Privacy Policy

1. Overview

Personal data is any data that can personally identify you.

This website is operated by:

This person is the “controller” within the meaning of the EU General Data Protection Regulation, GDPR.

2. Hosting and Server Log Files

This website is hosted by SiteGround Spain S.L. / SiteGround Hosting Ltd. (“SiteGround”), with data centers located in the European Union. When you visit this website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically.

These include: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and IP address.

This data is not merged with other data sources. It is collected on the basis of Art. 6 (1)(f) GDPR: the legitimate interest in the technically error-free presentation and optimization of this website, and in its security.

3. Contact Form and Email Contact

If you send me an inquiry via the contact form or by email, the information you provide, including name, email address, and the content of your message, will be stored by me for the purpose of processing your inquiry and in case of follow-up questions. I do not share this data without your consent.

The processing of this data is based on Art. 6 (1)(b) GDPR, if your request is related to the performance of a contract or pre-contractual measures, and otherwise on Art. 6 (1)(f) GDPR: my legitimate interest in the effective handling of inquiries addressed to me.

Your data will be deleted once your inquiry has been conclusively processed, unless statutory retention obligations apply.

4. Newsletter (Substack)

My newsletter, The Green Lights Letter, is delivered via the platform Substack, operated by Substack Inc., 111 Sutter Street, San Francisco, CA 94104, USA. If you subscribe, your email address is transmitted to and stored by Substack for the purpose of sending you the newsletter.

Subscription is based on your consent, Art. 6 (1)(a) GDPR. You can withdraw your consent at any time by clicking the unsubscribe link contained in every newsletter.

Please note that data is processed in the United States. Substack's privacy policy is available at: https://substack.com/privacy

5. Sale of Digital Products (Gumroad)

The PDF edition of my book is sold via Gumroad, operated by Gumroad, Inc., USA, which acts as the merchant of record. If you purchase through the Gumroad checkout, your order and payment data, such as name, email address, and payment information, are processed directly by Gumroad and its payment service providers.

I receive only the information necessary to fulfill the purchase, such as your email address for delivery of the file.

This processing is necessary for the performance of a contract, Art. 6 (1)(b) GDPR. Gumroad's privacy policy is available at: https://gumroad.com/privacy

6. Embedded Content: YouTube and Spotify

This website embeds videos from YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and audio content from Spotify, Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.

When you open a page containing embedded content, a connection to the servers of the respective provider is established. The provider receives the information that you have visited this website with your IP address, and may set cookies or collect further usage data, particularly if you are logged into your YouTube/Google or Spotify account.

This embedding serves the appealing presentation of my content and is based on Art. 6 (1)(f) GDPR, legitimate interest.

Further information: Google/YouTube privacy policy · Spotify privacy policy

7. Cookies

This website itself only uses cookies that are technically necessary for its operation. Embedded third-party content may set its own cookies.

You can configure your browser to inform you about the setting of cookies, to allow cookies only in individual cases, or to exclude them generally. Please note that deactivating cookies may limit the functionality of this website.

8. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to me. You can recognize an encrypted connection by the “https://” prefix and the lock symbol in your browser line.

9. Your Rights

You have the following rights regarding your personal data at any time:

• Right of access (Art. 15 GDPR) — to obtain information about the personal data I process about you
• Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected
• Right to erasure (Art. 17 GDPR) — to have your data deleted
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise any of these rights, simply contact me at: cris@crisroata.com

You also have the right to lodge a complaint with a supervisory authority. The competent authority for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW): https://www.ldi.nrw.de

10. Updates to this Privacy Policy

I may update this privacy policy from time to time to reflect changes to the website or legal requirements. The current version is always available on this page.

Last updated: July 2026