A portfolio site with no accounts, no sign-up and no advertising. This page states what is processed anyway, on what legal basis, and how to have it removed.
§ 5 DDG · Art. 4 (7) GDPR
Responsible for the content of this site and for the data processing described below:
Meili WyssNo data protection officer is appointed; the thresholds in § 38 BDSG are not met. Content responsibility under § 18 (2) MStV rests with the same address.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, timestamp, requested file, referrer, user agent | Delivering the pages and keeping the server secure and stable | Art. 6 (1) (f): legitimate interest in an operable site | About 30 days at the host, then deleted |
| Google Analytics 4: cookie ID, IP address (shortened by Google), pages viewed, device, approximate region, referring source | Understanding which pages and case studies get read, in aggregate | Art. 6 (1) (a): your consent, § 25 (1) TDDDG for the cookie. Withdrawable any time, with no effect on past processing. | Event data 14 months, then deleted by Google |
| Google Search Console: search queries, impressions, clicks and positions for this domain | Seeing how the site performs in Google Search | Art. 6 (1) (f). Google aggregates this from its own search data before I see it; it sets nothing in your browser. | 16 months rolling, held by Google |
| Your name, email address and message content | Answering an enquiry you sent by email | Art. 6 (1) (b) and (f): pre-contractual contact | Until the enquiry is settled; deleted on request |
| Local browser storage | Remembering your analytics choice | Technically necessary, § 25 (2) TDDDG, no consent needed | Stays in your browser; clear it any time |
Google signals are off, ads features are off, data sharing with Google products for advertising is off, and IP anonymisation is on. No advertising pixels, no cross-site profiling and no automated decision-making under Art. 22 GDPR.
Data from the work shown in the case studies is never processed here. The GA4 and Search Console properties behind those case studies belong to the companies the work was done for and stay in their accounts. The figures published on this site are aggregates, with no personal data in them.
Under Art. 15 to 21 GDPR you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Consent for analytics can be withdrawn at any time.
One email to hello@meiliwyss.com is enough. No form, no identity documents. I answer within a month, usually the same week.
You can also complain to a supervisory authority, without going through me first. The competent one for Munich is:
Bayerisches Landesamt für DatenschutzaufsichtText, charts and structure are mine. Screenshots of Google Search Console, Google Analytics, Ahrefs and the websites I worked on are shown as evidence for the figures beside them; the rights in those interfaces stay with their owners.
If you represent a company named here and want a figure, capture or name removed, write to me and it comes down.
Version 2 · 15 September 2026 · This notice is updated whenever the processing above changes.