Privacy

Who is responsible

The controller under Art. 4 (7) GDPR is Zulqarnain Haidar, Kurt-Schumacher-Str. 104, 82256 Fürstenfeldbruck, Germany. Email: info@zulqarnainhaidar.com. Full details are in the imprint.

No data protection officer has been appointed; the thresholds in § 38 BDSG are not met.

What this site does not do

It is easier to start here, because most of the usual privacy policy does not apply:

• No cookies. The site sets none at all — not analytics cookies, not advertising cookies, not consent-banner cookies. That is why there is no cookie banner.
• No analytics or tracking. No Google Analytics, no Meta pixel, no tag manager, no heatmaps, no fingerprinting, no third-party scripts of any kind.
• No advertising and no data sales. Your address is never sold, rented, shared or used for anything but sending this newsletter.
• No profiling and no automated decision-making within the meaning of Art. 22 GDPR.
• No open or click tracking in emails. Issues contain no tracking pixel, so I cannot see whether you opened one.

The only thing stored in your browser is a theme entry in local storage, remembering whether you chose light or dark. It is a preference you set, it never leaves your device, and clearing site data removes it.

Subscribing to the newsletter

What is stored: your email address; a short label for which form you used (for example site or post-footer); your status (pending, confirmed or unsubscribed); two random tokens used for the confirmation and unsubscribe links; and the timestamps of signing up, confirming and unsubscribing.

What is not stored: no name, no IP address, no country, no device or browser information.

Legal basis: your consent, Art. 6 (1) (a) GDPR. Subscription uses double opt-in: the address is inactive until you click the link in the confirmation email, which means nobody can sign up someone else.

Withdrawing consent: every issue carries an unsubscribe link, and mail clients that support one-click unsubscribe show a native button. You can also email me. Withdrawal takes effect for the future and does not affect processing already carried out.

Retention: your address is kept until you unsubscribe. On unsubscribing the record is marked as unsubscribed and retained so the address is not accidentally re-added and so the withdrawal itself remains provable. Ask me to delete it entirely and I will.

Which issues went out: a record of which issue was sent to which subscriber is kept, so that re-running a send cannot deliver the same issue twice.

Spam protection

The signup endpoint limits how many attempts can come from one IP address in a sixty-second window. The address is held in memory for that window only, is never written to the database, and is never used for any other purpose. Legal basis: legitimate interest in keeping the form usable, Art. 6 (1) (f) GDPR.

Server logs

The hosting provider records technical request logs — IP address, timestamp, requested page, referrer and user agent — as every web server does. These are used for operating and securing the site and are short-lived. Legal basis: Art. 6 (1) (f) GDPR.

Who processes your data

Each of the following acts as a processor under Art. 28 GDPR, under a data processing agreement:

• Supabase — the subscriber database. This project is hosted in the EU (Stockholm, eu-north-1), so subscriber records stay in the EU.
• Resend — delivers the confirmation, welcome and issue emails.
• Vercel — hosts the website and serves its pages.
• Google Workspace — receives replies you send to me.

Where a processor is based outside the EU or transfers data to a third country, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

Your rights

Under the GDPR you have the right to:

• access the data held about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time (Art. 7 (3)).

Email info@zulqarnainhaidar.com and I will handle it. Since the only identifier held is your email address, a request has to come from that address for me to match it to a record.

You also have the right to complain to a supervisory authority (Art. 77). The competent authority here is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach.

Changes

If what the site does changes, this page changes with it, and the date at the top is updated.