Privacy Policy

This is a complete English translation for international visitors. The legally binding version is the German Datenschutzerklärung, which governs where the two differ.

1. Controller

Henning Merkel, Blumenau 22, 22089 Hamburg, Germany.
Email: mail@henningmerkel.de

2. Hosting and server log files

This site is delivered via Cloudflare Pages by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. On each request Cloudflare automatically processes server log files (IP address, date and time of access, requested resource, user agent, referrer) under Art. 6(1)(f) GDPR, the legitimate interest in secure and stable operation of the website and in defending against attacks. The log data is deleted once it is no longer needed for these purposes. In doing so, personal data is also transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); where that does not apply, transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Storing your language choice

If you choose a language version with the language switcher or the language notice, or close the notice, your browser stores this choice ("de" or "en") in the local storage (localStorage) of your device. The language notice then no longer appears, and opening henningmerkel.de shows the home page in the language you chose. To suggest the matching language version, the website also evaluates the languages set in your browser. Both happen only in your browser; the information is not transmitted to me. The legal basis is Section 25(2) No. 2 TDDDG. You can delete the stored choice at any time in your browser settings.

4. Contact and booking

If you contact me by email, the data you provide (name, email address, the content of your message, and any company) is processed to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). My mailbox is operated by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (Google Workspace), as a processor under Art. 28 GDPR. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); where that does not apply, transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). I delete your message once it is no longer needed to handle your enquiry and no statutory retention period applies.

To book a call I run an instance of the open-source software Cal.com on my own hardware in Germany at calendar.henningmerkel.de; the connection runs through Cloudflare's network (section 2). When you open the home page, your browser loads a script from there that provides the booking dialog. This processes your IP address and the connection data named in section 2. My server logs the IP address, the requested page and the browser; these logs are deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in offering a working booking function).

Only when you open the booking dialog does the calendar store technical information in your browser: cookies and local storage entries for session security and display (colour scheme, 12/24-hour format, time zone) and, once you select a slot, a random identifier that reserves that slot for you. The legal basis is Section 25(2) No. 2 TDDDG.

A booking processes your name, email address, the chosen appointment, and any voluntary notes about your enquiry. A booking is not possible without your name and email address. The appointment is added to my Google Calendar with a Google Meet link, and Cal.com sends the confirmations through my Google Workspace mailbox; the details above on my mailbox apply to Google. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). The data is deleted once it is no longer needed to handle the enquiry or appointment and no statutory retention period applies.

5. Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21 GDPR).

Right to object: Where I process data under Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg.