Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Ines Perak
c/o Autorenglück #76815
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany

Email: [email protected]
Website: inesthedesigner.com

This website is a personal, non-commercial portfolio used to present selected design and web projects for professional presentation and job application purposes.

No freelance, commercial or other paid services are currently offered through this website.

2. General Information on Data Processing

The protection of your personal data is important to me.

Personal data is processed only where this is necessary to provide this website, maintain its functionality and security, respond to enquiries, comply with legal obligations or, where applicable, analyse website usage after you have given your consent.

Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, email address, IP address, browser or device information, or information that you submit through the contact form.

Depending on the respective processing activity, processing may be based in particular on:

• Art. 6(1)(a) GDPR – consent;
• Art. 6(1)(b) GDPR – processing necessary for the performance of a contract or to take steps at your request prior to entering into a contract;
• Art. 6(1)(c) GDPR – compliance with a legal obligation;
• Art. 6(1)(f) GDPR – legitimate interests, in particular the secure, reliable and technically functional operation of this website.

Where processing is based on legitimate interests, the relevant interests are balanced against the rights and interests of the individuals concerned.

Personal data is retained only for as long as necessary for the respective processing purpose, unless legal retention requirements, the establishment or defence of legal claims or another lawful basis requires longer storage.

3. Hosting and Server Log Files

This website is hosted through:

OstrovLabs LLC
30 N Gould St Ste N
Sheridan, Wyoming
United States

The hosting infrastructure processes technical information necessary to make this website available and to ensure its security and stability.

When you access this website, technical data may be automatically processed in server log files. Depending on the server configuration, this may include:

• IP address;
• date and time of access;
• requested page, URL or file;
• referrer URL;
• browser type and version;
• operating system and device information;
• HTTP status information;
• amount of data transferred;
• technical connection information;
• information relevant to detecting errors, attacks or misuse.

This processing is carried out to establish the connection to the website, deliver the requested content, ensure technical stability, diagnose errors and protect the website and hosting infrastructure against attacks and misuse.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interests are the secure, stable and efficient operation of this website and the protection of the website and its visitors against technical and security risks.

Server log information is retained only for as long as required for these purposes, unless longer retention is necessary for the investigation of security incidents, the establishment or defence of legal claims or compliance with legal obligations.

As OstrovLabs LLC is established in the United States, processing may involve the transfer of personal data outside the European Economic Area. Where such transfers take place, the requirements of Chapter V GDPR apply.

4. WordPress and Bricks

This website is built using WordPress as its content management system and Bricks as its website builder.

These systems are used to create, manage and technically provide the content and functionality of this website.

Depending on the functionality requested, WordPress may process technical information necessary for the operation, security and delivery of the website.

The legal basis for technically necessary processing is Art. 6(1)(f) GDPR, based on my legitimate interest in providing a functional, secure and professionally presented website.

5. Password-Protected Portfolio Content

Certain areas of this portfolio may be protected using the password protection functionality provided by WordPress.

The purpose of this protection is to restrict access to selected portfolio content. Visitors are not required to create a personal user account to access password-protected content.

After the correct password has been entered, WordPress may store technically necessary information in the visitor's browser in order to remember that access to the protected content has been authorised.

Such storage is used solely to provide the password-protected functionality requested by the visitor.

The password and the use of the protected area are not used for advertising purposes or to create marketing profiles.

6. Contact Form

A contact form is available on this website.

When you use the contact form, the following information may be processed:

• first name;
• last name;
• email address;
• subject;
• message;
• technical information required to transmit and protect the form submission.

The information you provide is processed solely for the purpose of receiving, handling and responding to your enquiry.

Depending on the technical configuration of WordPress and Bricks, information submitted through the contact form may also be stored in the WordPress database in addition to being forwarded by email.

Where your enquiry relates to a potential employment relationship, cooperation or other pre-contractual communication, processing may be based on Art. 6(1)(b) GDPR.

