Privacy Policy

Last updated: 13 October 2026

Preamble

This privacy policy explains which types of personal data (“data”) we process, for which purposes and to what extent. It applies to all processing of personal data carried out by us, in particular on this website and within our social media profiles (together, the “online services”).

Controller

Thomas Hartmann
Eschersheimer Landstraße 42
60322 Frankfurt am Main, Germany

Email: contact@thomasships.com
Legal notice: thomasships.com/impressum

No data protection officer has been appointed, as there is no legal obligation to do so.

Overview of processing

Types of data processed

Contact data (e.g. email address).
Content data (e.g. content of emails).
Usage data (e.g. pages visited, referrer, browser and device type).
Meta, communication and process data (e.g. IP addresses, timestamps).
Log data (e.g. server log files).

Categories of data subjects

Users (visitors of this website).
Communication partners (e.g. newsletter subscribers, people who email us).

Purposes of processing

Providing our online services and their usability.
IT infrastructure and security.
Audience measurement (visit statistics without recognising returning visitors).
Sending the newsletter.
Communication.
Public relations and information.

Legal bases

Below is an overview of the legal bases under the GDPR on which we process personal data. Where a more specific legal basis applies in an individual case, we state it in this policy.

Consent (Art. 6(1)(a) GDPR): you have given consent to the processing of your personal data for one or more specific purposes.
Legal obligation (Art. 6(1)(c) GDPR): processing is necessary to comply with a legal obligation to which we are subject.
Legitimate interests (Art. 6(1)(f) GDPR): processing is necessary for our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms that require protection of personal data override them.

German data protection law: In addition to the GDPR, German national rules apply, in particular the Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).

Security

Taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This includes safeguarding the confidentiality, integrity and availability of data, and data protection by design and by default.

TLS encryption (HTTPS): All connections to this website are encrypted with TLS to protect data in transit. You can recognise this by “https://” in your browser’s address bar.

Disclosure of personal data

Personal data may be disclosed to other companies as part of our processing. Recipients are exclusively IT service providers (hosting, email delivery, audience measurement) named individually in this policy. Data processing agreements (Art. 28 GDPR) are in place with these recipients. We do not sell data or share it for advertising.

International data transfers

Where we transfer data to a third country (outside the EU or the European Economic Area), or this happens through the use of third-party services, this is always done in accordance with the law.

For transfers to the USA we rely primarily on the EU-US Data Privacy Framework (DPF), recognised as providing an adequate level of protection by the European Commission’s adequacy decision of 10 July 2023. In addition, the European Commission’s Standard Contractual Clauses apply as part of the data processing agreements. For each provider we state the relevant basis. A list of DPF-certified companies is available at https://www.dataprivacyframework.gov/.

Storage and deletion

We delete personal data in accordance with the law as soon as consent is withdrawn or no other legal basis for processing exists. Exceptions apply where legal obligations or specific interests (e.g. establishing or defending legal claims) require longer retention. In that case we process the data only for the reasons justifying its retention. Where several retention periods apply, the longest one prevails.

Your rights

Under the GDPR, in particular Art. 15 to 21, you have the following rights:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where your personal data is processed for direct marketing, you have the right to object at any time to such processing.
Right to withdraw consent: You may withdraw any consent at any time with effect for the future. This does not affect the lawfulness of processing before the withdrawal.
Right of access: You have the right to confirmation as to whether your data is being processed, and to access that data, further information and a copy of the data as provided by law.
Right to rectification: You have the right to have incomplete data completed or inaccurate data corrected.
Right to erasure and restriction of processing: As provided by law, you have the right to have your data erased without undue delay or, alternatively, to have its processing restricted.
Right to data portability: You have the right to receive data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
Right to lodge a complaint: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de.

To exercise your rights, simply email contact@thomasships.com.

No automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Website provision and hosting

We process users’ data in order to provide our online services. For this purpose we process the user’s IP address, which is required to deliver content and functions to the user’s browser or device.

Data processed: usage data; meta, communication and process data (e.g. IP addresses, timestamps); log data.
Data subjects: users (website visitors).
Purposes: providing our online services; IT infrastructure; security.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Access data and log files: Access to our website is recorded in server log files. These may include the address of the pages and files requested, date and time of access, amount of data transferred, success status, browser type and version, operating system, referrer URL and IP address. Log files are used for security (e.g. defending against overload attacks) and server stability. They are stored by our hosting provider only for a limited period and then deleted; details are set out in the provider’s privacy policy. Data whose further retention is required for evidence purposes is excluded from deletion until the incident has been finally resolved.

Vercel: hosting and delivery of the website via a global content delivery network. Server-side functions (e.g. newsletter sign-up) run in Frankfurt am Main, Germany; provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; legal basis: legitimate interests (Art. 6(1)(f) GDPR); privacy policy: https://vercel.com/legal/privacy-policy; data processing agreement: https://vercel.com/legal/dpa; basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

Storage on your device (no cookies)

This website does not set any cookies, so no cookie banner is required.

Display setting (light/dark mode): When you switch between light and dark mode, your choice is stored in your browser’s local storage (“localStorage”, key “theme”) and read on later visits so the setting is kept. This information never leaves your device and is not sent to us. Storing it is strictly necessary to provide the function you explicitly requested (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

Fonts

The fonts used on this website (Montserrat, Inter) are served from our own hosting. No connection is made to Google or any other font provider.

Audience measurement

To understand which content is read, we use privacy-friendly audience measurement. Only page views are recorded, with the following details: page visited, referrer (previous page), browser and operating system type, and time. Screen resolution and similar device characteristics are not recorded.

