Privacy policy

1. Controller

The data controller responsible for this website (jdtbuchan.com) is Jonathan Buchan. Contact details are listed in the imprint.

2. What this site collects

This site is a static website hosted on Amazon CloudFront and S3. Three data flows apply:

• Server logs (CloudFront / S3). AWS records standard request metadata when you load a page — IP address, user agent, time of access, URL requested. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating and securing the site). Logs are retained by AWS according to their default retention policy and used only for operations and security troubleshooting.
• Google Analytics 4 (analytics cookies). If — and only if — you accept analytics cookies via the consent banner, this site loads Google Analytics 4 and reports pageviews and basic interaction events. IP addresses are anonymised at collection (the anonymize_ip flag is set). Consent Mode v2 is enabled, so when consent is denied or never granted, no analytics cookies are set and no measurable events are sent. Legal basis: Art. 6 (1) (a) GDPR (your explicit consent). See section 5 below for how to change or withdraw your choice. See also Google’s privacy policy.
• Contact form submissions. When you submit the contact form, your name, email address, and message are sent to FormSubmit, a third-party service that forwards the message to my email address. Legal basis: Art. 6 (1) (a) GDPR (consent given by submitting the form) and Art. 6 (1) (b) (steps prior to entering into a contract). Submissions are retained in my inbox until the underlying conversation is resolved.

3. Third parties

This site loads the following third-party assets:

• Google Fonts (Fraunces, DM Sans). When you load a page, your browser fetches the font files from Google’s CDN. Google receives standard request metadata as a result. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in typographic presentation of the site).
• Google Analytics 4. Loaded only when analytics consent has been granted. Operated by Google Ireland Limited as data processor; data may be transferred to Google LLC in the United States under the EU–U.S. Data Privacy Framework. See section 2 for what is collected and section 5 for how to withdraw consent.
• Amazon S3 (résumé download). The résumé PDF is hosted in an S3 bucket in eu-central-1. AWS receives standard request metadata when you download it.

4. Your rights

Under GDPR you have the right to access, rectify, or erase personal data concerning you; to restrict or object to its processing; to data portability; and to lodge a complaint with the supervisory authority. The competent authority for Hesse, Germany is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI).

To exercise any of these rights, contact me using the details in the imprint.

5. Cookies and consent

This site does not set its own cookies. The only cookies that can be set on your device are by Google Analytics 4 (typically _ga and _ga_*), and only after you grant consent via the banner shown on your first visit.

You can change your decision at any time by clicking Cookie preferences in the footer of any page. Withdrawing consent clears the analytics decision and re-presents the banner; declining or never granting consent leaves Consent Mode v2’s defaults in place — analytics storage is denied, no cookies are written, and no individualised events are reported. Your choice is stored only in your browser’s localStorage on this domain, not on any server.

A small set of strictly-necessary signals (security, functionality) is considered legitimate-interest under GDPR and is not gated by the banner. Those signals do not write cookies.

6. Changes

This policy may be updated when the site adds or removes third-party integrations. The "last updated" date above reflects the current version.