Work Blog Contact

Privacy Policy

This is a courtesy English translation. The legally binding version is the German Datenschutzerklärung.

Last updated: 25 September 2026

This notice informs you, pursuant to Art. 13 GDPR, which data is processed when you visit berezka.me. It also covers the subdomains news.berezka.me (newsletter) and umami.berezka.me (web analytics).

1. Controller

Responsible for data processing on this website: Alexey Berezka, M 7, 13, 68161 Mannheim, Germany. E-mail: [email protected].

2. Hosting

This website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a Hetzner data centre in Helsinki (Finland, EU). A data processing agreement (Art. 28 GDPR) is in place with Hetzner. The legal basis is my legitimate interest in the secure and reliable operation of the website (Art. 6 para. 1 lit. f GDPR).

3. Cloudflare (delivery, protection and DNS)

All requests to this website and its subdomains pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare acts as a reverse proxy and content delivery network: it receives your request, encrypts the connection (TLS), fends off attacks and automated mass requests, manages the domain’s DNS records and passes the request on to my server. For every request Cloudflare processes your IP address, the requested address (URL), date and time, the HTTP headers sent by your browser (including the browser identification and the previously visited page, if your browser sends it) and technical connection data (TLS and HTTP version).

The purpose is the secure, fast and stable delivery of the website and the defence against attacks; the legal basis is my legitimate interest in this (Art. 6 para. 1 lit. f GDPR). Cloudflare is my processor (Art. 28 GDPR) under the Cloudflare Data Processing Addendum. Cloudflare operates a worldwide network of data centres, so processing of your data in the USA cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision for this framework (Art. 45 GDPR, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023). Should that decision fall away, the EU Commission’s standard contractual clauses agreed in the Data Processing Addendum apply (Art. 46 para. 2 lit. c GDPR).

Cloudflare also replaces e-mail addresses in the page source with an obfuscated form so that spam programs cannot harvest them (Email Address Obfuscation). To decode them, your browser loads a small script from this domain itself; no third-party server is contacted for this.

On a normal page load Cloudflare sets no cookies. If Cloudflare classifies a request as suspicious, for example during an attack on the website, it may set a technically necessary security cookie (for example __cf_bm or cf_clearance) to tell your browser apart from automated requests. This cookie is strictly necessary for the secure operation of the website and does not require consent (§ 25 para. 2 no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

More in Cloudflare’s privacy policy.

4. Server log files

For every request my server stores: IP address, date and time, requested address, status code, amount of data transferred, previously visited page (referrer) and browser identification (user agent). The logs serve secure operation, troubleshooting and the defence against attacks (Art. 6 para. 1 lit. f GDPR). They are rotated daily and deleted after 14 days.

5. Contact form, e-mail and requests via AI assistants

Contact form. When you write to me via the contact form, I process your name, your e-mail address and your message in order to answer your enquiry. Files cannot be uploaded through the form. The legal basis is Art. 6 para. 1 lit. b GDPR where a possible engagement is concerned, otherwise my legitimate interest in answering your enquiry (Art. 6 para. 1 lit. f GDPR). Providing the data is voluntary, but without a name and an e-mail address I cannot reply.

What is stored. The form hands your message to my contact service on the Hetzner server. There, every message is stored in a database together with technical data: IP address and country of origin (both provided by Cloudflare), browser identification, originating page (origin/referrer), timestamp and delivery status. I need this data to detect spam and abuse, to resolve delivery problems and, in case of a dispute, to prove what was received and when (Art. 6 para. 1 lit. f GDPR). The technical data is removed automatically after 90 days, the rest of the record is deleted after 365 days. Against automated submissions the form uses a hidden field (honeypot), a minimum time before submitting and a limit on requests per IP address.

Delivery to the mailbox. The contact service then sends the message by e-mail through the SMTP server of Apple iCloud Mail to my mailbox [email protected], which is also hosted by Apple iCloud Mail. The provider for users in the European Economic Area is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple may also process this data outside the EEA, in particular through Apple Inc. in the USA; for this Apple relies on the EU Commission’s standard contractual clauses (Art. 46 para. 2 lit. c GDPR). The same applies if you e-mail me directly at [email protected]. I keep e-mails for as long as I need them for your enquiry and a possible collaboration; after that I delete them unless a statutory retention obligation applies (§ 147 AO, German Fiscal Code).

