Malik Arbab

Privacy Policy

This is a convenience translation. Only the German version of this privacy policy is legally binding.

This policy explains which personal data is processed when you visit malikarbab.de. This website is a portfolio; no goods or services are sold here.

1. Controller

Malik Arbab E-mail: ai@malikarbab.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. No cookies, no tracking

This website uses no tracking scripts and no analytics services such as Google Analytics. Fonts are served locally from my own server; no connection to Google Fonts or other font providers is established.

The site stores one technically necessary value in your browser’s session storage to avoid repeating the intro animation during the same visit. This value is deleted when you close the tab, is not a cookie, contains no identifier, and is exempt from consent under § 25 (2) TDDDG. The embedded Mux video player is loaded with its analytics switched off and sets no analytics cookies; on pages with video it may additionally store a volume preference locally (details in section 5). These storage items are technically necessary or purely functional and are exempt from consent under § 25 (2) TDDDG. A cookie banner is therefore not required.

No analytics service is currently in use.

3. Hosting and delivery via Cloudflare

This website is operated on Cloudflare Workers (Static Assets) provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All website traffic is routed through Cloudflare’s network. Still images (https://malikarbab.de/stills/) and other static assets are served from the same domain (malikarbab.de) through Cloudflare; no separate CDN subdomain is used.

When you access the website, Cloudflare processes technically necessary connection data, in particular your IP address, date and time of the request, requested resource, user agent, and referrer (server logs). This processing serves the delivery of the content as well as security and stability (including defense against attacks). I myself have no or only limited access to these logs and do not use them to identify visitors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and performant provision of the website). A data processing agreement (Art. 28 GDPR) including EU Standard Contractual Clauses is in place with Cloudflare; see also section 8.

4. Locally hosted fonts

All fonts are hosted on my own server. No connections to third-party servers are established when fonts are loaded.

5. Video embedding via Mux

Videos on this website are delivered via the streaming service Mux (Mux, Inc., San Francisco, California, USA). Two distinct mechanisms are used. On the work detail pages and on the UFC page, the Mux player component is embedded. On the Work overview (the flight gallery), the video stream is loaded technically from stream.mux.com using hls.js or native HLS playback. Preview and poster images are obtained from image.mux.com.

In each case, your IP address and technical request data (e.g. user agent, requested resource) are transmitted to Mux; without this transmission the video cannot technically be delivered. These connections are only established on pages that actually contain video.

The Mux player is embedded with the options disable-cookies and disable-tracking. This switches off the Mux Data analytics component, so no Mux Data cookies are set and no cross-device recognition takes place. The player only stores your volume preference locally in your browser (purely functional storage, no identifier, not shared with third parties). The flight gallery uses bare HLS playback only and sets no storage on your device. The player software is part of this website and is served from malikarbab.de itself through Cloudflare; no separate third-party CDN is used for the player.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting artistic video works directly on my own website). For third-country transfers, see section 8.

6. Contact form (Cloudflare Worker, Turnstile, Resend)

When you use the contact form, the data you enter (name, e-mail address, message) is transmitted via a Cloudflare Worker to the e-mail delivery service Resend (Resend, Inc., USA), which delivers the message to my mailbox. The data is used exclusively to process and answer your inquiry and is not passed on for any other purpose.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in receiving, answering, and processing inquiries directed at me). Where your inquiry is genuinely aimed at initiating or carrying out a specific contract or commission, Art. 6(1)(b) GDPR applies in addition.

To protect against spam and abuse, the form is secured with Cloudflare Turnstile, a CAPTCHA mechanism that works without cookies. Turnstile processes technical characteristics of your browser and your IP address to verify that the request originates from a human. Turnstile is a service of Cloudflare, Inc.; for third-country transfers and the safeguards in place, see sections 3 and 8. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form against automated abuse).

7. E-mail communication and forwarding

E-mails sent to addresses under the malikarbab.de domain are received via Cloudflare Email Routing and forwarded to a mailbox at GMX, operated by 1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany. The content and metadata of your e-mails are thereby processed by Cloudflare (during routing) and by 1&1 Mail & Media GmbH (as the receiving mailbox provider). The final mailbox is located in Germany, so it does not involve a third-country transfer; only the forwarding itself runs through the US-based Cloudflare (see sections 3 and 8). The data is used exclusively to handle the correspondence.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the efficient handling of incoming communication); where the inquiry is contract-related, Art. 6(1)(b) GDPR applies in addition.

8. Transfers to third countries

The service providers named in this policy, namely Cloudflare, Inc., Mux, Inc., and Resend, Inc., are based in the USA or process data there. This covers all Cloudflare functions used here (hosting and Workers, Turnstile, and Email Routing). Cloudflare, Mux, and Resend are certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, Art. 45 GDPR); EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) are additionally in place. The forwarded e-mail mailbox (GMX / 1&1 Mail & Media GmbH) is located in Germany and does not involve a third-country transfer.

9. Storage periods

Server and security logs are retained by Cloudflare only for a short period for security purposes and are deleted automatically. I delete inquiries received via the contact form or by e-mail once the matter has been fully dealt with and no reasons for further retention exist; statutory retention obligations remain unaffected.

10. Your rights

With regard to your personal data, you have the following rights vis-à-vis me as the controller:

To exercise these rights, an informal message to ai@malikarbab.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for me: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI) (Hessen Commissioner for Data Protection and Freedom of Information), Wilhelmstraße 7, 65185 Wiesbaden (postal address: Postfach 3163, 65021 Wiesbaden), Germany, telephone 0611 1408-0, poststelle@datenschutz.hessen.de, https://datenschutz.hessen.de.

11. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Last updated: 14 June 2026