Data controller
Christoph Meier
Röttgen 111
42109 Wuppertal
Germany
contact@mei3r.de
Scope
This notice describes the personal portfolio and blog. Public accounts, comments, newsletters, a shop, a contact form, analytics and advertising trackers are not currently planned. Updated: 2 November 2026.
Hosting and technical delivery
The website and email mailbox are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Requests involve technical connection data such as IP address, time, requested URL, browser information and, where applicable, the referring page. This supports delivery and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is reliable operation and protection against abuse.
STRATO states a maximum seven-day retention period for visitor IP addresses retained for attack detection. This is not a uniform period for all error logs, messages or backups. STRATO processes hosting data as a processor.
Language, colour scheme and browser storage
On an initial visit, language is selected from existing preferences or browser settings. A new persistent language choice is saved only when you deliberately use the language switch. The first-party portfolio2_language cookie lasts up to one year; portfolio2-design-language may additionally be stored in your browser’s localStorage. portfolio2-design-theme stores an explicitly selected light or dark scheme. Returning to system mode removes the saved theme choice.
localStorage has no built-in expiry and remains until you or your browser clear it. These settings serve your requested presentation and do not track your behaviour. Necessary storage of an expressly requested setting relies on section 25(2), no. 2 TDDDG and, where personal data is involved, Article 6(1)(f) GDPR. You may delete or block these entries in browser settings; the website remains usable with defaults. Fonts, icons and images are generally served locally; public WordPress emoji detection and its external image fallback are disabled.
YouTube videos
YouTube is initially blocked. “Load YouTube video” activates a player through youtube-nocookie.com, transmitting IP and request data to Google/YouTube; provider storage may be used. Activation relies on Article 6(1)(a) GDPR and section 25(1) TDDDG. Permission applies only to that video on the current page. “Disable video” removes the player but cannot retrieve data already sent. Reloading requires activation again.
Google identifies Google Ireland Limited as its responsible entity for EEA users. Processing outside the EEA is possible. Google’s privacy and transfer information explain further processing. Privacy-enhanced mode does not mean that no data is processed after activation.
Email contact and external links
If you contact us by email, we process your sender address and message to respond. Article 6(1)(f) GDPR applies; our legitimate interest is answering your enquiry. Routine completed enquiries are manually reviewed and deleted no later than six months after completion unless a specific reason for continued retention exists, such as ongoing correspondence or legal claims.
LinkedIn, Xing and Instagram are ordinary links with locally served icons. These icons alone do not connect to those services. Following an external link is subject to that provider’s processing notices.
Administration, security and backups
The unlisted WordPress admin uses authentication, test and settings cookies and server-side sessions. Login limiting processes IP-related failed attempts and lockouts. The llar_login_flow cookie currently lasts 24 hours. Failed attempts have a 24-hour assessment window; lockouts initially last 20 minutes and up to 24 hours after repetition. Expired temporary records may remain until the next technical cleanup; this does not imply immediate deletion from all backups.
This processing protects access and prevents abuse under Article 6(1)(f) GDPR and, for necessary access storage, section 25(2), no. 2 TDDDG. The security plugins have no configured cloud connection. TOTP and backup-code verification data belong to the protected admin account. Manual backups may contain database, media and configuration data. The retention target is 30 days; backups are managed manually, without automatic rotation. Copies no longer required must be deleted during manual maintenance once their purpose ends.
Your rights and contact
Subject to the relevant legal conditions, you may request access, rectification, erasure, restriction and data portability. You may withdraw consent for future processing; earlier lawful processing is unaffected. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Contact the email address above.
You may complain to a data protection supervisory authority, particularly where you normally live, work or believe an infringement occurred. The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is a point of contact for the operator in that state. The website itself does not make automated decisions producing legal or similarly significant effects.