Ibi MalikThe world through my eyes

Privacy policy

How this site handles your data — the privacy policy for ibimalik.com.

Last updated 12 September 2026.

The short version. This site sets no cookies, runs no analytics and has no forms, accounts or payments. Nothing is requested from another company until you press play on a video. If you appear in the photographs or on the podcast, the section headed People who appear in the work is the part that concerns you.

Who we are #

This website, https://www.ibimalik.com, is published by Earthas DNCS OÜ, a private limited company registered in Estonia under company number 17406676, registered office Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Harju maakond. Earthas DNCS OÜ trades as Ibi Malik.

In this policy, “we” and “us” mean Earthas DNCS OÜ. “You” means anyone reading the site, writing to us, or appearing in what we publish.

For the purposes of the General Data Protection Regulation (EU) 2016/679 and Estonian data protection law, Earthas DNCS OÜ is the data controller.

This policy sits alongside our terms of use. If you have recorded a podcast episode with us, the podcast guest release applies as well.

What this policy covers #

Two different things, and it is worth separating them:

  • Reading the site. What is recorded when you visit, which is very little.
  • Appearing in the work. What we publish about the people in the photographs and on the podcast, which is the substantial part.

Most privacy policies only address the first. On a site that is an archive of real people, the second matters more.

Visiting the site #

The site is a set of static files hosted by Cloudflare Pages. There is no database, no login, no shopping cart and no form to fill in.

Like any web host, Cloudflare records each request in its server logs: your IP address, the page requested, the time, and the browser and operating system your device reports. This happens for every website you visit and is necessary to deliver pages and to defend against attack and abuse. The lawful basis is our legitimate interests in running a secure, working website (Article 6(1)(f) GDPR).

Those logs belong to Cloudflare and are held under Cloudflare’s own retention policy, which you can read at https://www.cloudflare.com/privacypolicy/. We do not download them, and we hold no per-visitor record of our own. Cloudflare’s dashboard shows us aggregate figures — how many requests a page received — which do not identify anyone.

No cookies, no analytics, no tracking #

  • The site sets no cookies. There is no consent banner because there is nothing to consent to.
  • We run no analytics — no Google Analytics, no Plausible, no Fathom, no tracking pixel of any kind.
  • There is no advertising and no retargeting. We do not build profiles, and we do not sell, rent or share personal data with anyone for marketing.
  • The typeface is self-hosted from our own server, so no request goes to Google Fonts or any other font service.
  • Photographs, video clips and handpan recordings are served from our own domain.

The episode player and embedded players #

Each podcast episode page shows a locally hosted still image and a play button. Nothing is requested from YouTube until you press play. When you do, the player loads from youtube-nocookie.com and, from that moment, Google receives your IP address and can process data about your viewing under its own privacy policy, at https://policies.google.com/privacy. If you never press play, no request reaches Google.

Video clips and handpan recordings inside a monthly capsule are served from our own domain with preload="none", so the file is only fetched once you press play.

Where a monthly capsule embeds a music player from Spotify or SoundCloud, that player loads with the page, and those companies receive your IP address and may set their own cookies. We will say so on any page where such an embed appears.

Links to Spotify, Apple Podcasts and YouTube on the episode pages are ordinary links. Following one takes you to that company, under its own terms.

If you write to us #

The site publishes an email address. If you contact us, we hold your message and your address for as long as needed to deal with what you wrote about, and to keep a sensible record of correspondence afterwards. The lawful basis is our legitimate interests in answering people who get in touch (Article 6(1)(f) GDPR), or taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) where that is what your message is about.

Email travels through our mail provider, under its own privacy policy. We do not add anyone to a mailing list. There is no newsletter.

People who appear in the work #

This site is a personal archive. It publishes photographs of real people, written accounts of time spent with them, and recorded conversations. If you are one of those people, this section is for you.

What we publish. Depending on how you appear, this may include your photograph, your first name or full name, a description of a place and time you were present, and — for podcast guests — your recorded voice and likeness, your professional background, and whatever you chose to talk about. Podcast guests' Instagram handles, websites and LinkedIn pages are published where the guest has given them. For people who appear only in photographs, social handles are held privately for tagging on Instagram and are not published on this site.

