Source: https://www.friedsamphotography.com/en/privacy-policy
Timestamp: 2019-04-21 08:11:17+00:00

Document:
Visitors and users of the website (hereinafter, I collectively refer to the data subjects as “users”).
I take appropriate technical and organizational measures in accordance with art. 32 of the GDPR, taking the best available technology, the implementation costs and the nature, scope, circumstances and purposes of processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons into account, to ensure a level of protection appropriate for the risk.
In particular, these measures include ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access it is affected by, input, disclosure, securing availability and its separation. Furthermore, I have established procedures, which ensure data subject rights being able to be exercised, data erasure and a reaction to data vulnerability. Moreover, I already consider the protection of personal data in the development phase or selection of hardware, software as well as procedures, according to the principle of data protection by technology design and by privacy-friendly default settings (article 25 of the GDPR).
If, in the context of my processing, I disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant access to the data, this will only be done on the basis of legal permission (e.g. if transmission of the data to third parties, such as to payment service providers, is required to fulfill the contract in accordance with art. 6 sec. 1 lit. b of the GDPR), you have consented, a legal obligation stipulates it or based on my legitimate interests (e.g. when using agents, web hosts, etc.).
If I commission third parties with the processing of data based on a so-called “Agreement on data processing”, this is conducted based on art. 28 of the GDPR.
If I process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or do this in the context of using third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfill my (pre)contractual obligations, based on your consent, based on a legal obligation or based on my legitimate interests. Subject to legal or contractual permissions, I only process or have the data processed in a third country if the special requirements pursuant to art. 44 ff. of the GDPR are met. That means processing takes place e.g. on the basis of specific guarantees, such as the officially recognized identification of an EU compliant data protection standard (e.g. for the US through the Privacy Shield) or in compliance with officially recognized special contractual obligations (so-called “standard contractual provisions”).
In accordance with art. 16 of the GDPR, you have the right to request the completion of data pertaining to you or the rectification of inaccurate data pertaining to you. According to art. 17 of the GDPR, you have the right to request that respective data is immediately erased or alternatively, in accordance with art. 18 of the GDPR, a restriction of the data processing.
You have the right to request that data pertaining to you, which you made available to me, is maintained and that it is transferred to other controllers in accordance with art. 20 of the GDPR.
A consent to “necessary cookies” is required for the use of my website and these are marked as “necessary” accordingly. If you would like to continue using my website, please consent to the use of these cookies.
of my customers, interested parties and business partners for the purpose of fulfilling contractual services and managing customer accounts as well as marketing, advertising and market research.
I process the data of my contractual partners and interested parties as well as other clients, customers or contractual partners (collectively referred to as “contractual partners”) in accordance with art. 6 sec. 1 lit. b of the GDPR, to be able to render my contractual or precontractual services to them. The data processed in this connection as well as the nature, scope, purpose and necessity of its processing is determined based on the underlying contractual relationship.
The processed data includes the master data of my contractual partners (e.g. names and addresses), contact data (e.g. email and phone numbers) as well as contractual data (e.g. services received, contractual content, contractual communication, names of contact persons) and payment data (e.g. bank details, payment history).
As a basic principle, I do not process special categories of personal data unless these are a component of commissioned or contract specific processing.
I process data required to constitute and fulfil the contractual services and indicate the necessity of your data, insofar as this is not evident to the contractual partner. A disclosure to external persons or companies only takes place if this is required in line with a contract. In the processing of data provided to me in line with an order, I act according to the client’s instructions as well as the statutory requirements.
In line with the use of my online services, I can store the IP address and the time of the respective user action. Storage is based on my legitimate interests as well as in the interests of the users, to protect against misuse and other unauthorized use. This data is generally not disclosed to third parties unless required to pursue my claims according to art. 6 sec. 1 lit. f of the GDPR or I have a legal obligation to do so according to art. 6 sec. 1 lit. c of the GDPR.
