Privacy Policy

The controller within the meaning of the GDPR is:

I have not appointed a data protection officer, as I am not required to.

When you open a page, your browser necessarily transmits technical information to the server so that the page can be delivered at all: your IP address, the page requested, the date and time, the referring page, and your browser and operating system. This data is processed to deliver the site and to keep it secure and stable.

Legal basis: Art. 6 (1) (f) GDPR — my legitimate interest in operating a functioning, secure website. This data is not used to identify you and is not combined with any other source.

This site is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the server log data described above on my behalf, in order to deliver the site.

Because Vercel is a US company, personal data may be transferred to the United States. Vercel is certified under the EU–US Data Privacy Framework and relies on the EU Standard Contractual Clauses for such transfers. You should nonetheless be aware that US authorities may in principle be able to access such data. Vercel's own privacy notice describes how it handles that data.

Legal basis: Art. 6 (1) (f) GDPR, and Art. 45/46 GDPR for the transfer.

I use Vercel Web Analytics to understand, in aggregate, how many people visit the site and which case studies they read. I use this to decide what work is worth writing up — nothing else.

This tool is deliberately chosen because it is privacy-preserving:

• It sets no cookies and stores nothing on your device.
• It does not create a persistent identifier and cannot follow you across other websites.
• Your IP address and browser details are not stored. They are turned into a temporary, non-reversible hash purely so a single visit is not double-counted, and that hash is discarded.
• What I actually see is aggregate counts: page views, rough location at country level, device type, and referring site.

Because nothing is stored on or read from your device, this does not require consent under § 25 TDDDG. Legal basis: Art. 6 (1) (f) GDPR — my legitimate interest in basic, non-invasive reach measurement. You have the right to object to this at any time (see “Your rights”), and any content or script blocker will prevent the measurement entirely.

Details from the provider: Vercel Web Analytics privacy documentation.

This site sets no tracking cookies — which is why you are not being asked to dismiss a cookie banner.

The only thing stored on your device is your light/dark theme choice and your language choice, kept in your browser's local storage so the site does not flash the wrong theme or language on your next visit. They are set only because you asked for them by using the toggles, they never leave your browser, and they are therefore strictly necessary within the meaning of § 25 (2) TDDDG. You can clear them at any time via your browser settings.

A single functional cookie also records which language to show you by default — German for visitors from German-speaking countries, English otherwise. The country is determined by my host, Vercel, from your IP address at the moment of the request; the IP address itself is not stored for this, only the resulting default. This cookie carries no identifier and is strictly necessary to deliver the site in an appropriate language (§ 25 (2) TDDDG). Whatever it chooses, the language toggle overrides it, and you can clear the cookie via your browser settings.

Some case studies include videos hosted on YouTube (Google Ireland Limited) or Vimeo. These players are not loaded when the page opens. Instead you see a placeholder, and nothing is requested from the provider until you click it.

If you do click, the player is loaded from the provider, and at that point your IP address and browsing information are transmitted to them, and they may set cookies. That is unavoidable once the player loads. I request the providers' privacy-enhanced modes (youtube-nocookie, and Vimeo's “do not track” flag), but I have no control over what they do with the data once it reaches them, and they may process it in the USA.

Legal basis: your consent, given by that click — Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it simply by reloading the page and not clicking; no player will load again on its own. See Google's privacy policy and Vimeo's privacy policy.

The written content of the case studies is managed in Notion and rendered on my server, so your browser never talks to Notion when you read a page. Images are likewise fetched by my server and re-served from this domain.

One exception: short video clips uploaded inside a case study are streamed directly from Notion's file storage (Notion Labs, Inc., using Amazon S3). Playing such a clip therefore transmits your IP address to that storage provider. Legal basis: Art. 6 (1) (f) GDPR — my legitimate interest in presenting the work.

The typeface is self-hosted: it is downloaded at build time and served from this domain. No request is made to Google Fonts, and your IP address is never transmitted to Google in order to render text.

Links to LinkedIn, Behance, Instagram, GitHub and my CV on Google Drive are ordinary links. Nothing is transmitted to those services unless you actually click through, at which point their own privacy policies apply.

If you email me, the content of your message and your email address are processed solely in order to reply to you. Legal basis: Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR where your message concerns entering into a contract or an employment relationship. I keep such correspondence only as long as it is needed to deal with your enquiry, and delete it once it is settled and no retention obligation applies.

You have the right, at any time and free of charge, to:

• access the personal data I hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• have its processing restricted (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interests, including the analytics described above (Art. 21 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR).

To exercise any of these, just email hello@nadamel.com.

You also have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state of your habitual residence or place of work, or where you believe an infringement occurred (Art. 77 GDPR).

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this site.

If the site changes — a new tool, a new embed — this policy will be updated to match. The date at the top always reflects the current version.