Privacy Policy

Last updated: 17 July 2026. This is a simple personal website that processes as little personal data as possible.

1. Controller

2. Hosting and server logs

This website is self-hosted on our own server at Hetzner Online GmbH, Nürnberg, Germany (EU). When you visit, the web server automatically processes technical access data: your IP address, the date and time of the request, the page requested, the referring URL, and your browser and operating system (user agent). This is necessary to deliver the site securely and reliably. Legal basis: our legitimate interest in a stable, secure website (Art. 6 (1)(f) GDPR). These logs are kept only briefly and then deleted.

3. Analytics (Umami)

We use Umami, a privacy-friendly analytics tool that we self-host on our own server (Hetzner, Germany) — your data is not shared with any third party. It measures aggregate usage such as page views, referrers and approximate country. It uses your IP address only transiently to derive your country and a daily-rotating, hashed visitor identifier; it does not set cookies, does not store your raw IP address, and does not track you across other websites. Legal basis: our legitimate interest in understanding site usage (Art. 6 (1)(f) GDPR). Because no cookies or comparable technologies are used, no consent is required.

4. Embedded video

One venture on the home page links to a short film hosted on YouTube. Nothing is loaded from YouTube until you actively open the video; when you do, it is embedded via youtube-nocookie.com (YouTube’s privacy-enhanced mode, which does not set cookies until you interact with the player). Once it plays, Google/YouTube’s own privacy policy applies.

5. External links

This site links to third-party services (e.g. LinkedIn, GitHub, InfraNest, TrainingsTeller). Once you follow such a link and leave this site, the privacy policy of the respective provider applies; we have no control over their data processing.

6. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). To exercise any of these, email hello@steenman.org.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).