Datenschutzerklärung according to Art. 13 GDPR.
Last updated: 29 October 2026
This policy explains how personal data is processed when you visit kkirchheim.de.
Controller §
The controller is Konstantin Kirchheim. Contact details, including the postal address, are available in the legal notice.
Email: mail [at] kkirchheim.de
Server logs §
When you visit the website, our server records:
- Your IP address.
- The date and time of the request.
- The requested URL, HTTP status code and amount of data transferred.
- The referring page, if supplied by your browser.
- Your browser’s user agent string.
We process these data to deliver the website, diagnose technical problems, detect and prevent attacks, and produce the usage statistics described below. The legal basis is Article 6(1)(f) GDPR: our legitimate interests in operating a reliable, secure website and understanding how it is used.
Server log files are automatically deleted after 14 days. Security signals shared with CrowdSec are subject to the separate processing described under Attack protection.
Hosting §
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on a server in Nuremberg, Germany.
Hetzner provides hosting as our processor under a data processing agreement pursuant to Article 28 GDPR. The separate arrangements for security information shared with CrowdSec are described below.
Further information: Hetzner privacy policy.
Usage statistics §
We use GoAccess, running on our own server, to generate statistics such as page views and referring sites from the server logs. GoAccess’s IP-anonymisation option is enabled, which truncates IP addresses for statistical processing.
We do not use tracking scripts, tracking pixels or third-party analytics services. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in understanding how the website is used.
Attack protection §
We use CrowdSec to analyse server logs for suspected attacks, such as vulnerability scans and brute-force attempts. Addresses flagged by security rules or community blocklists may be blocked automatically and temporarily.
When an attack pattern is detected, the associated IP address, incident type, timestamp and technical signal metadata may be transmitted to CrowdSec SAS, France. These signals contribute to a shared IP-reputation database and may be distributed to participating members and partners. Routine access logs are not uploaded as a whole.
For this shared processing, CrowdSec describes itself and contributing operators as joint controllers. CrowdSec coordinates requests concerning the shared data; you may contact us or dpo@crowdsec.net. We remain responsible for our local security measures.
CrowdSec normally retains full IP addresses for up to three months and subsequently reduces identifying detail. For specified investigation or training purposes, retention before anonymisation may extend to one year. CrowdSec states that transfers outside the EU rely on European Commission standard contractual clauses where required.
Further details, including responsibilities, retention and transfer safeguards, appear in the CrowdSec privacy policy and EULA, section 13.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in protecting the server and contributing to the detection and prevention of attacks. If you believe you have been blocked incorrectly, please contact us.
Cookies and theme preference §
This website sets no cookies.
If you select light or dark mode, your preference is saved in your browser’s local storage so it can be remembered across visits. It is not sent to us and remains until changed or removed by clearing your browser’s site data. Storage serves the display preference you expressly requested, pursuant to § 25(2) no. 2 TDDDG.
Third-party content §
Scripts, styles, fonts and images are served from our own server. Site search runs entirely in your browser; search queries are not sent to us or to third parties. Viewing the website does not load embedded content from external providers.
External links, such as links to GitHub, Google Scholar or YouTube, take you to independently operated websites. When you follow them, those providers process data under their own privacy policies.
Your rights §
Subject to the applicable legal conditions, you may request access to your personal data, rectification, erasure or restriction of processing. The right to data portability applies where processing is automated and based on consent or a contract.
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.
To exercise your rights, contact us using the details above.
You may also lodge a complaint with a data protection supervisory authority, including the Landesbeauftragter für den Datenschutz Sachsen-Anhalt.
You are not legally or contractually required to provide personal data to visit this website. However, processing your IP address is technically necessary to deliver pages.
Automated security assessment and blocking are described above. We do not make automated decisions producing legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.