Legal
Privacy Policy
Privacy policy according to the GDPR (DSGVO). Short version: this site sets no cookies, uses no analytics and loads nothing from third-party servers.
1. Controller
Oliver Blaum
Ziegelwies 3
87629 Füssen
Germany
E-mail: hello [at] oblaum [dot] com
Phone: +49 175 …
No data protection officer has been appointed, as the conditions of Section 38 of the German Federal Data Protection Act (BDSG) are not met. For any privacy matter, reach me directly at the contact details above.
2. Principle: no cookies, no tracking
This website sets no cookies, uses no analytics, statistics or advertising services and embeds no third-party content. Fonts, scripts, images and all other resources are loaded exclusively from my own server. No profiles are built, no data is passed to social networks, and there is no consent requirement that would call for a cookie banner.
3. Hosting and server logs
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.
On every request the server automatically logs: IP address, date and time of access, requested file, amount of data transferred, HTTP status code, referrer, and browser and operating system identifiers. This data is technically necessary to deliver the page and serves to detect and fend off attacks.
The legal basis is Art. 6 (1) f GDPR. My legitimate interest lies in the secure and stable operation of the website. The logs are deleted after 365 days. They are not merged with other data sources.
4. Contact by e-mail and phone
If you contact me by e-mail or phone, I process the data you provide solely to handle your request. The legal basis is Art. 6 (1) b GDPR for contractual or pre-contractual communication, otherwise Art. 6 (1) f GDPR (legitimate interest in answering enquiries).
Enquiries that do not lead to business are deleted no later than six months after the last contact. If the contact results in a business relationship, the statutory retention periods under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) apply (six years for business correspondence, eight years for accounting records).
5. E-mail service
My mailbox runs on iCloud Mail by Apple. The provider for users in the European Economic Area is Apple Distribution International Limited, Hollyhill Industrial Estate, Cork, Ireland. Storage and processing by Apple Inc. in the United States does take place; Apple bases this transfer on the European Commission's standard contractual clauses.
The data processed comprises sender address, subject, message content, attachments and technical header data. Transmission is encrypted in transit (TLS/SSL); there is no end-to-end encryption by default. If you wish to send particularly confidential content, please contact me beforehand — I will then arrange a different channel.
6. Booking a call
The website offers a form with a time-slot picker for arranging a call. The slot selection runs entirely in your browser; no data is sent to third parties and no calendar services are embedded.
By submitting the form you send me your name, e-mail address, preferred way of communicating, your browser’s time zone (so the appointment can be shown and confirmed in your local time) and, optionally, a topic and website. The request is delivered as an e-mail to my mailbox; no external form or booking service is involved.
The legal basis is Art. 6 (1) b GDPR (arranging the call you requested). Providing the data is voluntary; without a name and e-mail address, however, I cannot confirm the appointment. The data is deleted once the call has taken place, unless a business relationship results from it.
7. Video calls via Microsoft Teams
On request the call takes place via Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
The data processed comprises name, e-mail address, IP address, device and connection data, and the audio and video transmitted during the call. I do not record meetings and do not create transcripts. The legal basis is Art. 6 (1) b GDPR.
Microsoft processes data primarily within the EU Data Boundary, but processing in third countries including the United States cannot be ruled out. Microsoft bases such transfers on the European Commission's standard contractual clauses and is certified under the EU-US Data Privacy Framework. If you would rather avoid this, please choose the phone call — no third-party provider is involved there.
8. Downloads and machine-readable files
My résumé as a PDF and machine-readable files (resume.json, llms.txt) are available on the website. Retrieving them requires no registration and no personal data. The only data created are the server log entries described in section 3.
9. Business contacts
To initiate and maintain business relationships I process business contact data: name, role, company, business e-mail address and phone number, and notes on our conversations.
This data comes either from you or from publicly accessible sources — in particular company websites, professional networks such as LinkedIn, industry directories, business cards and referrals from third parties. Where I process data that I did not collect from you directly, I hereby inform you in accordance with Art. 14 GDPR.
The legal basis is Art. 6 (1) f GDPR. My legitimate interest lies in making contact and communicating for business purposes. You may object to this processing at any time without formality (Art. 21 GDPR); I will then delete your data immediately and not add it again.
10. Recipients
Your data is passed on only where necessary to deliver my services or to meet legal obligations. Recipients may be: my tax advisor for bookkeeping, my hosting provider, and the communication services named in sections 5 and 7. Data is never sold or rented.
11. Newsletter and advertising
I send no newsletter and run no e-mail marketing. Your contact data is not used for third-party advertising.
12. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
13. Your rights
You have the right to access the data stored about you (Art. 15), to rectification of inaccurate data (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).
You also have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) f GDPR (Art. 21 GDPR).
An informal message to hello [at] oblaum [dot] com is enough. I answer requests within one month.
14. Right to lodge a complaint
Independently of this, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
You may also contact the supervisory authority of your place of residence or work.
15. Data security
The website is delivered exclusively over an encrypted HTTPS connection (TLS). Access to my systems is protected by two-factor authentication and disk encryption. I take technical and organisational measures under Art. 32 GDPR to protect your data against loss, misuse and unauthorised access.
16. Changes to this policy
I update this privacy policy when the services offered or the legal situation change. The version published on this page applies.