Privacy policy

Last updated: 17 October 2026

1. Who is responsible for your data?

The controller responsible for this website is:

Maya Erofeeva
Kollwitzstraße 84
10435 Berlin
Germany

This policy explains how personal data is processed when you visit maya-portfolio.com or contact me through this website. Personal data means information relating to an identified or identifiable person.

2. Hosting and technical operation

This website uses WordPress and is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

When you visit, technical information is processed to deliver pages, maintain the connection, identify errors and protect the website. Depending on the service and request, this includes your IP address, request date and time, requested URL or file, referring page, browser and operating-system information, and connection or response details.

The legal basis is Article 6(1)(f) GDPR. My legitimate interests are delivering the website, keeping it available and preventing misuse. Hosting providers process data under the applicable contractual arrangements, including processing agreements where Article 28 GDPR requires them.

Technical records are retained for the period needed to operate the service, investigate faults and address security incidents, subject to the hosting product’s configured retention and any applicable legal requirements. Information relevant to a specific incident may be retained until that incident and related claims have been resolved.

Further information: IONOS data protection information.

3. Cookies, local storage and consent

The website uses technologies that may store information on your device or access information already stored there. These include cookies and comparable browser storage.

Storage or access that is strictly necessary to provide a service you explicitly request, including remembering your privacy choices where necessary, is based on Section 25(2) TDDDG. Other storage or access requires consent under Section 25(1) TDDDG. Where personal data is processed on the basis of consent, the legal basis is Article 6(1)(a) GDPR.

Consent management is provided through the GDPR Cookie Compliance plugin by Moove Agency, with WordPress consent integrations where configured. The tool processes your choices and the technical information needed to remember or apply them. Processing necessary to meet legal obligations is based on Article 6(1)(c) GDPR. Otherwise, maintaining and applying your preferences is based on Article 6(1)(f) GDPR, reflecting my interest in respecting your choices and operating the consent tool.

You can refuse optional services without losing access to the basic website. Locally hosted BBH Hegarty remains available. Other fonts requested from external providers may be replaced with fallback fonts, and external content may remain unavailable.

You can change or withdraw consent through Cookie Settings. Withdrawal takes effect for future processing and does not affect processing lawfully carried out before withdrawal. It cannot reverse a connection or disclosure that has already occurred.

See the Cookie Policy for further information.

4. Locally hosted BBH Hegarty

The website uses BBH Hegarty, served directly from maya-portfolio.com. Your browser retrieves the font file from the website’s hosting service. This does not require a connection to Adobe Fonts or Google’s font servers for BBH Hegarty.

Font delivery involves the hosting-related technical request processing described in section 2, based on Article 6(1)(f) GDPR for delivering the website. BBH Hegarty remains available when you reject optional services.

5. Google Fonts

The website uses typefaces available through Google Fonts, including Jost and Kumbh Sans. When fonts are requested from Google’s servers, your browser discloses your IP address and technical request information to Google so that the stylesheets and font files can be delivered.

For users in the European Economic Area, the relevant provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States may also process information.

Externally loaded Google Fonts are subject to your consent under Article 6(1)(a) GDPR. Without consent, fallback fonts are used. Fonts served directly from this website do not require a connection to Google’s font servers.

Further information: Google Fonts privacy information and Google’s Privacy Policy.

6. Google Analytics

The website uses Google Analytics 4 to understand which pages are visited and how visitors interact with the website. Google services are connected through Site Kit by Google and the website’s analytics configuration.

The relevant provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC and other authorised service providers outside the EEA.

With your consent, Analytics may process page views, interactions, referral information, visit times, browser and device details, approximate location and pseudonymous identifiers. It may store cookies to recognise a browser and associate activity. Google states that Analytics 4 does not log or store individual IP addresses, although an IP address is used during collection, including to derive approximate location.

The purpose is to evaluate website use and improve its content and operation. The legal basis is Article 6(1)(a) GDPR and, for optional storage or access on your device, Section 25(1) TDDDG.

Analytics collection is enabled only after consent. You can withdraw through Cookie Settings. Event-level and user-level records are deleted according to the retention period configured in the Analytics property. Aggregated reports may be retained separately. Cookie lifetimes are described in the consent information and Cookie Policy.

Further information: Google Analytics privacy information and Google’s Privacy Policy.

7. IONOS website statistics

IONOS provides hosting-related website statistics through WebAnalytics or SiteAnalytics. This can involve requested pages, access times, referring pages, browser or device details and anonymised IP information. IONOS states that its standard WebAnalytics service does not use cookies and anonymises IP addresses directly after transmission.

The purpose is to understand traffic and monitor website operation. To the extent that personal data is processed, the legal basis is Article 6(1)(f) GDPR, reflecting my interest in operating and improving the website. This basis does not cover optional access to information on your device that would independently require consent.

