PRIVACY
Privacy notice
This notice explains what personal data mikapeltomaa.com processes, why it is processed and how long it is retained. The processing is deliberately limited.
Updated 26 August 2026
Prepared in accordance with Article 13 of the EU General Data Protection Regulation (2016/679).
1. Controller
Mika Peltomaa, private individual
Rauma, Finland
[email protected]
This is a personal portfolio. For privacy matters, contact the address above.
2. Data processed
Visitor analytics
The site uses first-party analytics without cookies or third parties. With your consent, each page view records:
- the page path, such as
/work - the referring site's domain, never the complete URL
- a broad device category: desktop, mobile or tablet
- the time
- a visitor identifier calculated as a salted hash of the IP address and browser identifier
Your IP address is not stored. The salt changes daily, so visits cannot be linked across days and the identifier cannot be reversed into an IP address.
Clicks on article share buttons are also recorded. The data says only which button was clicked and on which page; anything after the click happens in another service and is not visible here.
Server and login logs
Standard server logs contain the IP address, timestamp, requested URL, response code and browser identifier for technical operation and security. The protected administration area also logs login attempts, including the submitted email address and whether the attempt succeeded. These logs are not connected to visitor analytics.
Email and external links
If you contact me by email, your message is processed to handle the matter. The site has no contact form, newsletter or user accounts. External services load only when you click a link; there are no third-party embeds, tracking pixels or scripts on the page.
3. Legal bases
| Processing | Legal basis |
|---|---|
| Visitor analytics | Consent, GDPR Article 6(1)(a). You may withdraw consent at any time below. |
| Server logs and security | Legitimate interests, Article 6(1)(f): reliable and secure operation and prevention of misuse. |
| Login log | Legitimate interests, Article 6(1)(f): protecting the administration area. |
| Legitimate interests or steps before entering into a contract, Articles 6(1)(f) and 6(1)(b). |
4. Retention
- Analytics events: 12 months.
- Login log: 6 months.
- Server logs: no more than 30 days.
- Email: as long as handling the matter or a related legal obligation requires.
5. Recipients and transfers
Analytics data is not disclosed, sold, exchanged or used for advertising or profiling. The site runs in a Hetzner Online GmbH data centre under a GDPR Article 28 processing agreement. The server is in the European Union and data is not transferred outside the EU or EEA.
6. Automated decisions
The site does not make automated decisions or create profiles with legal effects concerning you.
7. Your rights
You may request access, correction, deletion, restriction, objection and portability where applicable, and withdraw consent at any time. Analytics is pseudonymised and cannot be linked back to you. Under GDPR Article 11, identification data need not be retained solely to meet GDPR obligations. In practice I cannot locate or delete your particular analytics rows, but you can prevent future collection below.
8. Right to complain
If you believe processing infringes the GDPR, you may lodge a complaint with the Finnish Data Protection Ombudsman.
9. Changes
If the site changes, this notice and its date will be updated. Material changes will be shown in the consent banner and consent requested again.