Privacy notice
How your data is handled when you visit this portfolio or send me a message.
1. Controller
Steffen Klima is responsible for the processing described here. The postal address and phone number are in the imprint. For privacy questions, email steffen@nineosevenlabs.com.
2. Visiting the website
When you open a page, the hosting infrastructure processes technical connection data needed to deliver and protect it. This can include your IP address, the date and time of access, the requested page, browser information and the referring page where provided. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in running a secure, reliable website.
The hosting provider may retain server logs for security and troubleshooting. They are kept only as long as needed for those purposes, subject to the provider’s retention settings and any legal obligations.
3. Contacting me
If you use the contact form, I process your name, email address, chosen language and message to handle your enquiry. The form also uses a hidden spam field and a submission identifier to prevent misuse and duplicate delivery. Information you send by email is processed to handle your enquiry in the same way.
For enquiries about a possible project or contract, the legal basis is Article 6(1)(b) GDPR (pre-contractual steps). For other enquiries, it is Article 6(1)(f) GDPR (my legitimate interest in responding and protecting the form). Contacting me is voluntary, but without your contact details I cannot reply.
The form uses Resend to deliver your message to me and attempt a confirmation email in your chosen language. Your submitted details and message are sent to Resend for this purpose. There is no separate portfolio database of form submissions. Email correspondence is retained only as long as necessary to handle your enquiry, maintain relevant business records or meet legal retention duties.
To protect the form against abuse, Upstash Redis stores temporary counters linked to keyed hashes of email addresses and, where a trusted hosting proxy provides it, IP addresses. These counters expire within 24 hours. Names, message contents and original email or IP addresses are not stored in these counters. Confirmation emails contain a fixed acknowledgment rather than a copy of your message.
4. Recipients and transfers
Technical data is processed by the website’s hosting provider. Email correspondence involves my email provider and, for form submissions, Resend. Providers receive the data needed for their respective tasks. I do not sell your data.
Resend is based in the United States, so processing outside the European Economic Area may occur. Its data processing addendum includes safeguards for international transfers, including EU Standard Contractual Clauses. Other transfers depend on the production hosting and email configuration.
5. Cookies, analytics and external links
Your choice is stored locally in this browser for 180 days and applied on future visits.
Links to LinkedIn, Padelgrid and BirdySnap take you to other websites only when selected. Their own privacy notices then apply. No content from these sites is loaded as an external embed in this portfolio.
Optional usage analytics with Google Analytics 4
Only with your consent do we load Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We measure page views, contact and project clicks, visible sections, scroll depth, and enquiry starts and successful submissions. We also measure email and credential/social link clicks, opened FAQ answers, submission attempts and fixed categories of displayed form errors. Names, email addresses and form contents are not sent as analytics events. URL queries and fragments are excluded; external referrers are reduced to their origin.
Google receives pseudonymous cookie identifiers, usage events and technical device information. Your IP address is processed during connection, including to derive approximate location; Google states that GA4 does not store it. Pseudonymous data is not anonymous. Google Signals and advertising personalisation are disabled, with no Google Ads linking.
Consent is the legal basis under section 25(1) TDDDG for device storage/access and Article 6(1)(a) GDPR for processing personal data. Google acts as a processor. Processing by Google LLC in the US is possible. International transfers are covered by the safeguards described in Google’s processing terms, including Standard Contractual Clauses where required. See the Google documents linked below.
The _ga and _ga_<measurement-ID> cookies last up to 180 days. GA4 user and event data retention is two months, without resetting on new activity; aggregated reports may remain longer. We save acceptance or rejection in this browser’s local storage (portfolio-consent) for 180 days, with a timestamp and notice version, solely to manage your choice (section 25(2)(2) TDDDG; Article 6(1)(c) GDPR in conjunction with Article 7 GDPR).
Before consent or after rejection, no Google analytics script is loaded and no analytics is sent to Google. You can withdraw at any time in Privacy settings in the footer. This stops collection, removes this site’s analytics cookies and reloads the page. Withdrawal does not affect the lawfulness of previous processing or automatically delete data already transmitted. Your data protection rights continue to apply.
6. Your rights
Depending on the circumstances, you may request access (Article 15 GDPR), correction (Article 16), deletion (Article 17), restriction (Article 18) or portability (Article 20) of your data. You may object to processing based on legitimate interests (Article 21). To exercise your rights, contact steffen@nineosevenlabs.com.
You also have the right to complain to a data protection supervisory authority. No automated decision-making or profiling within the meaning of Article 22 GDPR takes place on this website.
7. Changes
This notice reflects the portfolio as of 25 September 2026. It will be updated if the contact workflow, hosting, analytics or other services change.