Privacy policy
1. Data controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is Valentin Eiber, Kurfürstenstraße 19, 10785 Berlin, Germany, email: hello@valentineiber.com.
No data protection officer is appointed, as none is required by law. For any privacy question, please write to the address above.
2. Principles and legal bases
Personal data is processed only where this is necessary to provide a functioning website together with my content and services, or where you have given consent.
Depending on the case, the legal basis is your consent (Art. 6 (1) (a) GDPR), the performance of a contract or steps taken prior to entering into one (Art. 6 (1) (b) GDPR), a legal obligation (Art. 6 (1) (c) GDPR), or my legitimate interest in operating this website securely and appropriately (Art. 6 (1) (f) GDPR).
3. Hosting
This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When the site is accessed, the hosting provider processes technically necessary access data on my behalf.
The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in providing the website securely and reliably. A data processing agreement under Art. 28 GDPR is in place with the provider.
4. Server log files
Each time the site is accessed, information transmitted by your browser is recorded automatically: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request, and the IP address.
This data is not merged with other sources and is used solely for technical operation, error analysis, and defending against attacks. The legal basis is Art. 6 (1) (f) GDPR. It is deleted after seven days at the latest, unless a security incident requires longer retention.
5. SSL / TLS encryption
For security reasons this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar starting with “https://”. While encryption is active, the data you send me cannot be read by third parties.
6. Cookies and consent
On your first visit, a banner asks which services may load. Without your consent, this website loads no analytics, marketing or external services and sets no cookies for those purposes. Refusing is as easy as agreeing.
Your choice is stored in your browser’s local storage (localStorage), so I do not have to ask on every visit. This storage is strictly necessary (Section 25 (2) no. 2 TDDDG). Only the chosen categories and the time of your choice are stored, and none of it is sent to me or anyone else.
The categories are “Statistics” (Google Analytics, Microsoft Clarity, sections 8 and 9), “Marketing” (LinkedIn Insight Tag, section 10) and “External content” (HubSpot booking calendar, section 11). The legal basis for these services is your consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You can change or withdraw your consent at any time through the “Cookie settings” link at the bottom of every page. After a withdrawal, I remove the affected cookies of this website and reload the page without the services concerned.
7. Google Tag Manager
This website uses Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is a tool through which the services named in sections 8 to 10 are embedded. Tag Manager itself sets no cookies, but loading it transmits your IP address to Google.
Tag Manager is only loaded once you have consented to the “Statistics” or “Marketing” category. The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.
8. Google Analytics 4
With your consent to the “Statistics” category, I use Google Analytics 4 by Google Ireland Limited. Google Analytics shows which pages are visited, where visitors come from, how long they stay and which devices and browsers they use. For this, cookies (e.g. “_ga”) are set and kept for up to two years. Google Analytics 4 does not store full IP addresses.
I use Google Consent Mode: with every request, Google learns which categories you have allowed, and processes no analytics data without consent. The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. A data processing agreement under Art. 28 GDPR is in place with Google.
9. Microsoft Clarity
With your consent to the “Statistics” category, I use Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors use the site, such as mouse movements, clicks and scrolling, and shows this as heatmaps and session recordings. Anything typed into form fields is masked.
Clarity sets cookies (“_clck” for up to one year, “_clsk” for one day). The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.
10. LinkedIn Insight Tag
With your consent to the “Marketing” category, I use the LinkedIn Insight Tag by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It measures whether visitors reach this website through my LinkedIn ads, and makes it possible to address visitors of this website again on LinkedIn later. LinkedIn receives, among other things, your IP address, device and browser data and the pages visited, and sets cookies kept for up to one year.
I only receive aggregated reports from LinkedIn, no information about individuals. LinkedIn and I are joint controllers for collecting data through the Insight Tag (Art. 26 GDPR). The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.
11. Meeting booking via HubSpot
The contact page can embed the booking calendar of HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland. It is only loaded once you have consented to the “External content” category or clicked “Show calendar” on the contact page. Loading it establishes a connection to HubSpot servers, transmits your IP address and technical connection data, and HubSpot sets cookies. The legal basis for loading it is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.
Alternatively, you can book directly on HubSpot’s booking page or email me. If you book a slot, I process the details you provide, usually name, email address and what you would like to discuss, in order to prepare and hold the call. The legal basis for this is Art. 6 (1) (b) GDPR. A data processing agreement under Art. 28 GDPR is in place with HubSpot.
12. Contact by email
If you contact me by email, your details are stored in order to handle your enquiry and any follow-up questions. I do not pass this data on without your consent.
The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, and Art. 6 (1) (f) GDPR otherwise.
13. Video
The home page includes a video. It is stored on the same server as this website, no third-party video service is used, and playing it transmits no data to anyone else.
The same applies to a client’s video statement on the about page. Both videos are deliberately loaded only once you click them. Until then you see a still frame or a photo. Requesting them is covered by the same server log files as any other file on this website, see section 4. No cookies are set.
14. Fonts
This website uses the typefaces Schibsted Grotesk, JetBrains Mono and Lazydog. All three are bundled at build time and served from my own server. No connection to Google or any other provider is made, and your IP address is not transmitted to third parties.
15. Links to LinkedIn
This website links to my LinkedIn profile. This is a plain hyperlink without a social media plugin. Data is only transmitted to LinkedIn once you click that link, at which point LinkedIn’s own privacy policy applies. The LinkedIn Insight Tag is separate from this and only runs with your consent, see section 10.
16. Transfers to third countries
Google, Microsoft, LinkedIn and HubSpot may also process personal data in the United States. Transfers are based on the EU-US Data Privacy Framework under Art. 45 GDPR where the provider is certified, and additionally on the European Commission’s standard contractual clauses under Art. 46 (2) (c) GDPR.
Please note that the United States does not offer a level of data protection comparable to the EU, and that access by authorities there cannot be entirely ruled out. By consenting to the respective category, you also consent to this transfer (Art. 49 (1) (a) GDPR).
17. Retention
Personal data is stored only for as long as the respective purpose requires or a statutory retention period applies. Commercial and tax retention periods are generally six or ten years. Once the purpose ceases to apply and the periods have expired, the data is routinely deleted or blocked.
18. Your rights
You have the right at any time to information about the personal data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), and to data portability (Art. 20 GDPR).
You also have the right to object, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out until then.
An informal message to hello@valentineiber.com is enough to exercise these rights.
19. Right to lodge a complaint
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work, or the place of the alleged infringement. The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information.
20. Changes to this privacy policy
I update this privacy policy whenever the processing or the services used change. The version published on this page is the one that applies.