I'm Lilian Schiffler. I decide how the personal data described here is used, which makes me its controller under UK data protection law.

For anything about your data, write to lilianschiffler@gmail.com.

When you use the contact form, what you write reaches me as one email in my Gmail inbox, sent through my email provider's mail server. You don't have to send me anything, but without an email address I can't reply.

What

Your name, your email address, the subject and your message. If you came to the site through a personal link (see below), the email also names the company I made the link for.

Why

To reply and, if we go on to work together, to prepare that work. I don’t add you to a mailing list or use what you send for marketing.

Lawful basis

My legitimate interest in answering the people who write to me (UK GDPR Article 6(1)(f)).

How long

Up to two years after our last exchange, unless we go on to work together.

The server that runs this site keeps no log of the pages people visit.

My server counts the pages people visit and the projects they open, so I can see how the site is used. It does this itself, as it answers each request: no script runs in your browser for it, and nothing is stored on your device.

What

The page you asked for; the projects you open; the site that linked to this one, without the rest of its address; any campaign tags in the link (source, medium and campaign); your browser’s language; and your browser, operating system and type of device. When you send the contact form, I count that a message was sent, never what it says. If you came through a personal link, the count records only that a personal link was opened, never which one.

How

My server passes these details to my analytics server, which runs Umami, open-source software. It shortens your IP address first. Umami uses the shortened address to find your country and, with your browser’s details and a value that changes every day, to tell one visitor’s pages from another’s on the same day. It keeps the country and that day’s identifier, never the address.

Why

To see which pages and projects people look at and how they find the site, so I can improve it. I don’t use it to identify you, for advertising, or to follow you on other sites.

Lawful basis

My legitimate interest in understanding how the site is used, to improve it (UK GDPR Article 6(1)(f)).

How long

Up to 25 months.

Your choice

If your browser sends a Global Privacy Control or Do Not Track signal, your visits are never counted in these analytics. You can also turn analytics off in this browser with the link below. That stores one cookie, described under Cookies and storage, and nothing else. Neither changes what a personal link records (see Personal links).

If you choose Accept in the analytics bar, the site also measures how you use its pages: how much of each video you watch (a quarter, half, three quarters or all of it), which portfolio filters you use, whether you follow the link to my LinkedIn profile, and how fast pages load and respond on your device.

How

A small script, served from this site, runs in your browser (Umami’s tracker). It reads your screen size and sends these measurements to my server, which shortens your IP address and passes them on to my analytics server, as above. The script stores nothing on your device.

Lawful basis

Your consent (UK GDPR Article 6(1)(a)). You can withdraw it at any time with “Analytics settings” at the bottom of every page. That takes effect at once.

How long

Up to 25 months. Your choice is kept for 6 months, then the bar asks again.

When I apply for a job, I may send the company a personal link to this site (such as lilianschiffler.me/ab12). It shows my portfolio as I've arranged it for them.

What

For the link as a whole, not for any one person: when it was opened; the type of device (computer, phone or tablet); the site it was opened from, without the rest of its address; and what was done on the site during the visit: the pages and projects opened, the videos played and how much of them was watched, the filters used, whether anyone scrolled or moved the mouse, and whether the contact form or the LinkedIn link was used.

Nothing in these records tells one visitor from another: no identifier, no fingerprint, no IP address.

A cookie, lili_sl, keeps the link's arrangement of the portfolio while you browse the site's other pages, and is deleted when you close your browser.

Why

To know whether and how my application was looked at, and to tell visits by people from automated link checks. I receive an email summary after each visit.

This happens whether or not you choose Accept in the analytics bar, turn analytics off, or your browser sends a Global Privacy Control or Do Not Track signal.

Lawful basis

My legitimate interest in following up my job applications (UK GDPR Article 6(1)(f)).

How long

Until three months after the link expires. I delete the email summaries on the same schedule.

Your choice

You can object at any time by writing to me. I’ll stop recording visits to your company’s link and delete what was recorded.

Some projects play from Vimeo or YouTube. Their player loads only when you open one of those projects. Vimeo's player is set not to track you, and YouTube's comes from its privacy-enhanced domain, youtube-nocookie.com. Each service's own privacy policy applies to its player.

• lili_analytics records your analytics choice: for a year if you turned analytics off, for 6 months for your answer in the analytics bar. It holds nothing else.
• lili_sl, only if you opened a personal link: keeps the link's arrangement of the portfolio and counts your visits to the site's other pages as visits to that link, until you close your browser (see Personal links).
• theme, in your browser's storage, only if you use the light/dark switch: the theme you chose.
• A sign-in cookie, only for me when I sign in to edit the site.

lili_analytics, theme and the sign-in cookie each do something you asked for or record a choice you made.

• Hetzner Online runs the servers for this site and its analytics, in Germany.
• Mind The Gap Studio LTD runs the analytics software for me, only on my instructions, under a data processing agreement.
• Cloudflare stores and delivers the site's images and videos.
• My email provider, A2 Hosting, sends the contact form's email, and Google holds my mailbox (Gmail).

Cloudflare, A2 Hosting and Google are US companies, so the law treats their handling of this data as a transfer to the US. These transfers rely on the UK-US data bridge, under which they are certified.

No one else receives it. I never sell personal data, and I disclose it only when the law requires it.

You can ask me to:

• tell you whether I hold personal data about you, and send you a copy
• correct it
• delete it
• restrict how I use it

You can also object to my use of your data at any time. When you do, I stop, unless I have a compelling reason the law recognises, such as defending a legal claim.

Write to lilianschiffler@gmail.com. I reply within one month.

If you're unhappy with how I've handled your data, you can complain to me at lilianschiffler@gmail.com. I acknowledge a complaint within 30 days, look into it, and tell you what I found and what I've done.

You can also complain to the UK regulator, the Information Commission (ICO), at ico.org.uk/make-a-complaint. You don't have to come to me first.

When this notice changes, the new version appears here with its date.