Privacy Policy

Last updated: 7 November 2026. This privacy policy explains which personal data we process when you visit dogan-ucar.de, use its forms or buy the book, for what purpose, on which legal basis and for how long. Deutsche Fassung. If the two versions differ, the German version prevails.

1. Controller

Ucar Solutions UG (haftungsbeschränkt)
represented by its managing director Doğan Uçar
Feldstraße 1, 65719 Hofheim am Taunus, Germany
Email: info@ucar-solutions.de
Phone: +49 6192 98 99 814

We have not appointed a data protection officer because the legal requirements for doing so are not met. For any privacy question, contact us using the details above.

2. Overview

• Visiting the site: technically required server logs (section 3).
• Cookies: one necessary cookie for your cookie choice, a session cookie on pages with form protection, Google Analytics only with your consent (sections 4 and 5).
• Contact and callback: the details you enter in the contact form or send by email (section 6).
• Downloads and checklists: your email address to send documents you request (section 7).
• Buying the book: your email address and order data, payment via Mollie (section 8).

We do not sell data, do not use advertising or retargeting services, do not embed social media content and do not send newsletters. Links to GitHub, LinkedIn or Medium are plain links; no data is transferred until you click them.

3. Hosting, server logs and email delivery

The site is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO provides the servers and sends the emails triggered by the site (for example confirmations and download links). We have a data processing agreement with STRATO under Art. 28 GDPR. Data is processed in data centres in Germany.

With every request the web server automatically logs: IP address, date and time, requested address, HTTP status code, amount of data transferred, the previously visited page (referrer) and your browser identifier (user agent). The IP address is personal data, so these logs are not anonymous.

• Purpose: delivering the site, stability, detecting and preventing attacks and abuse.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).
• Retention: logs are deleted automatically after 14 days. Individual entries are only kept longer if needed to investigate a specific security incident, and only until it is resolved.

The connection to the site is encrypted with TLS.

4. Cookies and consent management

On your first visit we ask whether you allow analytics cookies. “Accept all” and “Reject all” are presented equally. You can change or withdraw your choice at any time via “Cookies” in the footer of every page.

Name	Purpose	Type	Duration
cc_cookie	Stores your cookie choice so we do not ask again on every visit.	necessary	182 days
PHPSESSID	Session cookie that protects forms against forged requests (CSRF). Only set on pages with such a form, currently the book page and the AI Code Review page.	necessary	until you close the browser
_ga, _ga_<ID>	Google Analytics: distinguishes visitors by a random identifier (client ID) and stores the session state.	analytics, consent only	up to 2 years; many browsers cap this at 400 days

Necessary cookies are set under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); the related processing is based on Art. 6(1)(f) GDPR. Analytics cookies are only set with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR.

5. Google Analytics 4 (consent only)

If you consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent the Google script is not loaded and no data is sent to Google.

• Data processed: pages viewed, time on page, scroll depth, traffic source, approximate location (country, region), device and browser information and the pseudonymous client ID from the _ga cookie. Google Analytics 4 does not store full IP addresses. The data is pseudonymous, not anonymous: the client ID makes repeat visits from the same browser recognisable.
• Purpose: understanding which content is used in order to improve the site.
• Legal basis: your consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG.
• Retention: user-level event data is deleted in Google Analytics after 2 months. For cookie durations see section 4.
• Recipients and transfers outside the EU: Google processes the data as our processor. Transfers to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; transfers are covered by the European Commission's adequacy decision of 10 July 2023. In addition, the European Commission's standard contractual clauses apply as part of Google's data processing terms; we provide a copy on request.
• Withdrawal: via “Cookies” in the footer. After withdrawal the analytics cookies are deleted and the page reloads so that no further data is sent to Google.

6. Contact form, callback requests and email contact

In the contact form we process: topic, name, company (optional), phone number, email address, description (optional) and the requested callback day and time window. Name, phone number and email address are required: we need the phone number for the callback you request, and the email address for the confirmation and for follow-up questions if we cannot reach you by phone. Without them we cannot handle the request. If you contact us directly by email or phone, we process the data you share with us.

• Purpose: handling your request, the agreed callback and, where applicable, preparing an offer or contract.
• Legal basis: Art. 6(1)(b) GDPR where your request aims at a contract (for example a project or callback request). For other requests Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries. We do not ask for consent for the contact form.
• Recipients: STRATO as hosting and email provider (section 3). You receive a confirmation at your email address.
• Retention: if no business relationship results, we delete the data no later than 12 months after the last contact. If a contract is concluded, business correspondence is kept for the statutory retention periods (§ 257 HGB, § 147 AO; currently up to 6 years for business letters and up to 8 years for accounting records).

Spam protection: our forms use ALTCHA, a small computation your browser solves in the background (proof of work). We run ALTCHA ourselves: the script is loaded from our server, and the challenge is created and verified by our server. No data is passed to third parties and no cookies are set. We also limit the number of form submissions per IP address; a counter linked to your IP address is cached on our server for 15 minutes and then discarded (Art. 6(1)(f) GDPR, preventing abuse).

7. Downloads, checklists and results by email

On some pages you can request documents by email: the PHP security checklist, the Claude Code cheat sheet and the guide “5 Steps to Clean AI Code”. On the legacy migration checklist pages you can have the result of your self-assessment sent to you by email.

• Data processed: your email address, the requested document, date and time. For the migration checklist also the items you left unchecked and the page language.
• Purpose: sending the requested document or your result once. We receive a notification of the request, for the migration checklist including your result, so we can offer help if needed.
• Legal basis: Art. 6(1)(b) GDPR (fulfilling your request). The notification to us is based on Art. 6(1)(f) GDPR.
• No marketing: we do not add you to a newsletter and do not send you marketing emails.
• Retention: 12 months from the request, then deleted automatically.

8. Buying the book “Almost Generics in PHP” (PDF)

When you buy the PDF directly, you enter your email address and are redirected to our payment provider.

• Data we process: email address, the payment provider's order ID, payment status, price and currency, a random download key, the times of the order, the email and the download, and your consent to immediate delivery (see the cancellation policy).
• Payment provider: payments are handled by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. You enter your payment details (for example card or account details) directly with Mollie; we do not receive them. Mollie processes this data as an independent controller, among other things to meet legal obligations (for example anti-money-laundering rules). Mollie's privacy policy applies: mollie.com/en/privacy.
• Purpose: performing the purchase contract, sending the download link, invoicing and accounting.
• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial retention obligations).
• Retention: order and invoice data are kept for the statutory retention periods (currently up to 8 years for accounting records under § 147 AO and § 257 HGB). Orders that were never completed are deleted after 12 months.

On the book page we randomly show one of two text variants (A/B test). We only count which variant was shown; no personal data is stored for this.

9. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawing consent with effect for the future (Art. 7(3) GDPR), for example via “Cookies” in the footer

Right to object (Art. 21 GDPR): where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an email to info@ucar-solutions.de is enough.

Right to lodge a complaint: you can complain to a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

10. Other

We do not use automated decision-making, including profiling, under Art. 22 GDPR. We update this privacy policy when the site or the services we use change; the version published here applies.