Legal / data & privacy

Privacy notice

What this site collects, why, and your rights under the GDPR. Short version: no cookies, no tracking, and the only personal data processed is what you choose to submit — an email address for the reader list. Nothing is sold on this site; the books are sold by external stores under their own policies.

1) Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Sascha Zehe
c/o Postflex #6060
Emsdettener Str. 10
48268 Greven, Germany
Phone: +49 1575 2452826
Email: jd@jdhalvorsen.com

2) Visiting this site

When you visit this site for information only, no cookies are set, no analytics run, and no tracking of any kind takes place. Your browser technically transmits data that is necessary to display the site (requested page, date and time of access, browser type, operating system, IP address). This data is processed by our hosting provider to deliver the site and to ensure its stability and security (Art. 6 (1) point f GDPR) and is not combined with other data or used to identify you.

This site uses TLS encryption (https://) for all connections.

3) Hosting (Cloudflare)

This site is hosted and delivered by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Requests to the site are processed on Cloudflare's servers. Cloudflare participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. A data processing agreement per Art. 28 GDPR is in place.

4) The reader list (signup form)

If you submit your email address in the signup form, the following happens:

• Your address is passed to our email service provider, Brevo SAS, 55 Rue d'Amsterdam, 75008 Paris, France, which sends you a single confirmation email (double opt-in). A data processing agreement per Art. 28 GDPR is in place with Brevo.
• Only if you click the confirmation link is your address stored on the reader list. If you do not confirm, it is not added to the list.
• The list is used only for news about the author's books — release announcements, the free prequel novella, and closely related reader information. The legal basis is your consent (Art. 6 (1) point a GDPR).
• You can revoke your consent at any time with effect for the future — every email contains an unsubscribe link, or you can write to the address in section 1. After revocation your address is removed from the list.

To protect the signup endpoint against automated abuse, the server keeps a short-lived, keyed cryptographic hash of the requesting IP address for up to 48 hours (Art. 6 (1) point f GDPR — preventing misuse of the email endpoint). The IP address itself is never stored and the hash cannot be reversed into it.

5) Buying the books

Nothing is purchasable on this website, and no payment data is collected or processed here. The books are sold by external stores (such as Amazon); when you buy there, the store is the controller for that purchase under its own privacy policy.

6) Contact by email

If you email jd@jdhalvorsen.com, the data you send (your address and the content of your message) is used solely to handle the correspondence (Art. 6 (1) point f GDPR, or point b where the contact is contract-related) and is not shared with anyone else.

7) Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7 (3)), and objection to processing based on legitimate interest (Art. 21). You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

8) Storage duration

List addresses are stored until you revoke your consent. Server-side abuse-protection hashes expire after 48 hours and are purged automatically. Server log data held by the hosting provider is subject to the provider's short technical retention periods. Email correspondence is kept only as long as the exchange requires, unless statutory retention periods apply.