Privacy Policy
Last updated: 21 September 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
diedrich designcritic
Prof. Dr. Lisa Diedrich
Markgrafenstrasse 88
DE-10969 Berlin
Germany
Telephone: +49 30 259 321 10
Email: lisa@diedrich-designcritic.com
2. Scope of this Privacy Policy
This Privacy Policy explains how personal data are processed when you visit this website, download a document, use the site search, change your cookie preferences, or contact us by email or telephone.
The website is an informational professional website. It does not currently provide user registration, user accounts, public comments, online purchases, newsletters, or a web-based contact form.
3. Hosting and Server Log Files
When you access the website, the web server and hosting infrastructure process technical request data required to deliver the requested page and maintain the security and stability of the service. These data may include:
- IP address;
- date and time of the request;
- requested page or file;
- referrer URL, where transmitted by your browser;
- browser type, browser version and operating system;
- HTTP status code;
- amount of data transferred; and
- technical error and security information.
The purpose of this processing is to provide the website, detect and investigate technical faults or misuse, defend against attacks, and maintain the confidentiality, integrity and availability of the service.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the reliable and secure operation of the website and the protection of our systems and content. Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR also applies.
Log data are retained only for as long as they are required for website operation and security. They are then deleted or anonymised unless continued retention is necessary to investigate a specific security incident, establish or defend legal claims, or comply with a statutory obligation.
The hosting provider and technical service providers may process these data on our behalf and under our instructions where this is necessary to operate and maintain the website.
4. Contact by Email or Telephone
The website provides an email link and telephone number. If you contact us, we process the information you provide, such as your name, contact details, the content of your message, and related communication metadata, in order to respond to your enquiry.
If your enquiry concerns a possible contract, a project, or services, the legal basis is Article 6(1)(b) GDPR. For general professional correspondence, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to communicate with interested persons, professional partners, institutions and members of the public. Article 6(1)(c) GDPR applies where retention or processing is required by law.
Correspondence is deleted when the enquiry has been conclusively dealt with and no further retention is required. Business and legally relevant correspondence may be retained for the applicable statutory retention period or for the establishment, exercise or defence of legal claims.
Please note that ordinary email is not necessarily encrypted end to end. Do not send confidential or special-category personal data by unencrypted email unless this is necessary and you accept the associated risk.
5. WordPress, Divi and Website Security
The website is operated with WordPress and Divi. These systems process technical data as necessary to generate and deliver pages, manage content, maintain sessions for authorised administrators, and protect the website against unauthorised access.
Security components, including the installed WordPress security functionality, may process IP addresses, request data, login attempts and technical event data in order to identify and prevent attacks or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the protection of the website, our systems and website visitors.
Administrative cookies are relevant only to authorised persons who log in to the WordPress administration area. The public website does not offer visitor accounts or public login functionality.
6. Cookies and Consent Management
The website uses Complianz as its consent-management tool. Complianz stores technically necessary information in your browser in order to remember whether the cookie banner has been displayed, which policy version applies, and which consent choices you have made. Depending on the configuration and your choices, these storage entries may include Complianz consent cookies such as cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_policy_id, cmplz_consented_services and cmplz_banner-status.
These consent settings are used solely to store and respect your privacy choices. They are not used to create an advertising profile. Complianz consent cookies are generally stored for up to 365 days unless you delete them earlier or the configuration is changed.
Storage that is strictly necessary to provide the website or a function expressly requested by you is used on the basis of Section 25(2) TDDDG. Any non-essential storage or access to information on your device requires your consent under Section 25(1) TDDDG. Where personal data are processed on the basis of consent, the legal basis is Article 6(1)(a) GDPR.
You may withdraw or change your consent at any time using the “Cookie Settings” control on the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can also delete cookies through your browser settings.
The website does not currently use analytics cookies, advertising cookies or cross-site behavioural tracking. If such technology is added in the future, it will not be activated before the required consent has been obtained, and this Privacy Policy and the Cookie Policy will be updated accordingly.