I process data in line with administrative tasks as well as for the organization of my company, accounting and to comply with statutory obligations such as archiving for instance. In this connection, I process the same data I process in line with fulfilling my contractual services. This processing is based on art. 6 sec. 1 lit. c of the GDPR, art. 6 sec. 1 lit. f of the GDPR. This processing pertains to customers, interested parties, business partners and website visitors. The purpose of and my interest in this processing lies in the administration, accounting, office organization, data archiving, i.e. functions, which serve maintaining my business activities, performing my tasks and rendering my services. The erasure of data regarding contractual services and the contractual communication complies with the tasks stated for these processing activities.
In this connection, I disclose or transfer data to the fiscal authority, consultants, e.g. tax consultants or auditors as well as other billing centres and payment service providers.
Moreover, I store data pertaining to suppliers, organizers and other business partners bases on my business interests, e.g. for the purpose of contacting at a later point in time. I generally store this predominantly company-related data permanently.
In order to be able to conduct my business in an economic manner and identify the requirements of the contractual partners and users, I analyze the data I have in connection with business transactions, contracts, enquiries, etc. At the same time, I process master data, communication data, contractual data, payment data, usage data and metadata based on art. 6 sec. 1 lit. f of the GDPR; the data subjects in this connection include contractual partners, interested parties, customers, visitors and users of my website.
The analyses are carried out for the purpose of business assessments, marketing and marketing research. In the process, I can take the profiles of the registered users with data, e.g. regarding the services they received, into account. The analyses enable me to increase user-friendliness, optimize my product range and operate in a more efficient manner. These analyses are only intended for me and are not disclosed to third parties unless it is a matter of anonymous analyses with pooled values.
The users can receive information relevant to their user account, e.g. technical modifications, via email. If users cancel their user account, their data pertaining to the user account is erased subject to a statutory retention obligation. The users are responsible for backing up their data after cancellation prior to an expiration of the contract. I am entitled to irretrievably erase all user data stored over the term of the contract.
In line with the use of my registration and login functions as well as the use of the user account, I store the IP address and the time of the respective user action. Storage is based on my legitimate interests as well as to protect the user from misuse and other unauthorized use. This data is generally not disclosed to third parties unless this is required to pursue my claims or I have a legal obligation to do so according to art. 6 sec. 1 lit. c of the GDPR. The IP addresses are anonymized or erased after 7 days at the latest.
I use the so-called ”Brute Force Protection”, provided by iThemes Media, LLC Privacy Matters, c/o Liquid Web, LLC, 2703 Ena Drive, Lansing, MI 48917, USA, (“iThemes”).
Brute Force Protection is a service, which helps protect the content of my website against possible brute force attacks. When users log on to their user account, the users’ IP address is shared with a service made available by iThemes. The users’ data is solely processed for the aforementioned purposes and to maintain the security and functionality of Brute Force Protection.
This processing is based on my legitimate interests, i.e. the interest in a secure and efficient provision, analysis and optimization of my website in accordance with art. 6 sec. 1 lit. f of the GDPR.
When users leave comments or make other posts, their IP addresses can be stored for 7 days based on my legitimate interests as defined by art. 6 sec. 1 lit. f of the GDPR. This is for my protection in the event somebody adds comments or posts with illegal content (insults, prohibited political propaganda, etc.). In this case, I myselve can be prosecuted for the comment or post and are therefore interested in the identity of the author.
I store the data provided in line with comments and posts permanently until the user objects to such storage.
My website uses the “Antispam Bee” service, which is provided by pluginkollektiv (https://profiles.wordpress.org/pluginkollektiv), Sergej Müller at WordPress.org (https://wordpress.org/plugins/antispam-bee/). The use thereof is based on my legitimate interests as defined by art. 6 sec. 1 lit. f of the GDPR. Comments from actual people are distinguished from spam comments with the help of this service.
I only use Antispam Bee with a local spam database. That means no data is transferred to third parties according to the author but compared locally and categorized accordingly. I deactivated “Consider public spam database”, “Block or allow specific countries” and “Only allow comments in one language”.
Users are welcome to use pseudonyms or can refrain from entering a name or email address as well as website. You can completely prevent data from being tested by not using my commentary system. That would be a share but unfortunately, I do not have any other alternative, which works as effectively.
I use the Gravatar service provided by the Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA within my website and in particular in the blog.
