it loads well. You can object at any time (see below), and blocking static.cloudflareinsights.com in your browser stops the script.
What your browser keeps
The site sets no cookies of its own. Only when you use the theme switch does it store one entry in your browser’s local storage, “sk_theme”, holding “light” or “dark”, so the next page opens in the theme you chose. It never leaves your browser, and storing it is strictly necessary for what you asked for (§ 25 (2) no. 2 TDDDG). You can delete it in your browser’s settings. Your browser also remembers to reach this site over HTTPS only, for two years after your last visit.
Writing to me
If you write to hi@sbstn.io or use the form in the Impressum, I process your email address, your name if you give it, and what you write, in order to answer you. The legal basis is Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR where your message concerns a contract with me or steps before one.
Cloudflare’s email routing service receives the mail and passes it on without keeping its content; for 31 days it keeps a delivery log with the sender and recipient, the subject, the time and the result. My mail provider then handles the message under its own terms, and may process it outside the EU on the basis of the EU-U.S. Data Privacy Framework. I keep a message as long as the conversation needs it and delete it afterwards, unless a legal duty requires me to keep it longer.
Booking a call
“Book a call” takes you to my booking page on cal.com. When you book, Cal.com, Inc. (2261 Market Street #4382, San Francisco, CA 94114, USA) processes, on my behalf and under its data processing addendum, what you enter: your name, email address, the time you choose, your time zone, any note you add and the addresses of any guests you invite. It sends a confirmation, and the appointment goes into my calendar. The call itself runs on the video service named in the confirmation, which processes what a call needs, such as your IP address, device data and the audio and video you send.
The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in arranging the conversation you asked for, or Art. 6 (1) (b) GDPR where the call is about a contract with me. Cal.com transfers the data to the USA and, in its own words, relies on the EU Standard Contractual Clauses or an adequacy decision such as the EU-U.S. Data Privacy Framework; you can get a copy of these clauses from me. I keep the booking and the calendar entry only as long as the call and anything that follows from it need them. If someone invited you as a guest, this applies to you too; I received your address from the person who booked.
Links to other sites, such as GitHub, LinkedIn, Google Scholar and arXiv, are plain links: nothing is sent to them until you click. The preview cards shown when you point at a link are built from text and screenshots stored on this site.
Your rights
You have the right to access the personal data I hold about you (Art. 15 GDPR), to have them corrected (Art. 16) or erased (Art. 17), to restrict their processing (Art. 18), and to receive them in a portable format (Art. 20). Write to hi@sbstn.io or to the address above.
You can also complain to a supervisory authority (Art. 77 GDPR), in the member state where you live or work or where you think the infringement took place. The authority responsible for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.
You are not obliged to give me any personal data. Your browser has to send your IP address for the site to load at all; beyond that, without your data I cannot answer a message or hold a call. There is no automated decision-making under Art. 22 GDPR.
Your right to object
Where I process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 (1) GDPR). I then stop processing them unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to hi@sbstn.io or to the address above.
5 October 2026. When the site changes what it does with data, this page changes with it. See also the Impressum.