Privacy policy

The controller under the General Data Protection Regulation (GDPR) is Dr. Mario M. Modena, Freiburg, Germany. You can reach me through the contact form on this website.

This website does not use cookies, tracking pixels, advertising or social media plug-ins. It has no user accounts and no comments, and it stores nothing on your device. The fonts and the statistics script are served from this website itself, not from a third party. Apart from the hosting provider (see below), one counting request to GoatCounter per page (see "Visitor statistics") and the map tiles on the Biking page (see "Maps"), your browser contacts no other server while you read the pages. It contacts the form provider only when you send the contact form (see "When you contact me").

This website is hosted on Cloudflare Pages, and Cloudflare also provides its domain name service (DNS). When you open a page, Cloudflare processes your IP address and the technical data your browser sends, such as the page requested, the date and time and your browser type, in order to deliver the page through its network and protect the website against attacks and misuse. Cloudflare may keep this data in its logs for a limited time. I do not use this data, I have not switched on Cloudflare’s own analytics, and I do not link the data to any other information about you.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in presenting my professional profile online in a reliable and secure way. How long Cloudflare keeps its logs is determined by Cloudflare.

The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Because Cloudflare is a US company, data can be transferred to the USA. Cloudflare states that it complies with the EU-U.S. Data Privacy Framework and also relies on the standard contractual clauses published by the European Commission for such transfers. Details are in Cloudflare’s privacy policy.

To know how many people read this website and which pages they find useful, I use GoatCounter, a privacy-friendly statistics service. It sets no cookies, stores nothing on your device and does not follow you across other websites. The small counting script is served from this website itself; for each page you open, your browser then sends one request to GoatCounter with: the address of the page, the page title, the referring page (the website you came from, if your browser shares it), your screen width, and the technical data every request carries, namely your IP address and your browser’s User-Agent header.

From this, GoatCounter keeps only counts per day or hour: pages, referrers, browser and operating system, screen size, language and country. It derives the country from your IP address and then discards the address. To avoid counting a reload as a new visitor, it keeps a random ID for each combination of website, IP address and User-Agent in memory only, for up to eight hours, and never writes it to disk. According to GoatCounter, it does not store IP addresses, the full User-Agent header or any tracker ID, and no person can be identified from the data, even with full access to its database. I can only see the aggregated numbers.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in knowing how much this website is used and which content is of interest, in a way that does not identify visitors. If you use a content or tracking blocker, the counting request is usually blocked, and that is fine: the website works the same.

GoatCounter is operated by Martin Tournoij in Ireland, and its data is stored on servers of Hetzner Online GmbH in Germany and Finland, so it stays in the European Union. Details are inGoatCounter’s privacy policy and in itsnotes on the GDPR.

The contact form asks for your name, your email address and your message. When you send it, your browser transmits these entries, together with your IP address and technical data such as your browser type, directly to the servers of the form provider Formspark (Trampoline Software SRL, Mazy, Belgium). Nothing is sent to Formspark when you only open the page. Formspark stores the submission and forwards it to me by email. It also filters spam automatically and, according to Formspark, uses the sender’s IP address for this.

Formspark acts as my processor under a data processing agreement (Article 28 GDPR). Formspark states that it holds data within the European Economic Area, in Ireland and Germany. A few of its vendors are outside the EEA and are covered by safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses; see Formspark’s list of subprocessors and itsGDPR information. According to Formspark, a submission is kept until I delete it, and the sender’s IP address is kept for 12 months.

I use your details only to read and answer your message and, where relevant, to discuss a job opportunity or a collaboration. The legal basis is Article 6(1)(b) GDPR if your message concerns a possible employment or contract, and otherwise Article 6(1)(f) GDPR: my legitimate interest in answering enquiries and in protecting the form from spam and abuse.

Messages reach me in my email inbox (Gmail, operated by Google). I keep a message only as long as needed to deal with your request and any follow-up, and then delete it from my inbox and from the Formspark dashboard, unless the law requires me to keep it.

The maps on the Biking page are made of map images (tiles) that your browser loads when you open that page: from CyclOSM (cycling map, shown by default), and from OpenTopoMap (topographic map) or OpenStreetMap (street map) only if you switch to them. To send you the tiles, these servers receive your IP address and the technical data your browser sends, such as the time and your browser type. No cookies are set. The other pages of this website do not load map tiles.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in showing the routes of my bike tours on a map. CyclOSM tiles are served by OpenStreetMap France (cyclosm.org). Information about OpenTopoMap and who runs it is at opentopomap.org/about. OpenStreetMap tiles are served by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; the United Kingdom has an adequacy decision of the European Commission. Details are in the OpenStreetMap Foundation privacy policy.

This website links to LinkedIn, ORCID and my map of bike rides (a separate website on GitHub Pages that loads map tiles from OpenStreetMap, CyclOSM, OpenTopoMap and Esri). These are plain links: nothing is sent to those services until you click one. After that you are on their websites, and their own privacy policies apply. I have no influence on how they process data.

Under the GDPR you have the right to:

• access the personal data I hold about you (Article 15),
• have inaccurate data corrected (Article 16),
• have your data erased (Article 17),
• have the processing restricted (Article 18),
• receive your data in a portable format (Article 20),
• object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Article 21).

To exercise any of these rights, send me a message through the contact form. You also have the right to complain to a data protection authority (Article 77 GDPR), for example in the country where you live or work. The authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
[email protected], baden-wuerttemberg.datenschutz.de

This website does not make automated decisions and does not create profiles of visitors.

I update this policy when the website or the legal requirements change. The current version is always on this page. Last updated: 21 October 2026.