Legal
Privacy
This notice describes personal data processing during website visits and contact enquiries. Last updated: 9 October 2026.
1. Controller
Lars Düwel – Software EngineeringHeidestraße 17
10557 Berlin, Germany
+49 160 2020 187
duewel@larsduewel.de
Use these contact details for privacy questions and to exercise your rights.
2. Website operation and hosting
This website is hosted using Microsoft Azure App Service in the Germany West Central region in Germany. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft and its subprocessors receive the data needed to provide the service.
Delivery and display require processing your IP address, request date and time, requested address, technical browser information and, where transmitted, the referring page. Interactive features use a server connection. Connection and session data is processed in memory during use and discarded after the session ends or the technical reconnection period expires.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is providing a secure, functioning website. Providing technical connection data is not a contractual obligation, but is necessary to access the website.
Storage of HTTP access logs and application logs, as well as Application Insights, is disabled in the App Service configuration. I do not create persistent visitor profiles. Microsoft may separately process and retain technical operational and security data under the privacy terms applicable to the service. Retention depends on the operational purpose and those terms.
3. Cookies, fonts and analytics
The website currently does not set cookies or store data in your browser's local storage or session storage. Language selection and portfolio filters are controlled through the URL. Fonts and other website assets are loaded from the website's own server. No external font services, advertising trackers or visitor analytics services are embedded.
4. Contact by email or telephone
If you contact me, I process your contact details and the contents of your enquiry, including attachments, to respond to you. Email is processed using Microsoft 365 / Exchange Online, provided by Microsoft Ireland Operations Limited identified above. Please provide only necessary data. The website does not offer a contact form.
For enquiries about an engagement or an existing contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR on the basis of my legitimate interest in responding to your message. Statutory retention is based on Article 6(1)(c) GDPR.
Enquiry data is deleted once the enquiry has been resolved and the data is no longer needed for an engagement, statutory retention duties or the establishment, exercise or defence of legal claims. Business and contractual correspondence is retained for the applicable statutory period and then deleted. Contacting me is voluntary; without necessary contact details I may be unable to respond.
5. Downloads and external links
CVs are provided as PDFs from the website's own server. Downloads require neither registration nor an email address; connection data described in section 2 is processed. External links lead to other providers' websites. Your browser connects to those providers only when you follow the links. Their own privacy notices apply to their processing.
6. Microsoft and international processing
Microsoft's data protection and processing terms apply to its cloud services. Despite the German hosting location, Microsoft affiliates or subprocessors outside the European Economic Area may be involved in operations, security and support. Microsoft's terms provide, in particular, EU standard contractual clauses for relevant transfers. You can obtain a copy of the applicable safeguards through the linked terms or by contacting me.
Microsoft Data Protection Addendum (DPA) ↗
Microsoft privacy statement ↗
7. Your rights
Subject to statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time for the future without affecting the lawfulness of prior processing (Article 7(3)). No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.
8. Right to object
Under Article 21 GDPR, you may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.
I will stop processing unless I can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims. You may object to direct marketing at any time without giving reasons. Please use the contact details above.
9. Right to lodge a complaint
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement. The competent authority for my Berlin establishment is the Berlin Commissioner for Data Protection and Freedom of Information.