What data I hold, why, for how long, and how to make me delete it. If I wrote to you without you contacting me first, the section below headed “If I contacted you” is the notice the GDPR requires me to give you, and the one after it is your right to stop it.
The controller for all processing described on this page, within the meaning of Art. 4(7) GDPR:
Florian S. Kluge, acting in his own name and established in Portugal. I do the work and I answer the mail; there is nobody else in the loop.
[email protected] — for any privacy request, including deletion. A postal address is provided on request.
None. A one-person business does not meet the thresholds in Art. 37 GDPR or § 38 BDSG. Write to the address above; it reaches me directly.
This is the Art. 14 GDPR notice — the one owed when personal data was not obtained from you but from somewhere else.
Publicly accessible sources: your employer's website, its public job postings and applicant-tracking job boards, press releases and company announcements, and public professional profiles. A business email address may additionally have been supplied by a commercial email-lookup and verification service. Nothing came from a logged-in scrape, a purchased list of private addresses, or anyone's private account.
Your name, job title, employer, business email address, public profile URLs, the publicly posted role or announcement that prompted me to write, my own notes on why the company looked relevant, and our correspondence if you reply.
To contact you once, at your place of work, about a professional service related to a responsibility your employer has publicly stated is yours — and to keep a record of that contact so I do not repeat it.
Art. 6(1)(f) GDPR, legitimate interests. Mine is direct business development; Recital 47 GDPR names direct marketing as capable of being a legitimate interest. I weighed it against your interests: the data is professional rather than private, it was already public, the contact is about your stated job, and one message with a working opt-out is the whole intended volume. If you reply and we discuss working together, the basis for what follows becomes Art. 6(1)(b) GDPR — steps taken at your request before a contract.
Deleted at the latest 12 months after the last contact if nothing comes of it, and immediately if you ask. One exception, and it works in your favour: if you object, I keep your name, the address you objected from, and the date, indefinitely and for the single purpose of never contacting you again. Deleting that record is how people end up on a second list.
My email and hosting providers, and the contact-data service named in the source row above, acting as processors under Art. 28 GDPR. Nothing is sold, rented, shared for anyone else's marketing, or passed to a third party for their own purposes. I will name the specific providers on request.
Yes, to the United States — my hosting and email providers are US companies. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the recipient is certified under it, and otherwise on the Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. A copy of the clauses is available from the contact address above.
None within the meaning of Art. 22 GDPR. Software helps me read public markets and job postings; a human decides who to write to and what to say, and that human is me.
You can tell me to stop, and that is the end of it. Under Art. 21(2) GDPR you have the right to object at any time to the processing of your personal data for direct marketing. There is no balancing test on this one and I do not get to argue: once you object, Art. 21(3) GDPR means the data is no longer processed for that purpose.
Reply to my email with “stop”, or write to [email protected]. No form, no account, no reason required, and no cost beyond sending the message. I will confirm, delete the rest, and keep only the suppression record described above so that the objection holds.
Against me, as controller, you also have:
No processing described here is based on consent, so there is no consent to withdraw under Art. 7(3) GDPR. Requests are answered within one month, per Art. 12(3) GDPR, and free of charge.
This site is static HTML served by Cloudflare Pages, a service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), acting as my processor. Delivering a page necessarily processes your IP address, the requested URL, timestamp, referrer, and browser user agent, on the basis of Art. 6(1)(f) GDPR — the legitimate interest in serving the site and keeping it up and secure. Cloudflare may set strictly necessary cookies for security and bot mitigation.
Beyond that: no analytics, no tracking pixels, no advertising cookies, no cross-site identifiers, and nothing that needs a consent banner — which is why you were not shown one. Web fonts load from Google Fonts (Google Ireland Limited), so your IP address reaches Google to fetch them. If you would rather it did not, blocking fonts.googleapis.com costs you nothing but the typeface.
Mail to [email protected] is forwarded by Cloudflare Email Routing to a Gmail mailbox operated by Google. Mail you send me is processed to answer it — Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR once we are discussing an engagement — and kept for as long as the exchange is live, plus any retention period the resulting contract or tax law imposes. Standard email is not end-to-end encrypted in transit between providers; if something is genuinely sensitive, say so and we will find another channel before you send it.
When what I do changes, this page changes with it, and the date in the header moves. There is no archive of prior versions; the page states what is true now.
Privacy questions — [email protected]
Deletion requests, access requests, and objections all go to the same address and reach me, not a queue.