Privacy Policy

Effective date: August 23, 2026

1. Who is responsible for your data (Controller)

The controller responsible for personal data processed on this website is:

Stephan Christopher Kuehn
Achlada Maleviziou 157
715 00 Heraklion, Crete
Greece
Email: me [at] stevenkeen [dot] com

A Data Protection Officer is not required for a website of this nature and has not been appointed. You can contact the controller directly at the address above on any data-protection matter.

2. Scope

This policy applies to personal data processed through this website, fisherofkids.com. Other websites have their own privacy policies.

3. What data we collect, why, and on what legal basis

a) Server log files (technical access data). When you visit the site, our hosting and security providers automatically process technical data such as your IP address, browser and device type, the pages requested, and the date and time of access. This is necessary to deliver the website reliably and to protect it against attacks and misuse.
Legal basis: our legitimate interest in the secure and stable operation of the website (Article 6(1)(f) GDPR).

b) Website analytics (Umami). We use Umami, a privacy-friendly analytics tool we host ourselves on our own server in Germany, to see which pages are read, which sites link to us, and roughly where in the world readers are. It sets no cookies and stores no IP address, no name and no email address. To tell one visit from another it derives a short code from your IP address and browser that cannot be turned back into either. We keep these statistics for as long as this website operates.
Legal basis: our legitimate interest in understanding how our content is used so that we can improve it (Article 6(1)(f) GDPR). Our analytics store nothing on your device, so no consent is required for them. To opt out, switch on Do Not Track or Global Privacy Control in your browser: we stop counting you immediately, here and on every other site we run.

c) Contact by email. If you email us, we process your email address and the contents of your message solely to reply to you, and for no other purpose.
Legal basis: our legitimate interest in answering inquiries (Article 6(1)(f) GDPR)—or, where your message aims at a contract, Article 6(1)(b) GDPR. Correspondence is deleted once the matter is closed, unless a statutory retention duty applies.

d) The trailer (Vimeo). The film preview is hosted on Vimeo. The Vimeo player loads only after you actively click to play it—until then, no connection to Vimeo is made and no data reaches it. Once you play it, Vimeo (Vimeo, Inc., United States) may process data, including your IP address, in accordance with its own privacy policy; the safeguards for that transfer are set out in §6.

4. Cookies

This site sets no cookies of its own. Our analytics use no cookies. Cloudflare, which routes and protects this site, may set a strictly necessary security cookie to separate trusted visitors from malicious traffic. None of this requires consent, so there is no cookie banner. We do not use advertising cookies. If you reach the site through a campaign link, its parameters (so-called UTM tags) appear in the page address and are used only as anonymous, cookieless context attached to the aggregate visit statistics described in §3(b). They are not stored on your device and are not used to identify or profile you.

5. Who we share your data with (recipients/processors)

We do not sell your personal data. We share it only with service providers (“processors”) that help us operate the website, each under a data-processing agreement:

• Website hosting: Mittwald CM Service GmbH & Co. KG—Germany (EU).
• DNS, content delivery, and security: Cloudflare, Inc.—United States.
• Video hosting: Vimeo, Inc.—United States, and only once you play the trailer.

Our website analytics run on Umami, which we host ourselves on our own server at Mittwald in Germany (EU)—no third-party analytics company receives your data.

6. International data transfers

Some of our providers are US companies (Cloudflare, Vimeo), so data may be processed by them. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection, and both maintain the Commission’s Standard Contractual Clauses as a fallback safeguard. Our hosting and our analytics both run on Mittwald’s servers in Germany, with Cloudflare in front as our content-delivery and security layer.

You may request a copy of the relevant safeguards by emailing me [at] stevenkeen [dot] com.

7. How long we keep your data

• Server log data (hosting): retained for 60 days, then deleted.
• Security and delivery log data (Cloudflare): generated and held by Cloudflare, our DNS, content-delivery and security provider, for abuse detection and attack mitigation, and then deleted. Cloudflare sets that period itself and publishes no fixed figure for it, stating only that it keeps such data for a limited period; we do not receive, export or store these logs, so we can neither shorten nor extend it.
• Analytics data: kept for as long as this website operates. It contains no name, no email address and no IP address.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing in certain circumstances (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21)—for analytics, switch on Do Not Track or Global Privacy Control and we stop counting you at once; and
• withdraw consent at any time where processing is based on consent (Art. 7(3)).

Arts. 15-20 apply to data that identifies you, which our analytics counts do not—your right to object always applies.

To exercise any of these, email me [at] stevenkeen [dot] com.

9. Right to lodge a complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority—in particular in the EU country where you live or work. The authority competent for the controller is:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifissias Avenue 1-3, 115 23 Athens, Greece—www.dpa.gr

10. Automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR.

11. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The current version is identified by the effective date above.