Privacy

Controller and scope

Susanne Kollberg is responsible for processing personal data on this website. Contact details appear above. This notice describes the current draft website and its contact and protected portfolio functions. It is a review draft, not a confirmation that every deployment and contractual question has been resolved.

Website delivery and security

The website is hosted using Lovable and Lovable Cloud. The application runs on a Cloudflare Worker runtime. Lovable’s published data processing agreement identifies Lovable Labs AB in Sweden. Available project connection information points to the database region eu-west-1 (Ireland). This does not establish EU-only hosting for every service, asset, log or support operation.

When the website is requested, technical data such as IP address, time, requested URL, browser information and response or error information can be processed to deliver the website and maintain security. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in reliable and secure website operation. Essential platform error diagnostics are retained; the site does not add optional visitor analytics. Exact provider log fields, retention and transfer arrangements must still be verified.

Contact enquiries and email

The contact form asks for your name, email address and message. These details are used to respond to your enquiry and, if relevant, prepare a contractual relationship. The legal basis is Article 6(1)(b) GDPR for precontractual enquiries and Article 6(1)(f) GDPR for other correspondence, based on the interest in responding to enquiries. No marketing consent is requested and no newsletter subscription is created.

The intended outgoing service is Lovable’s managed app email delivery. No sender domain is configured at present, so form submissions are not sent, do not produce a success confirmation and are not stored as messages by the application. Direct email remains available. Once separately configured, the service would send one notification to susanne@skollberg.com, with the validated visitor address as Reply-To. Lovable handles delivery, delivery events, suppression and its mandatory unsubscribe footer. It does not confirm that the message was read.

The owner’s mailbox uses Microsoft, as confirmed by the owner. Correspondence sent directly or delivered to that mailbox is processed through Microsoft. The specific Microsoft product, contracting entity, applicable agreement, mailbox location and retention settings have not yet been verified. The Microsoft data protection addendum is relevant for review but its applicability to this account is not assumed.

The application does not maintain a contact-message database or log form contents. Email processing necessarily makes message contents and addressing data available to the delivery and mailbox services. Delivery event records may include recipient, timestamps, status and message identifiers. Exact provider retention and technical log handling remain to be confirmed.

Abuse protection

The form uses an invisible honeypot and persistent security counters. The server derives a keyed, pseudonymous token from the edge-provided IP address; the raw IP is not saved in the counter table. Hourly and daily counters and global limits help prevent automated misuse. The basis is Article 6(1)(f) GDPR, the legitimate interest in preventing spam and protecting availability. The token remains personal data where it can be related to a person.

Contact counter expiry is set to two hours for hourly buckets and two days for daily buckets; expired entries are removed on the next valid form attempt. These are security-counter settings, not email or hosting-log retention periods. Portfolio access attempts have separate security counters. Their inactive entries currently have no automatic cleanup schedule, which requires review before launch.

Protected portfolio and necessary session

Portfolio content and CV access require server-side authorization. The sk-portfolio cookie is an encrypted session cookie, HTTPOnly, Secure and SameSite=Lax, with an eight-hour lifetime. It holds an authorization fingerprint, not the plaintext access code. Private requests check authorization again; changing the current access code revokes existing access on the next request. Security counters process pseudonymous IP-derived tokens and attempt counts to limit access attempts.

The necessary session storage serves the expressly requested protected access under Section 25(2) no. 2 TDDDG. Authorization and security processing are based on Article 6(1)(f) GDPR, the legitimate interest in protecting non-public application materials. No tracking or marketing consent is inferred from portfolio access.

Fonts, links and optional services

Inter and Anton are supplied as local-origin font files. The application does not request fonts from Google Fonts. Photographs are served through local-origin Lovable asset paths. LinkedIn is an ordinary external link, not an embedded widget; LinkedIn receives a request when you follow that link.

No optional analytics, newsletter, embedded calendar booking, maps or chat service is configured by this website. Enquiries are not sent to an AI service by application code. Essential hosting, security and preview diagnostics are not disabled by this statement.

Recipients, transfers and deletion

Access is limited to the owner and service providers involved in hosting, security, delivery and mailbox operations as needed for those purposes. There is no blanket promise that processing or support access stays within the EU. Actual processors, subprocessors, contractual safeguards and any third-country transfers must be checked against the applicable service agreements before publication.

Enquiries and correspondence are kept only while needed to respond, handle follow-up or establish, exercise or defend legal claims, and where statutory retention duties apply. Afterwards they should be deleted under the applicable mailbox and provider settings. No arbitrary fixed deletion period is promised. The actual hosting, delivery, backup and mailbox retention settings are unresolved review items.

Your rights

Subject to the applicable legal conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21) GDPR. In particular, you may object to processing based on legitimate interests for reasons relating to your particular situation. Please contact the controller using the details above.

Under Article 77 GDPR you may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information. The authority’s current contact information is available on its official website linked below.

Open review items before publication

Confirm the applicable Lovable and Microsoft processor contracts, the exact Microsoft mailbox product and entity, all relevant subprocessors and transfer safeguards, hosting and asset delivery locations, technical log and delivery-event retention, mailbox deletion and backup settings, and cleanup of inactive portfolio rate-limit records. Outgoing app email requires separate owner-authorized sender setup. This draft must be reviewed against the final deployment before publication.