Privacy Policy & Multi-Cloud Infrastructure Map

This web environment serves as an active educational showcase and freelance hub, demonstrating full-stack engineering, automated database execution and cross-platform cloud deployment.

---

1. Data Protection Controller

Kathrin Markworth
Süderlücke 3
24944 Flensburg
Germany

Telephone: 004915732745789
Email: sunnyandkate@icloud.com

2. Data Subject Rights (GDPR Alignment)

As a visitor interacting with this network zone, you hold sovereign protective rights under the European General Data Protection Regulation (GDPR). You may exercise these rights at any time by contacting me directly:

• Right to Inspection (Art. 15 GDPR): You have the right to request clear confirmation and copies of any personal tracking records processed across this server cluster.
• Right to Rectification & Deletion (Art. 16 & 17 GDPR): You can demand the immediate correction of inaccurate data variables or the wholesale deletion of your logged parameters.
• Right to Restriction & Object (Art. 18 & 21 GDPR): You may block the ongoing processing of your data rows or object completely to future telemetry collection grounded under legitimate interests (Art. 6 Para. 1 lit. f) GDPR).
• Right to Data Portability (Art. 20 GDPR): You have the right to request that data we process automatically based on your consent or in fulfillment of a contract be handed over to you or a third party in a structured, machine-readable format.
• Right to Withdraw Consent (Art. 7 Para. 3 GDPR): You have the absolute right to revoke your previously granted data processing consent at any time. For the interactive components and embedded game modules across this domain, you can exercise this revocation with future effect by simply clearing your browser cache and reloading the page grid.
• Right to Regulatory Complaint (Art. 77 GDPR): You reserve the right to report data handling compliance issues straight to an official state supervisory authority. For Schleswig-Holstein, you may file a complaint with the Unabhängige Landeszentrum für Datenschutz (ULD) in Kiel, Germany.

3. Data Isolation, Browser Storage & Technical Tokens (TDDDG Compliance)

I do not profile or monetize your personal data. Terminal equipment data interaction is strictly restricted to functional performance.

• Game Settings and Browser Storage: Uses temporary browser session storage for essential game configurations (such as audio playback settings and volume states), processed entirely locally and deleted automatically on close.
• Content Management System (CMS) & Security Cookies: When interacting with database-driven Content Management System (CMS) frameworks, server-side initialization scripts (session_start()) automatically distribute a strictly technical session identifier (PHPSESSID). This token handles temporary administrative state parameters, contains no marketing metrics, tracks no persistent browsing profiles, and completely dissolves from your browser cache upon termination of the session window.
• Legal Basis: Executed under Section 25 Paragraph 2 No. 2 of the German TDDDG as strictly necessary to deliver the requested service.
• cc_cookie (Consent Management Token): Generated by the locally-hosted CookieConsent (v2.9.2) by Orest Bida framework. This token records your technical interaction state (consent timestamps, accepted script classifications, and an anonymous, randomly generated cryptographic UUID string).
  Storage Profile: Persistent client-side cookie. Automatically retained on your end-device for a duration of 182 days from initialization to prevent the consent UI from re-prompting on subsequent navigation cycles.
  Legal Basis: Executed under Section 25 Paragraph 2 No. 2 of the German TDDDG and Art. 6 Para. 1 lit. f GDPR as strictly necessary to deliver and document the requested service.
• Change your Cookie Settings

4. Server Data and Log Files (Hosting Infrastructure)

For technical reasons, technical parameters sent by your internet browser to me or to my cloud infrastructure server providers will be collected automatically. This data processing is mandatory to ensure a secure, stable, and functional website infrastructure. These server log files record browser types, operating systems, referrer URLs, visited sub-pages, timestamps, and IP addresses.

The data thus collected will be temporarily stored, completely isolated from any other data records, and protected through robust architectural controls:

• Security Measures: Inbound IP addresses are automatically pseudonymized and masked at the cloud infrastructure layer immediately upon collection to isolate unique online identifiers.
• Data Retention: Technical server logs are automatically deleted within a window of 7 to 14 days, unless continued storage is required for active evidentiary purposes (e.g., analyzing server exploitation or security breaches).
• Legal Basis: Art. 6 Para. 1 lit. f) GDPR. My legitimate interest lies in the maintenance, optimization, stability, and security of my web architecture.