AI assistants. This website additionally offers an interface for AI assistants (the endpoint /contact/agent and an MCP server at /mcp with the tool “contact_alexey_berezka”). Through it an assistant can send me a message on behalf of a person. The flow is the same as for the contact form (same database, same technical data, same retention period, same delivery); in addition, the name of the assistant and the “on behalf of” information are stored. In this case I receive your data not from you directly but from the assistant you instructed (Art. 14 GDPR).

6. Newsletter and checklist

Signing up. In the footer, at the end of blog posts and on the /consulting page you can enter your e-mail address to subscribe to my newsletter; in return you receive the “AI Audit Kickoff Checklist” right away. The newsletter goes out occasionally and contains pieces about my work and my services. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). There is no confirmation e-mail: your address is subscribed as soon as you submit the form.

Checks and storage. When you sign up, my contact service on the Hetzner server checks the address: it validates the spelling, rejects disposable-mail domains and looks up in DNS whether the address’s domain accepts e-mail (MX record). Too many sign-ups from the same IP address are rejected. The sign-up is logged in the same database as the contact form (e-mail address, IP address, country of origin, browser identification, originating page, timestamp) so that I can prove your consent (Art. 7 para. 1 GDPR) and detect abuse; the technical data is removed after 90 days, the entry is deleted after 365 days. The address itself goes into my newsletter software Listmonk, which I run on the same server (news.berezka.me). Listmonk stores your e-mail address, the date of sign-up and the status of your subscription, but not your IP address.

Sending. Listmonk sends newsletter e-mails through the SMTP server of Apple iCloud Mail (provider and third-country transfer as in section 5). I do not measure whether you open an e-mail or click links.

Unsubscribing, viewing and deleting your data. Every e-mail contains an unsubscribe link; many e-mail clients also offer unsubscribing directly (List-Unsubscribe). Unsubscribing is at the same time the withdrawal of your consent (Art. 7 para. 3 GDPR); it takes effect for the future, and the processing up to that point remains lawful. After that you receive no more newsletters. Listmonk keeps your address marked as “unsubscribed” so that it is not written to again by mistake (Art. 6 para. 1 lit. f GDPR). The unsubscribe link also takes you to the preferences page of your subscription, where you can export your stored data and delete it completely yourself; a short e-mail to me works as well. The sign-up entry in the contact service’s database remains as proof until the 365 days have expired.

7. Web analytics with Umami

For web analytics I use the analytics software Umami, which I run on my own server (umami.berezka.me). Umami sets no cookies, writes nothing to your browser’s storage and does not track you across other websites. It records the page viewed, the referring page, browser type, operating system, device type, screen size, language and the approximate country of origin (derived from the IP address). The IP address is used only briefly for processing and is not stored; no lasting profile of you is created. The evaluation takes place entirely on my own server. The legal basis is my legitimate interest in learning which pages are read (Art. 6 para. 1 lit. f GDPR).

8. No cookies; settings in your browser

This website itself sets no cookies (for possible Cloudflare security cookies see section 3). It stores three settings in your browser’s local storage (localStorage) so that they persist on your next visit:

  • theme-pref: light or dark, when you toggle the colour scheme;
  • lang-pref: your language, when you click a language;
  • lite-mode-pref: the lighter display without heavy animations. The value is set when you choose the lighter display yourself (“explicit”), or automatically when the site detects that your device cannot render the animations smoothly (“auto” with a timestamp).

These values are not transmitted to me and reveal nothing about you as a person. Storing them is necessary so that the website is displayed the way you chose or the way your device can render it (§ 25 para. 2 no. 2 TDDDG). You can delete the values at any time in your browser settings (website data).

9. External content and links

No content from other providers (fonts, scripts, images) is loaded from third-party servers when you visit this website. The preview of my Instagram posts on the home page consists of copies stored on my own server. Buttons and links to Instagram are plain links: only when you click them do you leave this website, and only then does Instagram receive data from you.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw a consent at any time with effect for the future (Art. 7 para. 3 GDPR), for the newsletter via the unsubscribe link or the preferences page of your subscription. To do so, write to [email protected].

Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing that I base on my legitimate interest (Art. 6 para. 1 lit. f GDPR). I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to direct marketing at any time without giving reasons.

11. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.