Privacy policy

Who is responsible for your data

What happens when you visit a page

The site is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States, which also runs the domain's name servers. When your browser requests a page, Cloudflare's servers receive your IP address, the page requested, the date and time, your browser's user agent and the referring page. That is needed to send you the page and to protect the site from abuse. Cloudflare processes this data on our behalf under its data processing addendum.

• Legal basis: our legitimate interest in running a secure, working website (Art. 6 (1) (f) GDPR).
• How long: we see only totals, such as requests per day, never individual visits. Cloudflare keeps request data for as long as it needs to deliver and protect the site, as described in its privacy policy.
• Transfer outside the EU: Cloudflare is based in the United States and certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as ensuring adequate protection (Art. 45 GDPR).

Google Analytics, only if you accept

If you click Accept in the cookie banner, we use Google Analytics to count visits and see which pages people read. Nothing from Google loads before you accept, and nothing loads if you click Reject.

The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records the pages you view, when, the page you came from, your approximate location (country and region, worked out from your IP address), your device, browser, screen size and language, and actions such as scrolling and clicks on links to other sites. It sets two cookies, _ga and _ga_BCVJGFC6VQ, which tell your later visits apart from a new visitor and are kept for up to two years. We have switched off Google signals and ad personalization, so the data is used only to count visits for us.

• Legal basis: your consent (Art. 6 (1) (a) GDPR; for storing cookies on your device, § 25 (1) TDDDG). You can withdraw it at any time with "Cookie settings" at the foot of every page; we then delete the cookies in your browser and load nothing more.
• How long: Google Analytics deletes the data on single visits and visitors after 14 months. Totals, such as the number of visits to a page in a month, stay in our reports.
• Transfer outside the EU: Google may process the data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as ensuring adequate protection (Art. 45 GDPR). Google processes the data for us under its data processing terms; see also Google's privacy policy.

Your answer in the banner is kept in your browser's local storage (the entry pp-consent) so the banner doesn't ask again on every page. It holds only "granted" or "denied", is never sent to us and is needed to respect your choice (§ 25 (2) TDDDG).

Fonts and Search Console

Fonts are served from our own server, so your browser makes no requests to font providers. We use Google Search Console to see how the site appears in Google Search; it runs no code on this site and receives no data about you from it.

If you use the contact form

The form on the contact page sends your email address, your message and, if you give it, your name to Formspree, Inc., a form service based in the United States, which forwards it to us by email. Formspree stores submissions on Amazon Web Services servers in the United States.

• Legal basis: your consent, given with the checkbox on the form (Art. 6 (1) (a) GDPR). You can withdraw it at any time by emailing us; we then delete your message.
• How long: we delete submissions, at Formspree and in our inbox, 12 months after the conversation ends.
• Transfer outside the EU: Formspree relies on the European Commission's Standard Contractual Clauses for transfers from the EU (Art. 46 GDPR). See Formspree's privacy policy.

The form has a hidden field that catches automated spam. It sets no cookies and loads no code from Formspree.

If you email us

We use your email address and message only to reply. Legal basis: our legitimate interest in answering you (Art. 6 (1) (f) GDPR), or steps before a contract if your message is about one (Art. 6 (1) (b) GDPR). We delete the conversation 12 months after it ends, unless the law requires us to keep it longer. Our email is hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

The salary data on this site

The pay figures come from public records published by government agencies. We never publish names, and every figure covers at least five people, so no figure describes one person. See where the numbers come from.

Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict how we process it (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on our legitimate interest (Art. 21)
• withdraw any consent you have given, such as for the contact form or Google Analytics, with effect for the future (Art. 7 (3))
• complain to a data protection authority (Art. 77). Ours is the Berlin Commissioner for Data Protection and Freedom of Information.

To use any of these rights, email hello@markus-green.com.