Privacy
Controller and contact
Ahmed Lotfy, Billhorner Kanalstraße, 20539 Hamburg, Germany, is responsible for the processing described here. For privacy questions or to exercise your rights, email Lotfy.ahmed@gmx.de.
These notices describe ahmedlotfy.studio with Cloudflare Pages hosting and the website features explained below. Updated: 27 October 2026.
Hosting and technical access data
The website is delivered through Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Delivering and protecting the site involves processing technical request data, including IP address, requested resource, access time and, where transmitted, browser, device and referrer information.
The purpose is to provide the portfolio reliably, prevent misuse and investigate technical problems. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in a secure, functioning professional website. Technical connection data is necessary to retrieve the pages.
Cloudflare processes data through its international network and service providers, potentially including the United States. Its published data-processing terms describe international-transfer safeguards, including EU Standard Contractual Clauses where applicable. The linked terms and privacy information explain the provider’s processing.
Retention depends on the data category, the service configuration and whether the data remains necessary for delivery, security, incident investigation or legal obligations. Cloudflare’s data-processing terms provide purpose- and contract-based retention criteria; no uniform fixed retention period is asserted here.
Cloudflare privacy information
Cloudflare data-processing terms and transfer safeguards
Local media, maps and preferences
Fonts, photographs, video posters, background films and map data are served with the website. The map does not load an external mapping service. The website code includes no advertising or analytics tools and does not create tracking profiles.
Language, filters, view settings and navigation state are handled through the page address and temporary browser memory. The website code does not set cookies or use persistent browser storage for these functions. Your reduced-motion preference is respected. Hosting security features and optional external films may involve separate processing as described in these notices.
Optional YouTube films
Project-film posters are local files. A YouTube player is loaded only when you choose to activate a film after the accompanying privacy notice. The player uses YouTube’s privacy-enhanced domain, youtube-nocookie.com. YouTube is provided in the EEA by Google Ireland Limited.
Activation sends connection and usage information to Google/YouTube, including your IP address, browser information and the website origin. Google may process playback interactions, use cookies or similar storage, and associate activity with a Google account if you are signed in. Privacy-enhanced mode limits personalisation; it does not make playback anonymous. Data may also be processed outside the EEA, including in the United States.
Activation is optional and is based on your consent under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. You can continue using the portfolio without activating a film. “Close video” removes the player and stops further player requests from this page. Activating it again is a new choice. Withdrawal does not affect earlier lawful processing or delete data already held by Google. Google’s privacy information explains retention and available controls.
“Watch on YouTube” opens the provider’s website. The downloadable offline preview uses external film links rather than embedded playback.
Email enquiries
The email link opens your email application; the website itself does not submit a contact form. If you send an enquiry, I process the sender details, message, attachments and related correspondence to respond and maintain the professional exchange. The recipient mailbox uses GMX, a service of 1&1 Mail & Media GmbH.
The legal basis is Article 6(1)(f) GDPR, reflecting my interest in answering professional enquiries. Article 6(1)(b) GDPR applies where the correspondence is necessary for a contract or steps requested before entering into one. Providing an enquiry is voluntary; a reply requires usable contact details.
Correspondence is retained while it is needed to deal with the enquiry or maintain the resulting professional relationship. It is deleted when that purpose ends, unless applicable retention duties or the establishment, exercise or defence of legal claims require longer storage. Any necessary retention for legal duties is based on Article 6(1)(c) GDPR.
External links and downloads
LinkedIn, project-source and other external links open services operated by third parties. Those providers process data under their own notices once you visit them. They are not loaded as embedded social-media widgets. CV downloads are local website files and generate the ordinary technical requests described above.
Your rights
Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Where processing is based on legitimate interests, you may object for reasons relating to your particular situation under Article 21 GDPR. You may withdraw consent at any time with effect for the future.
You can contact me at Lotfy.ahmed@gmx.de. You also have the right to complain to a supervisory authority, particularly in the country where you live or work or where an alleged infringement occurred. The Hamburg authority is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
I do not use this website to make automated decisions producing legal or similarly significant effects, or to profile visitors.