Privacy Policy

The controller responsible for data processing on this website is:

Christian Maier
c/o COCENTER
Koppoldstr. 1
86551 Aichach
Germany

Email: kontakt@christian-maier.com

This website is technically provided via Cloudflare infrastructure. When the website is accessed, the hosting infrastructure automatically processes technically necessary information (so-called server log data) transmitted by your browser. This includes in particular:

• IP address of the requesting device
• date and time of access
• page or file accessed
• browser type and version as well as operating system
• referrer URL (previously visited page)

Processing this data is necessary in order to deliver the website, to ensure the stability and security of operations and to analyse technical faults. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website). This data is not merged with other data sources.

If you contact me via the contact form, the data you enter is processed:

• your name
• your email address
• the content of your message

This data is processed exclusively for the purpose of handling and answering your enquiry. Your message is sent by email to kontakt@christian-maier.com. Technical delivery takes place via the email service Resend. Email is received via a mail service set up for this domain with Apple (iCloud Mail), so that your message arrives in a mailbox there.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Before submitting, you must tick a checkbox confirming that you have read and acknowledged this privacy policy. This confirmation is an acknowledgement of information about the processing and not a consent within the meaning of Art. 6(1)(a) GDPR; it does not change the legal bases stated above. The confirmation itself is not stored for the contact form.

Data submitted via the contact form is deleted as soon as it is no longer required for handling your enquiry and no statutory retention obligations prevent deletion.

To protect the contact form, the request form for portfolio documents and this website against automated access, spam and misuse, I use Cloudflare Turnstile. The provider is Cloudflare, Inc.

As part of this check, a connection to Cloudflare or challenges.cloudflare.com may be established. In doing so, technical information in particular may be processed, for example:

• IP address
• browser and device information
• technical connection data
• interaction and security signals
• the verification token generated by Turnstile

This information is used to distinguish legitimate human access from automated or abusive access. Where Cloudflare uses technical storage or security mechanisms that are necessary for the security check, this is done exclusively for the stated protection purpose. Turnstile is not used on this website for any advertising or marketing purposes of my own.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in protecting the website, and in particular the contact form, against spam, automated access and misuse.

Using the request form for portfolio documents, you can ask for personal access to my complete portfolio documents. The data you provide is processed: first name, last name, email address, optionally phone number and company, the selected reason for the request and your message. In addition, the processing status, an internal note and timestamps are stored. Submission is also protected by Cloudflare Turnstile (see section 4).

Once I approve a request, an individual, randomly generated access link is created and sent to you by email. For each access, a label, where applicable a contact person and email address, the origin of the request, the language, the expiry date and any revocation are stored. The portfolio documents themselves are kept in a non-public storage area and is only delivered after the access has been verified on the server. The protected area is excluded from search engine indexing.

If a personal access has expired or has been ended, you can submit a renewed access request from the access page. The details already held for your previous access (in particular name, email address, and where applicable company and occasion) are carried over into a new request and stored together with the reference to the previous access. The previous access is not reactivated. You receive a confirmation of receipt by email; a new access link is only created after renewed approval.

To make the use of a personal access traceable, events are stored with their time and type (opening, downloading, printing via the built-in viewer) and assigned to the respective access. No device or browser fingerprinting takes place and no usage profiles are created.

After an access request is received, transactional emails are sent that are directly connected to this process: a confirmation of receipt to the requesting person, a notification to me about the new request and — after my explicit approval — an approval email containing the personal access link. Email addresses from these processes are not used for advertising or newsletters; no marketing processing takes place.

In addition to access granted on request, I can create individual direct accesses myself in the protected admin area ("self-created direct access"), for example as part of an application I send out myself. Where entered by me, this may store in particular a label or company, where applicable a contact person and email address, an internal note, the creation and expiry dates, the status of the access and the related access events. Where these details relate to individuals, they also constitute personal data. For active self-created direct accesses, an email reminder may be sent to me automatically when an access remains valid for only about seven days; this message serves solely my internal administration and is not sent to the recipient of the access.

The management of access requests, personal accesses, self-created direct accesses, activity information and the portfolio documents takes place exclusively in a protected administrative area secured by authentication and additional two-factor authentication (2FA).

Once a personal access granted after a website request has expired or been deactivated, the data stored for this case (request data, access record and the related access events) is deleted automatically after a self-imposed period of 30 days. This period does not follow directly from a statutory requirement; it is my own decision and allows follow-up questions and renewed access requests to be handled within a reasonable time. Earlier deletion at your request is possible at any time. Data is kept longer only where this is legally required or necessary to establish, exercise or defend legal claims.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR. The legitimate interest lies in making my portfolio documents available only to authorised persons and preventing misuse. Requests, accesses and access events are deleted as soon as they are no longer required for this purpose.

For the request form as well as for a renewed access request made through an expired or deactivated personal access, you must confirm before submitting that you have read and acknowledged this privacy policy. This confirmation is an acknowledgement of information and not a consent within the meaning of Art. 6(1)(a) GDPR. As a record, only the time of the confirmation and the version date of this privacy policy are stored with the respective request; no further data is collected for this purpose.

This website uses no analytics or statistics services, no marketing or advertising technologies, and no local storage for tracking purposes. No user tracking takes place. The access logging in the protected portfolio documents area (see section 5) is limited to individually approved accesses and does not serve to monitor visitors of the public website; no general visitor profiles are created. The only exception is the contact form and the request form for portfolio documents, where Cloudflare Turnstile is used as a technical security and anti-abuse measure (see section 4); in that context, Cloudflare may use technically necessary storage or security mechanisms.

This website contains a link to my profile on LinkedIn. When you click the link, you leave this website and data is transmitted to LinkedIn. LinkedIn Ireland Unlimited Company is solely responsible for data processing on LinkedIn. The LinkedIn privacy policy applies: https://www.linkedin.com/legal/privacy-policy

Personal data is stored only for as long as is necessary for the respective processing purpose. Server log data from hosting is deleted or anonymised after a short period. Data from contact enquiries is deleted once the enquiry has been conclusively handled, provided that no statutory retention obligations apply.

Access requests for portfolio documents, personal accesses granted on that basis and the related access events are stored for the duration of processing and of the active access. Once such an access granted via a website request has expired or been deactivated, the data belonging to the process is in principle deleted automatically after a self-imposed period of 30 days (see section 5), unless a necessary or legally permissible longer retention prevents this; manual deletion in the admin area is possible earlier.

Self-created direct accesses are not subject to this automatic 30-day period. They are managed by me independently and stored only for as long as is necessary for the organisation, provision and administration of the portfolio documents.

Under the GDPR you have the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent given (Art. 7(3) GDPR) — withdrawal does not affect the lawfulness of processing carried out up to that point

To exercise your rights, an email to kontakt@christian-maier.com is sufficient.

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). The competent authority is in particular the supervisory authority of the federal state in which you reside, or the authority responsible for me.

This privacy policy will be updated as soon as the actual processing operations on this website change.

Last updated: 8 September 2026