Last updated: October 2026
1. Controller and contact
The controller responsible for processing personal data on this website under the General Data Protection Regulation (GDPR) is:
Tom Schmidt
Augustenstraße 89
80798 Munich
Germany
Phone: +49 155 68945438
E-Mail: contact@tomsmdt.com
I have not appointed a data protection officer because I am not legally required to. For all questions about data protection and to exercise your rights, please write to the address above.
2. Overview
This is a personal website with a blog, a photo portfolio and a film portfolio. It has no user accounts, no comment function, no contact form, no shop and no newsletter. I only process your data to deliver the website, to keep it secure, to answer your e-mails and, if you agree, to measure how the site is used. Analytics and behaviour analysis are off by default. Nothing is loaded from Google or Microsoft unless you consent in the cookie banner.
3. Hosting and server log files
This website is hosted by Hostinger. For customers in the European Union the hosting contract is concluded with Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Cyprus; other companies of the Hostinger group, such as HOSTINGER, UAB (Švitrigailos Str. 34, 03230 Vilnius, Lithuania), may be involved in providing the service. Hostinger processes data on my behalf under a data processing agreement pursuant to Art. 28 GDPR. Hostinger may process data in the EU and in third countries; where data leaves the EU/EEA, Hostinger relies on the EU Standard Contractual Clauses (see Hostinger's privacy policy).
Every time you open a page, the web server automatically records technical data in so-called server log files. These are: your IP address, date and time of the request, the requested page or file, the amount of data sent, the HTTP status, the page you came from (referrer), and information about your browser and operating system (user agent). The data is not combined with other data and is not used to identify you.
Purpose: delivering the website and ensuring its stability and security, for example to detect and fend off attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure and working website). Storage period: the log files are kept only for a short time as part of Hostinger's regular operation and are then deleted or overwritten. The transmission between your browser and the server is encrypted (HTTPS).
4. Cookie banner and your choice
When you first visit, a banner asks whether the services described in sections 5 and 6 may be used. You can reject all, accept all or choose individually. Rejecting is as easy as accepting. The banner is built into this website; no external consent service is used.
To remember your choice I store it in your browser (local storage, key tomsmdt-consent). It contains your selection, the time of the choice and the version of the banner, but no information that identifies you. It is kept for up to six months, after which you are asked again, or until you delete your browser data. This storage is technically necessary to respect your choice (§ 25 (2) no. 2 TDDDG); the processing is based on Art. 6 (1) (c) GDPR in connection with Art. 7 (1) GDPR (obligation to be able to prove consent) and Art. 6 (1) (f) GDPR.
You can change or withdraw your choice at any time with effect for the future: Open cookie settings, or use “Cookie settings” in the footer. If you withdraw consent, the cookies of the services are deleted and the page is reloaded. Withdrawing does not affect the lawfulness of processing before the withdrawal.
5. Statistics: Google Tag Manager and Google Analytics
If you consent to “Statistics”, I use Google Tag Manager and Google Analytics 4. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google LLC in the USA may also process data.
Google Tag Manager loads the measurement tags on this website. It does not set cookies itself, but when it is loaded Google receives your IP address and technical information about your browser. It is therefore only loaded after your consent.
Google Analytics shows me which pages are visited, how visitors find the site, and which devices and browsers are used. For that, Google Analytics sets cookies (_ga and _ga_<ID>, validity up to two years) and processes, among other things, pseudonymous identifiers, the pages you view, interactions such as clicks and scrolling, your approximate location derived from the IP address, and device and browser data. I do not use the data for advertising and do not share it with advertising networks.
Google processes the data on my behalf. It may transfer it to the USA. For this there is an adequacy decision of the European Commission for the EU–US Data Privacy Framework, under which Google LLC is certified. Event data in Google Analytics is deleted automatically after the retention period set in my account, at the latest after 14 months.
Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time (see section 4). Further information: policies.google.com/privacy.
6. Behaviour analysis: Microsoft Clarity
If you consent to “Behaviour analysis”, I use Microsoft Clarity. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”).
Clarity records how visitors use the site: clicks, taps, scrolling, mouse movements, the pages viewed, device and browser data and your approximate location. From this it creates heatmaps and anonymised session replays that show me where the site is confusing. Clarity sets the cookies _clck (validity up to one year) and _clsk (one day). Entries in input fields are masked by default and not recorded. I use the data only to improve this website.
Microsoft processes the data under its Clarity terms and may transfer it to the USA. Microsoft is certified under the EU–US Data Privacy Framework. How Microsoft processes data for its own purposes is described in Microsoft's privacy statement: privacy.microsoft.com/privacystatement.
Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time (see section 4).
7. Google Search Console
I use Google Search Console to see how this website performs in Google Search, for example which search terms lead to it. Search Console does not store anything on your device and does not track you on this website. I only receive aggregated data from Google. If you reach this site through Google Search, Google processes your data under its own responsibility.
8. Contact by e-mail or phone
If you write or call me, I process your e-mail address or phone number, your name if given, the content of your message or call and the time, solely to read and answer it. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries) and, if your message concerns a contract or preparing one, Art. 6 (1) (b) GDPR. I delete the data once your request is dealt with, unless I am legally required to keep it. E-mail can be read by third parties on its way; for confidential content, please contact me by another route.
9. Links to other websites and fonts
This website links to external pages, for example my profiles on Instagram and YouTube. These are plain links: nothing is loaded from these platforms until you click. After the click, the respective provider is responsible for processing your data; please see their privacy policies. Fonts are delivered from this website's own server; no connection to Google Fonts or similar services is made.
10. Recipients and data transfers
Recipients of your data are the hosting provider (section 3) and, only if you consent, Google (sections 5 and 7) and Microsoft (section 6) as processors or independent controllers as described there. I do not sell your data. Data is transferred to countries outside the EU/EEA only as described in these sections.
11. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7 (3)). You are not obliged to provide personal data, but without the server logs I cannot deliver the website, and without consent the analytics services stay off.
Right to object: Where I process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
There is no automated decision-making, including profiling, that produces legal effects concerning you.
12. Changes
I update this policy when the website, the services I use or the law change. The current version is always available on this page.