Privacy Policy
Updated 29 October 2026. This notice explains how I process personal data when you visit philippkrueger.com, use the contact form, leave a comment, or email me.
Controller
Philipp Krüger
Blk K/4, Triq Xemxija
Marsa, Malta
Email: [email protected]
Hosting and security
The WordPress website is hosted by netcup. When you request a page, the server receives your IP address, the requested URL, time of access, referrer, browser information, and technical response data. netcup keeps web server logs for up to 14 days. I use these data to deliver and secure the website. The legal basis is my legitimate interest in operating a reliable and secure site (Article 6(1)(f) GDPR).
Wordfence and other local spam and security controls can process IP addresses and request details to detect attacks and misuse. Wordfence may record security events and block suspicious requests. Its Live Traffic records are kept for no more than 30 days; other security records are kept only while needed to investigate or prevent abuse. Wordfence’s cloud security services may also process technical data. This processing is based on my legitimate interest in protecting the website (Article 6(1)(f) GDPR). See Wordfence’s privacy policy.
Privacy choices and cookies
Consentimental records your privacy choices so the site can respect them. The necessary cmp_consent cookie lasts 180 days. The cmp_sale_opt_out cookie lasts 400 days and may be renewed on visits. WordPress may also set login or password-protection cookies when those functions are used. If you choose to remember your details when commenting, WordPress sets comment cookies. These functions are needed to remember your choices or provide the service you request. The legal basis is my legitimate interest in doing so (Article 6(1)(f) GDPR), or consent where you opt in (Article 6(1)(a) GDPR).
You can change your choices through the site’s privacy settings. The current list of cookies and services is available on the Cookie Information page.
Analytics
The site’s privacy settings list Google Analytics 4 and Umami under Analytics. When you allow analytics, these services measure page views and site usage. The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw through the privacy settings at any time.
Google Analytics 4 receives usage and technical information such as page views, device and browser information and approximate location. With analytics enabled, it may set _ga cookies lasting up to two years. Google may process data outside the European Economic Area; its data transfer frameworks describe the safeguards it uses. See Google’s privacy policy. The exact retention of user and event data follows this site’s Google Analytics property settings; standard properties offer 2 or 14 months, while aggregated reports can remain longer.
Umami is self-hosted at umami.philippkrueger.com on IONOS server infrastructure in Germany. It measures page URLs and titles, referrers, browser language, screen size, device type, and approximate location without analytics cookies. It processes your IP address and browser data to create a session identifier; the IP address is not stored as a field in standard Umami analytics records. This remains processing of personal data. The self-hosted analytics records remain until manually deleted; no fixed deletion period is currently set.
Contact form and email
The Formling contact form collects your name, email address, project description, choices about the type and timing of work, and preferred contact method. Depending on what you enter, it may also collect your company, phone number, website address, budget, and other details. The form can record source or campaign parameters from the link you used. Form submissions are stored in this WordPress installation for up to 90 days; submissions classified as spam are retained for up to 30 days. A notification is sent to me by email. I delete contact emails when no longer needed, at the latest after 90 days, unless a legal obligation requires longer retention.
If you email me directly, I receive the content and technical email delivery data. I use contact information to reply and, where relevant, take steps toward or carry out a contract. The legal basis is Article 6(1)(b) GDPR for contractual enquiries and my legitimate interest in answering other messages under Article 6(1)(f) GDPR. Hosting and mail delivery providers process these messages to deliver and store them. Contact form enquiries are not added to a marketing list.
Comments
If you comment on an article, WordPress processes the comment, your name and email address, any website address you provide, your IP address, and browser details. This supports publication, moderation, and spam prevention. Approved comments and the name you supply can be visible publicly. Comments remain until removed or until a valid deletion request is fulfilled, unless retention is required by law. The legal basis is my legitimate interest in discussion and abuse prevention (Article 6(1)(f) GDPR). Optional comment-detail cookies are set only when you choose that option.
External links and transfers
Links to external sites, including LinkedIn, are opened only when you follow them. Those providers then process requests under their own policies. Google Analytics and Wordfence may involve processing outside the EEA; their linked policies describe applicable safeguards. The site does not use your contact form details for automated decisions with legal or similarly significant effects.
Your rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction, or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing. Contact me at [email protected]. You can also lodge a complaint with Malta’s Information and Data Protection Commissioner or another competent supervisory authority.
