Privacy policy
As of: June 2026
1. Controller
The controller for data processing on this website is:
Bardia Shahbaz
Denninger Str. 100
81925 München, Germany
Email: kontakt@bardiashahbaz.com
2. Hosting (Vercel)
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the website is accessed, Vercel processes technically necessary data (including IP address, time of access, requested resource) to deliver the page and ensure security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, performant provision). A data processing agreement (Art. 28 GDPR) is in place with Vercel; the data transfer to the USA is safeguarded by the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
3. Server log files
The hosting provider automatically collects and stores information in so-called server log files that your browser automatically transmits (including browser type/version, operating system used, referrer URL, hostname, time of the server request, IP address). This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR.
4. Cookies and consent
This website sets non-essential cookies (e.g. for reach measurement) only with your explicit consent. On your first visit a consent banner appears; until you agree, no analytics cookies are set and no personal data is processed for analytics purposes. Technically necessary cookies (including storing your cookie decision) are set without consent on the basis of § 25 (2) TDDDG. The legal basis for consent-requiring cookies is § 25 (1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future (see the “Your rights” section).
5. Google Tag Manager and Google Analytics
With your consent only, we use Google Tag Manager and Google Analytics, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself sets no cookies and processes no personal data for analytics purposes; it serves solely to manage downstream tags. Google Analytics uses cookies that enable an analysis of website use (including truncated IP address, device and browser information, interactions). We use Google Consent Mode: before your consent, no analytics cookies are set; by default consent is set to “denied” and is only updated to “granted” after your agreement. A transfer of data to the USA (Google LLC) cannot be ruled out; it is safeguarded by the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25 (1) TDDDG.
6. Contact form
If you send us enquiries via the contact form, we process the data you provide (name, email address, selected topic, and your message) to handle the enquiry. To prevent spam and abuse, we also process your IP address (rate limiting and bot check). The legal basis is Art. 6(1)(b) GDPR (steps prior to entering a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and the security of the form).
To send the form message as an email, we use the service Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin; servers within the EU). For spam protection (captcha) we use Cloudflare Turnstile, a service of Cloudflare, Inc. (USA); your IP address is processed in doing so. Both providers are processors and/or safeguarded by appropriate guarantees (Standard Contractual Clauses). Your data is deleted as soon as the enquiry has been conclusively handled and no statutory retention obligations apply.
7. Your rights
You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and a right to object (Art. 21) to processing based on legitimate interests. You can withdraw any consent given at any time with effect for the future. To manage your cookie consent, delete the “cookie_consent” cookie in your browser; the consent banner will appear again on your next visit. A message to kontakt@bardiashahbaz.com is sufficient to exercise your rights.
8. Right to lodge a complaint with a supervisory authority
Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work, or place of the alleged infringement.