PRIVACY POLICY

Last updated: 14 November 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Maria Kossak c/o Christoph Najberg, Legal counselor Wallstraße 15a 10179 Berlin Email: info@mariakossak.com (See also our imprint)

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functional website, our content and our services. Processing of personal data regularly takes place only with the user’s consent, unless it is necessary to perform a contract, to comply with a legal obligation, or is permitted by our legitimate interests. Legal bases • Art. 6(1)(a) GDPR: consent • Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures • Art. 6(1)(c) GDPR: legal obligation • Art. 6(1)(f) GDPR: legitimate interests • § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act): consent to storing or accessing information on your device; § 25(2) TDDDG: where strictly necessary You can withdraw any consent at any time with effect for the future (see section 4).

3. Hosting and server log files

The website is hosted on an IONOS server managed through Plesk. The server records routine technical information to deliver pages and diagnose errors and abuse. This may include the IP address, date and time, requested URL, HTTP status, referrer and browser user agent. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is keeping the website available and secure. Technical logs are subject to the hosting environment’s retention and rotation settings.

4. Cookies and external media preferences

The website stores your selection in the first-party mk_consent cookie for up to 180 days. It remembers whether you allow external videos. The website processes this preference on your device. You can change or withdraw your selection at any time using “Cookie settings” in the footer.

External players load only after you allow them. Consent is based on Art. 6(1)(a) GDPR and § 25(1) TDDDG. Saving your requested preference uses Art. 6(1)(f) GDPR and § 25(2) TDDDG.

5. WordPress

This site uses WordPress. It can set technical cookies when an editor signs in or saves dashboard preferences. These cookies support the requested login and dashboard features.

6. Website security and portfolio reactions

The site uses a local WordPress plugin to protect the login and configure browser security headers. When you choose to like a portfolio project, the site stores the reacted-to project in your browser to prevent repeat votes. The server records the aggregate reaction count and briefly processes a keyed identifier derived from the request IP address to limit abuse. The legal basis for abuse prevention is Art. 6(1)(f) GDPR.

7. YouTube

With your permission, the site can embed a YouTube player using its privacy-enhanced domain. When the player loads, Google may receive your IP address, device information and related request data. Google may process information in the United States. You can withdraw your consent through “Cookie settings” in the footer.

Google’s privacy policy

8. Vimeo

With your permission, the site can embed a Vimeo player with its do-not-track option. When the player loads, Vimeo may receive your IP address, device information and related request data. Vimeo may process information in the United States. You can withdraw your consent through “Cookie settings” in the footer.

Vimeo’s privacy policy

9. External links

Links to social profiles and other websites open the destination when you activate them. Their providers process information according to their own privacy notices.

10. Storage period

We delete or anonymise personal data as soon as the purpose of processing no longer applies and no statutory retention obligations (e.g. under commercial or tax law) prevent this. Cookie durations are stated in the cookie settings and in the descriptions above.

11. Your rights

You have the following rights regarding your personal data: • Access (Art. 15 GDPR) • Rectification (Art. 16 GDPR) • Erasure (Art. 17 GDPR) • Restriction of processing (Art. 18 GDPR) • Data portability (Art. 20 GDPR) • Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR) • Right to object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, and at any time to processing for direct marketing. To exercise your rights, contact us at the address in section 1.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

13. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the browser’s address bar and the lock symbol.

14. Changes to this privacy policy

We may update this privacy policy to reflect changes to our website, services or legal requirements. The current version published on this page applies.