For other enquiries, processing is based on Art. 6(1)(f) GDPR. My legitimate interest is to receive and respond to communications addressed to me.

Information submitted through the contact form is retained only for as long as necessary to process the enquiry and any subsequent communication, unless legal retention requirements or other legitimate grounds require longer storage.

Please do not submit special categories of personal data or other highly confidential information through the contact form unless this is necessary for your enquiry.

7. Email Communication and Microsoft

Emails sent to [email protected], including messages generated through the contact form, are processed using Microsoft email services.

Depending on the communication, the following information may be processed:

• name;
• email address;
• subject;
• message content;
• attachments;
• date and time of communication;
• technical email metadata.

The purpose of this processing is to receive, manage and respond to communications.

Where communication relates to contractual or pre-contractual matters, processing is based on Art. 6(1)(b) GDPR.

For other communications, processing is based on Art. 6(1)(f) GDPR, based on my legitimate interest in receiving and responding to communications addressed to me.

Microsoft may process information using infrastructure located within and outside the European Economic Area. Where personal data is transferred internationally, the applicable requirements of Chapter V GDPR apply.

8. Wordfence Security

This website uses Wordfence Security to protect the website and WordPress installation against unauthorised access, malware, brute-force attacks, malicious requests and other security threats.

For these purposes, Wordfence may process technical and security-related information such as:

• IP addresses;
• request information;
• attempted logins;
• blocked access attempts;
• information relating to suspected malicious activity;
• technical information required to identify and prevent attacks.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is protecting this website, its infrastructure and its visitors against attacks, unauthorised access and other security risks.

Wordfence is provided by Defiant, Inc., United States. Where personal data is transferred to the United States or another third country, the applicable requirements of Chapter V GDPR apply.

9. Cloudflare and Cloudflare Turnstile (Spam Protection)

This website uses Cloudflare Turnstile, a service provided by Cloudflare, Inc., United States, to help protect the contact form against automated submissions, bots and spam.

When you use a form protected by Turnstile, Cloudflare may process technical information to assess whether the request is likely to come from a person rather than an automated program. Depending on the implementation, this may include your IP address, browser and device information, technical request data and interaction or verification signals.

This processing is intended to protect the contact form and website against spam, misuse and automated attacks. The legal basis relied upon for the security-related processing is Art. 6(1)(f) GDPR, based on my legitimate interest in protecting the website and its communication channels. The applicable legal basis and any consent requirements must be assessed against the actual Turnstile configuration.

If website traffic is also routed through Cloudflare's network, Cloudflare may process technical connection and security information, such as IP addresses, requested URLs, request timestamps and security-related data, to deliver and protect the website. This paragraph applies only where those Cloudflare network services are enabled.

Processing by Cloudflare may involve transfers of personal data outside the European Economic Area, including to the United States. Where such transfers take place, the requirements of Chapter V GDPR apply.

Further information is available in Cloudflare's Privacy Policy .

10. ShortPixel Image Optimisation

This website uses ShortPixel Image Optimizer for technical image optimisation.

Images uploaded to the website may be processed through ShortPixel infrastructure for purposes such as compression, conversion or optimisation and subsequently returned to the website in an optimised form.

The purpose of this processing is to reduce image file sizes, improve website loading times, reduce bandwidth requirements and improve the technical performance of the website.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is the efficient and technically optimised operation of this website.

ShortPixel is not intentionally used for advertising or visitor profiling purposes.

11. Backups with UpdraftPlus

This website uses UpdraftPlus to create backups.

Backups may contain website files, configuration information and database content. Depending on the data stored on the website at the time a backup is created, backups may therefore contain personal data.

Backups are created exclusively for security, recovery and disaster-recovery purposes.

Backups may be stored within the website or server environment and may additionally be downloaded and stored locally on a protected personal computer.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is ensuring the availability, integrity and recoverability of the website and its data.

