Privacy notice

1. Controller and contact

Shora Shirzad is responsible for the processing described here. You can contact him about privacy or exercise your rights using the postal or email address below.

Shora Shirzad - Projects & Portfolio

c/o Autorenglück #36937

Albert-Einstein-Str. 47

02977 Hoyerswerda

Germany

2. Website access and hosting

The website is hosted by Hostinger. When you visit it, technical connection and request data such as your IP address, time, requested resource, browser information and response status are processed to deliver the site, maintain its reliability and protect it from abuse. The basis is Article 6(1)(f) GDPR: our interest in operating a secure and reliable website.

Hostinger may process technical data and keep server logs, including through its service providers. Its privacy information describes the provider’s processing and retention.

Hostinger privacy policy

3. Contact messages and delivery

If you use the contact form, we process your name, email address, optional company, message and privacy confirmation to handle and respond to your inquiry. The required fields are necessary for submission and a useful response. Please do not send passwords or unnecessary sensitive information.

For inquiries about possible cooperation, the basis is Article 6(1)(b) GDPR: pre-contractual steps at your request. For other professional inquiries, the basis is Article 6(1)(f) GDPR: our interest in answering relevant correspondence. The confirmation checkbox does not authorize unrelated marketing.

Messages are sent through an encrypted Hostinger SMTP connection to contact@shorashirzad.com, a mailbox hosted by Hostinger. Your address is used as Reply-To. The operator and Hostinger process the information needed to deliver and answer the message. Email is not end-to-end encrypted.

4. Cloudflare Turnstile

Cloudflare Turnstile protects the contact form against automated spam. Loading the widget establishes a connection to Cloudflare, Inc.; technical connection, browser/device and interaction signals may be processed. Our server verifies the challenge token with Cloudflare before accepting a message. Message fields are not sent to Siteverify.

The basis for this abuse prevention is Article 6(1)(f) GDPR. According to its Turnstile privacy addendum, Cloudflare processes signals on our behalf to protect this website and separately as a controller to improve its bot detection. If you cannot use the widget, you can contact us directly by email.

5. Security and retention

The application limits form submissions using a short-lived HMAC identifier derived from an available request IP address, or a shared fallback. It does not keep the raw IP address in the rate-limit bucket. Counters have a 15-minute validity window and are removed on a later limiter request, eviction or server restart. Hosting logs are separate.

The contact API does not store messages in an application database or intentionally log message bodies or email addresses. We review correspondence monthly and delete ordinary inquiries from receiving and sent mailboxes, forwards and local copies no later than one month after the inquiry has been handled. If a particular message is needed for an applicable legal retention duty, an agreement or a legal claim, we keep only the necessary record for the applicable period and review the exception separately. You may request erasure using the contact details above. Provider backups and logs may have different retention periods under their policies.

6. Other services and international processing

If you choose “Accept analytics” in the privacy prompt, this website loads Contentsquare Experience Analytics. The tag can set first-party cookies such as _cs_id (13 months), _cs_s (30 minutes), _cs_c (13 months) and, after an opt-out, _cs_optout (13 months). The consent choice itself is stored locally in your browser so the prompt is not shown on every visit. No contact-form values, identity data or custom user properties are sent to Contentsquare; the form is explicitly marked for masking.

The analytics processing is based on your consent under Article 6(1)(a) GDPR. Contentsquare may process data internationally. Its current DPA provides for adequacy decisions or Standard Contractual Clauses for transfers to countries without an adequacy decision; current locations, subprocessors and platform retention are described in the linked provider documents and can change. You can withdraw consent at any time through “Privacy settings”.

Fonts and 3D assets are served from this website. The interactive career presentation runs in the browser without camera, microphone or location access. LinkedIn opens only if you select a link; no LinkedIn feed is embedded. Hostinger and Cloudflare may also involve processing outside the EU/EEA as described above.

7. Your rights

Subject to the applicable requirements, you may request access, correction, erasure, restriction or portability of your data. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may lodge a complaint with a data protection authority, including in the country of your habitual residence, workplace or the alleged infringement.

Please use the contact details above to make a request. We may need to verify your identity before disclosing personal data. We do not make solely automated decisions with legal or similarly significant effects.

GDPR: official text