Legal
Privacy
This page explains how data are processed when you visit this website or contact me.
Controller
The controller for this website is Dr Lucas Temming, Koppenstraße 33, 10243 Berlin, Germany. For privacy enquiries, please email lucas.temming@gmx.de.
Visiting the website and hosting
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit, your browser sends technical information, including your IP address, the time, the requested address, the response status, and information about your browser and operating system. These data enable page delivery, troubleshooting and protection against attacks. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in operating a secure and reliable website.
STRATO processes hosting data under a data processing agreement. According to STRATO, full IP addresses are retained for attack prevention for a maximum of seven days. STRATO also produces anonymised access statistics. Please see STRATO’s privacy information for details.
Fonts, images, videos and external links
Fonts, images and short video clips on the portfolio pages are served by this website’s own server. Turning on a video’s sound does not send data to an additional provider. Links to ORCID, LinkedIn, ResearchGate, publishers or other websites connect to those providers when you open the link. Their privacy policies then apply.
YouTube on the band page
The “Wrap Your Troubles” page includes a YouTube video. The player loads only after you give consent. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Once enabled, Google receives data including your IP address, browser information and video activity. Google may use cookies and similar technologies and associate activity with your Google account if you are signed in. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent is voluntary and can be withdrawn for future visits through “Manage consent”. See Google’s privacy policy for details.
Processing in the United States is possible. Google describes the EU–US Data Privacy Framework and, where needed, Standard Contractual Clauses in its information on data transfers.
Cookies and audience measurement
EmbedPress visitor analytics is turned off. Normal use of the portfolio pages does not require analytics or marketing cookies. Cookies may be needed when an authorised user signs into the administration area or when a consent choice is saved. These strictly necessary operations are based on Section 25(2) TDDDG and, where personal data are involved, Article 6(1)(f) GDPR. Optional external content is loaded only with separate consent, under Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Language choice
On your first visit to the home page, the browser language selects German for German-language browsers and English otherwise. When you choose a language using DE or EN, that choice is saved on your device under lt_language_choice and remains valid for one year. An expired entry is removed on your next visit. You can remove the entry in your browser settings. Direct links to a language version keep their language. No location service is contacted and no IP address is used for language selection. Saving the language you explicitly request is based on Section 25(2) TDDDG and, where personal data are involved, Article 6(1)(f) GDPR; my interest is to provide the website in your chosen language.
Contact enquiries
If you contact me by email or a contact form, I process your contact details and message to answer your enquiry. For enquiries about a commission or contract, the legal basis is Article 6(1)(b) GDPR; for other enquiries it is Article 6(1)(f) GDPR and my interest in responding to your message. Providing information is voluntary, but I need a working contact address to reply. The email providers involved process messages for delivery and storage. The contact form includes spam checks. To limit repeated submissions, a pseudonymous identifier is derived from the IP address and used for up to one hour. Expired records are removed during the next automatic cleanup. The legal basis is Article 6(1)(f) GDPR and my interest in preventing abuse. Messages are deleted once the enquiry is resolved, unless a legal retention obligation or a legitimate reason requires further storage.
Login protection and security records
The administration area is protected against repeated login attempts. IP addresses, the entered username, the time and the outcome of failed attempts are processed locally. These data are not sent to the Limit Login Attempts cloud service. Temporary lockouts and attempt counters expire according to the configured lockout periods, at the latest after 24 hours without further failed attempts. Security records are used to investigate attacks and are deleted when an investigation is complete, unless they are still needed to prevent or document an incident. The legal basis is Article 6(1)(f) GDPR and my interest in protecting the website from unauthorised access.
Backups
Website files and the database are backed up so the site can be restored after a failure. Backups may therefore include stored contact and security data. The current schedule retains 14 daily database backups and four weekly file backups. Additional backups made before major changes are kept for as long as a rollback is needed. Deleted data may remain in a backup until that backup expires. Backups are used only for recovery and are not publicly accessible. The legal basis is Article 6(1)(f) GDPR and my interest in the website’s availability and integrity.
Automatic backups are stored in the existing Dropbox account. The provider for customers in Germany is Dropbox International Unlimited Company, Ireland. Processing in the United States is possible. Dropbox describes the EU–US Data Privacy Framework and EU Standard Contractual Clauses as transfer mechanisms. For information on recipients, transfers and contact options, please see Dropbox’s privacy policy.
Your rights
Subject to the conditions in the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw it at any time with effect for the future. No automated decision-making, including profiling, takes place.
Last updated: 12 October 2026.