Clean CoDE Dojo

Privacy Policy

I take the protection of your personal data seriously. On this page, I explain in clear and simple terms which data is processed when you visit my website or contact me.

Controller

Mihaela Jarema – Clean CoDE Dojo
Schellingstr. 109a
80798 München
Germany
Email: mihaelajarema@cleancodedojo.dev
Phone: +49 8709 2654490

Processors

To run my website and handle your inquiries, I work with a number of service providers (called "processors" under data protection law). They act on my instructions – for example, for hosting, sending emails, delivering content, and sending my newsletter. Any exceptions are described in the relevant sections below. Using these providers is not considered "sharing your data with third parties" under data protection law. I don't share your data beyond this, except where I'm legally required to, for instance, if a court, law enforcement agency, or tax authority makes a lawful request.

(Legal basis: Art. 6(1)(c) GDPR – complying with a legal obligation).

Email contact

If you send me an email, I store your message and your contact details so that I can reply.

Retention periods

  • Emails relevant for tax or commercial-law purposes: I keep these for 6, 8, or 10 years, depending on which statutory retention period under Section 147 Abgabenordnung (German Fiscal Code) applies to the specific document.
  • All other emails: As a general rule, I keep these for 3 years after our last contact and then delete them, unless one of the legal retention duties above applies or keeping them longer is necessary in an individual case. I review at least once a year whether continued retention is still justified.

(Legal bases: Art. 6(1)(c) GDPR – compliance with legal obligations for the statutory retention of tax- and commercial-law-relevant emails; Art. 6(1)(f) GDPR – legitimate interest in responding to inquiries for all other emails).

Hosting and access data

My domain is registered with Infomaniak Network SA (Switzerland). I also use Infomaniak for my email infrastructure and for the encrypted backup of certain records I need as proof of consent (for example, proof of newsletter sign-up consent – see "Newsletter" below). Switzerland is officially recognized by the EU under Art. 45 GDPR as having an adequate level of data protection, and I also have a data processing agreement with Infomaniak in accordance with Art. 28 GDPR. If you email me, your message is handled through Infomaniak's systems (see "Email Contact" above for how long it's kept).

For the reliable and secure operation of my website, I use a virtual private server (VPS) provided by UpCloud Oy (Finland), with the data center located in Germany. UpCloud acts as a processor under a data processing agreement in accordance with Art. 28 GDPR.

When you visit the website, certain technical data is automatically processed by the web server, for example: the IP address of your device, the time of access, or the pages you view. Collecting this data is technically necessary to deliver the website, diagnose errors, and ensure security; without it, the site cannot be accessed. This data is not used for marketing purposes or to create user profiles.

I have configured UpCloud so that:

  • Only EU-based servers are used.
  • No data is transferred to third countries.
  • Log files are automatically deleted once they reach 10 MB in size; I can also delete them manually at any time.
  • No automated backups of the VPS are created.

(Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the secure operation of the website).

Content delivery network

To make my website fast and reliable, I use the Content Delivery Network (CDN) provided by BunnyWay, informacijske storitve d.o.o. (Slovenia), trading as Bunny.net. Static files are delivered through servers located in the EU. Bunny.net acts as a processor under a data processing agreement in accordance with Art. 28 GDPR.

I have configured Bunny.net so that:

  • Only EU servers are used.
  • No data is transferred to third countries.
  • Access logs are stored for a maximum of 3 days to detect technical issues and ensure website security.
  • IP addresses are anonymized.
  • No cookies are set.
  • No profiling or tracking takes place.

(Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the secure and stable delivery of the website).

Embedded content

My website may contain YouTube videos. To protect your privacy, I use a two-click solution: No connection to YouTube is made when the page loads. Only when you actively click "Click to load the video" will the video be embedded. Once you click, a connection is made to YouTube (run by Google Ireland Limited and Google LLC (US)), and you also give your consent under Section 25(1) TDDDG (German Act on Data Protection in Telecommunications and Digital Services) for YouTube to access your device, and under Art. 6(1)(a) GDPR for the subsequent processing of your data by YouTube. For more detail on what YouTube/Google does with this data, see their own privacy policy. Using this feature is entirely optional – if you don't click, no connection is established and the video will not play. I do not receive any personal data from YouTube through my website.

Any resulting transfer of data to Google LLC in the US relies, to the extent Google LLC is certified for the relevant service under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision under Art. 45 GDPR. Should this adequacy decision be withdrawn in the future, or not apply in a particular case, the transfer instead relies on your explicit consent under Art. 49(1)(a) GDPR: by clicking "Click to load the video," you also explicitly consent to a possible transfer of your data to the US, even though the level of data protection there may be lower, for example because of access by public authorities.

(Legal basis for displaying the button: Art. 6(1)(f) GDPR – legitimate interest in providing video content).

My website contains links to external platforms (YouTube, LinkedIn). These are simple links – no content from these platforms is embedded, and no connection is made when the page loads. Only when you click a link do you leave my website. The privacy policies of the respective platforms then apply. Through this link mechanism, I do not receive any data from these providers.

