Privacy

The protection of your personal data is an important concern to me. This privacy policy informs you, pursuant to Art. 13 of the General Data Protection Regulation (GDPR), which personal data is processed when you visit this website, for which purposes and on which legal basis this takes place, and which rights you are entitled to.

notDIRK.de is a largely static, private publication offering without user accounts, without a comment function, without a contact form, without payment functions, and without advertising. Beyond the processing technically unavoidable for the operation of the website and a cookieless, data-minimizing audience measurement (see Section 7), personal data is only processed if you subscribe to the optionally offered newsletter – and even then exclusively on the basis of your express consent (see the „Newsletter“ section).

1. Controller

The controller within the meaning of the GDPR and other data protection provisions is:

Dirk Wolbeck
St.-Martin-Str. 28
56761 Düngenheim
Germany
Telephone: +49 174 3440541
E-mail: [email protected]

2. Data protection officer

There is no legal obligation to appoint a data protection officer for this service. The requirements under Art. 37 GDPR and under Sec. 38 BDSG (German Federal Data Protection Act) are not met, as no data processing takes place that would make an appointment necessary (in particular, no permanent employment of at least 20 persons in the automated processing, no extensive processing of special categories of data, and no core activity requiring extensive regular monitoring of data subjects). For all questions relating to data protection, you can contact the controller named under Section 1 directly.

3. General information on data processing, legal bases, and storage period

I process personal data only insofar as this is necessary to provide a functional website and the content I offer. The legal basis for the processing is regularly Art. 6 (1) (f) GDPR. My legitimate interest lies in the technically error-free presentation, the security and stability of the website, as well as a data-minimizing audience measurement (see Section 7). Insofar as you contact me by e-mail, the processing to handle your request is likewise carried out on the basis of Art. 6 (1) (f) GDPR.

The personal data of the data subject is deleted or its processing restricted as soon as the purpose of storage no longer applies. Storage beyond this may take place if provided for by the European or national legislator in Union regulations, laws, or other provisions to which the controller is subject. Specific storage periods are indicated below for the respective processing operations.

4. Hosting (Hetzner)

This website is operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is in Germany. On my behalf, Hetzner processes the data that arises in the course of accessing the website (in particular technical connection and access data). The legal basis is Art. 6 (1) (f) GDPR (interest in a reliable and secure provision of the website). A data processing agreement pursuant to Art. 28 GDPR exists with Hetzner.

5. Content delivery network / edge proxy (Cloudflare) and transfer to third countries

The website is publicly accessible exclusively via a so-called Cloudflare tunnel. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare acts as an edge and reverse proxy as well as a content delivery network (CDN), terminates the TLS encryption at the network edge, and forwards the requests to the origin server. In doing so, Cloudflare necessarily processes the IP address and other connection data of the requesting end device in order to establish the connection, accelerate the delivery of content, and protect the website against attacks and misuse.

The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest lies in a secure, high-performance, and available delivery of the website. A data processing agreement pursuant to Art. 28 GDPR exists with Cloudflare.

In the course of using Cloudflare, a transfer of personal data to the USA may occur. Insofar and as long as Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (DPF), the transfer takes place on the basis of the adequacy decision of the European Commission pursuant to Art. 45 GDPR. Otherwise, and additionally, the transfer is based on the Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to Art. 46 (2) (c) GDPR, supplemented where applicable by additional protective measures.

6. Server log files

When this website is accessed, the web server used (Caddy) automatically records information and stores it in so-called server log files. The following are recorded:

This data is technically necessary in order to deliver the content of the website correctly, to ensure system security and stability, and to be able to trace disruptions. The recording of this connection data occurs as a technical necessity when the website is accessed; without it, the website cannot be delivered. The legal basis is Art. 6 (1) (f) GDPR. This data is not merged with other data sources or used to identify individual persons.

For purely internal, server-side analysis of accesses, I use the locally operated program GoAccess. The analysis is carried out exclusively with an anonymized IP address; no personal reference is established in the process. Within this local GoAccess analysis, no data is transmitted to external services; for the separate, cookieless audience measurement at the Cloudflare edge, see Section 7. The server log files are automatically deleted after 7 days.

7. Audience measurement

For statistical analysis of website usage, I evaluate the aggregated access statistics generated server-side at the Cloudflare edge (see Section 5). This analysis is cookieless and operates without client-side analytics scripts, without counting pixels, without cross-device tracking, and without fingerprinting; your end device is not accessed for analytics purposes, and no information is stored on or read from it. Consent pursuant to Sec. 25 TDDDG is therefore not required.

For the analysis, Cloudflare briefly processes the IP address of the requesting device when the page is accessed (among other things to determine the approximate country of origin); according to Cloudflare, no part of the IP address is stored in the process, and no cross-device or cross-session individual profiles are created. The legal basis is my legitimate interest in a data-minimizing analysis of website usage (Art. 6 (1) (f) GDPR); in the balancing of interests, this interest prevails because the processing takes place without cookies, without fingerprinting, and without individual profiles, so that the interference with your rights is minor. You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR; see Section 16). Regarding Cloudflare's role as processor and the possible transfer of data to the USA, the information provided in Section 5 applies accordingly; the data processing agreement pursuant to Art. 28 GDPR mentioned there also covers this function. Cloudflare stores the aggregated analysis data only for a limited period (according to Cloudflare, at most a few months) and then deletes it.