The use of Gravatar is based on my legitimate interests as defined by art. 6 sec. 1 lit. f) of the GDPR because with the help of Gravatar, I give the authors of posts and comments the option of personalizing their contributions with a profile picture.
If users do not want a user picture linked to their email address at Gravatar to appear in the comments, they should use an email address in their comments, which is not stored with Gravatar. Furthermore, I would like to point out that it is also possible to use an anonymous email address or no email address at all, should the users not want their own email address to be sent to Gravatar. Users can completely prevent data from being transmitted by not using my commentary system.
When contacting me (e.g. via contact form, email, phone or via social media), the user’s data is processed, to process the contact request and the handling thereof in accordance with art. 6 sec. 1 lit. b) of the GDPR. The users data can be stored in a customer relationship management system (“CRM system”) or a comparable enquiry set-up.
I erase enquiries, insofar as they are no longer required. I review the necessity every two years; furthermore, the statutory archiving obligations apply.
The hosting services I use serve making the following services available: Infrastructure and platform services, computing capacity, memory capacity and database services, emailing, security services as well as technical maintenance services, which I use for the purpose of operating this website.
In the process, I or my hosting provider process(es) master data, contact data, content data, contractual data, usage data, metadata and communication data from customers, interested parties and visitors to this website based on my legitimate interests in an efficient and secure provision of this website according to art. 6 sec. 1 lit. f of the GDPR in conjunction with art. 28 of the GDPR (conclusion of a data processing agreement with a processor).
I or my hosting provider collect(s) data (so-called server log files) everytime the server, on which this service is located, is accessed. This is based on my legitimate interests as defined by art. 6 sec. 1 lit. f of the GDPR. This access data includes the name of the accessed web page, file, date and time of access, volume of data transferred, notification of successful access, browser type incl. version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
I use a so-called “Content Delivery Network” (CDN), provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare is certified under the Privacy Shield agreement and therefore, guarantees compliance with the European data protection laws (https://www.privacyshield.gov/participant?id=a2zt0000000GnZKAA0&status=Active).
A CDN is a service, which helps delivering, in particular large media files such as graphics or scripts quicker with the help of regionally distributed servers, which are connected via the Internet. The users’ data is solely processed for the aforementioned purposes and to maintain the security and functionality of the CDN.
I use a so-called “SiteCheck”, provided by the Media Temple Inc. d/b/a Sucuri, 6060 Center Dr. Suite 500, Los Angeles CA 90045, USA, (“Sucuri”). Sucuri is certified under the Privacy Shield agreement and therefore, guarantees compliance with the European data protection laws (https://www.privacyshield.gov/participant?id=a2zt0000000TN9xAAG&status=Active).
A SiteCheck is a service, which helps scan the content of my website for possible malware and security issues. No personal data is sent to Sucuri. However, Sucuri can discover personal data during the scanning process (e.g. in comments). The users’ data is solely processed for the aforementioned purposes and to maintain the security and functionality of the SiteCheck.
Google will use this information on my behalf, to analyze the use of my website by the user, to compile reports on activities within this website and to provide me with additional services associated with the use of the website and Internet. In the process, pseudonymous user profiles of the users can be created from the processed data.
I only use Google Analytics with activated IP anonymization. That means that the IP address of the user is truncated by Google within member states of the European union or other states party to the Agreement on the European Economic Area. The complete IP address is only transmitted to a Google server in the USA and truncated there in exceptional cases.
On the basis of my legitimate interests (ie interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 (1) lit. DGPR), we use the plugin Jetpack (here the subfunction “Wordpress Stats”) Automated Visitor Access Statistics Tool and Automattic, Inc. 132 Hawthorne Street San Francisco, CA 94107, United States. Jetpack uses so-called “cookies”, text files that are stored on your computer and that allow an analysis of the use of the website by you.
I maintain online presence within social media and platforms, to communicate with the customers, interested parties and users active there and to be able to provide them with information regarding my services there.
I would like to point out, that in the process user data can be processed outside the region of the European Union. This can result in risks for the users because the enforcement of user rights can be complicated by this for instance. In regard to US providers certified under the Privacy Shield agreement, I point out that you undertake to observe the data privacy standards of the EU.
