Skip to content
Sultan Kautsar

Home / Privacy /

Privacy Policy

This site is a personal portfolio. It collects as little as it can: no account, no newsletter, no third-party embeds, and nothing stored on your device for analytics unless you allow it.

Who Is Responsible

The controller for this site under the General Data Protection Regulation (GDPR) is Sultan Kautsar. For any question about your data, email [email protected].

Hosting

The site is served by Cloudflare Pages (Cloudflare, Inc.). To deliver pages and protect the site from abuse, Cloudflare processes technical data from every request, such as your IP address, browser, the page requested, and the time of the request.

This is necessary to run the site, so the legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The fonts, images and video on this site are hosted on the same domain; no request goes to a font or media service.

When you first visit, a banner asks what you allow. Your answer is saved in your browser's local storage under the key consent, together with the time you chose. It never leaves your device, and it expires after 12 months, when the banner asks again.

Storing this choice is necessary to respect it, so it does not need consent itself. You can change or withdraw your choice at any time with Cookie settings in the footer of every page. Withdrawing analytics consent also deletes the Google Analytics cookies already set.

Google Analytics

I use Google Analytics 4 (Google Ireland Limited), loaded through Google Tag Manager, to see which pages are read, how visitors find the site, and which of a few key actions they take: clicking the main buttons, opening an email link, sending the contact form (only that it was sent, never what you wrote), and reading a case study to the end. The setup uses Google Consent Mode V2 in advanced mode:

  • Before you choose, or if you decline: Google Tag Manager still loads, and Google Analytics sends cookieless pings. These contain no cookies or identifiers, only that a page was viewed and basic technical details such as browser type. Google uses them to estimate visits in aggregate. The legal basis is my legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).
  • If you allow analytics: Google Analytics sets the cookies _ga and _ga_*, which store a random ID for up to 2 years so repeat visits can be recognized. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

Google Analytics 4 does not log or store IP addresses. Analytics data is kept for 14 months and then deleted automatically. If you want to know how the consent signals work in detail, I wrote about it in Consent Mode V2.

Advertising

This site does not currently run advertising tags. The Advertising option in the banner controls the Consent Mode signals ad_storage, ad_user_data and ad_personalization, and it stays off unless you turn it on. If I add advertising measurement in the future, this page will be updated first.

Contacting Me

The contact form does not send anything to a server. It composes a message in your own email app, which you then send yourself. I use what you write, including your name and email address, only to reply to you, and delete it when the conversation no longer needs it. The legal basis is answering your request (Art. 6(1)(b) and (f) GDPR).

Transfers Outside the EU

Cloudflare and Google may process data in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection (Art. 45 GDPR).

Your Rights

Under the GDPR you have the right to:

  • access the data held about you (Art. 15),
  • have it corrected (Art. 16) or deleted (Art. 17),
  • restrict its processing (Art. 18),
  • receive it in a portable format (Art. 20),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).

To use any of these rights, email [email protected]. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work (Art. 77 GDPR).