Privacy policy

1. Controller

The controller within the meaning of the GDPR is:

Jens Hartmann Burnitzstraße 47 60596 Frankfurt am Main Germany Email: post@weltenbummler.info Phone: +49 69 34877122

I have not designated a data protection officer, as the statutory requirements for one (Art. 37 GDPR, § 38 BDSG) are not met. For any privacy matter, a message to post@weltenbummler.info is enough.

2. Overview

There are exactly four processing operations: visiting the site at the host (section 3), cookieless audience measurement with Plausible (4), error reports to Sentry (5), and your message if you write to me or call (6). Measurement and error reports run via this domain; your browser does not connect to any third party for them.

3. Hosting and server logs (Vercel)

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through its global network. On every visit the host processes the technically necessary access data: IP address, date and time, the address requested, status code, data volume, referring page, and browser and operating system (user agent). They serve delivery, defence against attacks and fault analysis, and are not combined with other data.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is secure and stable operation. Logs are deleted after 30 days at most, unless a specific security incident requires longer investigation. A data processing agreement under Art. 28 GDPR is in place with Vercel. Transfers to the USA are based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) and, where the provider is certified, on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Name resolution (DNS) for the domain is handled by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare only answers at which address the site can be reached; the site itself is not delivered through Cloudflare, and neither page visits nor content reach Cloudflare. The lookup is usually made by your internet provider’s DNS resolver, not by your device. Insofar as any personal data arise in the process, the legal basis is Art. 6 (1) (f) GDPR (keeping the domain reachable).

4. Audience measurement (Plausible Analytics)

For statistical analysis the site uses Plausible Analytics by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia; processing takes place on servers in Germany. Only aggregated details are recorded: page requested, referring page, country or region, device type, browser and operating system, and technical metrics on the loading, responsiveness and stability of the page (Core Web Vitals). To count visits, Plausible derives a daily changing, irreversible checksum from the IP address and user agent; the IP address and user agent themselves are not stored. No cookies are set, nothing is stored on or read from your device, and no profiles are built.

The script and the measurement endpoint run via this domain and are forwarded from there to Plausible; your browser does not connect to the provider. If your browser signals “Do Not Track” or “Global Privacy Control”, the technical metrics are not sent. When a page has been in the foreground for two minutes in total, the site counts this as the event “Read”, with no further details.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly audience measurement to improve the site). Since nothing is stored on or read from your device, no consent under § 25 (1) TDDDG is required — which is why there is no consent banner. A data processing agreement under Art. 28 GDPR is in place with Plausible; processing takes place in the EU. Only the aggregated statistics are retained, with no link to any person.

5. Error reports (Sentry)

So that faults surface and can be fixed, the site reports technical errors in your browser to Sentry, a service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Data are stored in the service’s EU region (Frankfurt am Main).

Only technical details are transmitted: type and message of the error, the stack trace (as text truncated to 2,000 characters), the address of the page concerned, browser and operating system (user agent), timestamp, the version identifier of the site and a random event identifier — at most five reports per page view. No cookies, no user identifier, no profiles. The report runs via this domain and is forwarded from there; your browser does not connect to the provider. Your device’s IP address may reach Sentry in the process; I do not analyse it and do not attribute reports to any person.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in error-free, secure operation). Reports are deleted after 90 days at most. A data processing agreement under Art. 28 GDPR is in place with the provider. Access from the USA, for example by the provider’s support, cannot be ruled out; it is then based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) and, where the provider is certified, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

6. If you write to me or call

There is no contact form. If you email or call me, I process your details — address or phone number, your name if you give it, and the content of your message — to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in answering) and, where a contract or steps prior to one are concerned, Art. 6 (1) (b) GDPR.

I delete the details once the enquiry is settled. If business results from it, the retention periods of commercial and tax law apply: six years for business letters, eight years for accounting records (§ 257 HGB, § 147 AO).

7. What this site does not load or store

The fonts are served from this domain; there is no connection to a font service such as Google Fonts. Images, maps, scripts and styles likewise come exclusively from here — no embeds, no map service, no third-party media; a content security policy enforces this in the browser. The site stores nothing on your device: no cookies, no local storage, no service worker.

Links to other sites, such as Instagram or jenshartmannphoto.com, are plain links. Only when you follow one does your browser connect to the destination; its own privacy policy applies there.

8. Recipients and third-country transfers

The only recipients of personal data are the service providers named here — Vercel, Plausible and Sentry, and Cloudflare for name resolution —, for messages also the providers that carry email and phone calls, and myself. Data are neither sold nor passed on for advertising. Where data may reach the USA, the relevant section names the safeguard the transfer relies on.

9. Obligation to provide data, no automated decisions

You are under no statutory or contractual obligation to provide data. Without the technically necessary connection data, however, the site cannot be delivered, and without an address or number I cannot reply. There is no automated decision-making, including profiling (Art. 22 GDPR).

10. Security

Every connection is TLS-encrypted (HTTPS). The content security policy admits only content from this domain; data go to no one not named in this notice.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). This site asks for consent for no processing; if you have nonetheless given me consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR), and processing carried out until then remains lawful. An informal message to post@weltenbummler.info is enough.

12. Right to object (Art. 21 GDPR)

Where I process data on the basis of a legitimate interest (Art. 6 (1) (f) GDPR) — which is all processing on this site, except where a contract is concerned —, you may object to it at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. A message to post@weltenbummler.info is enough.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for me is: The Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

14. Last updated and changes

This privacy policy was last updated on 27 October 2026. It is revised whenever the processing on this site or the legal situation changes; the version published here applies.