Privacy policy

1. Controller

The controller's details can be found in the Imprint.

2. General Data Processing

We generally process personal data of our users only to the extent necessary to provide a functioning website and our content and services. The processing of personal data of our users usually takes place only with the consent of the user. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by statutory provisions.

3. Legal Basis

Where we obtain consent from the data subject for processing operations involving personal data, Article 6(1)(a) GDPR serves as the legal basis. In the processing of personal data that is necessary for the performance of a contract, Article 6(1)(b) GDPR serves as the legal basis. In the event that vital interests of the data subject require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest of our company, Article 6(1)(f) GDPR serves as the legal basis.

4. Collection and Storage of Personal Data and Nature and Purpose of Their Use

a) Visiting the Website
When accessing our website, information is automatically sent to our server by the browser. This information is temporarily stored in a so-called log file. The following information is recorded without your intervention and stored until automatic deletion:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access originated (referrer URL)
• Browser used and, if applicable, the operating system of your computer and the name of your access provider

The aforementioned data is processed for the following purposes: Ensuring a smooth connection establishment of the website, ensuring comfortable use of our website, evaluating system security and stability.
The legal basis for data processing is Article 6(1)(f) GDPR.

b) Booking a Session
When you book a photo session, we collect the following personal data:

• First and last name
• Email address
• Phone number
• Postal address (if required for invoicing)

This data is used exclusively for processing the booking, communication, and invoicing. The legal basis for this is Article 6(1)(b) GDPR (contract performance).

c) Payment via Mollie
Payment processing is handled by the service provider Mollie. During payment, your payment data (credit card details, IBAN, etc.) is transmitted directly to Mollie. We do not store credit card details or bank account information. Mollie processes this data in accordance with its own privacy policy: https://www.mollie.com/legal/privacy

d) Image Material
During the photo session, photographs of the clients are created. These images are used and stored as follows:

• Retention: Image files are stored on our secure storage media. Raw files and the final selection are stored indefinitely for portfolio use, unless you object in writing.
• Portfolio Use: We reserve the right to use created portraits for our portfolio (website, social media, print materials), unless you object to this use in writing.
• Disclosure to Third Parties: Your images are not disclosed to third parties.

The legal basis for the processing of image data is Article 6(1)(f) GDPR (legitimate interest in portfolio display) as well as Article 6(1)(b) GDPR (contract performance).

5. Disclosure of Data

Your personal data will not be transmitted to third parties for purposes other than those listed below:

• For payment processing to Mollie (see Section 4c)
• As far as we are legally obligated to do so (e.g., official orders)

6. Retention Period

• Customer and Booking Data: These are stored for the duration of the business relationship and beyond for statutory retention periods. According to commercial and tax regulations, the retention period is 10 years (§ 257 HGB, § 147 AO).
• Image Material: As described in Section 4d, image data is stored indefinitely for portfolio use unless a written objection is received. Raw files that are not part of the final selection may be deleted after a reasonable period.
• Website Logfiles: These are deleted after a maximum of 7 days.

7. Your Rights

You have the following rights regarding your personal data:

• Right to information (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object to processing (Article 21 GDPR)
• Right to withdraw consent (Article 7(3) GDPR)
• Right to complain to a supervisory authority (Article 77 GDPR)

If you wish to exercise your rights, please contact us at: studio@hamburgheadshot.com

8. Cookies

Our website does not use cookies.

9. Contact Form / Email Contact

If you contact us by email, the data you provide (name, email address, message) will be stored by us to answer your inquiry. We do not pass this data on to third parties without your consent. The processing of data entered in the contact form is based on your consent (Article 6(1)(a) GDPR).

10. SSL Encryption

Our website uses SSL encryption for security reasons. An encrypted connection is established when you send us sensitive information. This can be recognized by the changed address line of the browser from "http://" to "https://" and by the lock symbol in your browser bar.