Privacy Policy

Last updated: 3 October 2026

Controller

The controller responsible for processing personal data through this website is:

Email: maximilian.malterer@gmail.com
Phone: +49 (0) 176 6129 4598

If you have questions about this Privacy Policy or wish to exercise your data-protection rights, you can contact me using the details above.

General information

This website is designed to collect as little personal data as possible. Personal data is information relating to an identified or identifiable natural person. This may include an email address, an IP address, device information, or information about how a person interacts with a website or newsletter.

I process personal data only where there is an appropriate legal basis. Depending on the circumstances, processing may be based on:

• your consent under Article 6(1)(a) GDPR;
• the performance of a contract or steps taken at your request under Article 6(1)(b) GDPR;
• compliance with a legal obligation under Article 6(1)(c) GDPR; or
• my legitimate interests under Article 6(1)(f) GDPR, provided those interests are not overridden by your rights and interests.

Website hosting and delivery through Vercel

This website is hosted and delivered using services provided by:

When you visit this website, Vercel and its infrastructure providers may process technical connection data required to deliver and secure the website. Depending on the request, this may include your IP address, browser and device information, operating-system information, the date and time of the request, the requested page or file, the referring website, and technical error or security information.

This processing is necessary to display the website, maintain its security and stability, diagnose technical problems, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure, reliable, and technically functional operation of the website.

Vercel is based in the United States and uses subprocessors in several countries. International transfers may therefore occur. Vercel describes the safeguards it uses for international transfers, including the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses where applicable.

Further information is available in Vercel’s Privacy Notice and Trust Center. You may contact me using the details above if you would like further information about the safeguards applicable to a transfer.

Vercel Web Analytics

I use Vercel Web Analytics to understand aggregate website usage. The data points may include the time of a visit, page URL, filtered query parameters, referrer, approximate geolocation, device type, operating system, and browser.

According to Vercel, Web Analytics does not use third-party cookies. Visitors are distinguished through a hash generated from the incoming request; the visitor session is discarded after 24 hours. Vercel states that recorded data points are anonymous and are not tied to an individual, customer, or IP address.

The legal basis, to the extent the collection involves personal data, is Article 6(1)(f) GDPR. My legitimate interest is understanding the overall performance and use of the website so that I can maintain and improve it.

You can read more in Vercel’s Web Analytics privacy and compliance information.

Newsletter and Substack

You can subscribe to my newsletter using an embedded form provided directly by Substack Inc. The form is loaded automatically on pages where it appears. When such a page loads, your browser connects to Substack.

Substack may receive technical data such as your IP address, browser and device information, the referring page, and the time of the request. I use the form to provide a direct and accessible way to subscribe to the newsletter. To the extent this involves personal data, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is making the newsletter available to readers. Substack may use cookies or similar technologies under its own policies.

The newsletter and subscriber list are managed using:

When you subscribe, and depending on your later interaction with the newsletter, the following information may be processed:

• your email address and subscription status;
• the date and time of registration, confirmation, and unsubscription;
• technical information such as IP address, browser, and device information;
• delivery information and whether a newsletter was opened;
• whether links in a newsletter were selected; and
• other subscription or engagement information made available through Substack.

Your email address is required to receive the newsletter. You are not required to provide it for any other use of this website.

The newsletter is sent on the basis of your consent under Article 6(1)(a) GDPR and the German rules governing electronic direct marketing, particularly § 7(2) UWG. Substack may send a confirmation email and retain registration and confirmation information to document consent and prevent unauthorised subscriptions.

Substack uses technical identifiers to measure newsletter delivery and engagement, including whether a message was opened and whether a link was selected. This measurement is part of Substack’s newsletter service and cannot currently be disabled by me. Substack may also provide publication and newsletter analytics under its own terms. I do not add Google Analytics, Meta Pixel, X Pixel, or comparable advertising tracking to this website. If you do not want Substack to process newsletter engagement information, please do not subscribe.