No cookies are set and nothing is stored permanently on your device. For the duration of a visit (until the browser tab is closed or reloaded), a random identifier is held only in the browser’s memory. Returning visitors are therefore not recognised. No user profiles are created, no sessions are recorded and no clicks are captured automatically. The IP address is processed only for technical transmission and is not stored.

Data processed: usage data; meta, communication and process data.
Data subjects: users (website visitors).
Purpose: audience measurement (visit statistics).
Retention: statistics data is deleted after 24 months at the latest.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest is to see, based on visit statistics, which content is read and to improve the website accordingly.
Right to object (opt-out): You can object at any time, e.g. by emailing us or by blocking JavaScript for this website or requests to posthog.com in your browser (e.g. with a content blocker).

PostHog: web analytics; provider: PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA; processing on servers in the EU; legal basis: legitimate interests (Art. 6(1)(f) GDPR); privacy policy: https://posthog.com/privacy; data processing agreement: https://posthog.com/dpa; basis for third-country transfers: Standard Contractual Clauses (for any access from the USA).

Blog

Readers’ data is processed for the blog only to the extent necessary to display it or for security reasons. There is no comment function. Otherwise, the other sections of this policy apply.

We send newsletters only with the recipient’s consent. Only your email address is required to subscribe. Providing it is voluntary, but without it we cannot send you the newsletter.

Content: notifications about new blog posts and updates on our projects.

Double opt-in: Sign-up uses a double opt-in process. After signing up you receive an email asking you to confirm. This ensures nobody can sign up with someone else’s email address. Sign-ups are logged (time of sign-up and confirmation, IP address) so we can prove the sign-up process as legally required. Logging is based on our legitimate interest in proving valid consent.

Deletion and restriction: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, so we can prove that consent was previously given. Processing of this data is limited to defending against possible claims. You may request individual deletion at any time, provided you also confirm that consent previously existed. Where we are obliged to permanently respect objections, we reserve the right to keep the email address in a block list for that sole purpose.

Open and click tracking: Newsletters contain a “web beacon”, a pixel-sized file loaded from our email provider’s server when the newsletter is opened. This collects technical information (e.g. browser, system), your IP address and the time of access. We also record whether links in the newsletter are clicked. This analysis is done per recipient. We use it only to see whether and which newsletter content is read and to improve the newsletter. The tracking is explicitly mentioned at sign-up and forms part of your consent. It cannot be withdrawn separately; unsubscribing from the newsletter also ends the tracking.

Data processed: contact data (email address); meta, communication and process data (e.g. IP addresses, timestamps); usage data (opens, clicks).
Data subjects: communication partners (subscribers).
Purposes: sending the newsletter; measuring newsletter reach.
Retention: until you unsubscribe; afterwards as described under “Deletion and restriction”.
Legal basis: consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR) for logging and proof.
Opt-out: You can unsubscribe at any time, i.e. withdraw your consent. Every newsletter contains an unsubscribe link. Alternatively, email contact@thomasships.com.

Brevo: email delivery and newsletter platform; provider: Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France; legal basis: consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR); privacy policy: https://www.brevo.com/legal/privacypolicy/; data processing agreement: part of Brevo’s terms of use.

Contact by email

If you email us, we process your details (email address, name, message content) to handle your request. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). The data is deleted once the request has been fully dealt with and no statutory retention obligations apply.

Contact form

You can also contact us via the form on our Impressum page. We process the data you enter (name, email address, message content) as well as the IP address and timestamp in order to handle your request and to protect the form against spam and abuse.

Data processed: contact data (name, email address); content data (message content); meta, communication and process data (IP address, timestamp).
Data subjects: communication partners.
Purposes: handling your enquiry; security (spam protection).
Retention: until your enquiry has been fully dealt with; afterwards as required by statutory retention obligations.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest is to respond to your enquiry and to secure the form against misuse.

Email delivery: The form is submitted to our server and, after a successful security check, forwarded by email using Brevo. The same provider information applies as for the newsletter.

Cloudflare Turnstile

To protect the contact form from automated spam and abuse, we use Cloudflare Turnstile. Before the form is submitted, Turnstile checks whether the input comes from a human. This may involve processing your IP address, browser and device information and other technical data required to distinguish humans from bots.

Data processed: meta, communication and process data (e.g. IP address, browser type, device information, time); possibly usage data.
Data subjects: users of the contact form.
Purposes: spam prevention; abuse protection; IT security.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest is to secure our online services against automated attacks and spam.

Cloudflare: bot protection and security services; provider: Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA; legal basis: legitimate interests (Art. 6(1)(f) GDPR); privacy policy: https://www.cloudflare.com/privacypolicy/; data processing agreement: https://www.cloudflare.com/cloudflare-customer-dpa/; basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

We maintain profiles on social networks to communicate with users there and to provide information about us. On this website these networks are included only as plain links. Data is transferred to the network operator only when you click such a link.

Please note that network operators may process user data outside the EU and use it for market research and advertising. For details on their processing and opt-out options, please refer to the operators’ privacy policies. Access requests and other data subject rights are most effectively exercised directly with the providers. If you still need help, you can contact us.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
X: social network; provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; privacy policy: https://x.com/en/privacy.
Instagram: social network; provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; privacy policy: https://privacycenter.instagram.com/policy/; basis for third-country transfers: Data Privacy Framework (DPF).

Changes

We update this policy whenever changes to our data processing require it. We will inform you if a change requires action on your part (e.g. consent) or other individual notification. Please note that company addresses given here may change over time.

Based on a template from Datenschutz-Generator.de by Dr. Thomas Schwenke.