This website is my personal job application page. I do not offer goods or services through it, I do not trade, and I do not enter into contracts. It consists of a home page, this privacy policy and an error page.
Below I describe what personal data arises, what I use it for, and what rights you have. This text follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
1 Controller
I am the controller for the processing described here:
Alexander van der Berg
Zurich, Switzerland
Email: alexander@vanderberg.de
For questions about data protection and to exercise your rights, please contact me by email.
2 When you visit the website
The website is hosted on GitHub Pages (GitHub, Inc., United States). When you open a page, your browser transmits technically necessary data that GitHub records in server logs: your IP address, the requested path, browser type and operating system, the referring page, and the date and time. Without this data a page cannot be delivered. I have no access to these logs myself; GitHub's own privacy statement applies in addition.
Beyond that, this website processes nothing. It sets no cookies, embeds no fonts, maps, videos or other third-party content, uses no analytics or tracking tools, performs no profiling, makes no automated individual decisions, and sends no newsletter. All images, stylesheets and scripts are loaded from the same domain.
3 Contact form
The home page has a contact form. If you use it, the data you enter is transmitted to Formspree (Formspree, Inc., United States), which receives the message and forwards it to me. Formspree acts on my behalf in doing so.
Collected are: first name, last name and email address (required), organisation (optional) and the text of your message. I use these details solely to answer your enquiry and pass them on to no one else.
Your message is stored at Formspree and is also held in my email inbox. I delete enquiries once they are settled and no follow-up is expected, at the latest after twelve months. You may request earlier deletion at any time. Formspree's own privacy policy applies in addition.
Use of the form is voluntary. You may instead contact me directly by email, in which case no data is transmitted to Formspree.
4 Legal bases
Where the GDPR applies, I rely on my legitimate interest under Art. 6(1)(f) GDPR: the interest in operating the website securely and reliably (section 2) and in answering enquiries addressed to me (section 3). If you make contact with a view to an employment relationship, Art. 6(1)(b) GDPR applies in addition.
Under Swiss law, as a private individual I may process personal data as long as I observe the principles in Art. 6 FADP, in particular purpose limitation, proportionality and transparency. No separate justification under Art. 31 FADP is required for this.
5 Transfers to the United States
Both providers named above are based in the United States, so your data is transferred there.
GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. For transfers from Switzerland and the EEA there is therefore a recognised level of protection. You can look up the certification on the official list at dataprivacyframework.gov.
Formspree, Inc. is not covered by an adequacy decision of the European Commission or by a recognition of the Swiss Federal Council. It therefore cannot be ruled out that US authorities access the transmitted data, and that you have no remedies against this comparable to those in Switzerland or the EEA. Should you wish to avoid this transfer, please use direct email contact rather than the form.
6 Your rights
Within the limits of applicable law, you have the right to request information about the data processed about you, to request its correction or deletion, to have processing restricted, and to receive your data in a common format or have it transferred to another party.
Right to object: where I process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time (Art. 21 GDPR). I will then stop processing the data unless I can demonstrate compelling legitimate grounds.
Providing this information is free of charge. To make sure I do not disclose data to the wrong person, I may follow up if there is doubt about your identity, normally via the email address your request came from. I do not require a copy of an identity document for this.
You may also lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch). Where the GDPR applies, you may contact the supervisory authority of your habitual residence or place of work.
7 Data security
The website is served exclusively over HTTPS. It embeds no third-party content and further restricts the permitted sources through a Content Security Policy. Even so, transmission over the internet can never be made entirely secure.