Privacy policy
This page explains which data is processed when you visit this website, what I use it for and what rights you have. In short: there is no tracking, no advertising, no analytics tools and no embedded content from other providers.
This translation is for information only. The German version is legally binding.
Who is responsible?
The controller responsible for data processing on this website is:
Patrick Rauch
c/o Online-Impressum 12114, Europaring 90
53757 Sankt Augustin
kontakt@it-rauch.dev
These details are also in the legal notice (Impressum). I am not required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG).
Hosting
The website, the contact form and my mail server run on a server I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in Nuremberg (Germany).
Hetzner processes the data on the server only on my behalf (processor under Art. 28 GDPR). I have concluded a data processing agreement with Hetzner for this purpose.
Visiting the website
When you open a page, your browser automatically sends technical data to the server: your IP address, date and time, the page requested, your browser identifier (user agent) and your preferred language. Some of this, above all the IP address, is needed for the server to be able to send you the page at all.
Access log: This data is only used to deliver the page. The web server keeps no access log. Its technical messages, for example about failed connections, may contain your IP address. These messages are limited to 30 MB at most; the oldest entries are overwritten continuously.
Application log: The website logs technical errors and notices, for example when a spam submission was rejected – without IP addresses and without anything you typed in. The log has a fixed size of a few megabytes; the oldest entries are overwritten continuously.
Connection during your visit: The site is an interactive web application. After the first page load, your browser opens a permanent, encrypted connection to my server through which clicks and page changes are handled. For this to work, the server keeps in memory for the duration of your visit which page you are viewing, which language you use, where you are on the journey page and – on the contact page – what you type into the form and how long you have been on the page (as protection against spam). This information is never stored permanently and is discarded a few minutes after the connection ends.
Legal basis is Art. 6(1)(f) GDPR. My legitimate interest is to provide you with the website and to run it securely and reliably. The data is not combined into a profile.
Cookies and language setting
This website uses at most two technically necessary cookies. They contain no advertising or tracking identifier and are only read by my own server.
| Cookie | Purpose | When it is set | Lifetime |
|---|---|---|---|
.AspNetCore.Culture |
remembers the language you selected (contains only the language code, e.g. "en") so that you don't have to choose it again on every visit | only when you switch the language yourself | 1 year |
pameliachat.download |
remembers that you entered the download password correctly (holds only an expiry date and a checksum, not the password) | only when you enter the download password correctly | 30 days |
I do not need your consent to store and read these cookies because they are strictly necessary to provide the function you have expressly chosen to use: your selected language or the unlocked download (Section 25(2) no. 2 TDDDG). I base the processing of the information they contain on Art. 6(1)(f) GDPR; my legitimate interest is a multilingual website that keeps your choice and a download only authorised people use.
As long as you have not selected a language, the site follows the language setting your browser sends with every request. Nothing is stored for this. You can delete or block cookies in your browser at any time. Without the cookies, the site is shown in your browser's language and you have to unlock the download every time.
Contact form and email
When you write to me using the contact form, your name, your email address, your message and the language in which you are using the site are sent as an email via my own mail server to my mailbox and stored there. The website itself does not store this information in a database and does not write it to a log. If you email me directly, the same applies to your email address and the content of your message. My mail server logs connection data (IP address of the sending server, time, result of delivery). This log is limited to 30 MB at most; the oldest entries are overwritten continuously.
Purpose: I only use the data to answer your enquiry.
Legal basis: If you yourself – not on behalf of a company – want to enter into a contract with me, for example to commission me to do something, the legal basis is Art. 6(1)(b) GDPR. In all other cases, including when you write on behalf of a company (for example with a job offer), it is Art. 6(1)(f) GDPR; my legitimate interest is being able to answer messages sent to me.
Voluntary: You are not obliged to write to me. Without your name, email address and message, however, I cannot reply.
Spam protection: The form recognises automated submissions by an invisible field and by a fill-in time that is too short; such messages are discarded and not stored. It does not accept messages with more than two links. In addition, the website accepts only a limited number of messages per hour, in total and from the same IP address. For this it keeps the IP address and the time of a sent message in memory for one hour and then discards both; none of it is written to disk or logged. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protecting the form from misuse.
Recipients: Messages arrive in my mailbox on my server at Hetzner (see the Hosting section). I fetch them with an email program (Mozilla Thunderbird) on my own computer; a copy is then kept there, which I delete after the same period. I do not forward them to other email providers and I do not pass them on to anyone else.
Retention: I delete your message no later than six months after your enquiry has been dealt with. If it leads to a contract, I keep it until the contract has been completed and any statutory retention periods have expired.
Download area and app update check
The installation files of my app PameliaChat (for Windows and Android) are in an area protected by a password. I issue the password myself: there is one shared password, which I give to testers and renew when needed. If you enter it correctly, the website sets a cookie so that you don't have to enter it again for 30 days (see the section "Cookies and language setting"). After five wrong tries from the same IP address the form locks for ten minutes; for this the website keeps the IP address in memory for that long. In addition, the technical data from the section "Visiting the website" is processed. The website itself does not store or count downloads.
The installed app requests a public file on this website at start-up that contains only the current version number and the address of the download page, so that it can notify you about updates. You can switch this off in the app's settings. In doing so, the server receives the technical data from the section "Visiting the website", in particular the IP address.
The legal basis in each case is Art. 6(1)(f) GDPR. My legitimate interest is to make the app available only to authorised people and to notify you about new versions. The app itself has its own privacy policy.
Links to other websites
This website contains simple links, for example to GitHub, LinkedIn and the legal notice. Only when you click a link do you leave my site; from then on, the privacy policy of the respective provider applies. No data is transferred to these providers before you click.
Backups
My server is backed up automatically every day at Hetzner so that no data is lost in the event of a technical fault. A backup is a copy of the whole server's disk, so it also contains my mailbox and the logs. Hetzner keeps the last seven backups; the oldest is overwritten each time. Deleted data may therefore still exist in a backup for up to seven days. I only restore data from a backup to fix a data loss. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protection against data loss.
Retention periods at a glance
| Data | How long |
|---|---|
| Technical data when visiting | not stored in an access log; technical messages of the web server: 30 MB at most, the oldest entries are overwritten continuously |
| Application log | fixed limit of a few megabytes, the oldest entries are overwritten continuously |
| State during your visit | until a few minutes after the connection ends |
| Language cookie | 1 year |
| Download cookie | 30 days |
| Contact messages and emails | no later than six months after the enquiry has been dealt with |
| Mail server logs | 30 MB at most, the oldest entries are overwritten continuously |
| Backups | up to seven days (the last seven daily backups) |
Recipients and transfers to third countries
The only recipient of your data is Hetzner as the provider of my server (see the Hosting section). The server is located in the European Union. Your data is not transferred to countries outside the European Union or the European Economic Area.
Your rights
Subject to the respective statutory requirements, you have the right
- to access the data I hold about you (Art. 15 GDPR),
- to have incorrect data rectified (Art. 16 GDPR),
- to have your data erased (Art. 17 GDPR),
- to have processing restricted (Art. 18 GDPR),
- to receive or have transmitted data you provided to me for a contract in a common format (Art. 20 GDPR).
Just send me an email at the address in the section "Who is responsible?" above.
Complaint to a supervisory authority
If you believe that I am not processing your data in accordance with data protection law, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) – in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for me is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
No automated decisions
There is no decision-making based solely on automated processing within the meaning of Art. 22 GDPR, and no profiling.
Version
This privacy policy is valid as of 5 November 2026. If anything significant changes, I will update this page.