1. Controller
Stefan Werner is responsible for this personal profile website. Contact: contact section (email and telephone). The postal address is available in the legal notice.
2. Website access and hosting
Accessing the website involves processing technical access data. These may include your IP address, request time, requested file or URL, browser and operating-system information, the referring page if transmitted, and status or error information. They are used to deliver the website, maintain security, and identify technical errors or misuse. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in providing this professional profile securely and reliably.
The website is provided through OpenAI’s ChatGPT Sites. Under the standard agreement, OpenAI Ireland Ltd. is the contracting entity for customers in the European Economic Area. Subprocessors support delivery, including Cloudflare for content delivery and security. Further information: OpenAI privacy policy, Data Processing Addendum and subprocessor list.
3. Security cookie and language preference
The hosting infrastructure may use the __cf_bm security cookie to detect automated or abusive traffic. According to Cloudflare, it expires after 30 minutes of continuous inactivity. See the Cloudflare cookie documentation. Storage for this necessary security function is based on section 25(2)(2) TDDDG; where personal data are processed, the basis is Article 6(1)(f) GDPR.
When you select DE or EN, your language preference is saved under stefan-werner-language in your browser’s Session Storage for the respective browser session. It is used only to display your chosen language, not for advertising or visitor analytics. Storage ends with the session and can be cleared through your browser. The basis is section 25(2)(2) TDDDG and, where personal data are involved, Article 6(1)(f) GDPR.
4. Contacting me
If you send an email or call, the contact details and information you provide are used to handle your enquiry. The basis is Article 6(1)(f) GDPR (handling professional enquiries) or, where applicable to a contractual enquiry, Article 6(1)(b) GDPR. Information is deleted once the enquiry and necessary follow-up have been completed, unless statutory retention requirements or specific evidentiary or legal-defence needs require further retention.
The contact address uses Gmail. Google processes email content and connection data to provide the email service. Processing outside the European Economic Area is possible. Information about processing, retention and international transfers is available in the Google privacy policy.
5. Recipients, processing locations and retention
Technical information is accessible to hosting and security providers and their relevant subprocessors where necessary for delivery and protection. Processing outside the European Economic Area, including in the United States, is possible. For such transfers, OpenAI’s DPA provides for an applicable adequacy decision under Article 45 GDPR or standard contractual clauses under Article 46 GDPR. Details and further information about safeguards are available through the provider information linked above and by contacting the controller.
Technical operational data are subject to the hosting provider’s contractual deletion and retention arrangements. Relevant criteria include operational necessity, fault analysis, security incidents, any required wind-down after the hosting agreement ends, and statutory obligations. The website operator maintains no separate visitor or analytics database. Session data and security cookies follow the periods in section 3; enquiries follow the criteria in section 4.
6. Local files and external links
Fonts, images and CV PDFs are served directly by this website. The page code does not embed external font services, advertising trackers or analytics. Downloading a CV generates only the technical access information associated with other file requests.
LinkedIn, image credits, references and provider information are ordinary external links. You visit the corresponding provider only when opening a link; that provider’s privacy information then applies. The website has no contact form or registration. Email and telephone links open the corresponding application on your device.
7. Your rights
Subject to the applicable legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21). Any consent given may be withdrawn prospectively at any time. Please use the contact section (email and telephone) to exercise these rights.
You may complain to a supervisory authority under Article 77 GDPR, particularly in the country of your residence, workplace or the alleged infringement. For non-public bodies in Bavaria, the relevant authority is generally the Bavarian State Office for Data Protection Supervision (BayLDA).
8. Required information and automated decisions
Providing personal information for an enquiry is voluntary. Without the details needed to reply, it may not be possible to handle your enquiry. Technical data described in section 2 are needed to deliver and secure the website. The website operator does not make automated decisions with legal or similarly significant effects under Article 22 GDPR and does not conduct advertising profiling.