Further information: IONOS information about processing by hosting products.

8. Contact forms and email

If you contact me, I process the information you supply, such as your name, email address, message and any attachments, to respond and manage the enquiry. Contact Form 7 provides the website’s contact form.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns steps towards a contract or performance of a contract. Other enquiries are processed under Article 6(1)(f) GDPR, reflecting my legitimate interest in responding to communications addressed to me.

Providing this information is voluntary. Without an address for a reply and enough information to understand your enquiry, I may be unable to respond. Please do not send sensitive information that is unnecessary for the enquiry.

My email correspondence uses Google services. The relevant provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Messages may also pass through the website’s configured email-delivery service before reaching my mailbox.

Enquiries are retained until they have been answered and any follow-up is complete. Correspondence relevant to a contract, accounting obligation or legal claim may be retained for the applicable statutory period or until the relevant claim can no longer be pursued. Other correspondence is deleted when it is no longer needed for its purpose.

Further information: Google’s Privacy Policy.

9. Spam prevention, security and backups

The website uses technical measures to identify automated or abusive submissions and protect its availability. The installed tools include WP Armour and Antispam Bee. Their involvement depends on the form or comment function being used and the configured checks.

These measures may involve checking submitted fields and technical request information. The legal basis is Article 6(1)(f) GDPR, reflecting my interests in preventing spam, protecting communications and maintaining website security. Additional consent is obtained where a particular feature requires optional storage, device access or an external service for which consent is needed.

Backups may contain website records and personal data stored in them. They are used to restore the website after faults, loss or security incidents. Backup processing is based on Article 6(1)(f) GDPR, reflecting my interest in maintaining service availability and recovering data. Access is restricted to authorised persons and providers. Backup copies are removed through the applicable rotation schedule, except where retention is necessary for an incident or legal obligation. Deleted records may remain in an existing backup until that backup expires and should not be returned to active use without applying the relevant deletion.

10. Links and embedded content

Ordinary links to services such as LinkedIn, Pinterest and Upwork do not by themselves require your browser to load content from those services. If you follow a link, the destination’s own privacy practices apply.

Embedded media, maps, social feeds or other external content can behave differently because loading them may disclose your IP address and technical information to their provider. Optional external content requiring consent is kept blocked until you choose to enable it. The relevant provider and purpose are identified with the content or in the consent settings.

11. Recipients and international transfers

Depending on the activity, recipients may include hosting and infrastructure providers, font providers, analytics services, email providers, authorised maintenance or security providers, professional advisers and public authorities where disclosure is required by law.

Where a provider processes personal data on my behalf, an agreement under Article 28 GDPR is used where required. Not every provider acts exclusively as a processor.

Some providers may process data outside the EEA. Such transfers require an applicable mechanism under Chapter V GDPR, for example an adequacy decision covering the recipient or Standard Contractual Clauses with any supplementary measures needed. Use of a provider does not by itself establish that a particular transfer mechanism applies to every operation.

You can contact me for information about the safeguards applicable to a particular processing activity and how to obtain a copy, subject to legitimate confidentiality restrictions.

12. Your rights

Subject to the relevant legal conditions, you may request access, correction, deletion, restriction of processing and data portability under Articles 15–20 GDPR.

You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Where processing is based on Article 6(1)(f) GDPR, you may object for reasons relating to your particular situation. I will stop that processing unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continuing it. You may object to direct marketing at any time.

Please send requests to me.erofeeva@gmail.com. I may request information reasonably necessary to verify your identity. Requests are handled within the time limits set by the GDPR.

You may complain to a data protection authority, particularly in the EU Member State where you live or work or where the alleged infringement occurred. The Berlin authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. Current contact details are available at datenschutz-berlin.de.

13. Children

This is a professional portfolio and is not directed specifically at children. I do not knowingly seek personal data from children for marketing.

Where Article 8 GDPR applies to a service offered directly to a child and processing relies on the child’s consent, the applicable parental-authorisation requirements must be met. In Germany, the relevant age threshold under that provision is 16. This is not a general prohibition on all processing of information concerning anyone under 16.

A parent or guardian who believes that information has been collected without legally required authorisation can contact me. I will investigate and restrict or delete the data where required. Technical information needed to deliver and secure the website may still be processed when a child visits.

14. Automated decisions and security

I do not use solely automated decisions that produce legal or similarly significant effects concerning visitors within Article 22 GDPR.

Technical and organisational measures are used to protect personal data against unauthorised access, disclosure, alteration and loss. No internet service can guarantee complete security.

15. Changes

This policy is updated when the website’s processing or relevant requirements change. The date at the top identifies the current text.

Privacy Policy