This is a translation of the German privacy policy (Datenschutzerklärung). In case of doubt, the German version shall prevail.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:
Felix Kling
Färbergasse 4
88131 Lindau (Bodensee)
Germany
E-mail: contact@felixklingpictures.com
Cookies
This website does not use cookies for advertising, analytics or tracking. It only uses two technically necessary cookies:
• fkp_lang stores the language you have chosen (German or English), so that the website appears in this language on your next visit. It is only set if you switch the language yourself. Storage period: one year.
• kirby_session is a session cookie of the content management system Kirby. It is only set when you open the contact form (protection against forged form submissions) or log in to a client gallery. Storage period: up to two hours for the contact form, up to two weeks after logging in to a client gallery, so that you do not have to log in again on every visit.
The legal basis is Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as these cookies are strictly necessary for the functions you request, as well as Art. 6 (1) (f) GDPR or, for client galleries, Art. 6 (1) (b) GDPR.
Storage in your browser (local storage)
The website remembers some settings in your browser's storage (local storage or session storage). This information stays on your device and is not transmitted to us: that you have read the notice about cookies, the selected size of the photo grid, whether the photo information is open, which notifications (e.g. "Follow me on Instagram") have already been shown to you and, during a visit, when it began, so that such notifications do not appear too early. You can delete this information at any time in your browser settings. The legal basis is Section 25 (2) no. 2 TDDDG.
No third-party content or services
This website does not embed any content, fonts, scripts or tracking services from third parties. All files are delivered from our own server.
Visitor statistics
To find out which content is read and how visitors find this website, we compile simple, anonymous visitor statistics. For this we use the Kirby plugin "SimpleStats", which runs exclusively on our own server. No cookies are set, no data is passed on to third parties and no user profiles are created.
When a page is requested, an encrypted checksum (hash) is formed from the shortened IP address (the last block is removed), a shortened browser identifier (user agent) and a secret key. It only serves to count several requests of the same page within 24 hours only once. Together with this checksum, the pages requested as well as the device type (e.g. smartphone), browser engine and operating system family, each without version numbers, are stored for a maximum of 24 hours.
After 24 hours at the latest, this information is combined into pure counts per day, e.g. "Page X: 12 visits". The checksum is deleted in the process. After that it is no longer possible to identify individual persons.
If a visit comes via a link on another website or via a search engine, the address of the referring page (referrer) is also counted, e.g. "google.de". This information is stored without any connection to the checksum or to your person. Visits by search engine robots are not counted.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in understanding the reach and use of this website and improving it. You can object to the processing at any time. To do so, please contact the e-mail address given above.
Links to social networks
We only refer to Instagram and Facebook with simple links. No data is transmitted to these networks when you visit our website. Only when you click on such a link do you leave our website; the privacy policy of the respective provider then applies (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland).
Contact form and contact by e-mail
If you send us an enquiry via the contact form, we process the details you enter: name, e-mail address, subject, desired date or place and your message, as well as the language in which you use the website. The details are sent to us by e-mail; the website itself does not store them. A field in the form that is invisible to visitors serves to protect against automated spam; no further data is collected in the process.
We use your details exclusively to handle your enquiry and to clarify any questions. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry is aimed at a commission, otherwise Art. 6 (1) (f) GDPR; our legitimate interest lies in answering your enquiry. We delete the enquiry once it has been dealt with, unless statutory retention obligations apply (e.g. if it leads to a commission). The same applies if you contact us directly by e-mail or telephone.
Client galleries
We provide protected online galleries for our clients. You receive the access details (access code and password, or a personal link) from us. When you use a gallery, we process:
• Login: After logging in, the session cookie kirby_session remembers which galleries you have opened. We only store passwords in encrypted form (as a hash).
• Protection against misuse: After several incorrect login attempts, logging in is temporarily blocked. For this purpose we store, for a maximum of 24 hours, an irreversible key (HMAC) of your IP address – not the IP address itself – together with the number of failed attempts.
• Favourites: If you mark photos as favourites, this selection is stored with the gallery and is visible to us so that we can process your selection.
• Activity log: We log logins, failed login attempts and downloads (individual photos and ZIP archives) with date and time, without IP address and without browser identifier. The log covers at most the last 500 entries of a gallery.
The legal basis is Art. 6 (1) (b) GDPR (performance of the contract for the photo production) and, for protection against misuse, Art. 6 (1) (f) GDPR; our legitimate interest lies in the security of the galleries. Client galleries are available for a limited time. When we delete a gallery, the favourites and the activity log are deleted as well.
