Privacy.

Who is responsible

Karl Sutanto is responsible for the processing described here. For privacy questions or to exercise your rights, email me.

When you visit

The website is hosted using Amazon Web Services (AWS). To serve a page and protect the service, AWS processes connection and request information, including your IP address, the time of the request, the requested address, browser and device information, and the referring address if your browser sends it.

I use AWS CloudFront’s built-in summary reports to understand overall traffic, the content requested, broad visitor locations, and device and browser types. These reports count requests, which can include images and automated traffic; they do not identify individual people. I do not add browser tracking code, create visitor identifiers or use these reports to build individual browsing profiles. I do not enable a separate archive of detailed website access logs.

For page statistics, CloudFront also estimates a country, region and city from the connection’s IP address. A server in Stockholm immediately adds successful page requests to separate daily city, country, page and device totals. These counters do not store IP addresses, visitor identifiers, exact visit times, query strings, referring addresses or browser identification strings. Location estimates can be inaccurate or unavailable. Known automated requests are excluded where possible. The totals measure requests, not unique people or sessions, and are available only through a private administration dashboard.

The legal basis is my legitimate interest in operating a reliable, secure website and understanding its use in a proportionate way, under Article 6(1)(f) of the General Data Protection Regulation (GDPR). The website’s fonts, images and other assets are served with the website rather than loaded from third-party font or social-media services.

When you contact me

If you use the contact form, I receive your name, email address and message so that I can respond. The form also sends basic technical information, including when you opened it, to help reject automated submissions. Providing these details is voluntary, but the required fields are needed to send the form and reply.

AWS processes and sends the enquiry to my email inbox. The providers involved in sending and receiving email also process the correspondence. The form’s operational logs do not contain your name, email address or message.

To limit abuse, the form also keeps short-lived counts of total sending attempts per hour and day. These limits apply to the whole website and do not identify individual visitors. The counters expire shortly after their time window and are then automatically deleted.

The legal basis is my legitimate interest in handling correspondence under Article 6(1)(f) GDPR, or Article 6(1)(b) where your enquiry concerns steps you request before entering into a contract. Please do not send medical records or other sensitive health information through this general contact form.

Storage and service providers

The website’s storage and contact-processing services are configured in AWS’s Stockholm region. CloudFront delivers the website through a global network, so connection information may also be processed outside the European Economic Area. Email delivery can involve providers in other countries.

AWS processes customer data under its Data Processing Addendum, which includes the European Commission’s Standard Contractual Clauses where applicable to international transfers. You can contact me for information about the safeguards relevant to your enquiry.

The contact service’s operational logs are configured for deletion after seven days. CloudFront’s built-in viewer reports cover the preceding 60 days; this reporting window is not a claim that every record held by AWS is deleted after 60 days. Correspondence is kept for as long as needed to handle your enquiry and any related obligations or legal claims, then deleted when those reasons no longer apply.

The additional daily aggregate counters are retained for 90 full days and then scheduled for automatic deletion; AWS may take several days to complete that deletion. Operational logs for the page and statistics services are kept for seven days and contain no detailed visitor records.

Your rights

Subject to the conditions in the GDPR, you may request access to your personal data, correction, deletion or restriction of processing. You may also have a right to receive data in a portable format. Where processing relies on legitimate interests, you have the right to object for reasons relating to your particular situation.

You can email me to make a request. You also have the right to complain to a data protection supervisory authority, particularly in the EU country where you live or work, or where you believe an infringement occurred.

Links to other websites

External links, including LinkedIn, take you to services with their own privacy practices. Those services are not embedded as tracking widgets on this website.