You may withdraw your consent at any time with effect for the future by selecting the unsubscribe link in any newsletter email or by contacting me. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Substack may act as a processor for publication subscriber data and as an independent controller for certain platform features and processing carried out for its own purposes. Substack is based in the United States and states that it participates in the EU–US Data Privacy Framework. Further information is available in Substack’s Privacy Policy and Publisher Agreement.

Subscriber information is generally retained for the duration of the subscription. After you unsubscribe, limited records may be retained where necessary to document consent and withdrawal, honour the unsubscription, prevent unwanted emails, or establish, exercise, or defend legal claims.

Contact by email or telephone

If you contact me by email or telephone, I process the information you provide in order to respond. This may include your name, contact details, the contents of your message, and any other information you choose to provide.

Where your request concerns a contract or steps taken before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is responding to enquiries and communicating with readers, business partners, and other contacts.

Email correspondence sent to my published Gmail address is processed using a consumer Gmail service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Google may process message content, contact details, technical metadata, and security information to provide and protect the email service. International transfers may occur. Google describes its transfer mechanisms and privacy practices in its Privacy Policy. You may contact me if you would like further information about applicable transfer safeguards.

The information will be deleted when it is no longer required to deal with the enquiry, unless it must be retained for contractual, tax, accounting, or legal reasons.

Cookies and similar technologies

This website does not currently use Google Analytics, Meta Pixel, or other advertising or cross-site tracking technologies. Vercel Web Analytics does not use third-party cookies.

Strictly necessary cookies or similar technologies may be used where required to deliver and protect the website or provide a requested function. The embedded Substack form and Spotify player connect to their respective providers when a page containing them loads. Those providers may use cookies or similar technologies under their own policies.

Spotify embedded content

The Birthright page includes an embedded audio player provided by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. When the page loads, your browser connects to Spotify. Spotify may receive your IP address, browser and device information, the referring page, and the time of the request, and may use cookies or similar technologies.

I use the player to let visitors sample or access the audiobook directly from the book page. To the extent the connection involves personal data, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is presenting the audiobook in a convenient format. Further information is available in Spotify’s Privacy Policy and Cookie Policy.

External links

This website contains links to third-party websites and services, including book retailers, audio platforms, YouTube, social networks, and Substack. When you select an external link, your browser connects directly to the relevant third party. That third party may receive technical information such as your IP address, browser information, the referring page, and the time of the request. Once you leave this website, the relevant third party’s privacy terms apply.

Data retention and recipients

Unless a more specific period is stated above, personal data is retained only for as long as necessary for the purpose for which it was collected. Data may be retained longer where necessary to comply with legal obligations, meet tax, accounting, or commercial retention requirements, establish or defend legal claims, or protect the security and integrity of the website and associated services.

Personal data may be disclosed to Vercel and its infrastructure providers, Substack and its service providers, Spotify in connection with its embedded player, Google in connection with email correspondence, other technical providers supporting the website, and public authorities, courts, or professional advisers where disclosure is legally required or necessary for legal claims.

Your rights

Subject to the conditions of the GDPR, you have the right to access under Article 15, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, data portability under Article 20, objection under Article 21, and withdrawal of consent under Article 7(3).

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. I will stop the processing unless I can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is required for legal claims.

To exercise your rights, email maximilian.malterer@gmail.com. I will respond without undue delay and generally within one month. In some cases, I may need additional information to confirm your identity.

You also have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority responsible for a Berlin-based controller is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Data security

This website uses encrypted HTTPS connections. I and my service providers take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. Nevertheless, no internet transmission or storage system can be guaranteed to be completely secure.

Automated decision-making

I do not use personal data collected through this website or newsletter to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Changes to this Privacy Policy

I may update this Privacy Policy where the website, its service providers, its data-processing activities, or applicable legal requirements change. The current version will always be published on this page with its most recent update date.