Separate privacy notices on how I operate my own profiles on these platforms (including any usage insights the platforms make available to me) can be found in the Social Media Notice.

Newsletter

You can voluntarily sign up for my newsletter on my website, through which I share courses and blog posts on sustainable software and data practices, along with practical tips and insights in every issue.

If you enter a valid email address, actively check the consent box ("I agree to receive the Clean CoDE Dojo newsletter. I can unsubscribe at any time."), and click "Sign up," your email address is sent server-side to my email service provider, Brevo GmbH (Germany). No connection to Brevo is made simply by visiting the page. Brevo acts as a processor under a data processing agreement in accordance with Art. 28 GDPR.

After signing up, you'll receive a confirmation email from Brevo with a confirmation link (double opt-in). Only once you confirm are you added to the list and start receiving the newsletter. This process proves that the signup genuinely came from you and helps prevent abuse by third parties.

Without providing an email address and actively checking the consent box, you cannot sign up; without confirming via the link in the confirmation email, you will not receive the newsletter. You can withdraw your consent at any time, with effect for the future, by using the unsubscribe link in every newsletter email or by contacting me directly.

I have configured Brevo so that:

  • An anonymized reporting view is enabled. To deliver the newsletter, Brevo uses pixel- and link-based tracking technologies to record open and click statistics. Due to the anonymization I have activated, this data is shown to me only in aggregated, non-personal form (e.g. total number of opens for a campaign); attributing individual opens or clicks to a specific person is not possible for me. Only the confirmation from the double opt-in procedure is retained as proof of consent.
  • There's no profiling or personal analysis of your usage behavior by me.

In the current plan, Brevo adds its own footer link to campaigns. This link is used solely for Brevo's own marketing and tracking purposes, for which Brevo acts as an independent controller. This link is not required to receive the newsletter – you can safely ignore it. For this processing, Brevo's privacy policy applies.

To operate its core infrastructure, Brevo engages subcontractors, some of which are located in third countries outside the EU/EEA or process or access data there. Depending on the destination country, these transfers are safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses. As I do not use any AI-powered features, SMS, or WhatsApp sending via Brevo, no transfer takes place to the optional subcontractors provided for these purposes.

Retention period:

  • Until you unsubscribe: your data is kept for the duration of your subscription, so I can send you the newsletter.
  • After unsubscribing: your contact isn't deleted, but placed on a suppression list to prevent accidentally contacting you again (legal basis: legitimate interest, Art. 6(1)(f) GDPR).
  • Upon explicit deletion request: complete deletion.
  • Transactional and event logs at Brevo (including the double opt-in delivery log): automatically deleted after 24 months – this is currently the maximum retention period configurable in Brevo. However, since proof of consent must be available for as long as the subscription lasts, I export the data needed for this proof before this period ends and keep an encrypted copy locally and as a backup with Infomaniak (Switzerland). This copy is deleted once the contact unsubscribes or requests deletion.
  • After my contract with Brevo ends: your data is deleted or anonymized in accordance with the Data Processing Agreement with Brevo.

(Legal basis: This processing relies on your consent under Art. 6(1)(a) GDPR, given through the double opt-in process. Retaining the delivery log and the export copy created for proof purposes is based on Art. 6(1)(f) GDPR for the purpose of documenting the consent, reflecting my obligation under Art. 7(1) GDPR to be able to demonstrate that consent was given).

No cookies, no tracking

I don't use cookies, analytics tools, or social media plugins on my website. I also don't load any tracking or analytics scripts that transmit personal data for marketing or profiling purposes – the only exception is YouTube videos, which you load yourself by clicking (see above). This doesn't cover the technical data transfers involved in simply delivering website content, such as through the CDN described above.

No user accounts

My website currently does not include: user accounts, registration or comment functions.

Keeping your data secure

I take appropriate technical and organizational measures to protect your personal data against loss, misuse, and unauthorized access (Art. 32 GDPR). I review and update these measures regularly to keep up with current standards.

Data protection officer

As I fall below the legal thresholds, I'm not required to appoint a data protection officer (Section 38 BDSG, the German Federal Data Protection Act).

Your rights

You have the right to request access, correction, deletion, restriction of processing, data portability, and objection, as well as to withdraw any consent you've given at any time. To exercise these rights, simply send me an email. If there is any doubt about who you are, I will need sufficient information to verify your identity – without it, I will unfortunately not be able to process your request.

Your right to object

If I am processing your data based on my legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time, for reasons related to your particular situation (Art. 21(1) GDPR). If you do, I will stop that processing unless I can show compelling, legitimate grounds that override your interests.

Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de

Applicable law

This website is operated by an individual based in Germany. The processing of personal data is governed by the GDPR and German data protection law. Mandatory data protection rules of your country of residence remain unaffected.

Changes to this privacy policy

I update this privacy policy when my website or legal requirements change. The current version is always available on this page.