Controller
[Not provided], [Not provided], [Not provided], Germany, email: [[Not provided]](mailto:[Not provided])
Gallery and selection
When you open a gallery, we process the technically necessary data (truncated IP address, time, device type, selected language) and – if you provide them – your name and email address in order to attribute favourites, comments, approvals and your selection. The legal basis is the performance of our contract (Art. 6(1)(b) GDPR) and, for guests of the gallery, our legitimate interest in performing our client's order (Art. 6(1)(f) GDPR). If image protection is active, a personal identifier is displayed over the images and the session is logged for up to twelve months so that the sharing of protected images can be traced (Art. 6(1)(f) GDPR, protection of our copyright).
Consent to publication
If you allow us to publish images, we store the wording of your declaration together with the time, name, email and truncated IP address as proof (Art. 7(1) GDPR). You can withdraw your consent at any time with effect for the future – in the gallery or via the link in the confirmation email.
Purchases and invoices
If you buy files or photo products, we process the order, amount, email address, billing address, for photo products the delivery address, for a commercial licence the licensee, the language of your order and the payment status in order to perform the contract (Art. 6(1)(b) GDPR). To calculate VAT correctly, we store the country of your billing address and – where the payment service provides it – the country of your card or account as evidence (Art. 6(1)(c) GDPR). We keep invoices for eight years (§ 147 AO, § 14b UStG); records and evidence relating to the One-Stop-Shop scheme for ten years (Art. 63c MwSt-DVO, § 22 UStG). The legal basis is Art. 6(1)(c) GDPR. Where applicable, we have photo products made by a photo lab, which receives the images and the delivery address for this purpose. We store a shopping cart until the purchase or until the gallery is deleted.
If you buy as a business with a VAT identification number, we check it via the European Commission's VAT Information Exchange System (VIES); in doing so, the number and our own number are transmitted to the Commission and the competent tax administration (Art. 6(1)(c) GDPR).
Contracts, questionnaires and model releases
If you fill in a questionnaire or sign a contract or a model release, we store the wording, your details and answers, your signature, the time and the truncated IP address as proof for as long as the contract runs or the photographs are used, and beyond that until any possible claims have become time-barred (Art. 6(1)(b), (c) and (f) GDPR).
Withdrawal from contracts
If you declare the withdrawal from a contract using the withdrawal function, we store your name, email address, the contract details, the time and the truncated IP address in order to process the withdrawal and acknowledge its receipt to you (Art. 6(1)(c) GDPR), and keep this data for three years (Art. 6(1)(f) GDPR, proof).
Customer records
As a client or buyer, we keep you in our customer records with your name, email address, language and the details you give us (Art. 6(1)(b) GDPR).
Statistics
We evaluate how often galleries are viewed and images are marked as favourites and downloaded – exclusively on the basis of gallery events on our own server, without any tracking service and without profiling across galleries (Art. 6(1)(f) GDPR).
Payments
Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland); you enter your payment details directly with Stripe, and we do not receive them. Stripe may also process data in the USA (EU-US Data Privacy Framework, standard contractual clauses). More information: Stripe's privacy policy.
Cookies
Only one technically necessary session cookie is set, which stores the unlocking of the gallery, your language choice and your selection (§ 25(2) no. 2 TDDDG). There is no tracking.
Processors
These pages run on Passepartout, operated by [Angabe fehlt], [Angabe fehlt], [Angabe fehlt], on servers in the European Union. The operator processes the data exclusively on our behalf (Art. 28 GDPR); we also send the emails (gallery links, confirmations, invoices) via its mail server. Server logs with truncated IP addresses are deleted after no more than 14 days.
Storage period
A gallery's data is deleted when the gallery is deleted; image protection logs after twelve months without activity. If our subscription to the platform ends, all data of these galleries is automatically deleted 30 days later, and backup copies no later than 14 days after that. Statutory retention obligations remain unaffected.
Right to object
Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). To do so, write to [Not provided].
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). To exercise them, contact [Not provided].
As of: October 2026