Backups are retained only for as long as reasonably necessary for these purposes and are deleted or overwritten in accordance with the applicable backup cycle.

12. Cookies and Similar Technologies

This website uses cookies and similar technologies where necessary for its operation and, where applicable, for optional analytics.

Cookies are small pieces of information that can be stored on your device when you visit a website.

A distinction is made between technologies that are technically necessary for providing the website or functionality explicitly requested by you and optional technologies used for purposes such as analytics.

Technically necessary technologies may be used without consent where the applicable legal requirements are fulfilled.

Optional analytics or tracking technologies are activated only after you have provided the required consent.

You can change or withdraw your consent at any time with effect for the future through the cookie/privacy settings available on this website.

13. Consent Management with Borlabs Cookie

This website uses Borlabs Cookie as its consent management solution.

Borlabs Cookie is used to inform visitors about optional services and technologies and to obtain and manage consent decisions.

Borlabs Cookie stores a technically necessary cookie in your browser in order to remember the privacy choices you have made.

According to the provider, the Borlabs Cookie consent mechanism operates locally on the website and does not transmit visitors' consent information to Borlabs.

The Borlabs Cookie may contain information such as:

• selected consent settings;
• cookie lifetime;
• cookie version;
• website domain and path;
• a randomly generated identifier.

The purpose of this storage is to remember the choices you have made and to ensure that optional services are activated only in accordance with those choices.

Where personal data is processed in connection with consent management, processing may be based on Art. 6(1)(c) GDPR where necessary to comply with legal obligations and Art. 6(1)(f) GDPR based on the legitimate interest in managing and demonstrating privacy choices.

You can change or withdraw your consent at any time through the cookie/privacy settings available on this website.

Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn.

14. Google Analytics

This website uses Google Analytics to obtain statistical information about the use of the website, provided that you have given the required consent.

The provider for users in the European Economic Area is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics is used to understand how visitors interact with this portfolio and to obtain statistical information that may help improve the website, its usability and its content.

Depending on the technical configuration, Google Analytics may process information such as:

• pages viewed;
• interactions with pages;
• date and time of visits;
• approximate geographic information;
• browser and device information;
• operating system;
• referrer information;
• technical identifiers;
• session information;
• IP-related information.

Consent before activation

Google Analytics is only activated after you have actively consented to analytics through Borlabs Cookie.

Google Analytics is not intended to be loaded simply because you access this website.

The legal basis for processing through Google Analytics is Art. 6(1)(a) GDPR – your consent.

You are free to refuse consent. Refusing analytics consent does not prevent you from using the essential functionality of this website.

You can withdraw your consent at any time with effect for the future through the cookie/privacy settings available on this website.

Google may process personal data in countries outside the European Economic Area, including the United States. Where such international transfers take place, the requirements of Chapter V GDPR apply.

15. Google Search Console

This website may use Google Search Console to monitor the technical visibility and indexing of the website in Google Search.

Google Search Console is an administrative service used by the website owner to obtain information about search visibility, indexing and technical website issues.

The use of Google Search Console does not in itself mean that an additional analytics or tracking script is loaded in a visitor's browser when accessing this website.

If the technical implementation or functionality changes in a way that results in additional processing of visitor data, this Privacy Policy will be updated accordingly.

16. Essential and Optional Services

Services and technologies that are technically necessary for providing this website or functionality explicitly requested by you may be used without optional consent where permitted by applicable law.

Services used for optional analytics, tracking or comparable purposes are activated only after the required consent has been given.

Where Borlabs Cookie is used to manage such services, the choices made through the consent interface determine which optional services may be activated.

17. Recipients of Personal Data

Personal data is disclosed only where this is necessary for the purposes described in this Privacy Policy, where a service provider is required for the operation of the website, or where disclosure is required by law.

Depending on the respective processing activity, recipients may include:

• hosting and infrastructure providers;
• email providers;
• IT and security providers;
• website software and technical service providers;
• image optimisation providers;
• analytics providers where the required consent has been given;
• professional advisers where necessary;
• public authorities where disclosure is required by law.

