Privacy Policy

Jens Höwelkröger
Lerchenweg 8
33415 Verl, Germany
Email: hi@jens.pm

This website is hosted by Vercel Inc., 340 Pine Street, Suite 700, San Francisco, CA 94104, USA. Each page request is recorded in standard server logs:

• IP address
• Date and time of the request
• Page URL and HTTP referrer
• Browser type and operating system
• HTTP status code

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating a secure and functional website.

Retention: Vercel retains log data for up to 30 days.

Page performance is measured with Vercel Speed Insights (Core Web Vitals such as load and response times). The data points are anonymised and are not linked to individual visitors.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in monitoring and improving website performance.

If you contact me by email (via the "Get in touch" link), your email address and the contents of your message are processed in order to handle your enquiry. Mail to the published address is forwarded by INWX GmbH, Prinzessinnenstr. 30, 10969 Berlin, Germany, to my mailbox, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in responding to your enquiry.

Retention: Correspondence is deleted once the purpose of the communication is fulfilled and no statutory retention obligation applies.

The CV request form collects your name, company and email address. Providing them is voluntary, but without them the CV cannot be sent. Requests are not processed automatically: your details are sent to my mailbox, where I decide individually whether to send the CV. The approval link carries your details in signed form and expires after 48 hours. Emails are delivered by Resend Inc. (USA); my mailbox is provided by Google Ireland Limited.

Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract.

Abuse prevention: To prevent abusive use of the form, your IP address is held in the server's memory for up to ten minutes to count submissions received from it. It is not written to disk.

Legal basis for abuse prevention: Art. 6(1)(f) GDPR — legitimate interest in protecting the form against misuse.

Retention: The request email remains in my mailbox until deleted, at the latest twelve months after the request. Resend retains email and log data for 30 days.

The "Ask Jens" feature answers questions about my professional background. Your question text is transmitted to the Anthropic API to generate the response; no account information or other personal data is required to use it.

Processor: Anthropic, PBC, 548 Market Street PMB 90375, San Francisco, CA 94104, USA.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing an interactive way for visitors to learn about my professional profile.

Abuse prevention: To prevent abusive use and cost inflation, your IP address is held in the server's memory for up to 24 hours to count questions received from it. It is not written to disk and is not stored alongside your question.

Legal basis for abuse prevention: Art. 6(1)(f) GDPR — legitimate interest in protecting the service against misuse.

Retention: This website does not store your question: it is neither recorded in analytics nor written to disk or a database at any point. Anthropic retains inputs and outputs for a limited period for abuse monitoring in accordance with its terms. The IP address used to count requests is discarded after 24 hours at the latest, or sooner if the server restarts.

This website uses PostHog, a product analytics platform provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data is stored on PostHog's EU Cloud (Frankfurt, Germany). The following is collected:

• Technical data your browser sends with each request — the page URL and referrer, browser and version, operating system, device type, screen and window size, and language
• Approximate location — country, city, region and time zone (derived from IP address — the IP itself is not stored, and no postal code or coordinates are kept)
• Identifiers for the visit, the browser window and the device — each generated fresh for that visit and never written to your device
• Interaction events such as section expansions, button clicks, and CV requests
• Time spent on the page, and how far down it you scrolled
• Session recordings: mouse movements, clicks, and scroll behaviour — form inputs are masked before transmission and never recorded, the text of your question and the answer to it are masked, and no keystrokes are captured

PostHog runs in cookieless mode (persistence: 'memory') and creates no individual visitor profiles. No cross-site tracking occurs.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how the website is used to improve it.

Retention: Session recordings are deleted automatically 30 days after they are captured. Analytics events — the data listed above, other than recordings — are kept for as long as this site uses PostHog. They carry no identifier that persists between visits, so they cannot be linked to you or to an earlier visit.

The recipients named above are established in, or transfer data to, the USA. Each transfer is covered by the safeguard stated:

• Vercel Inc. (USA) — hosting and performance measurement; EU–US Data Privacy Framework
• PostHog Inc. (USA), EU Cloud Frankfurt — product analytics; EU–US Data Privacy Framework and, in addition, Standard Contractual Clauses (Art. 46 GDPR). Processing is not limited to Germany: PostHog and its sub-processors — Amazon Web Services, PlanetScale, Modal Labs and Cloudflare, all US companies — may access the data to operate and support the service
• Cloudflare, Inc. (USA) — delivery of the PostHog script from European edge locations; EU–US Data Privacy Framework. Your IP address is necessarily visible to that network in order to serve the file
• Resend Inc. (USA) — delivery of CV emails; Standard Contractual Clauses (Art. 46 GDPR)
• Anthropic, PBC (USA) — generation of chat responses; Standard Contractual Clauses (Art. 46 GDPR)
• Google Ireland Limited (Ireland) — my email mailbox; data may be transferred to Google LLC (USA) under the EU–US Data Privacy Framework.INWX GmbH (Germany) forwards mail to it and holds no data outside Germany

A copy of the safeguards for any of these transfers is available from me at the email address above. See the Vercel, PostHog, Cloudflare, Resend, Anthropic and Google privacy policies.

The Inter typeface is self-hosted on this server. No request is made to Google Fonts or any external font CDN, and no data is transmitted to third parties for font delivery.

This website sets no cookies, tracking pixels or fingerprinting scripts, and stores nothing on your device unless you use the analytics opt-out below; once you do, a single entry records your choice — opted out or opted back in — so that it survives a reload. That entry is strictly necessary in order to provide a service you have expressly requested and is therefore exempt from the consent requirement under § 25(2) no. 2 TDDDG. No consent banner is required.

Most processing described above rests on legitimate interest (Art. 6(1)(f) GDPR). You have the right to object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR). You may exercise this right for analytics directly via the control below, which takes effect immediately in this browser. For any other processing, send an objection to the email address above; processing will then cease unless I can demonstrate compelling legitimate grounds which override your interests. No direct marketing takes place on this website.

Under GDPR you have the right to:

• Access — obtain a copy of data held about you (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — request deletion ("right to be forgotten") (Art. 17)
• Restriction — limit processing in certain circumstances (Art. 18)
• Portability — receive your data in a machine-readable format (Art. 20)

These rights reach data that can be traced back to you, such as a CV request or an email you sent me. Analytics is different: its identifiers are generated fresh for each visit, written nowhere on your device, and tied to nothing you did before. I am therefore unable to identify which records relate to you (Art. 11(1) GDPR), and Art. 11(2) GDPR does not require me to collect additional identifying data in order to make that possible. If you can supply the session identifier from your visit, I can act on it. To stop analytics collection, use the opt-out above.

No automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR takes place.

To exercise any of these rights, contact me at hi@jens.pm.

You have the right to lodge a complaint with the competent data protection supervisory authority. The authority for North Rhine-Westphalia (NRW) is:

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf
www.ldi.nrw.de