5. Hosting & Database Infrastructure Provider Disclosures

To ensure reliable global routing, runtime stability, and relational database persistence, this domain utilizes external multi-cloud infrastructure nodes. Where cross-border data delivery to the United States occurs, providers guarantee compliance with European standards through active certification under the EU-U.S. Data Privacy Framework (DPF) and the execution of Standard Contractual Clauses (SCCs) as a baseline fallback data transfer mechanism to ensure absolute compliance in the event of framework modifications or future regulatory adjustments. Furthermore, data processing actions are governed by strict Data Processing Agreements (DPAs) pursuant to Art. 28 GDPR:

1. GitHub Pages: This website uses static content hosting nodes provided by GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA. To review how GitHub handles metadata, you can read the GitHub General Privacy Statement. GitHub secures data processing alignment through standard contractual frameworks and is fully certified under the EU-U.S. Data Privacy Framework to ensure data safety.
2. Render Web Services: Backend application rendering environments are hosted via Render Services, Inc., 525 Brannan St, Suite 300, San Francisco, CA 94107, USA. Render handles runtime computational metadata and server transaction logs required to execute our Java Spring Boot API code. Render is certified under the EU-U.S. Data Privacy Framework to align cross-border data delivery with European transparency standards. You can inspect their parameters in the official Render Privacy Policy.
3. Eco Web Hosting Infrastructure: Web server hosting, technical routing networks, and file storage environments are provisioned via Eco Web Hosting Ltd., 20-22 Wenlock Road, London, N1 7GU, United Kingdom. To ensure technical operations, system stability, and IT security, our hosting infrastructure provider automatically processes server log file data transmitted by your browser immediately upon page access. This data includes browser types and versions, operating systems, referrer URLs, hostnames (IP addresses), and timestamps of server requests. Because the United Kingdom operates under an official EU Adequacy Decision, data transfers to their servers satisfy strict European legal confinement and data safety criteria. Data processing operations are strictly governed by an active Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. Your data is processed under the legal basis of **Art. 6 Para. 1 lit. f) GDPR**, grounded in our legitimate interest to deliver a secure, functional, and error-free website infrastructure. You can review their full data logging parameters and protective frameworks via the official Eco Web Hosting Privacy Policy.

6. User Authentication & Profile Storage (CMS & User Accounts)

If you actively create an administrative profile via the CMS registration framework, sign up for platforms, or authenticate through a login panel, the text values you submit (such as usernames, email addresses, and encrypted password metrics) are processed strictly to initialize, protect, and maintain your account state.

• Legal Basis: Data processing is executed under Art. 6 Para. 1 lit. b) GDPR to deliver the secure software architecture environment explicitly requested by the visitor. Data records are housed securely within our hosting nodes and are completely purged upon account removal or database resets.

7. External Platform Redirection & Asset Downloads (Phonebooth Navigation, Project Code, Demos & Binaries)

My interactive portfolio features a customized phonebooth navigation dashboard, confirmational selection modals, wishlists, and direct download buttons designed to route visitors to external profiles (LinkedIn), technical repositories (GitHub), indie gaming marketplaces (Itch.io), web frameworks (Vercel), and compiled desktop/mobile software build packages (such as Java .jar archives, mobile application packages, or storefront links). Once you click these buttons, you actively transition away from my project domain.

• Legal Basis & Data Transfer: The provision of these external redirection pathways, download binaries, and storefront merchant links is executed under Art. 6 Para. 1 lit. f) GDPR, grounded in my legitimate interest to securely showcase engineering codebases, professional networks, product designs, and live software demonstrations to prospective recruiters or clients.
• Data Boundaries: Once you leave this website, I maintain absolutely no oversight, system access, or legal liability over the tracking parameters, background cookies, tracking pixels, or profiling methods deployed by those external platform architectures or merchant servers.

8. Interactive Game Showcases & Embedded Content Telemetry (Unity & Itch.io)

My portfolio integrates software showcases and game builds developed using the Unity Engine and associated with the digital indie gaming marketplace Itch.io (operated by itch corp., 251 Little Falls Dr, Wilmington, DE 19808, USA).