Beyond this, no further web analytics or audience measurement services are used; in particular, no Google Analytics, no Plausible, and no comparable tools. Your usage behavior is not tracked across different websites or sessions.

8. Cookies

This website itself does not set any cookies. Since it is a purely static offering without session management, without login, and without a shopping cart, no information is stored on or read from your end device by the website itself.

The Cloudflare service upstream as an edge proxy (see Section 5) may, for technical security reasons, set a strictly necessary cookie (e.g. „__cf_bm“). This serves exclusively for bot and attack defense as well as distinguishing human from automated accesses and is not used for analytics or marketing purposes. The storage is exempt from consent pursuant to Sec. 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary to provide the service you have expressly requested.

Since no cookies or comparable technologies requiring consent are used, consent pursuant to Sec. 25 (1) TDDDG is not required; for this reason, no cookie consent banner is displayed.

9. Locally hosted fonts

For a uniform presentation, the fonts „Montserrat“ and „Roboto Mono“ are used. These fonts are provided and delivered locally by this website's own server. There is no integration via external services (such as Google Fonts) and no associated transfer of data to third parties. When the page is accessed, no connection is therefore established to third-party servers for the purpose of loading fonts.

10. Images, graphics, and integration of third parties

Images, graphics, audio files, and other assets are delivered exclusively from my own server via the Cloudflare edge. No third-party content with its own tracking is integrated. In particular, this website contains no social media plugins, no embedded content from external platforms, and no tracking pixels.

11. Contact by e-mail

Contact is possible exclusively by e-mail to [email protected]. When you send me an e-mail, the personal data you provide (in particular your e-mail address and the information contained in the text of your message) is processed and stored for the purpose of handling your request. The legal basis is Art. 6 (1) (f) GDPR (interest in responding to your matter). The provision of this data is neither legally nor contractually required and is voluntary; however, without the information necessary for a response, I cannot process your request. This data is deleted as soon as the processing of your matter has been completed and no statutory retention obligations preclude this.

For e-mail communication I use Microsoft 365. The provider within the EU is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In this context, a transfer of data to the USA to Microsoft Corporation may occur. Upstream is a spam and malware filtering service of Hornetsecurity GmbH, Am Listholze 78, 30177 Hannover, Germany, which checks incoming and outgoing e-mails for malicious software and unwanted messages. Data processing agreements pursuant to Art. 28 GDPR exist with both service providers. With regard to the transfer to the USA, the safeguards described under Section 13 apply (EU-US Data Privacy Framework, alternatively Standard Contractual Clauses).

12. Recipients and processors at a glance

To provide this website and for communication, I use the following service providers as processors within the meaning of Art. 28 GDPR:

Your data is passed on to other third parties only if there is a legal obligation to do so or you have expressly consented.

13. Transfer to third countries

Insofar as, in the course of the processing operations described above (Cloudflare and e-mail via Microsoft 365), personal data is transferred to third countries outside the European Union or the European Economic Area – in particular to the USA – this takes place on the following graduated basis:

Further information on the respective safeguards as well as a copy of the Standard Contractual Clauses can be requested from the controller (Section 1).

14. SSL / TLS encryption

For security reasons and to protect the transmission, this website uses SSL / TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser displays „https://“ and a padlock symbol is shown. This protects the transmitted data against being read by uninvolved third parties during transmission. At the network edge, the encryption is terminated by the processor Cloudflare named under Section 5.

15. No automated decision-making, no profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Your rights as a data subject

Within the framework of the statutory requirements, you are entitled to the following rights vis-à-vis the controller with regard to the personal data concerning you:

Insofar as the processing is based on consent, you also have the right to withdraw your consent at any time with effect for the future pursuant to Art. 7 (3) GDPR. The lawfulness of the processing carried out on the basis of the consent up to the withdrawal remains unaffected by this.

Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (f) GDPR. I will then no longer process the personal data concerned unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

To exercise your rights, an informal notification to the contact details given under Section 1 is sufficient.

17. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right pursuant to Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of the personal data concerning you infringes the GDPR. The supervisory authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz
Telephone: +49 (0)6131 8920-0
E-mail: [email protected]
Website: https://www.datenschutz.rlp.de

18. Currency and amendment of this privacy policy

This privacy policy has the status of July 2026. As a result of the further development of the website or due to changed legal or regulatory requirements, it may become necessary to adapt this privacy policy. The respective current version is always available on this page.

19. AI read-aloud function (audio contributions) and podcast feed

For individual articles I offer a spoken version (audio file) that reproduces the article text as speech output. The speech output is generated using an AI-based text-to-speech process that runs exclusively locally on my own infrastructure as part of the editorial creation process. In doing so, no content is transmitted to third parties and no personal data of website visitors is processed.

