Legal

Privacy Policy

This notice explains, pursuant to Art. 13 GDPR, which personal data are processed when you visit this website, for what purpose, and on what legal basis.

This site is deliberately simple: it sets no cookies, embeds no third-party content, loads no fonts from external servers, and has no contact form. No consent banner is therefore required — there is nothing here for which consent would need to be obtained.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Dmytro Kurkin
Mühlenbach 17
50321 Brühl
Germany

Telephone: +49 1512 515 3069
Email: dima@kurkin.de

2. Data protection officer

No data protection officer has been appointed, and none is required under § 38(1) BDSG: fewer than 20 people are permanently engaged in the automated processing of personal data, and no processing takes place that would require a data protection impact assessment. For any data protection matter, please use the contact details above.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes the data solely on my behalf and on my instructions; a data processing agreement under Art. 28 GDPR is in place.

Each time a page is requested, the server automatically records access data transmitted by your browser:

• IP address of the requesting device
• date and time of access
• name and path of the file requested
• volume of data transferred and whether the request succeeded
• browser type and version, and operating system
• the previously visited page (referrer), where your browser sends it

Purpose and legal basis: these data arise as a technical necessity of delivering the page at all, and additionally serve the stability and security of the service. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in delivering the site without fault and in defending against attacks. These data are not combined with other sources and are not analysed with a view to identifying individuals.

Retention: log data are deleted once they are no longer necessary for the purpose for which they were collected. That is the case at the latest once the session has ended and there is no security incident to investigate; where there is such an incident, until it has been conclusively resolved.

Transfer to a third country: Vercel Inc. is established in the United States, and the project is deployed in the iad1 region (Washington, D.C., USA). Personal data are therefore transferred to a third country. That transfer is based on the European Commission's Standard Contractual Clauses of 4 June 2021 (modules 1 to 3), which form part of the data processing agreement with Vercel. No adequacy decision of the European Commission underlies this transfer. Notwithstanding the Standard Contractual Clauses, access to the data by US authorities cannot be entirely ruled out.

4. Audience measurement

This site uses Vercel Web Analytics, a service of the same Vercel Inc., to see which content is being read. The script required for this is served by the site itself; no connection to a third-party server is made.

The measurement works without cookies. It sets no cookies and neither stores nor reads information in your device's local storage or session storage. Because no information on your terminal equipment is accessed, consent under § 25(1) TDDDG is not required.

The data processed are the page requested, the referrer, coarse information about device and browser, and — at least transiently — your IP address, from which an approximate geographic location and a non-persistent visitor identifier are derived. No profiles are created from this, and I am unable to identify individuals. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in keeping a data-minimising record of how the site is used. The third-country transfer described in section 3 applies here too.

You may object to this processing at any time — see section 10.

5. Storing your theme choice

The site can be switched between a light and a dark appearance. If you use the toggle, your choice is stored in your browser's local storage under the key psi-theme, with the value light or ember.

This entry stays on your device, is transmitted to no one, and contains no identifier capable of identifying you. It is written only if you actually use the toggle, and read only to restore your choice on your next visit. The storage is therefore strictly necessary in order to provide a service you have explicitly requested, and is exempt from consent under § 25(2) no. 2 TDDDG. You can delete the entry at any time through your browser settings.

6. Contacting me by email

There is no contact form on this website. The email address given is a mailto: link — clicking it opens your own mail program. The site itself collects no data in the process.

If you write to me, I process the information in your message — your email address, your name, and whatever else you choose to tell me — in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where your message concerns entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR, with the legitimate interest of answering enquiries.

The mailbox is operated using Google Workspace. For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a data processing agreement is in place here as well. Transfer to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission established an adequate level of protection by decision of 10 July 2023.

Retention: your message is deleted once your enquiry has been conclusively dealt with and no statutory retention obligation applies. Where the correspondence becomes part of a business transaction, the commercial and tax retention periods of six and ten years respectively apply (§ 257 HGB, § 147 AO).

7. Links to external websites

This site links in several places to third-party services — professional networks, source code platforms, and clients' websites. As long as you do not click such a link, no data are transmitted to those providers: these are ordinary hyperlinks, not embedded content. Once you follow a link, the privacy policy of the provider concerned applies, over whose processing I have no influence.

8. Recipients at a glance

• Vercel Inc. (USA) — hosting and audience measurement; processor, transfer based on the Standard Contractual Clauses
• Google Ireland Limited (Ireland), and where applicable Google LLC (USA) — operation of the email mailbox; processor, transfer based on the adequacy decision for the EU-U.S. Data Privacy Framework

There are no other recipients. Personal data are neither disclosed for advertising purposes nor sold.

9. Your rights

You have the following rights against the controller:

• Access to whether and which of your data are processed (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure, where no retention obligation stands in the way (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR) — see the next section

An informal message to the contact details in section 1 is enough to exercise any of them. No consent is obtained on this website, so withdrawal of consent under Art. 7(3) GDPR does not arise.

10. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR.

On this website that concerns the server log files (section 3) and the audience measurement (section 4). If you object, I will no longer process the data concerned unless I can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No particular form is required; an email to the address in section 1 is sufficient.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority competent for the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Telephone: +49 211 38424-0
Online complaint form: ldi-extern.nrw.de

You may equally contact the supervisory authority of your habitual residence or place of work.

12. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

13. Providing your data

You are under no statutory or contractual obligation to provide personal data. The access data described in section 3 arise as an unavoidable technical consequence of visiting the site; beyond that, you need provide nothing. Whether you write to me is entirely your choice — though without your details an enquiry cannot be dealt with.

14. Encrypted transmission

This site is served exclusively over a TLS-encrypted connection, recognisable by "https://" in your browser's address bar. Content you transmit when requesting a page therefore cannot be read by third parties.

15. Status of this notice

As at August 2026. I will update this notice as soon as the processing described here or the legal position changes. The version published on this page applies.

The German version is the legally binding one: Datenschutzerklärung. The legal notice is at Legal Notice.