Privacy
Controller
Information under Art. 13 (and Art. 14 where applicable) GDPR. Controller: Jan Genz, sole proprietorship, Köpenicker Straße 77E, 22149 Hamburg, Deutschland. Email: x@jangenz.com. Phone: +49 160 93434341. No data protection officer has been appointed.
Scope
This notice covers only this website (legal.jangenz.de, including /x) and processing by the proprietor via the X accounts @ByJanGenz and @VerlagByJanGenz. Other services (shop, calendar, portal) have their own notices. The site is not directed specifically at children.
Categories of data
Visit (including requests by search-engine crawlers): IP address, technical headers (e.g. user agent), timestamp, URL requested. Browser: acknowledgement of the combined AI/cookie notice in localStorage (no user account of ours). X, where content reaches us: handle, message/comment/mention content, publicly visible profile data. No order, payment or account data on this origin. No analytics or marketing cookies.
Purposes and legal bases
Page delivery: operation, delivery and IT security (server logs with IP address, user agent, URL, timestamp) — Art. 6(1)(f) GDPR; legitimate interest: an available, abuse-resistant website. Public findability of the legal notices (see next section) — Art. 6(1)(f) GDPR. Storing acknowledgement of the AI/cookie notice in localStorage — Art. 6(1)(c) GDPR with Art. 50 AI Act and § 25(2) TDDDG (legal transparency duty, not consent). Messages, comments and mentions we receive on X and that the proprietor reads or replies to — Art. 6(1)(f) GDPR (communication, documentation, legal defence), or Art. 6(1)(b) if pre-contractual. No profiling, no automated decisions with legal effect (Art. 22 GDPR). Art. 6(1)(a) GDPR is not used for optional cookies or marketing on this website.
Public findability
The public legal URLs on this origin are meant to remain indexable: home, /x, /impressum, /datenschutz, /cookies, /ki and the English paths under /en. robots.txt allows general search engines to fetch these public paths; a sitemap lists the same URLs. No index block is intended for those paths. Purpose: making legally required provider and privacy notices publicly reachable and findable — Art. 6(1)(f) GDPR (legitimate interest). Crawler requests produce the same access logs as other visits. Search-engine operators store publicly available page content in their own indexes under their own policies; the proprietor does not control their retention. robots.txt and the sitemap do not set cookies or trackers.
Recipients
Hosting: Vercel Inc., USA, as processor (Art. 28 GDPR, Data Processing Addendum; sub-processors only as provided in the DPA). X Corp. is a separate controller of the platform (https://x.com/privacy). The proprietor only processes content that reaches him via the named accounts. Search-engine operators (for example Google LLC, Microsoft Bing) that fetch the public pages are separate controllers of their search indexes. No disclosure for advertising. No other trackers, ad pixels or font CDNs.
Third country
Vercel may transfer personal data (in particular IP addresses in access logs) to the United States. Basis (draft — operator must confirm DPA status and DPF certification): EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR), where Vercel is certified, and/or Standard Contractual Clauses (Art. 46 GDPR). X processes platform data in the US under its own policy; the proprietor does not control that transfer.
Retention
Hosting logs only for a short operational period (draft: typically days to weeks under Vercel’s standard; no analytics database of our own). localStorage until you delete it. Content on X for as long as the post exists or the proprietor keeps it for legal defence.
Sources (X)
Where mentions, public replies or direct messages reach us via X, the data come from the sending person or from the X platform (Art. 14 GDPR where applicable). Visits to x.com, tracking, advertising and account administration on X sit outside this website and with X Corp. as a separate controller.
Providing data
Visiting the website technically requires sending your IP address to the host. There is no further statutory or contractual duty to provide us with data. Without a page request, no server logs of your visit are created. Acknowledging the notice in localStorage is voluntary in that the notice will otherwise reappear; it is not a condition of a contract.
Your rights
Access, rectification, erasure, restriction, portability, and objection to processing based on Art. 6(1)(f) GDPR (Art. 15–21 GDPR). Requests to x@jangenz.com. Because no consent is collected for optional cookies or marketing, there is no Art. 7(3) GDPR withdrawal for those purposes. Complaint to Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI) (Art. 77 GDPR).
Draft — not legal advice.