Privacy policy (Datenschutz)
This is an English translation for convenience. The German version is the binding one: Datenschutzerklärung.
1. Controller
Sina Naghizadeh Kashani
Allee der Kosmonauten 20
10315 Berlin, Germany
Email: contact@sinakashani.com
I run this website as a private individual. There is no data protection officer, as none is required. For privacy questions, write to the address above. See also the Impressum.
2. Hosting and server logs
This website is served by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When a page is requested, Cloudflare processes technically necessary data: IP address, date and time, requested address, browser and device information (user agent) and referrer. This is needed to deliver the site and protect it from attacks.
Logging is enabled for the program that receives the contact form (a Cloudflare Worker). The logs contain such request data, including the IP address, are used only for debugging and security, and are deleted automatically by Cloudflare after a few days (at most 7 days). Form contents are not stored in them.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is a secure, working website. Cloudflare acts as a processor under its data processing agreement (Art. 28 GDPR).
Cloudflare may also process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision, Art. 45 GDPR). In addition, the data processing agreement includes the EU Commission's standard contractual clauses (Art. 46 GDPR).
3. Contact form and email
When you submit the contact form, your name, email address and message are sent to this website's Cloudflare Worker. It checks the details and forwards the message by email through Cloudflare Email Routing to my mailbox, with your email address set as the reply-to address. The website itself does not store the details in a database. To limit mass submissions, the IP address is used briefly to count requests per address.
Emails to contact@sinakashani.com are also forwarded to the same mailbox through Cloudflare Email Routing.
The mailbox is hosted by Google (Gmail); the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.
I use your details only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract or working together, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Recipients are Cloudflare (delivery) and Google (mailbox). I delete the message once it is no longer needed for the enquiry, unless statutory retention obligations apply.
Spam protection with Cloudflare Turnstile
The home page, which has the contact form, loads Cloudflare Turnstile from challenges.cloudflare.com. Turnstile checks whether a person is sending the form. For this, Cloudflare processes technical data such as the IP address, browser and device information (user agent, TLS characteristics) and characteristics of the check. The result is a token that the Worker has Cloudflare verify when the form is sent. Turnstile does not read form contents and is not used for advertising.
Turnstile sets no cookies, but stores an entry in your browser's local storage (under challenges.cloudflare.com) that is used for the check. This access is strictly necessary for spam protection (§ 25(2) no. 2 TDDDG). The legal basis for the further processing is Art. 6(1)(f) GDPR (legitimate interest in protection against spam and abuse). For Turnstile, Cloudflare is a processor. According to Cloudflare, it also uses the data as a controller in its own right to improve its bot detection. Details are in Cloudflare's Turnstile Privacy Addendum. For transfers to the USA, see section 2.
4. No cookies, no analytics
This website sets no cookies and uses no analytics or tracking tools. The only embedded third-party content is Cloudflare Turnstile on the home page (see 3.), which uses local storage as described. Fonts are served by this website itself.
5. External links
Links to GitHub, LinkedIn and other sites lead to services run by other providers. Data is processed there only once a link is clicked; their own privacy policies apply.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). A short email to contact@sinakashani.com is enough.
Right to object (Art. 21 GDPR): where I process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. I will then stop processing the data unless there are compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.
7. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Last updated: September 2026