Where an external service provider processes personal data on my behalf and the legal requirements are met, appropriate contractual arrangements are used.

Personal data is not sold to third parties.

18. International Data Transfers

Some service providers used in connection with this website are established outside the European Union or European Economic Area or may process information using infrastructure located in third countries.

Where personal data is transferred outside the EEA, such transfers are carried out only where the requirements of Chapter V GDPR are fulfilled.

Depending on the recipient and country concerned, this may include:

• an adequacy decision by the European Commission;
• participation in an applicable recognised data protection framework;
• Standard Contractual Clauses adopted by the European Commission;
• other safeguards recognised under applicable data protection law;
• an applicable statutory exception where its requirements are fulfilled.

Where appropriate and required, additional contractual, technical or organisational safeguards may be implemented.

19. Data Retention and Deletion

Unless a specific retention period is stated elsewhere in this Privacy Policy, personal data is retained only for as long as necessary to fulfil the purpose for which it was collected.

Data may be retained for a longer period where this is necessary to:

• comply with statutory retention obligations;
• establish, exercise or defend legal claims;
• investigate security incidents;
• comply with other legal obligations;
• protect legitimate interests where permitted by law.

When the relevant purpose and applicable retention requirements cease to apply, personal data will be deleted or anonymised where appropriate.

Data contained in backups may remain stored until the respective backup is deleted or overwritten as part of the regular backup cycle.

20. Your Rights under the GDPR

Subject to the applicable legal requirements, you have the following rights regarding your personal data:

Right of Access

Under Art. 15 GDPR, you may request information about whether your personal data is being processed and obtain access to that data.

Right to Rectification

Under Art. 16 GDPR, you may request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to Erasure

Under Art. 17 GDPR, you may request the deletion of your personal data where the applicable legal requirements are fulfilled.

Right to Restriction of Processing

Under Art. 18 GDPR, you may request restriction of processing in the circumstances provided by law.

Right to Data Portability

Under Art. 20 GDPR, where the applicable requirements are met, you may receive personal data you have provided in a structured, commonly used and machine-readable format.

Right to Object

Under Art. 21 GDPR, you may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or Art. 6(1)(f) GDPR.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw your consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

To exercise your rights or ask questions regarding the processing of your personal data, please contact: [email protected]

21. Competent Supervisory Authority

The data protection supervisory authority generally responsible for a controller based in Dortmund is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

You may also have the right to contact another competent supervisory authority in accordance with applicable data protection law.

22. Automated Decision-Making and Profiling

No automated decision-making within the meaning of Art. 22 GDPR is currently used on this website.

No personal profiles are created for the purpose of making automated decisions about individual visitors.

23. Obligation to Provide Personal Data

You are generally not legally or contractually required to provide personal data simply by visiting this website.

However, certain technical information may be necessary to establish a connection and deliver the website.

If you contact me through the contact form or by email, certain information, particularly a valid means of contact and the content of your enquiry, may be necessary in order to respond.

If required information is not provided, the relevant functionality or communication may not be possible.

24. Data Security

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Depending on the circumstances, these measures may include:

• encrypted transmission using HTTPS/TLS;
• access restrictions;
• security monitoring;
• WordPress security mechanisms;
• regular software and security updates;
• backups;
• password protection;
• measures against unauthorised login attempts;
• measures against malicious requests and other cyberattacks.

Security measures are reviewed and adapted where appropriate, taking into account the state of the art, the nature of the processing and the associated risks.

Nevertheless, no method of transmission over the internet or electronic storage can guarantee absolute security.

25. Changes to this Privacy Policy

This Privacy Policy may be amended where necessary, particularly if the functionality of this website, the services used, the technical configuration or applicable legal requirements change.

The current version of this Privacy Policy is available on this website.

Last updated: September 2026