• Redirection Demos (WebGL Modals): For game builds where you are redirected to an external platform via an interactive confirmation modal, you actively choose to leave this domain. The legal basis for this pathway is Art. 6 Para. 1 lit. f) GDPR, grounded in my legitimate interest to showcase interactive desktop and mobile assets.
• On-Site Embedded Frames (Consent Model): For any game build running directly inside an embedded frame on this website, third-party script execution is blocked by default until you grant permission (Two-Click Solution / Consent Model). The legal basis for initializing these embedded blocks and transmitting connection metadata is your explicit activation consent under Art. 6 Para. 1 lit. a) GDPR.
  • Unity Engine Telemetry: Upon user activation, Unity Technologies (USA) automatically gathers technical device metrics (IP addresses, unique hardware identifiers, operating system profiles, graphics vendor specs, and execution performance logs) required to render the engine smoothly. For explicit insights, refer to the official Unity Game Player and App User Privacy Policy.
  • Itch.io Platform Frames: When you click to initialize embedded players hosted via their network nodes, Itch.io automatically handles operational technical telemetry data, including your IP address, browser attributes, device hardware profiles, and localized interaction variables. For explicit insights, consult the official Itch.io Privacy Policy.

Note on Revocation: You can revoke your consent by adjusting your browser's cookie settings for this site or by clearing your browser storage for this domain.

9. External Retail Redirection (Online Shop Links)

My interactive wishlist system features optional outbound links to third-party digital marketplaces and physical online storefronts. Once you click these store buttons, you leave my project domain.

• Legal Basis & Data Transfer Framework: The provision of these external merchant links is executed under Art. 6 Para. 1 lit. f) GDPR, grounded in my legitimate interest to provide visual showcase references and product integrations for visitors. Once you transition away from this website, data handling, tracking pixels, and cookie processing are governed exclusively by the privacy parameters of the respective third-party merchants.

10. Portfolio Project Sandbox Disclaimer & Tech Stack Confinement

This entire web application is an educational software development portfolio piece highlighting my cozy pastel animal designs and game asset integration. The interactive user database environment (including the simulated code_reviewer login matrix, pre-configured test profiles, and the **Loot Inventory Explorer administrative access key panel pipeline**) functions exclusively as a read-only testing sandbox to show my backend CRUD programming capabilities and dynamic frame state-passing variables. No real-world commercial retail sales or financial transactions take place on this server.

Please note that certain linked repositories across this domain—such as the Loot Ecosystem Project—function strictly as open educational sandboxes and testing vaults. These systems are engineered to demonstrate multi-platform full-stack integrations (including React frontends, Java Spring Boot REST APIs, and Unity game engines connected to a relational MySQL database cluster managed via our infrastructure providers).

• Data Boundaries: These sandbox configurations and temporary browser data-passing lanes do not collect, process, or store any Personally Identifiable Information (PII), tracking cookies, real names, or email records. All data records, access keys, inputs, entries, and transaction logs generated inside the system panels use completely anonymous, structural gameplay variables (e.g., item names, numeric primary key IDs, and state properties) and can be cleared or deleted during administrative data purges at any time.

11. Interactive Communication & "Hire Me" Contact Form

Inquiries submitted via the "Hire Me" contact form or direct email are processed strictly for the purpose of evaluating, establishing, and answering project service inquiries.

• Legal Basis: Data processing is executed pursuant to Art. 6 Para. 1 lit. b) GDPR for pre-contractual commercial interactions, and in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) to manage data processing within initiation tracks for freelance engineering contracts and professional service provisioning. Your data parameters are processed securely via the open-source **PHPMailer** script engine running on our native server infrastructure hosted by **Eco Web Hosting**.
• Data Retention: The data transmitted via this form will remain stored until the purpose for capturing it is fulfilled—specifically when your inquiry has been conclusively settled or clarified. Following resolution, the data will be immediately deleted, unless ongoing preservation is required by applicable statutory documentation or commercial retention obligations.

12. Automated Decision-Making

Automated decision-making, including profiling pursuant to Article 22(1) and (4) of the GDPR, does not take place on this website.

---