Privacy

Privacy policy

1 · Controller

The controller within the meaning of Art. 4 (7) GDPR is Georgina Wilkinson, Miesbacher Straße 8, 83714 Miesbach, Germany, email welcome@georginawilkinson.com, phone +49 151 67359965. A data protection officer does not have to be appointed under § 38 BDSG.

2 · Principle

I collect as little as possible. There is no tracking, no analytics, no ad networks, no profiling, no social media plug-ins and no embedded maps or videos. No data is sold. What you write to me is used to reply to you and, if we work together, to run the project.

3 · Hosting and server logs

This site is hosted by Uberspace — Jonas Pasche, Kaiserstraße 15, 55116 Mainz, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with the provider.

When you open a page, the server automatically processes technical data: shortened IP address, date and time of access, page requested, volume of data transferred, referrer, browser type and operating system. The host shortens IP addresses as the log file is written: for IPv4 only the first 16 bits are stored, for IPv6 the first 32 bits, with the remainder set to zero. 82.98.87.93 therefore becomes 82.98.0.0. That leaves me unable to link an entry to a particular person. The data is not combined with other sources.

The legal basis is Art. 6 (1) (f) GDPR — my legitimate interest in running the site securely and reliably. The access log is kept by the host and overwritten by it on a rolling basis; on the platform in use I can neither switch it off nor set the retention period myself. The storage period is therefore determined by the host's rotation — when checked in October 2026 the log covered roughly the preceding nine days. I do not analyse the log data.

4 · Encryption

This site is served exclusively over HTTPS and protected by TLS encryption, so what you send — in particular what you enter in the contact form — cannot be read by third parties in transit.

5 · Contact form and email

If you use the form, I process your name, email address, what you say you need, and your message. It is sent to my inbox as an email; the form data is not stored in a database on the server. If you email me directly, I process what is in your email.

The form contains a field that is invisible to you, used to block automated submissions. If it is filled in, the submission is discarded; no personal data is collected in the process.

The legal basis is Art. 6 (1) (b) GDPR where this concerns entering into or performing a contract, otherwise Art. 6 (1) (f) GDPR — my legitimate interest in answering enquiries. Enquiries that do not become projects are deleted after six months. Where a project goes ahead, I keep the correspondence for the duration of the project and afterwards for the periods commercial and tax law require.

Providing this data is required neither by statute nor by contract, and you are under no obligation to provide it. Without a name, an email address and a message I cannot answer your enquiry; no other consequences follow.

6 · Cookies

This site sets no analytics, marketing or tracking cookies, so there is no consent banner.

One cookie is technically necessary: the Grav content management system sets a session cookie named grav-site-… as soon as a page is loaded. It holds nothing but a random session identifier — no details about you and no usage profile — and serves to protect the contact form against cross-site request forgery. It is sent back only to this site and not to third parties, is blocked from access by scripts (HttpOnly), is transmitted only over an encrypted connection (Secure), and expires at the latest 30 minutes after your last activity — normally when you close your browser.

No consent is required for this cookie: it is strictly necessary in order to provide the service you have requested — the delivery of this site with a working contact form (§ 25 (2) no. 2 TDDDG). The content management system creates the session when a page is loaded; restricting it to individual pages is not technically provided for. The subsequent processing is based on Art. 6 (1) (f) GDPR. Should a service that sets non-essential cookies be added later, consent will be obtained in advance under § 25 (1) TDDDG.

7 · Typefaces

The typefaces Newsreader and Karla are served exclusively from this server. There is no connection to Google Fonts or any other font service, and no IP address is transmitted to a third party. The same applies to every other design element on this site: nothing is loaded from an external server.

8 · Recipients and processors

I pass data on only where it is needed to run the business or required by law. Agreements under Art. 28 GDPR are in place with the following processors:

• Uberspace (Jonas Pasche, Mainz) — running the site, server logs, sending the form email
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — mailbox and correspondence via Google Workspace

I also pass data to recipients who act not on my instructions but on their own responsibility: my tax adviser and the tax office, where commercial and tax law require it (Art. 6 (1) (c) GDPR). No data processing agreement exists with them, and none is envisaged.

9 · Transfers outside the EU

The site itself runs entirely in Germany. Quotes and invoices are prepared locally on my own computer and no data is passed to third parties in the process. Email correspondence alone may involve processing by Google LLC in the United States. That company is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission's adequacy decision of 10 July 2023 and, in addition, on the Commission's standard contractual clauses.

10 · Retention

Server logs: rotated by the host, outside my control (see section 3). Enquiries without a project: six months. Project correspondence: the duration of the project, then the statutory period. Invoices and accounting records: ten years under § 147 AO and § 257 HGB. Beyond that, I delete data as soon as the purpose falls away and no statutory retention obligation stands in the way.

11 · Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Any consent you give can be withdrawn at any time with effect for the future; the lawfulness of processing carried out until then is unaffected. An email to welcome@georginawilkinson.com is enough. Exercising these rights is free of charge.

12 · Right to complain

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The one responsible for my location is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Postfach 1349, 91504 Ansbach, Germany (visiting address: Promenade 18, 91522 Ansbach). You may also contact the authority where you live.

13 · No automated decision-making

There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

14 · Changes to this policy

I update this policy when the site or the law changes. The version published here is the one that applies.

Last updated: October 2026