--- title: "Privacy Policy" description: "Published Arne Kellmann website information and agent integration guidance." canonical: https://arnekellmann.de/privacy last-updated: 2026-09-26 --- # Privacy Policy Arne Kellmann Odenwaldstraße 134L 64372 Ober-Ramstadt Germany contact@arnekellmann.de Controller The controller responsible for data processing on this website is: Scope This privacy policy applies to the website arnekellmann.de and all associated services. Privacy-First Principles This website is designed with privacy in mind. No advertising, marketing, analytics or tracking SDKs are used. Public pages set no cookies; the private admin login uses necessary authentication cookies. No personal data is sold or shared with third parties for marketing purposes. No automated decision-making or profiling takes place (Art. 22 GDPR). Website Data Processing Server Logs When you visit this website, Cloudflare automatically records technical data in server logs: IP address, browser type, referring page, requested URL and timestamp. Requests to the public API, the search endpoint and the MCP endpoint are logged in the same way. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). The data is retained only as long as needed for these purposes. Providing this data is technically required to deliver the site. Contact Form When you use the contact form, we process your name, email address, subject, message and the time of your consent. The data is sent by email to the controller to answer your enquiry and is not stored in a database. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (answering enquiries). You also confirm the consent checkbox; you can withdraw it at any time with effect for the future. Without these details I cannot answer. Please do not send sensitive data such as health information. Private Admin Login The private admin login sends one-time links by email and stores hashed login and session tokens, passkey public keys, short-lived verification challenges and rate-limit records in Cloudflare D1. Authentication cookies are necessary for this private area. Public visitors do not need an account. Third-Party Services Cloudflare This website is hosted on Cloudflare Workers. Cloudflare Turnstile protects the contact form and the private admin login against bots. The public contact form loads Turnstile only when you scroll to it. Cloudflare receives technical data such as your IP address. Legal basis: Art. 6(1)(f) GDPR (protection against abuse). Under § 25(2) no. 2 TDDDG, Turnstile is required so that the form you requested works securely. The website also stores your light or dark theme choice in your browser (localStorage key "theme"). This setting is strictly necessary to show the display mode you chose. Cloudflare is the processor under a data processing agreement. For more information, see the Cloudflare Privacy Policy. Resend Messages submitted through the contact form and private admin login links are delivered by email using Resend, which acts as a processor. The data needed for each delivery is transmitted to Resend for that purpose. Legal basis: Art. 6(1)(b) and (f) GDPR. Fonts Typefaces are self-hosted and served from this website. Your browser does not connect to Google Fonts or any other external font provider, so no font CDN receives your IP address. International Data Transfers Cloudflare, Inc. and Resend are based in the USA. According to their own statements, both are certified under the EU-U.S. Data Privacy Framework. Transfers are also covered by the EU Standard Contractual Clauses where the processing agreements provide for them (Art. 45 and 46 GDPR). Data Retention Server logs are retained only as long as needed for security and operation. Contact form data is not stored in a database. The resulting email is deleted six months after your enquiry is closed. Statutory retention periods for business correspondence remain unaffected if a contract is concluded. Your Rights Under the GDPR, you have the following rights: Right of access to your personal data Right to rectification of inaccurate data Right to erasure ("right to be forgotten") Right to restriction of processing Right to data portability Right to object to processing based on Art. 6(1)(f) GDPR, and right to withdraw consent at any time (Art. 7(3) GDPR) To exercise these rights, please contact us using the details below. We will respond within 30 days. Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority. The competent authority is: The Hessian Commissioner for Data Protection and Freedom of Information Data Security We implement appropriate technical and organizational measures to protect your personal data, including encryption of data in transit (TLS/SSL) and access controls. Changes to This Policy We may update this privacy policy from time to time. The current version will always be available on this page with the date of the last update. Contact For privacy-related inquiries, please contact: