What happens to your data.
Written plainly, built to meet Articles 13 and 14 GDPR.
This page explains what happens to your data when you visit this site or get in touch. It is written plainly, but it is built to meet Articles 13 and 14 of the EU General Data Protection Regulation.
1. Who is responsible
Mehmet Burak Dikmen, trading as fspark9
Beusselstrasse 31, 10553 Berlin, Germany
Email: info@fspark9.com
I am the controller for the data described below. There is no separate data protection officer, because Article 37 GDPR does not require one at this size.
2. The short version
I run a consulting practice, not a data business. I do not sell data, I do not build advertising profiles, and I do not track you across the web. Most of what I hold is the contents of an email you sent me or a call you booked.
This site is aimed at businesses. It is not intended for consumers and not intended for anyone under 16.
3. When you just visit
My hosting provider records standard server logs on every page load: IP address, date and time, page requested, referring page, browser and operating system.
Why
To serve the site, keep it stable, and detect attacks.
Legal basis
Article 6(1)(f) GDPR, my legitimate interest in a working and secure website.
Retention
30 days, then deleted or anonymised.
This is not combined with anything else and is not used to identify you.
Hosting provider
Vercel Inc., United States. A data processing agreement under Article 28 GDPR is in place. Where data reaches the United States, the transfer is covered by the EU Standard Contractual Clauses.
All fonts, scripts, and images are served from this site’s own domain. Nothing loads from Google Fonts or a font CDN. The site counts visits with Vercel Web Analytics, described below, which sets no cookies.
To see how many people visit and which pages load slowly, the site uses Vercel Web Analytics and Vercel Speed Insights, both run by my hosting provider. They set no cookies. With each page view they record the page, the page you came from, your country, region and city, your browser, operating system and device type, and how fast the page loaded. They do not record who you are. Within a single day a visit is recognised through a hash of the request, and that hash is discarded after 24 hours. I only ever see totals.
Why
To understand which pages are read and to keep the site fast.
Legal basis
Article 6(1)(f) GDPR, my legitimate interest in knowing how the site is used and keeping it fast. Nothing is read from or stored on your device, so § 25 TDDDG does not apply.
Retention
The figures are shown to me for one month. The visit hash is discarded after 24 hours.
4. When you book a call
The booking tool is provided by Cal.com, Inc. It does not load when the page loads. It loads only when you click Book a call, which opens the booking window on this site. Until you click, nothing from Cal.com runs in your browser and Cal.com learns nothing about your visit.
Once you open it, you provide your name, your email address, and whatever you write in the notes field. Cal.com processes this to create the appointment and send confirmations and reminders. The booking arrives in my calendar and my inbox.
Why
To arrange and hold the call you asked for.
Legal basis
Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. For loading the tool itself, Article 6(1)(a) GDPR and § 25(1) TDDDG, your consent, given by clicking Book a call.
Retention
[24] months after the call, unless it becomes an engagement, in which case section 6 applies.
Cal.com is a US company with EU infrastructure. Where data reaches the United States, the transfer runs on the EU Standard Contractual Clauses. A data processing agreement is in place. Their policy: https://cal.com/privacy
5. When you subscribe to the Spark newsletter
The newsletter forms on this site send your email address to Kit, the service that sends the newsletter. Nothing is sent until you submit a form. You then get an email with a confirmation link, and you are on the list only after you click it.
Why
To send you the Spark newsletter: one email a month with that month's Sparks.
Legal basis
Article 6(1)(a) GDPR, your consent, given by submitting the form and confirming by email.
Retention
Until you unsubscribe. If you never click the confirmation link, I do not mail you.
Every email has an unsubscribe link at the bottom. One click ends the subscription, and you can withdraw consent at any time with effect for the future. Kit is a US company. Where data reaches the United States, the transfer relies on the safeguards required by Chapter V GDPR, such as the EU Standard Contractual Clauses. Their policy: https://kit.com/privacy
6. When you email me or become a client
If you write to me, I hold your message, your contact details, and my replies.
Why
To answer you, and to run the engagement if we work together.
Legal basis
Article 6(1)(b) GDPR for anything connected to a contract or its preparation, Article 6(1)(f) GDPR for general correspondence.
Retention
Enquiries that go nowhere are deleted after [24] months. Anything connected to a paid engagement is kept as long as German commercial and tax law requires, which is six years under § 257 HGB and ten years under § 147 AO depending on the document.
Email provider
Google (Gmail). A data processing agreement is in place.
Client data is handled under the engagement contract. Where I process personal data on a client’s behalf, we sign a separate data processing agreement under Article 28 GDPR before that processing starts.
7. Who else sees your data
Only the providers I need in order to operate. Each processes data on my instructions under an Article 28 GDPR agreement and may not use it for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Serving the website | United States |
| Vercel Inc. | Visit counts and page speed, without cookies | United States |
| Cal.com, Inc. | Scheduling calls, after you click | EU / US |
| Kit | Sending the Spark newsletter, after you subscribe | United States |
| Google (Gmail) | Business email and calendar | United States |
Beyond this I disclose data only where legally obliged, for example to tax authorities or under a valid court order.
8. What this site does not do
No advertising cookies. No retargeting pixels. No social media tracking. No analytics cookies. No automated decision making or profiling under Article 22 GDPR. No selling or renting of data.
If any of this changes, this page is updated before the change goes live, and anything requiring consent will ask for it first.
9. Cookies
See the cookie notice. In short, this site sets nothing that is not strictly necessary, and the one third party tool it uses does not load until you click it.
10. Your rights
Under the GDPR you can ask me to:
- confirm whether I hold data about you and give you a copy (Art. 15)
- correct anything inaccurate (Art. 16)
- delete your data (Art. 17), where no legal retention duty applies
- restrict processing (Art. 18)
- provide your data in a portable format (Art. 20)
- stop processing based on legitimate interest, on grounds relating to your situation (Art. 21)
- withdraw any consent you gave, at any time, with effect for the future (Art. 7(3))
Write to info@fspark9.com. I respond within one month. No charge, and no reason needed for a deletion request.
You can also complain to a supervisory authority. Mine is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), and you may also go to the authority where you live or work.
11. Security
The site is served over TLS. Access to my email and files requires two factor authentication. No system is perfectly secure, but data sent to this site is encrypted in transit.
I do not ask clients for production customer data and do not want to receive it. Where work needs realistic data, we use anonymised or synthetic sets.
12. Changes
If the site changes in a way that affects data processing, this page is updated before the change goes live. The date at the top shows the last revision.