Privacy policy
Last updated: 25 October 2026
1. Controller and purpose of this website
Mona MoradiDammannkoppel 7
25524 Itzehoe
Germany
monamoradi91@gmail.com
017640439857
This website presents my work for job applications. It does not operate an online shop or offer bookings for freelance services. This notice explains how personal data is processed when you visit or contact me.
2. Hosting and technical access data
The website is hosted by Vercel Inc. Page requests involve technical information such as your IP address, request time and address, browser and device information and, where transmitted, the referring page. This is used to deliver, troubleshoot and secure the website. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in operating a secure and reliable portfolio.
Technical data is needed only as long as necessary for operation, security or investigating specific issues. Provider retention periods depend on the service configuration and the provider information linked below. I do not combine this information into advertising profiles.
Vercel privacy information · Data processing and transfer provisions
3. Content, images and videos through Sanity
Content is managed using Sanity. Images, videos and files may be loaded directly from the Sanity CDN, which receives technical connection data, including your IP address and the requested file. Contact form submissions are not stored in Sanity. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in delivering work samples efficiently and reliably. The editorial sign-in area is not a visitor account; Sanity’s sign-in and security functions also apply there.
Sanity privacy information · Sanity data processing terms
4. Contact form and email
When you contact me, I process your name, email address, message and any information you choose to include so I can reply and communicate with you. The contact form uses Formspree, Inc. Entered data is sent to Formspree when you submit the form; technical data may also be processed for delivery and abuse prevention. Messages are forwarded to my Gmail inbox at Google. Emails sent directly to me are also processed there.
The legal basis for general inquiries is Article 6(1)(f) GDPR: my legitimate interest in responding to messages about my job application portfolio. Providing information is voluntary; without the required contact details and a message I cannot process a form inquiry. Please do not submit sensitive information such as health data.
I delete completed inquiries from my Gmail inbox and Formspree no later than three months after the conversation ends. Longer retention applies only where required by a specific legal obligation or necessary to establish, exercise or defend legal claims; the data is then deleted. Shorter provider retention periods may apply. I do not use this information for newsletters or advertising.
5. Optional Figma prototypes
Interactive prototypes from Figma, Inc. load only after you activate the corresponding button. This connects to Figma, which may process your IP address, browser information and interactions. Figma may use cookies or similar technologies and associate activity with an existing signed-in Figma account. Loading the embedded content is based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG.
You can stop the embedded connection using “Unload prototype”. This website does not permanently store your consent; revisiting the page requires another click. Withdrawal takes effect for the future. Cookies already set by Figma can also be deleted in your browser. External prototype links open Figma only when clicked.
6. Language cookie, analytics and social links
Choosing EN or DE stores your selected language in the “portfolio-language” cookie for up to one year. It contains only the language choice and is used for the language setting you requested, not advertising identification. The legal basis is Article 6(1)(f) GDPR and, for storing the necessary preference, section 25(2) no. 2 TDDDG. You can delete the cookie in your browser or change your language at any time.
I do not use analytics or marketing services or operate a newsletter on this website. LinkedIn and X are ordinary external links, not embedded social media plugins. Clicking them takes you away from this website, where the respective provider’s privacy practices apply.
7. Recipients and international processing
The services described above receive data in connection with their respective functions. Depending on the service, processing may take place outside the EU or EEA, particularly in the United States. The linked Vercel and Sanity data processing terms describe EU Standard Contractual Clauses for applicable transfers. Google and Figma explain their transfer mechanisms and safeguards in their privacy information. Formspree describes processing in the United States, among other locations, and identifies EU Standard Contractual Clauses as a transfer mechanism under Article 46 GDPR. Google and Figma also identify their participation in the EU-US Data Privacy Framework for covered transfers under Article 45 GDPR. You can request details and available information about the transfer mechanisms applying to your data using my contact details above; current provider information is linked in each section.
Formspree transfer safeguards · Google transfer frameworks
8. Your rights
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time for the future without affecting the lawfulness of earlier processing. Please contact monamoradi91@gmail.com to exercise your rights.
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object at any time under Article 21 GDPR on grounds relating to your particular situation.
You may also lodge a complaint under Article 77 GDPR with a supervisory authority, particularly where you live or work or where you believe an infringement occurred. The supervisory authority for my place of residence is the State Commissioner for Data Protection Schleswig-Holstein. Contact the supervisory authority.
9. Security and automated decisions
The website uses HTTPS for encrypted transmission. Internet communications cannot be guaranteed to be entirely risk-free. I do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR. This notice will be updated when website functions or data processing change.