The processing of the users’ personal data is carried out based on my legitimate interest in effectively informing the users and communication with the users according to art. 6 sec. 1 lit. f of the GDPR. If the users are asked to consent to data processing by the respective providers (i.e. stating your consent e.g. by ticking a checkbox or confirming a button), the legal basis for processing is art. 6. sec. 1 lit. a, art. 7 of the GDPR.
I refer to the following linked information from the providers for a detailed display of the respective processing and objection options (opt-out).
In the case of information enquiries and the assertion of user rights, I would like to point out that this is most effective when asserted directly against the providers. Solely the providers have respective access to the users’ data and can take direct measures or provide information. Nevertheless, should you require support, feel free to contact me.
I use content or service offerings from third-party providers within my website based on my legitimate interests (i.e. interest in the analysis, optimization and economic operation of my website as defined by art. 6 sec. 1 lit. f of the GDPR), to embed their content and services such as videos and fonts for example (hereinafter collectively referred to as “content”).
This always implies that the third-party providers of this content obtain knowledge of the users’ IP address, given that the content cannot be sent to their browsers without the IP address. Consequently, the IP address is required to show this content. I strive to only use such content, whose respective provider merely uses the IP address to supply this content. Furthermore, third-party providers can use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Using “pixel tags”, information such as visitor traffic on the pages of this website can be analyzed. Furthermore, the pseudonymous information can be stored on the users’ device and among other things, contain technical information regarding the browser and operating system, referring web pages, visiting time as well as other information on the use of my website as well as be connected to information from other sources.
Based on my legitimate interests (i.e. interest in the analysis, optimization and economic operation of my website as defined by art. 6 sec. 1 lit. f of the GDPR), I use social plugins (“plugins”) from the social network facebook.com, which is operated by the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).
The plugins can display interaction elements or content (e.g. videos, graphics or text contributions) and can be recognized by one of the Facebook logos (white “f” on a blue tile or a “like”, “thumbs up” sign) or are marked with the addition “Facebook social plugin”. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/. Facebook is certified under the Privacy Shield agreement and therefore, guarantees compliance with the European data protection laws (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
When a user accesses a function of the website, which contains such a plugin, his/her browser establishes a direct connection to the Facebook servers. The content of the plugin is directly transmitted to the user’s device and incorporated into the website by it. In the process, user profiles of the users can be created from the processed data. Therefore, I do not have any control over the scope of data, which Facebook collects using this plugin and inform the users of this accordingly based on my knowledge.
By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the website. If the user is logged in to Facebook, Facebook can assign the visit to his/her Facebook account. If users interact with the plugins, for example press the like button or leave a comment, the corresponding information is directly transmitted to Facebook from your device and stored there. If a user is not a member on Facebook, there is still the possibility that Facebook can identify and store his/her IP address. According to Facebook, only anonymized IP addresses are stored in Germany. Users can view the Facebook privacy policies, to obtain information pertaining to the purpose and scope of data collection and the further processing and use of the data by Facebook as well as the rights and setting options of users, to protect the their privacy at: https://facebook.com/policy.
If a user is a Facebook member and does not want Facebook to collect data about him/her via this website or associate it with his/her member data stored on Facebook, he/she must log out of Facebook before visiting the website and erase his/her cookies. Additional settings and objections to use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are carried out irrespective of the platform, i.e. they apply to all devices such as desktop computer or mobile devices.
The functions and contents of the Twitter service provided by the Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA can be embedded within my website. This can for instance include images, videos or texts and buttons, with which users can share contents of this website on Twitter.
The functions and contents of the Google+ platform provided by the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (“Google”) can be embedded within my website. This can for instance include images, videos or texts and buttons, with which users can share contents of this website on Google. Insofar as the users are members on the Google+ platform, Google can allocate the access of the aforementioned content and functions to the user profiles there.
This privacy statement has been created by using the Privacy Generator by RA Dr. Thomas Schwenke and adapted by me accordingly.

References: art. 32
 art. 6
 art. 28
 art. 44
 art. 16
 art. 17
 art. 18
 art. 20
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 28
 art. 6
 Art. 6
 art. 6
 art. 6
 art. 7
 art. 6
 art. 6