Privacy Policy

01Who is responsible

The party responsible for processing personal data on this website (the “controller” under the EU General Data Protection Regulation, GDPR) is:

If you have any questions about this policy or about your data, you can contact us at any time using the details above.

02Overview

We take the protection of your personal data seriously. This page explains what data is collected when you visit this website, why, on what legal basis, and what rights you have.

Personal data is any information that can identify you personally, such as your name, email address or IP address. We only process it where the law allows it, and only as much as needed.

Data is transmitted over an encrypted connection (SSL/TLS). You can recognise this by the padlock and “https://” in your browser’s address bar.

03Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When you visit the site, the server automatically records technical information your browser sends, in so-called server log files:

• your IP address
• date and time of the request
• the page or file requested, and the website you came from (referrer)
• browser type and version, and operating system

This data is needed to deliver the website to you and to keep it secure and stable. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). We have a data processing agreement with Hostinger as required by Art. 28 GDPR.

04Contacting us

By email or phone. If you email or call us, we process the details you give us (for example your name, email address, phone number and message) to answer your enquiry.

Contact form. If you use the form on our Contact page, the details you enter (name, email address and message) are sent to us via the form service Web3Forms (web3forms.com), which forwards them to our email inbox. Web3Forms processes this data on our behalf only to deliver your message.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a booking or contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We keep your enquiry until it has been dealt with, unless we must keep it longer for legal reasons (for example tax retention periods for bookings).

05Client galleries

If you book a shoot with us, we deliver your photos through a private, password-protected gallery page on this website. It is hosted by Hostinger (see “Hosting and server log files”) and is not listed in search engines. Only people with the link and password can open it.

The photos in your gallery are processed to fulfil our contract with you (Art. 6(1)(b) GDPR). When you open the gallery, the server records the same technical log data as for any other page. Each gallery is available for the period we agree with you and is then deleted.

When you enter your gallery password, we set one strictly necessary session cookie (cs_sess) so you stay signed in to your gallery while you browse it. It contains only a random ID, is deleted when you close your browser, and is not used for anything else (§ 25(2) TDDDG).

06Google Analytics (only with your consent)

If you agree in our cookie banner, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies and similar technologies to analyse how visitors use the site, for example which pages are viewed, how long visits last, the approximate region and the type of device. This helps us understand what works and improve the website. In Google Analytics 4, IP addresses are not stored.

Google Analytics only loads after you click “Accept”. If you click “Decline”, it is never loaded. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with future effect using “Cookie settings” at the bottom of every page.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of data protection. More information: Google Privacy Policy.

07Your consent choice

To remember whether you accepted or declined Google Analytics, we store your choice in your browser’s local storage (the entry cs-analytics-consent). This entry contains no personal data, is not sent to us or to anyone else, and is strictly necessary to respect your choice (§ 25(2) TDDDG). You can delete it at any time via “Cookie settings” or your browser settings.

08Embedded videos (Vimeo and YouTube)

Our Videos page and the film on our home page show videos hosted by:

• Vimeo, provided by Vimeo.com, Inc., New York, USA. See the Vimeo Privacy Policy.
• YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See the Google Privacy Policy.

Videos only load when you click them. Until then, you see a preview image that is stored on our own website, and no connection is made to Vimeo or YouTube. When you click a video, your browser connects to the provider’s servers. The provider then receives at least your IP address and the page you are on, and may set cookies or similar technologies. If you are logged in to your Vimeo or YouTube/Google account, the provider can link this to your account. For Vimeo we use the “do not track” setting, which tells Vimeo not to track your viewing session.

The legal basis is your consent, given by clicking the video (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Data may be transferred to the USA; where the provider is certified under the EU–U.S. Data Privacy Framework, this provides an adequate level of protection.

09Links to social media

Our website links to our profiles on Instagram, TikTok and Facebook. These are ordinary links, not plug-ins: no data is sent to these networks when you visit our website. Only when you click a link and open the network’s website does its own privacy policy apply.

10Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict how we process it (Art. 18)
• receive your data in a portable format (data portability, Art. 20)
• object to processing based on our legitimate interests (Art. 21)
• withdraw your consent at any time with future effect (Art. 7(3))

To exercise any of these rights, simply contact us using the details at the top of this page.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) in Düsseldorf.

11Changes to this policy

We may update this privacy policy when our website or the law changes. The current version is always available on this page.