Privacy policy

Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Zuri Nimca Klaschka
Scheffelstraße 15A
97072 Würzburg
Germany
Email: contact@zuriklaschka.de

I am not required to appoint a data protection officer. If you have questions about data protection, please contact me directly.

Hosting

This website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. My mailbox is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. netcup and STRATO process data only on my behalf and according to my instructions. The servers are located in Germany.

Visiting the website (server log files)

When you visit this website, your browser automatically sends data to the server, which stores it temporarily in log files:

• IP address
• date and time of the request
• page or file requested
• status code and amount of data transferred
• the website you came from (referrer), if your browser sends it
• browser type and operating system (user agent)

Purpose: to deliver the website, keep it secure and stable, fend off attacks and find errors.

Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest is the secure and reliable operation of the website.

Retention: Log files are deleted after 7 days at the latest. I only keep individual entries longer if they are needed to investigate a specific security incident, and only until it is resolved. I do not combine this data with other data.

No cookies

This website sets no cookies and uses no similar techniques such as local storage, fingerprinting or tracking pixels. It neither stores information on your device nor reads it from there (§ 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). That is why there is no cookie banner.

Fonts and icons

The fonts and icons of this website are embedded locally and delivered by this server. Your browser does not connect to a font provider or any other service for them.

Contact form and email

When you write to me via the contact form or by email, I process the information you send me. For the form, that is your name, your email address and your message, plus the time you sent it and a note that you agreed to the processing via the checkbox. The form is forwarded as an email to my mailbox at STRATO. It is not stored on the website’s server.

Purpose: to handle and answer your request and, if you wish, to prepare and carry out an assignment.

Legal basis: For the contact form, your consent, which you give by ticking the checkbox (Art. 6 (1) (a) GDPR). If your request is aimed at a contract with me, Art. 6 (1) (b) GDPR also applies. If you email me directly, the legal basis is Art. 6 (1) (b) GDPR or, for general enquiries, Art. 6 (1) (f) GDPR; my legitimate interest is answering your message.

Withdrawal: You can withdraw your consent at any time with effect for the future, for example with a short email to me. Processing up to that point remains lawful.

Retention: I delete your request once it has been dealt with and no further exchange is expected. If an assignment follows, I keep the business correspondence for as long as statutory retention obligations require, in particular under commercial and tax law.

Protection against abuse: So that the form cannot be misused for spam, the server counts how often submissions are sent from an IP address (at most five per hour). This counter lives only in the server’s memory, is discarded after one hour at the latest and is not stored anywhere permanently. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is a working form without spam.

My plugins

This website presents plugins I published for Adobe products. The sections below describe which data two of them handle. This is about the plugins, not about visiting this website (see the other sections for that).

Document Chat for Adobe XD

Document Chat is very focused on privacy and only saves the data the plugin needs to work, unless users explicitly opt in to a feature that enhances the experience. There are three main data types, stored in different locations.

Document's messages. The plugin stores messages in the XD document itself. All message data is stored in the document and never communicated to any external service, such as my servers. Writing a message is therefore no different from manually writing the data into the XD document (even though, technically, it gets stored in another place of the document). How documents and their contents get stored, as Cloud Documents or local files, is out of my control. However, it is no different from any other document content and is subject to the applicable terms and conditions. For every message, the following data gets stored in the document:

• UUID: a randomly generated, unique ID of the message, allowing the plugin to identify that message, e.g., to link to it or delete it
• Content: the message's content, i.e., the text entered by the message's author before submitting
• Author UUID: the author's UUID, to link the message to the author and thereby let authors edit and delete their messages
• Date: the date and time at which the author sent the message, stored as the number of milliseconds since 00:00, Jan 1, 1970 (UTC)
• Viewport center: the center of the author's viewport when they sent the message, which allows other users to jump to the viewport position of the message

Document's authors. For every author (i.e., user) who has written at least one message, the following data gets stored in the XD document itself:

• UUID: a randomly generated, unique ID of the author, allowing the plugin to link the messages to that author in the document
• Name: a name that gets shown to other users for messages by that author. Providing a name is optional; authors who enter no name are shown as Anonymous.
• Gravatar email: optionally, an email address of the author to show a profile picture (based on Gravatar, see below) for messages of that author

User's preferences. On the local machine on which the plugin runs, the plugin saves the following data in a file (this only gets stored locally):

• Author: the author information for the local user (see Document's authors). The plugin sets this during onboarding, and users can change it later in the plugin's settings.
• Has accepted this privacy policy: confirmation that the user has accepted this privacy policy. Users can't use the plugin without it.
• Use Gravatar: the personal preference of whether to show Gravatar avatars. If users activate this option in the onboarding or the settings, profile pictures of message authors get loaded from Gravatar (see below).

Gravatar profile pictures. The plugin offers opt-in profile pictures, shown with the help of the Gravatar profile picture API. If a user provides a Gravatar email address, the plugin saves this address in the document's author data.

For users who have activated Gravatar profile pictures in the onboarding or the settings, profile pictures get loaded from Gravatar for each author who has written a message in the document. For that purpose, an HTTPS request gets sent to the Gravatar servers, including an MD5 hash of the author's email address. As with any HTTPS request, the client's IP address gets submitted; it is technically required for the plugin and the server to communicate.

Users who don't want their email address submitted to Gravatar can leave the email address field empty. Users who don't want the plugin to make requests to Gravatar can keep this feature disabled in the settings (it is disabled by default).

Gravatar is a service provided by a third party: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA; website: automattic.com; privacy policy: automattic.com/privacy.

Lorem Ipsum for Adobe XD, versions before 1.5.0: usage analytics

Versions of Lorem Ipsum for Adobe XD before 1.5.0 included a small usage-analytics feature (source code). Version 1.5.0 and later don't include it.

• Consent: the first time users ran the plugin, it showed a dialog linking to the privacy policy, with a required "I have read and accepted the privacy policy" checkbox. Nothing was sent without that acceptance. The acceptance was stored locally as a single flag.
• What was sent: an HTTPS request to an endpoint on my former plugin website, which was hosted on the same server as this site. It contained the plugin's name, the feature that was used and that feature's options. It contained no user ID or other identifier.
• Technical data: as with any HTTPS request, the user's IP address reaches the server, along with the time of the request.
• Today: the endpoint no longer exists. Installations of these old versions can still send the request after consent. The server logs it like any normal website request (see Visiting the website), but the analytics data itself is no longer saved.

Recipients

Apart from me, your data is only received by netcup and STRATO as my processors (see Hosting). I only pass it on to others if I am legally obliged to. There are no transfers to countries outside the EU and the European Economic Area.

Links to other websites

This website links to other websites. Simply visiting my site sends no data to them. Only when you click a link do you visit their website, and their privacy policy applies.

Your rights

You have the right at any time to:

• access the data I process about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7 (3) GDPR)

To exercise any of these rights, just email me at contact@zuriklaschka.de.

Complaints to a supervisory authority

If you believe I am processing your data unlawfully, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live. The authority responsible for me is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
www.lda.bayern.de

Other information

No obligation: You are not obliged to give me any data. Without an email address, however, I cannot reply to you.

No automated decisions: I use neither automated decision-making nor profiling (Art. 22 GDPR).

Encryption: The website, including the contact form, is served only over encrypted HTTPS (TLS).

Changes: I update this privacy policy when the website or the law changes. The version published here applies.