Privacy

1. Controller and contact

The controller responsible for processing personal data on this website is:

Email: info@christianslezak.de

This policy covers the personal portfolio at christianslezak.de and its subpages. My separately linked therapy website has its own privacy policy.

2. Hosting and technical access data

The website and email account are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider supplies the technical infrastructure and processes connection and access data for this purpose.

When you visit this website, technically necessary information is processed. This includes your IP address, the date and time of access, the requested page or file, the HTTP status, the amount of data transferred and information supplied by your browser, such as browser type, operating system and, where applicable, the previously visited page.

The purposes are to deliver the website, ensure stability and security, and detect and investigate technical faults and attacks. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of this portfolio.

Access logs are stored for 30 days and then deleted. In the event of a specific security incident, data required for investigation or legal proceedings may be retained separately until the matter is resolved. These technical logs are separate from the optional Google Analytics visitor analysis, which requires consent.

ALL-INKL processes data as a technical service provider within its hosting services. Processing on behalf of a controller is subject to Article 28 GDPR. Further information: ALL-INKL privacy information.

3. Contact by email

If you email me, I process your email address, your name if provided, and the content, attachments and technical transmission data of your message. This enables me to read and answer your enquiry and continue our correspondence. The email account is also hosted by ALL-INKL.

The legal basis is Article 6(1)(f) GDPR; my legitimate interest is responding to messages addressed to me. If, exceptionally, your enquiry directly concerns contractual or pre-contractual steps you have requested, Article 6(1)(b) GDPR applies.

I delete messages once the enquiry has been fully resolved and retention is no longer needed for correspondence. Messages are retained longer only where statutory retention duties or the establishment, exercise or defence of legal claims require it. You are not obliged to contact me; without the necessary information, I may be unable to answer your enquiry.

Clicking an email link opens your email application; it does not itself send a message to me. Ordinary email is not automatically end-to-end encrypted. Please do not send confidential health or therapy information to this portfolio contact address.

4. Cookies and privacy settings

The basic website functions, photo galleries and filters do not require analytics or advertising cookies. No external fonts, maps, social media plugins or video players are loaded automatically. Thumbnails, photographs, fonts or system fonts and website scripts are provided locally.

Your choice about optional statistics is saved in your browser’s local storage under the key cs-privacy-choice-v1 . The stored information comprises your selection, its timestamp and the associated configuration version. After 180 days, the selection is no longer applied and you are asked again. You can change it at any time using “Privacy settings” in the footer, or remove it by clearing this website’s data in your browser. This local entry is not sent to me as a separate statistics event.

This storage is used solely to honour your privacy choice. Access to your device is based on section 25(2), no. 2 of the German TDDDG; any associated processing of personal data is based on Article 6(1)(f) GDPR. The legitimate interest is to apply your choice reliably.

Optional analytics cookies and the necessary connections to Google are activated only after you consent. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. You can decline just as you can accept; the website remains usable without statistics.

Open privacy settings ↗

5. Google Analytics 4

With your consent, I use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps me understand which parts of the portfolio are visited and how the website is used, so I can improve its content and usability.

Data processed may include page views, timestamps, interactions such as scrolling or outbound link clicks, session information, pseudonymous browser identifiers, browser and device information, language and approximate geographical location. Your IP address is processed for technical communication. According to Google, IP addresses of EU users are not permanently logged or stored in Analytics when collected; they are deleted before further processing. This does not mean that all other analytics data is anonymous.

I use this integration without Google Signals or personalised advertising. No custom user ID is assigned. Page addresses sent to Google Analytics contain no URL query parameters or fragments, and no referring page is passed as an analytics parameter. The website code does not send the contents of your emails to Analytics.

The integration uses basic consent mode: the Google tag is not loaded before you consent. If you decline, no so-called cookieless pings are sent to Google either. Visiting an external platform through a link you click is a separate matter.

