Privacy Policy

This website, patrickheen.com, is a personal portfolio operated by Patrick Guldager Heen, based in Copenhagen, Denmark. I am the data controller for any personal data processed through the site, and I can be reached at patrick.heen@gmail.com.

This site does not have a contact form, a login, a newsletter, a comment section, a shopping function or a database of visitors. It carries no advertising, it does not build a profile of you, and it does not share anything about you with anyone for marketing purposes. It does use a privacy-focused analytics measurement, described below, which counts page views without cookies and without identifying you.

Server and security logs. The site is hosted on Cloudflare, and in order to deliver the pages to you and to protect the site from attacks and automated abuse, Cloudflare processes technical data on my behalf, including your IP address, the date and time of the request, which page was requested, your browser type and operating system, and the referring page if there is one.

The legal basis for this is my legitimate interest under Article 6(1)(f) of the GDPR in operating a functioning and secure website. Cloudflare acts as a data processor for me.

Website analytics. I use Cloudflare Web Analytics in order to see roughly how many people visit the site, which pages they open and how quickly those pages load. It is enabled through my Cloudflare account and served by Cloudflare rather than installed in the site's own code. It records the page address, the referring page if there is one, the country the request came from, the browser, operating system and device type, and timings describing how long a page took to render.

Cloudflare Web Analytics sets no cookies, does not use fingerprinting, stores nothing on your device and does not follow you across other websites. The measurements are aggregated, and neither Cloudflare nor I can use them to identify you or to single you out. The legal basis is again my legitimate interest under Article 6(1)(f) of the GDPR, in this case in understanding whether the site works and whether anyone is reading it, and you can object to this processing as described under Your rights.

Email. If you email me, I process whatever you choose to send, in order to reply to you. The legal basis is my legitimate interest in responding to enquiries, and for recruitment enquiries, taking steps at your request prior to a possible employment relationship.

This site sets no cookies of its own, and the analytics described above sets none either.

Cloudflare may set strictly necessary cookies in order to keep the site secure and working, most commonly __cf_bm, which is used to distinguish genuine visitors from automated bots and which expires after roughly 30 minutes of inactivity. Depending on how the security settings are configured, cf_clearance or __cfruid may also appear. These cookies exist for technical and security purposes, they do not track you between websites, and Cloudflare encrypts their contents.

Because these cookies are strictly necessary, they are exempt from the consent requirement under the ePrivacy rules and the Danish Executive Order on cookies, which is why this site shows no cookie banner. You can still block or delete cookies through your browser settings, though parts of the site may then behave unpredictably.

Cloudflare is a United States company, and by default some of the technical data described above, including log data, analytics measurements and cookie data, may be processed in Cloudflare's data centres in the United States. Cloudflare provides safeguards for these transfers, including the European Commission's Standard Contractual Clauses. Further detail is available in Cloudflare's own privacy policy at cloudflare.com/privacypolicy.

I do not keep server logs myself. Cloudflare retains technical log data for a limited period as part of its own service, in line with its retention practices.

Analytics measurements are aggregated and are retained by Cloudflare for a limited period as part of that service.

Emails are kept for as long as is useful for the correspondence and for any resulting professional relationship, and are deleted when they are no longer relevant.

The projects described on this site were largely carried out in teams and with external clients and research participants.

Research participants are anonymised, and no interview participant is named or made identifiable. No personal data collected during any research project is published here. Where a project was carried out with other people, their contributions are described rather than claimed, and where work is subject to confidentiality it is described in general terms only.

If you appear in a photograph on this site and would like it removed, email me and I will remove it without asking for a reason.

Under the GDPR you have the right to request access to the personal data I hold about you, to have it corrected or deleted, to have its processing restricted, to object to processing based on legitimate interest, and to receive it in a portable format where that applies.

Given how little this site processes, the practical answer to most access requests is that I hold nothing beyond any email you have sent me, however you are welcome to ask.

If you believe your data is being handled incorrectly, you can complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.

The projects, text, photographs, drawings, models and code presented on this site are my own work or the work of the teams I name, and may not be reproduced for commercial purposes without permission. You are welcome to reference or link to it.

Company, institution and product names and any associated marks belong to their respective owners and are used here only in order to describe work I have taken part in. Their appearance does not imply any endorsement of me or of this site by those organisations, nor any ongoing affiliation.

I may update this policy if the site changes. The date at the top shows when it was last revised.