← Back

Privacy Policy

Last updated: August 2026

1. Controller

Arne Ihmann

2. Scope

This privacy policy applies to this private portfolio website (https://portfolio.ihmann.design). The site is not publicly accessible. Access is provided individually via personal links.

3. What data we process

  • Access requests: name, optional email and message when you request portfolio access.
  • Invited viewers: the name assigned to your access link, visit timestamps and session counts.
  • Usage data: session start, which case pages you open, and optional “thumb” feedback on cases.
  • Technical identifiers: httpOnly cookies (viewer_token, portfolio_session) to maintain your access during browsing.

We do not use third-party analytics (e.g. Google Analytics). We do not intentionally store IP addresses in the usage events described above.

4. Purposes and legal bases

  • Providing portfolio access (Art. 6(1)(b) GDPR) — when you use a personal link or request access.
  • Session cookies (Art. 6(1)(b) GDPR / § 25(2) TTDSG) — to keep your access active while you browse.
  • Understanding viewer interest (Art. 6(1)(f) GDPR) — to see which projects invited viewers engage with, so I can follow up professionally. You may object to this at any time (see section 7).

5. Cookies

We use the following first-party cookies:

  • viewer_token — links your browser to your invited access (30 days).
  • portfolio_session — maintains your browsing session (30 days).

Both cookies are httpOnly and required for the invited portfolio experience. No marketing or advertising cookies are used.

6. Storage duration

  • Access requests: until processed and no longer needed, typically up to 12 months.
  • Viewer profiles and usage events: until deleted in admin or no longer needed for follow-up.
  • Session cookies: up to 30 days.

7. Hosting and processors

Data is stored on servers I operate or contract for hosting and database services (MongoDB). If data is processed outside the EU/EEA, appropriate safeguards apply where required.

8. Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • object to processing based on legitimate interest (Art. 21 GDPR)
  • data portability where applicable (Art. 20 GDPR)
  • lodge a complaint with a supervisory authority

To exercise your rights, please contact the controller using the details in the Impressum.

9. Changes

This policy may be updated when the service changes. The current version is always available at this URL.