7. Fonts
The website uses the typeface Open Sans and Divi interface icons. In the current configuration, font and icon files are provided locally by the website or through fonts available on your device. The website does not contact Google Fonts servers to deliver fonts.
The legal basis for delivering local website assets is Article 6(1)(f) GDPR. Our legitimate interest is a consistent, efficient and readable presentation of the website.
8. External Links and Media Platforms
The website contains links to third-party websites and services, including universities, publishers, professional organisations, YouTube, Spotify and Apple Podcasts. These are ordinary external links. The current website does not automatically embed or load videos, maps, social-media feeds or podcast players from those providers.
No connection to the external provider is established merely because the link is displayed on this website. If you click an external link, you leave our website. The destination provider may then receive technical data such as your IP address, browser information, date and time, and the referring page, and may process further data under its own privacy policy. We do not control the processing carried out by those independent providers.
9. Downloads
The website provides documents for download, including a PDF curriculum vitae. When you request a download, the request is processed in the same way as any other web request and may be recorded in server logs as described in Section 3. We do not use document downloads to build visitor profiles.
10. Site Search
Where a site-search field is available and you use it, the search term you enter is transmitted to the website and processed in order to return matching results. The search request may also appear in server logs.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide a useful search function and improve access to the website's content. Search terms are not used for advertising profiles.
11. Recipients and Service Providers
Personal data are disclosed only where this is necessary for the purposes described in this Privacy Policy, where you have consented, or where disclosure is required by law. Categories of recipients may include:
- hosting and infrastructure providers;
- website maintenance, IT and security service providers;
- professional advisers where necessary to establish, exercise or defend legal claims; and
- public authorities where disclosure is required by law.
Service providers acting on our behalf may process personal data only in accordance with our instructions and applicable data-protection requirements. We do not sell personal data.
12. International Data Transfers
The website itself does not currently load active third-party analytics, advertising, video, map or social-media services that would automatically transfer visitor data to a country outside the European Economic Area.
When you choose to follow an external link, the destination provider is responsible for its own processing and any international transfer. Where a service provider acting on our behalf processes personal data outside the European Economic Area, we use the safeguards required by Chapter V GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses, where applicable.
13. Retention
Unless a more specific period is stated in this Privacy Policy, personal data are retained only for as long as necessary for the purpose for which they were collected. Data may be retained for a longer period where this is required by statutory retention obligations or necessary for the establishment, exercise or defence of legal claims. Once the relevant purpose and any mandatory retention period have ended, the data are deleted or anonymised.
14. Your Rights
Subject to the conditions of the GDPR, you have the right to:
- obtain information about and access to your personal data (Article 15 GDPR);
- have inaccurate data corrected and incomplete data completed (Article 16 GDPR);
- request erasure of your personal data (Article 17 GDPR);
- request restriction of processing (Article 18 GDPR);
- receive personal data you have provided in a structured, commonly used and machine-readable format where the requirements for data portability are met (Article 20 GDPR);
- object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR); and
- withdraw consent at any time with effect for the future (Article 7(3) GDPR).
You also have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority responsible for organisations established in Berlin is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de/
To exercise your rights, please contact us using the details provided in Section 1. We may need to request information necessary to verify your identity before responding.
15. Automated Decision-Making
We do not use personal data collected through this website for automated decision-making or profiling within the meaning of Article 22 GDPR.
16. Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These measures are reviewed and adjusted where necessary, taking account of the state of the art, implementation costs, and the nature and risks of the processing.
Internet transmission can never be guaranteed to be completely secure. If you need to send particularly sensitive information, please contact us first to agree on an appropriate transmission method.
17. Changes to this Privacy Policy
We may update this Privacy Policy when the website, its services, the legal requirements, or our data-processing activities change. The current version is published on this website and identified by the “Last updated” date above.