Privacy

Privacy policy

1 · Controller

The controller within the meaning of Art. 4 (7) GDPR is Georgina Wilkinson, Miesbacher Straße 8, 83714 Miesbach, Germany, email welcome@georginawilkinson.com, phone +49 151 67359965. A data protection officer does not have to be appointed under § 38 BDSG.

2 · Principle

I collect as little as possible. There is no tracking, no analytics, no ad networks, no profiling, no social media plug-ins and no embedded maps or videos. No data is sold. What you write to me is used to reply to you and, if we work together, to run the project.

3 · Hosting and server logs

This site is hosted by Uberspace — Jonas Pasche, Kaiserstraße 15, 55116 Mainz, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with the provider.

When you open a page, the server automatically processes technical data: shortened IP address, date and time of access, page requested, volume of data transferred, referrer, browser type and operating system. The host shortens IP addresses as the log file is written: for IPv4 only the first 16 bits are stored, for IPv6 the first 32 bits, with the remainder set to zero. 82.98.87.93 therefore becomes 82.98.0.0. That leaves me unable to link an entry to a particular person. The data is not combined with other sources.

The legal basis is Art. 6 (1) (f) GDPR — my legitimate interest in running the site securely and reliably. Logs are rotated daily and deleted automatically after seven days.

4 · Encryption

This site is served exclusively over HTTPS and protected by TLS encryption, so what you send — in particular what you enter in the contact form — cannot be read by third parties in transit.

5 · Contact form and email

If you use the form, I process your name, email address, what you say you need, and your message. It is sent to my inbox as an email; the form data is not stored in a database on the server. If you email me directly, I process what is in your email.

The form contains a field that is invisible to you, used to block automated submissions. If it is filled in, the submission is discarded; no personal data is collected in the process.

The legal basis is Art. 6 (1) (b) GDPR where this concerns entering into or performing a contract, otherwise Art. 6 (1) (f) GDPR — my legitimate interest in answering enquiries. Enquiries that do not become projects are deleted after six months. Where a project goes ahead, I keep the correspondence for the duration of the project and afterwards for the periods commercial and tax law require.

Providing this data is required neither by statute nor by contract, and you are under no obligation to provide it. Without a name, an email address and a message I cannot answer your enquiry; no other consequences follow.

6 · Cookies

This site sets no analytics, marketing or tracking cookies, so there is no consent banner.

One cookie is technically necessary: when you submit the contact form, the Grav content management system sets a session cookie named grav-site-…. It holds a random session identifier, serves only to protect the form against cross-site request forgery, is blocked from access by scripts (HttpOnly), is not transmitted to third parties, and expires at the latest 30 minutes after your last activity — normally when you close your browser.

No consent is required for this cookie: it is strictly necessary in order to provide the service you have expressly requested, namely submitting the form (§ 25 (2) no. 2 TDDDG). The subsequent processing is based on Art. 6 (1) (f) GDPR. Should a service that sets non-essential cookies be added later, consent will be obtained in advance under § 25 (1) TDDDG.

7 · Typefaces

The typefaces Newsreader and Karla are served exclusively from this server. There is no connection to Google Fonts or any other font service, and no IP address is transmitted to a third party. The same applies to every other design element on this site: nothing is loaded from an external server.

8 · Recipients and processors

I pass data on only where it is needed to run the business or required by law. Agreements under Art. 28 GDPR are in place with all processors:

• Uberspace (Jonas Pasche, Mainz) — running the site, server logs, sending the form email
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — mailbox and correspondence via Google Workspace
• Tax adviser and tax office — where the law requires it

9 · Transfers outside the EU

The site itself runs entirely in Germany. Quotes and invoices are prepared locally on my own computer and no data is passed to third parties in the process. Email correspondence alone may involve processing by Google LLC in the United States. That company is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission's adequacy decision of 10 July 2023 and, in addition, on the Commission's standard contractual clauses.

10 · Retention

Server logs: seven days. Enquiries without a project: six months. Project correspondence: the duration of the project, then the statutory period. Invoices and accounting records: ten years under § 147 AO and § 257 HGB. Beyond that, I delete data as soon as the purpose falls away and no statutory retention obligation stands in the way.

11 · Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Any consent you give can be withdrawn at any time with effect for the future; the lawfulness of processing carried out until then is unaffected. An email to welcome@georginawilkinson.com is enough. Exercising these rights is free of charge.

12 · Right to complain

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The one responsible for my location is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority where you live.

13 · No automated decision-making

There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

14 · Changes to this policy

I update this policy when the site or the law changes. The version published here is the one that applies.

Last updated: September 2026