Our lawful basis. We rely on our legitimate interests in publishing a personal, documentary and artistic archive (Article 6(1)(f) GDPR), together with the provisions reconciling data protection with freedom of expression under Article 85 GDPR as implemented in Estonian law. For podcast guests, the guest release also forms a contract between us (Article 6(1)(b) GDPR).

Sensitive topics. Podcast guests sometimes speak about health, beliefs or other special-category matters. Where that happens, we rely on Article 9(2)(e) GDPR: the information was manifestly made public by the person themselves, in a recording they agreed to. We do not seek out such information, and we will remove it on request before publication.

How long it stays up. The archive is intended to be permanent. That is the point of it. Published material stays online indefinitely unless it is removed under the paragraph below.

Asking us to change or remove something. Write to ibraheem@malik5.com and tell us what you would like changed or taken down. We take these requests seriously and answer every one. We will always remove material where the law requires it — including where you object under Article 21 GDPR and we have no overriding legitimate ground to continue, or where you exercise your right to erasure. Where the law does not require removal, we will still weigh your request against the integrity of the archive and tell you what we have decided and why.

Two practical points. Removing something from this site does not remove it from platforms outside our control — a podcast episode also lives on YouTube, Spotify, Apple Podcasts and RSS.com, and we will ask those platforms to take it down but cannot guarantee their response or the removal of copies others have made. And search engines keep their own caches, which take time to clear.

Who else handles data #

  • Cloudflare — hosting and delivery of the site, and its server logs.
  • RSS.com — hosting and distribution of the podcast audio feed.
  • YouTube (Google), Spotify, Apple Podcasts — where the podcast is also published. Each is a separate controller for what it does with your data on its own service.
  • Our email and messaging providers — for correspondence.

We do not otherwise share personal data. There are no advertisers, no data brokers, and no payment processors, because there is nothing to pay for.

Some of these companies are outside the European Economic Area. Where personal data reaches them, transfers are made under the safeguards in Chapter V GDPR, generally the European Commission’s standard contractual clauses or an adequacy decision.

Keeping data secure #

The site is served only over HTTPS. It holds no accounts and no database, so there are no passwords or stored customer records to lose. Correspondence and the working files behind the archive are held on access-controlled, encrypted storage. If you believe data has been lost or accessed without authorisation, please tell us at once at ibraheem@malik5.com.

Your rights #

Under the GDPR you have the right to ask us to:

  • give you access to the personal data we hold about you, and a copy of it;
  • correct it if it is wrong or incomplete;
  • erase it;
  • restrict how we use it;
  • transfer it to you or another controller in a portable form; and
  • stop using it, by objecting to processing carried out on the basis of legitimate interests.

These rights are not absolute, and some are qualified where the processing is for journalistic, artistic or literary expression. We will tell you plainly if we cannot do what you have asked, and why.

To exercise any of them, write to ibraheem@malik5.com. We do not charge for this, and we aim to reply within one month.

Complaints #

If you are unhappy with how we have handled your data or your request, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, at https://www.aki.ee/en. You may also complain to the supervisory authority in the EU country where you live.

The site links to other websites — guests’ own pages, the platforms the podcast appears on, and places written about in a capsule. We do not control those sites and are not responsible for them. Their privacy policies, not this one, govern what they do.

Changes of ownership #

If the business or part of it is ever sold or transferred, personal data relevant to the transferred part may pass to the new owner, who would be bound by this policy until it told you otherwise. We would take steps to protect your privacy in any such transfer.

Changes to this policy #

We update this policy when what the site does changes, or when the law does. The date at the top is when it last changed. Material changes will be described here rather than made quietly.

Governing law #

This policy is governed by the law of Estonia and of the European Union, and disputes arising under it are subject to the jurisdiction of the Estonian courts. This does not affect your right to complain to a supervisory authority or to bring a claim where you live.

Contact #

Earthas DNCS OÜ, Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Estonia. Email ibraheem@malik5.com.