Privacy

Controller

Christian Lessner, for the address see the imprint, email: mail@christianlessner.com

Hosting and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The host processes the data on my behalf (Art. 28 GDPR). With every request, the server processes your IP address, the date and time, the page requested, your browser and operating system and, if you arrived via a link, the page containing that link (usually just its domain, e.g. google.com). Without this data the website cannot be delivered.

The purpose is to deliver the website and to fend off attacks; the legal basis is Art. 6(1)(f) GDPR. IP addresses are deleted or anonymized after seven days at the latest.

Visitor statistics with Swetrix

For anonymous visitor statistics I use the software Swetrix on my own server at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, which acts on my behalf (Art. 28 GDPR). It records the page requested, the previously visited page, browser language and time zone, browser, operating system and device type, your approximate location (country, region, city) and loading times. Swetrix sets no cookies and stores nothing on your device.

Your IP address is not stored. It is used only briefly to determine the approximate location and, together with the browser identifier and a regularly changing random value, to create an irreversible checksum that allows visits to be counted. It is then discarded. The statistics do not allow any conclusions about you as a person.

The purpose is to see which content is in demand; the legal basis is Art. 6(1)(f) GDPR.

Contact by email or phone

If you write to me or call me, I process your details to answer your inquiry and, where applicable, to carry out an assignment. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general inquiries. I delete the data as soon as it is no longer needed for this purpose, unless statutory retention obligations prevent this.

Videos

The showreels are stored on my own web space and play without any third party. The other project videos are hosted on YouTube or Vimeo and are not embedded directly. When you click one of these videos, a notice appears first. Only once you agree there does the provider’s player load:

• YouTube in privacy-enhanced mode: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (privacy policy)
• Vimeo with “Do Not Track” enabled: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA (privacy policy)

The provider then receives your IP address, information about your browser and which video you play. It may store or read information on your device and transfer data to the USA. Google and Vimeo are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can load a single video or allow the platform for the current visit. The website remembers this choice in your browser’s session storage (sessionStorage). It is not sent to me and is deleted automatically when you close the tab (Section 25(2) No. 2 TDDDG). You can withdraw your consent at any time with effect for the future by closing the tab or by withdrawing it at the end of this page.

Grading live stream for clients

Clients can watch an ongoing grading session live. The area is only accessible with personal login details that I issue as part of an assignment. For this, a username and password are stored, the password only as an irreversible hash.

When you open this area, it sets a session cookie that is deleted when you close your browser. It is technically necessary to keep you logged in (Section 25(2) No. 2 TDDDG). To protect against password guessing, I store the IP address, username, time and result of every login attempt. These entries are deleted after seven days.

The video is provided by my own streaming server at netcup GmbH (address see above), which acts on my behalf (Art. 28 GDPR). During playback, it processes your IP address and the technical connection data required for the transmission. No other providers are involved.

The legal basis is the performance of the assignment (Art. 6(1)(b) GDPR); for the log of login attempts, my legitimate interest in secure access (Art. 6(1)(f) GDPR).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal message to mail@christianlessner.com is sufficient.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

Right to object

Where I process data on the basis of Art. 6(1)(f) GDPR, you may object to this at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data unless there are compelling legitimate grounds for doing so or the processing serves the establishment, exercise or defense of legal claims.

Last updated: October 2026

Your video consent