Privacy policy

As of November 2026. Translation of the German Datenschutzerklärung, which is the legally binding version.

1. Controller

Julian Unruh
Borwinstr. 31
18057 Rostock, Germany
Email: info [at] nelumbo [dot] dev

2. Summary

• This website sets no cookies and uses no analytics or tracking tools.
• It loads no content from third parties. The fonts are also served from this domain.
• Access logs with IP addresses are not stored.
• I only process personal data when you write to me through the contact form or by email.

3. Hosting and delivery of the website

The website is hosted by Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The files are stored in Frankfurt am Main and are delivered through the content delivery network Amazon CloudFront, which uses servers in Europe and North America. You are usually served by a server near you.

When you open a page, AWS processes technically necessary data, mainly your IP address, the time, the requested address and information about your browser. The page cannot be delivered without this data. I have not enabled access logging and do not receive this data.

The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest is to provide the website securely and reliably. AWS processes the data on my behalf under a data processing agreement according to Art. 28 GDPR.

A transfer to the USA cannot be ruled out. Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The standard contractual clauses of the European Commission apply in addition.

The connection to the website is encrypted with TLS.

4. Contact form

When you use the contact form, I process your name, your email address and your message to answer your request. AWS Lambda and Amazon Simple Email Service (SES) in the AWS region Frankfurt receive the data and send it as an email to my address at this domain. From there it is forwarded to my mailbox as described in section 5. It is not stored in a database. The logs of the Lambda function contain only technical information without the content of your message and are deleted after 30 days.

My mailbox is hosted by Outlook.com. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A transfer to Microsoft Corporation in the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6 (1) (b) GDPR if your request aims at a contract, otherwise Art. 6 (1) (f) GDPR. My legitimate interest is to answer requests. Providing the data is voluntary, but without your name, email address and message I cannot reply.

5. Contact by email

Cloudflare Email Routing forwards emails sent to addresses at this domain to my mailbox at Outlook.com. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the message only to forward it. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Legal basis and purpose are the same as for the contact form.

6. Retention

I delete messages once your request has been dealt with, unless statutory retention obligations, for example under commercial or tax law, require me to keep them longer.

7. Your rights

You have the right to

• access the data I process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object: Where I process data on the basis of Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to the address above is enough for any of these requests.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Landesbeauftragter für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Lennéstraße 1, Schloss, 19053 Schwerin, Germany.

8. Automated decisions

No automated decision-making, including profiling, takes place.