Definitions
Our privacy policy uses specific terms from various data protection laws. We want our policy to be easy to understand and therefore explain these terms first.
The following definitions may be interpreted or extended in accordance with the case law of the General Court of the European Union (EGC), the Court of Justice of the European Union (CJEU), the Swiss Federal Supreme Court (BGE), the Supreme Court of the United Kingdom (UKSC) or in accordance with national data protection laws or national case law of a state or federal state, including but not limited to California, including judge-made law, also under common law, if this is necessary for the application of the law in an individual case.
In this privacy policy we use, among others, the following terms:
a) Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter, where applicable, "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, or who must be regarded as such on the basis of national data protection laws or the national case law of a state or federal state, including judge-made law, also under common law.
b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organisation or another data recipient, and persons who must be regarded as such on the basis of national data protection laws or the national case law of a state or federal state, including judge-made law, also under common law.
c) Processing
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
d) Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.
e) Profiling
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
f) Pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
g) Controller
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
h) Processor
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
i) Recipient
Recipient means a natural or legal person, public authority, agency or another body to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.
j) Third party
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
k) Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Hosting and server log files
ALL-INKL.COM - Neue Medien Münnich is a German provider of web hosting services, domain registrations and server solutions. With a broad range of hosting products, ALL-INKL enables private users and companies alike to present their web projects efficiently and securely on the internet.
When ALL-INKL is used, personal data such as names, addresses, e-mail addresses, telephone numbers and payment information are collected for the processing of the contract and the provision of the services. In addition, technical data such as IP addresses, access times and log files may be processed in order to ensure the security of the services and to optimise technical support.
The operating company of the service and thus the recipient of the personal data is: ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.
Purposes for which the personal data is to be processed and the legal basis for the processing: the purpose of using the service is the use of web hosting services and related services. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the reliable and secure provision of our website and the associated services.
The criteria for determining the period for which the personal data is processed are the contractual relationship between us and the operating company of the service or statutory or contractual retention periods. The provision of the personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operating company of the service. If you do not provide it, however, it may not be possible to use our services or those of the operating company of the service.
Further information and the applicable privacy policy of ALL-INKL can be found at https://all-inkl.com.
Rights of the data subject under the GDPR
a) Right to confirmation
Every data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her is being processed.
If a data subject wishes to exercise this right, he or she may contact us at any time.
b) Right of access
Every data subject has the right to obtain from the controller, at any time and free of charge, information about the personal data stored about him or her and a copy of this data. Furthermore, the European legislator has granted the data subject access to the following information:
• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data concerning him or her, or restriction of processing by the controller, or to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal data is not collected from the data subject: any available information as to its source;
• the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Furthermore, the data subject has the right to be informed whether personal data has been transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.
If a data subject wishes to exercise this right, he or she may contact us at any time.
c) Right to rectification
Every data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of a supplementary statement.
If a data subject wishes to exercise this right, he or she may contact us at any time.
d) Right to erasure (right to be forgotten)
Every data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as the processing is not necessary:
• The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
• The data subject withdraws the consent on which the processing is based according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.
• The personal data has been unlawfully processed.
• The personal data has to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.
If one of the above grounds applies and a data subject wishes to have personal data stored by us erased, he or she may contact us at any time.
Where we have made the personal data public and our organisation as the controller is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the published personal data that the data subject has requested the erasure by such other controllers of any links to, or copies or replications of, that personal data, insofar as the processing is not necessary.
e) Right to restriction of processing
Every data subject has the right to obtain from the controller restriction of processing where one of the following applies:
• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
• The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by us, he or she may contact us at any time.
f) Right to data portability
Every data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, in exercising his or her right to data portability pursuant to Art. 20 (1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
If a data subject wishes to exercise this right, he or she may contact us at any time.
g) Right to object
Every data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 (1) (e) or (f) GDPR. This also applies to profiling based on these provisions.
In the event of an objection, we shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where we process personal data for direct marketing purposes, the data subject has the right to object at any time to processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, we will no longer process the personal data for such purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
If a data subject wishes to exercise this right, he or she may contact us at any time. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may also exercise his or her right to object by automated means using technical specifications.
h) Automated individual decision-making, including profiling
Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is based on the data subject's explicit consent.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is based on the data subject's explicit consent, we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
If a data subject wishes to exercise this right, he or she may contact us at any time.
i) Right to withdraw consent under data protection law
Every data subject has the right to withdraw consent to the processing of personal data at any time.
If a data subject wishes to exercise this right, he or she may contact us at any time.
This privacy policy is based on texts created with a generator jointly developed by legal experts in IT law, data protection coordinators and the ISO 37001 certification body.