Last updated
5 August 2026
This page explains what happens to your data when you visit this site or get in touch. It is written plainly, but it is built to meet Articles 13 and 14 of the EU General Data Protection Regulation.
1. Who is responsible
Mehmet Burak Dikmen, trading as fspark9
Beusselstrasse 31, 10553 Berlin, Germany
Email: mehmetburakdikmen@gmail.com
I am the controller for the data described below. There is no separate data protection officer, because Article 37 GDPR does not require one at this size.
2. The short version
I run a consulting practice, not a data business. I do not sell data, I do not build advertising profiles, and I do not track you across the web. Most of what I hold is the contents of an email you sent me or a call you booked.
This site is aimed at businesses. It is not intended for consumers and not intended for anyone under 16.
3. When you just visit
My hosting provider records standard server logs on every page load: IP address, date and time, page requested, referring page, browser and operating system.
Why
To serve the site, keep it stable, and detect attacks.
Legal basis
Article 6(1)(f) GDPR, my legitimate interest in a working and secure website.
Retention
30 days, then deleted or anonymised.
This is not combined with anything else and is not used to identify you.
Hosting provider
Vercel Inc., United States. A data processing agreement under Article 28 GDPR is in place. Where data reaches the United States, the transfer is covered by the EU Standard Contractual Clauses.
All fonts, scripts, and images are served from this site’s own domain. Nothing loads from Google Fonts, a CDN, or any other third party server, so simply reading a page sends no data to anyone but my host.
4. When you book a call
The booking tool is provided by Cal.com, Inc. It does not load when the page loads. You see a placeholder, and Cal.com is only contacted after you click it. Until you click, nothing from Cal.com runs in your browser and Cal.com learns nothing about your visit.
Once you open it, you provide your name, your email address, and whatever you write in the notes field. Cal.com processes this to create the appointment and send confirmations and reminders. The booking arrives in my calendar and my inbox.
Why
To arrange and hold the call you asked for.
Legal basis
Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. For loading the tool itself, Article 6(1)(a) GDPR and § 25(1) TDDDG, your consent, given by clicking to open it.
Retention
[24] months after the call, unless it becomes an engagement, in which case section 5 applies.
Cal.com is a US company with EU infrastructure. Where data reaches the United States, the transfer runs on the EU Standard Contractual Clauses. A data processing agreement is in place. Their policy: https://cal.com/privacy
5. When you email me or become a client
If you write to me, I hold your message, your contact details, and my replies.
Why
To answer you, and to run the engagement if we work together.
Legal basis
Article 6(1)(b) GDPR for anything connected to a contract or its preparation, Article 6(1)(f) GDPR for general correspondence.
Retention
Enquiries that go nowhere are deleted after [24] months. Anything connected to a paid engagement is kept as long as German commercial and tax law requires, which is six years under § 257 HGB and ten years under § 147 AO depending on the document.
Email provider
Google (Gmail). A data processing agreement is in place.
Client data is handled under the engagement contract. Where I process personal data on a client’s behalf, we sign a separate data processing agreement under Article 28 GDPR before that processing starts.
6. Who else sees your data
Only the providers I need in order to operate. Each processes data on my instructions under an Article 28 GDPR agreement and may not use it for their own purposes.
Provider
What for
Where
Vercel Inc.
Serving the website
United States
Cal.com, Inc.
Scheduling calls, after you click
EU / US
Google (Gmail)
Business email and calendar
United States
Beyond this I disclose data only where legally obliged, for example to tax authorities or under a valid court order.
7. What this site does not do
No advertising cookies. No retargeting pixels. No social media tracking. No analytics. No automated decision making or profiling under Article 22 GDPR. No selling or renting of data.
If any of this changes, this page is updated before the change goes live, and anything requiring consent will ask for it first.
8. Cookies
See the cookie notice. In short, this site sets nothing that is not strictly necessary, and the one third party tool it uses does not load until you click it.
9. Your rights
Under the GDPR you can ask me to:
confirm whether I hold data about you and give you a copy (Art. 15)
correct anything inaccurate (Art. 16)
delete your data (Art. 17), where no legal retention duty applies
restrict processing (Art. 18)
provide your data in a portable format (Art. 20)
stop processing based on legitimate interest, on grounds relating to your situation (Art. 21)
withdraw any consent you gave, at any time, with effect for the future (Art. 7(3))
Write to mehmetburakdikmen@gmail.com. I respond within one month. No charge, and no reason needed for a deletion request.
You can also complain to a supervisory authority. Mine is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), and you may also go to the authority where you live or work.
10. Security
The site is served over TLS. Access to my email and files requires two factor authentication. No system is perfectly secure, but data sent to this site is encrypted in transit.
I do not ask clients for production customer data and do not want to receive it. Where work needs realistic data, we use anonymised or synthetic sets.
11. Changes
If the site changes in a way that affects data processing, this page is updated before the change goes live. The date at the top shows the last revision.