Privacy Policy

This policy explains what personal data is processed when you visit this website, why, and what rights you have. The binding version under German law is the German version (Datenschutzerklärung). This English translation is provided for convenience.

1. Controller

Controller within the meaning of Art. 4 (7) GDPR:

Norman Holz
Henry-Budge Str. 11d
22297 Hamburg, Germany
Email:

A separate Data Protection Officer is not required under Art. 37 GDPR. For any privacy question, contact me directly using the email above.

2. Hosting, content delivery and server log files

This website is hosted on GitHub Pages, operated by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, a subsidiary of Microsoft Corporation. When you open a page, your browser automatically transmits the following data to GitHub:

• IP address
• Date and time of the request
• Requested URL
• HTTP status and amount of data transferred
• User agent (browser and operating system)
• Referrer URL, if any

Processing takes place on the basis of Art. 6 (1) (f) GDPR. The legitimate interest is the secure, stable and efficient delivery of this website. Log data for regular visitors is handled by GitHub under their own retention rules; I do not store or access those logs myself.

Data transfer to the United States is covered by GitHub's certification under the EU-US Data Privacy Framework. See GitHub's privacy statement: GitHub General Privacy Statement.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94103, USA, processes connection data, including your IP address, only transiently to route requests, terminate TLS encryption, protect the chatbot API, apply rate limiting, and keep the site secure and available. Processing is based on Art. 6 (1) (f) GDPR; the legitimate interest is secure and efficient delivery. A data processing agreement under Art. 28 GDPR is in place. Transfer to the United States is covered by Cloudflare's certification under the EU-US Data Privacy Framework.

Analysis of automated crawler access: To understand how automated agents and AI crawlers (for example ClaudeBot, GPTBot, PerplexityBot) reach the public content of this site, I record technical metadata for requests that identify themselves as automated crawlers. The recorded fields are limited to: timestamp, requested URL, HTTP status code, and the user-agent string. IP addresses are not stored for this purpose, and requests from ordinary browsers are not recorded. This data does not relate to identified or identifiable natural persons. Legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is ensuring automated agents can access the public content correctly and improving the machine-readability of the site. This data is deleted after 12 months.

3. Browser-based language and color scheme selection

On each visit, language is selected from your browser's language preference (German if available, otherwise English). If you switch languages manually, this site stores your selected language in local storage under portfolio.preferredLocale. The stored value is only en or de, stays in your browser, and is not sent to me.

The color scheme follows your system setting when available and falls back to dark mode if it is unavailable. Manual color scheme changes are not stored.

No advertising or cross-site tracking cookies are set. Chatbot observability is described separately in Section 5.

4. Contact form and email

The contact buttons on this site lead to the contact form. When you submit the form, I process the fields you provide, such as your name, email address, company, website or product link, and message, to respond to your inquiry. The form may also include a hidden spam-prevention field that ordinary visitors do not fill out.

If the contact form is configured with Formspree, Inc., the submitted form data is transmitted to Formspree so it can forward the inquiry to me and store the submission in the Formspree dashboard. You can also contact me directly by email using the address in the imprint. If the form falls back to your email app, no data is transmitted to me until you send the email yourself.

Legal basis: Art. 6 (1) (b) GDPR for inquiries related to a contract or pre-contractual steps, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries). Messages are stored as long as needed to handle the inquiry and to meet legal retention obligations. Formspree's privacy policy is available at formspree.io/legal/privacy-policy/.

5. Chatbot

This website may provide an optional chatbot. When you send a message to the chatbot, I process the text you enter, the generated answer, a conversation ID, a request ID, timestamps, technical status data, latency information, error metadata, and technical request data such as IP address and user agent. Depending on what you write, your message may contain personal data. Please do not enter secrets, passwords, API keys, confidential client data, health data, payment details, or other sensitive information.

Processing is used to answer questions about my services and website, operate the chatbot securely, prevent abuse, debug errors, and improve answer quality. Legal basis is Art. 6 (1) (f) GDPR. The legitimate interest is providing a useful information and contact feature and operating it securely. If your question relates to a possible engagement or contract, Art. 6 (1) (b) GDPR may also apply.

The chatbot backend is hosted by Render Services, Inc., 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA. The Render server for the chatbot backend is located in Frankfurt, Germany. Chatbot requests are processed by the backend service hosted on Render. Render processes chatbot request and response data, network data, log data, and technical request metadata as a processor under Art. 28 GDPR.

Cloudflare also routes and protects traffic to the chatbot API, including abuse prevention and rate limiting. For this purpose, Cloudflare processes technical request metadata such as IP address, request headers, URL path, and timestamps.

For chatbot observability, tracing, debugging, and reliability monitoring, I use Langfuse Cloud EU. The provider is Langfuse GmbH, Oranienburgerstraße 91, 10178 Berlin, Germany. Langfuse processes this data as a processor under Art. 28 GDPR. The data is used for observability and analytics of the chatbot, not for advertising. According to Langfuse's data processing terms, customer data is not used to train AI models.

The data sent to Langfuse may include request IDs, conversation IDs, guardrail outcomes, error states, latency, token usage metadata, model parameters, and prompt source metadata. In the default production configuration, visible chat messages are not sent to Langfuse as trace input or output. If message tracing is enabled in the future, chatbot messages and responses may also be processed by Langfuse for observability and quality monitoring.

Chatbot logs and observability data are deleted after 30 days, unless longer storage is required to investigate abuse, security incidents, or legal claims. The conversation ID stored in your browser is kept in sessionStorage for the current browser tab and is usually deleted when the tab or browser session ends.

6. Links to third parties

This site links to external profiles and resources (GitHub, LinkedIn, Instagram, YouTube, Xing, Credly, edX, AWS Training, former employers, and others). These are plain links. No content is embedded, no tracking pixels are loaded, and no data is sent to those providers until you click. Once you do, the respective provider's privacy policy applies.

7. Profile download

The profile PDF (/norman-holz-cv.pdf) is served from GitHub Pages like any other file on this site. Accessing it generates the same server log entry described in Section 2. No separate processing takes place.

8. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on Art. 6 (1) (f) (Art. 21)
• withdraw consent at any time, where processing is based on consent (Art. 7 (3))

To exercise any of these rights, contact me via the email address above.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for me is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 7. OG
20459 Hamburg, Germany
datenschutz-hamburg.de

9. Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website. The chatbot generates informational answers only. It does not make decisions with legal or similarly significant effects.

10. SSL/TLS encryption

This site is served exclusively over HTTPS. Traffic between your browser and the server is encrypted using TLS provided by Cloudflare, with GitHub Pages as the origin host.

11. Changes to this policy

I may update this policy to reflect changes to the site or the legal situation. The current version is always available at this URL. The date at the top indicates the last revision.