The finished audio file is – like images and other assets (see Section 10) – delivered as a static file exclusively from my own server via the Cloudflare edge and embedded via a native HTML audio element. No embedded player of a third party is used; no third-party scripts, cookies, or counting pixels are loaded. For the retrieval, the same information applies as for the rest of the page access (see Sections 5 and 6).

In addition, I make the audio contributions available via a podcast feed (static RSS file). If you retrieve the feed directly or via a podcast app, the information on server log files (Section 6) and the Cloudflare edge (Section 5) applies. Insofar as the podcast is discoverable via third-party platforms (e.g. Apple Podcasts, Spotify), your retrieval there takes place under their own data protection responsibility, over which I have no influence. Any playback or download statistics are evaluated by me only server-side, in aggregated and anonymized form (Sections 6/7); no user-related tracking takes place.

Newsletter

Controller

The controller responsible for the data processing described in connection with the newsletter is the controller named under Section 1 above (Dirk Wolbeck). The full contact details can be found there as well as in our imprint.

Purpose and scope of the processing

On notDIRK.de you can subscribe to a free, non-commercial newsletter. We use it to inform you about new articles on the topic areas you have selected (AI & Automation, Data Protection & Digital Sovereignty, IT Security & Confidential Computing, Opinion & Society, Politics & Life). The newsletter contains no third-party advertising; your data is not sold or passed on to third parties for advertising purposes.

Data processed

In connection with the newsletter we process:

Legal basis

The legal basis for sending the newsletter and the associated data processing is your consent pursuant to Art. 6 (1) (a) GDPR (insofar as the dispatch qualifies as a commercial act, additionally in conjunction with Sec. 7 (2) No. 2 UWG). We base the logging of the sign-up on our legitimate interest in being able to demonstrate the consent given (Art. 6 (1) (f) GDPR in conjunction with Art. 5 (2) and Art. 7 (1) GDPR).

Double opt-in procedure and logging

Sign-up takes place using the so-called double opt-in procedure. After submitting the form, you receive an e-mail asking you to confirm your sign-up by clicking a confirmation link. Only after this confirmation do we add you to the distribution list. This ensures that no one can sign up using someone else's e-mail address.

To demonstrate that consent was obtained properly, we log the sign-up process: we store the time and IP address of the sign-up as well as the time and IP address of the confirmation, plus the version of the consent text valid at the respective time. The legal basis for this is our accountability obligation under Art. 5 (2) and Art. 7 (1) GDPR.

If the sign-up is not confirmed, the unconfirmed sign-up is automatically deleted – generally within a few days (at the latest, however, once the confirmation link has expired).

Dispatch service provider (processor) and third-country transfer

For sending the newsletter we use the service Brevo, operated by Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France.

Brevo processes the data mentioned above on our behalf as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. Storage and processing take place primarily on servers within the European Union.

Brevo uses its own sub-processors to provide the service. In individual cases, this may result in a transfer of personal data to countries outside the EU/EEA (third countries, including the USA). For these transfers, an adequate level of data protection pursuant to Chapter V of the GDPR is safeguarded as follows:

A copy of the appropriate safeguards (Standard Contractual Clauses) can be requested from us via the contact details given in the imprint. Further information can be found in Brevo's data processing agreement (DPA) and privacy policy at https://www.brevo.com/legal/privacypolicy/.

Bot protection via ALTCHA

To protect the sign-up form against automated abuse (spam bots) we use ALTCHA. ALTCHA is self-hosted by us; no data is transferred to third parties. The method is based on a computation-based „proof of work“ that is executed locally in your browser. ALTCHA sets no cookies, does not access information stored on your device (Sec. 25 TDDDG) and, beyond the technically necessary delivery of the form, processes no personal data for your identification (in particular no tracking, no profiling). For technical reasons – as with every page access – your IP address is transmitted to our server in order to verify the computational task; it is not evaluated to identify you. This makes the bot protection particularly privacy-friendly.

Storage period

Your data is stored for as long as your newsletter subscription exists. After you unsubscribe or withdraw your consent, your data is removed from the active distribution list.

We retain the consent log data (sign-up and confirmation time, IP addresses, consent version) even after unsubscribing for as long as this is necessary to demonstrate the consent originally granted. As a retention period we apply the regular limitation period of three years (Secs. 195, 199 BGB), calculated from the end of the year in which the unsubscription took place; after this, these log data are deleted. Your e-mail address may additionally be kept on an internal suppression list – preferably in hashed/pseudonymized form – to ensure that you are not inadvertently contacted again after unsubscribing; the legal basis for this is our legitimate interest in observing your objection (Art. 6 (1) (f) GDPR).

Withdrawal and unsubscription

You can withdraw your consent at any time with effect for the future. The easiest way is via the unsubscribe link contained in every newsletter e-mail. Alternatively, an informal message to [email protected] is sufficient. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

Your rights

You are entitled to the rights described in this privacy policy under the section „Your rights as a data subject“ – in particular the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as the right to withdraw consent (Art. 7 (3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).