Google Analytics uses cookies with names such as _ga and _ga_…. This integration limits their lifetime to a maximum of 365 days from creation; it is not automatically renewed on each visit. Your consent remains valid in this browser for up to 180 days. The Analytics property is set to retain user and event data for 14 months. Aggregated reports that are not associated with individual users or events may remain available longer.

The recipient is Google, including affiliated companies and technical service providers it engages. Processing in the USA by Google LLC and in other countries outside the EU or EEA cannot be ruled out. Such transfers are subject to the relevant requirements of Articles 44 et seq. GDPR. Google describes its use of the EU–US Data Privacy Framework for appropriately certified recipients and, additionally, standard contractual clauses. Information on transfer mechanisms and contractual terms is available in Google’s data processing terms and the Google Privacy Policy.

You can withdraw consent at any time using “Privacy settings” in the footer, by disabling statistics or selecting “Essential only”. Analytics will then no longer be loaded on this website; reloading stops analytics functions that are already loaded, and accessible Analytics cookies belonging to this website are deleted. Withdrawal does not affect the lawfulness of processing carried out before it. It does not automatically delete data already sent to Google retrospectively. You can contact me to exercise your data protection rights.

6. Film, social media and other external links

This website links to YouTube, Vimeo, Instagram, Facebook, LinkedIn, XING, project websites, training institutes and my other websites, among others. Videos are not embedded directly; their thumbnails are stored on this web server. Social media buttons are ordinary links, rather than automatically loaded platform plugins.

Your browser connects to a destination website only when you follow a link. Its providers may then process your IP address, set cookies and, if you are signed in, associate the visit with your account. Processing on those websites is governed by their own privacy policies. This website is configured to ask your browser not to send the address of the previously visited portfolio page as a referrer when following links.

7. Photographs, films and press publications

The published work documents my personal and professional journey. Where individuals are identifiable, publication may involve personal data. Depending on the publication, the basis may in particular be consent under Article 6(1)(a) GDPR or a legitimate interest in documenting and presenting the work under Article 6(1)(f) GDPR; any overriding rights of the individuals depicted must be respected.

If you are identifiable in an image and have questions about its publication or wish to object, please contact me. The same applies if you wish to withdraw consent you previously gave. Work is generally published for as long as it serves its documentary purpose. If the basis for publication ceases to apply or there is a valid request for deletion, the relevant content will be removed unless overriding legal grounds require otherwise.

8. Other recipients and retention

Personal data is not sold. It is disclosed only where necessary for the purposes described, where you have consented, where there is a legal obligation or where legitimate legal claims require it. Possible recipients include the hosting and analytics providers named above, email providers involved in correspondence, and, in individual cases, legally authorised authorities or parties involved in legal proceedings.

Where no specific period is stated above, personal data is deleted once its purpose no longer applies and no retention obligation or other legal basis prevents deletion. Backups may contain data until they are overwritten in the normal cycle; they are used for recovery after a failure, rather than any further use.

9. Your rights

Subject to the applicable legal conditions, you have the right of access to your personal data (Article 15 GDPR), rectification of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability for qualifying automated processing based on consent or a contract (Article 20). You may withdraw consent with effect for the future (Article 7(3)).

Right to object: Where I process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object under Article 21(1) GDPR on grounds relating to your particular situation. I will then stop processing the data unless there are demonstrably compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons; I do not carry out direct marketing through this website.

To exercise your rights, you can initially send a message to the contact address above. If necessary to identify you securely, I may ask for suitable additional information to verify your identity.

10. Right to lodge a complaint with a supervisory authority

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the location of a suspected infringement. The authority responsible for my place of residence is:

Supervisory authority: contact and complaints ↗

11. Further information

No automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR take place. Pseudonymous visitor analytics through Google Analytics is used solely for the purposes described in section 5.

You do not need to register or provide contact details simply to visit the website. Technical connection data is necessary to deliver the site; additional use of Analytics is optional.

Data should be transmitted using the website’s HTTPS address. Your chosen browser and device environment, as well as your email providers, may carry out additional processing over which I have no direct control.

This policy will be updated if the functions, service providers or legal requirements change.

Last updated: 1 November 2026