Menu Arthur Khessin's blog

Privacy Policy

Controller

The controller (Art. 4(7) GDPR) for www.khessin.de and khessin.de is:

Arthur Khessin
Siesmayerstr. 25
60323 Frankfurt am Main
Germany
Email: arthur@khessin.de

I am not required to appoint a data protection officer.

Overview

This private, non-commercial blog sets no cookies and uses no analytics, tracking or advertising. There are no comments, forms, newsletter or user accounts. Pages load nothing from third-party servers.

I process personal data only when you visit the website, email me or choose to load a video.

Visiting this website

When you open a page, my hosting provider processes access data on my behalf. This includes your IP address, date and time, the requested URL, the referring page (referrer), your browser and operating system (user agent) and similar technical data your browser sends.

This is needed to deliver the website securely and reliably and to stop attacks and misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in these purposes). The hosting provider is my processor (Art. 28 GDPR). It keeps access data only as long as needed for delivery and security, then deletes or anonymises it.

If you choose a light or dark colour scheme, your browser stores this choice on your device and never sends it to anyone. This is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG).

The site search runs entirely in your browser. Your search terms are not sent or stored.

Email

If you email me, I process your email address, your name (if given), your message and the email's technical data to deal with your message. The legal basis is Art. 6(1)(f) GDPR, based on my legitimate interest in answering messages sent to me.

An email forwarding provider passes incoming emails on to my mailbox, so my mailbox provider also receives them. I send replies, which may quote your message, through an email delivery provider. The forwarding and delivery providers are my processors (Art. 28 GDPR). I delete emails once they are no longer needed for your matter and there is no legitimate reason to keep them, such as ongoing correspondence.

Transfers outside the EU

These providers can also process data outside the EU/EEA:

  • Hosting provider: in the USA, based on the EU adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which the provider is certified; as a fallback, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
  • Email forwarding provider: in the USA, based on the EU Standard Contractual Clauses.
  • Email delivery provider: in a country with an EU adequacy decision (Art. 45 GDPR); in other countries, such as the USA, based on the EU Standard Contractual Clauses.

On request by email, I will name the countries concerned and send a copy of the safeguards.

Videos

Some older posts contain videos from YouTube, Vimeo or Dailymotion. At first you see only a placeholder from this website; nothing is loaded from the video provider.

Only when you click "Load video" does your browser load the player from the provider. This sends at least your IP address, browser data and the page address (referrer) to the provider. The provider can also use cookies or similar technologies on your device, analyse your use and, if you are logged in, link the visit to your account.

The legal basis is your consent, given by clicking "Load video" (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). It covers only that video during that page view and is not stored. You can withdraw it at any time with effect for the future by reloading or leaving the page (Art. 7(3) GDPR); processing before that remains lawful.

The provider and I are joint controllers only for loading the video and the resulting transmission of your data (Art. 26 GDPR). In essence, we share responsibility as follows: I am responsible for the placeholder, for asking for your consent and for this information; the provider is responsible for its player and for all further use of your data, including storage periods (see its privacy policy). You can exercise your rights against either of us (Art. 26(3) GDPR).

Vimeo is based in the USA and certified under the EU-U.S. Data Privacy Framework (EU adequacy decision, Art. 45 GDPR). Google Ireland and Dailymotion are based in the EU; for their own transfers to other countries, see their privacy policies.

Your right to object

Where I process data based on Art. 6(1)(f) GDPR (website visits and emails), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then stop processing it, unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or I need the data to establish, exercise or defend legal claims.

Your other rights

Subject to the legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise any of your rights, an email to arthur@khessin.de is enough.

You can also complain to a supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where the alleged infringement took place. The authority responsible for me is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7, 65185 Wiesbaden, Germany
Postal address: Postfach 3163, 65021 Wiesbaden, Germany
https://datenschutz.hessen.de

Further information

There is no automated decision-making, including profiling (Art. 22 GDPR). You do not have to provide personal data, but without the access data described above the website cannot be delivered.

Last updated: 20 October 2026