Privacy policy

This is a translation for convenience. The German version at https://drong.dev/datenschutz/ is the legally binding one.

Leon Drong Krefelder Straße 37 41748, Viersen Germany Email leon@drong.dev

This website does not require a data protection officer, because the conditions of Art. 37 GDPR and section 38 BDSG are not met. I handle all data protection matters myself at the address above.

This website is static. It embeds no content from third-party servers. There are no analytics or tracking services and no cookies for analytics or advertising. Fonts, images and scripts are served entirely from this website, so that opening it creates no connection to third parties.

This website is hosted on Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When you open the site, Cloudflare processes technically necessary connection data. This includes the IP address of the requesting device, the date and time of access, the address requested, the amount of data transferred, the browser type and the operating system. The legal basis is Art. 6(1)(f) GDPR, and my legitimate interest lies in operating the website securely and reliably.

According to Cloudflare, this connection data is kept for a few days only and then deleted automatically. I have no lasting access to it and keep no logs of my own.

To fend off automated access, Cloudflare may set technically necessary cookies such as __cf_bm or cf_clearance. These cookies serve security and availability only. Under section 25(2) no. 2 TDDDG they require no consent, because they are strictly necessary to provide the service you explicitly requested. The legal basis for processing the data collected that way is Art. 6(1)(f) GDPR, because I have a legitimate interest in fending off automated access. __cf_bm and cf_clearance each expire after thirty minutes.

The Cloudflare contract terms govern processing on my behalf under Art. 28 GDPR.

Cloudflare is based in the United States, so processing there cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023. The European Commission standard contractual clauses apply in addition. You can obtain a copy of those clauses by emailing the address above.

If you write to me, I process your message, your sender address and whatever details you provide in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR based on my legitimate interest in answering.

Messages to the address under drong.dev are received by Cloudflare through its Email Routing service and forwarded to my mailbox at Google. The recipients are therefore Cloudflare, Inc. and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Both also process data in the United States. Cloudflare, Inc. and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, are certified under the EU-US Data Privacy Framework for that purpose. The European Commission standard contractual clauses apply in addition.

Providing your data is neither required by law nor by contract and you are under no obligation to do so. Without your sender address I cannot answer an enquiry.

I delete this data once the enquiry has been dealt with and no statutory retention periods apply.

The legal notice lists my LinkedIn profile as a further channel. If you write to me there, I process your message and the details of your profile in order to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR based on my legitimate interest in answering.

The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. I have no influence on the processing carried out by LinkedIn itself, for which their privacy policy applies. I delete messages once the enquiry has been dealt with.

This website stores your choice between light and dark appearance in your browser's local storage under the key theme. It is written only when you use the toggle. The stored value is then read on every later visit, so that the page appears immediately in your chosen appearance.

Storing and reading require no consent under section 25(2) no. 2 TDDDG, because they are strictly necessary for the setting you explicitly asked for. As long as you do not use the toggle, nothing is stored and your operating system setting applies. The value never leaves your device and is transmitted neither to me nor to third parties. You can delete it at any time through your browser settings.

This website links to my LinkedIn profile. Following that link takes you off this website and the LinkedIn privacy policy applies from there. No data is transmitted to LinkedIn before you click.

There is no automated decision-making, including profiling, under Art. 22 GDPR.

You have the right of access under Art. 15 GDPR, to rectification under Art. 16 GDPR, to erasure under Art. 17 GDPR, to restriction of processing under Art. 18 GDPR and to data portability under Art. 20 GDPR. Please contact me at the address above.

Where I process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you have the right under Art. 21(1) GDPR to object to that processing on grounds relating to your particular situation. Here this concerns the connection data when the website is opened and the handling of enquiries by email.

An informal email to the address above is enough. After an objection I stop processing the data concerned, unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 bis 4, 40213 Düsseldorf, Germany.

September 2026