Data Protection Policy

1General

• 1.1

  The protection and security of your personal data is important to us. This privacy policy informs you in accordance with Art 13, 14 GDPR about the nature, scope and purpose of the processing of personal data on our website as well as in the context of our business activities as a photography company.

• 1.2

  The controller within the meaning of the GDPR is the operator of this website, as stated in the legal notice under /disclaimer. If you have any questions about data protection, you can reach us at hello@digitalminds-photography.com.

• 1.3

  This privacy policy applies to the website under the domain digitalminds-photography.com as well as all associated subdomains and services. It does not apply to linked third-party websites.

2Rights of Data Subjects

• 2.1

  Under the GDPR, you have extensive rights as a data subject. You have the right at any time to access, rectification, erasure, restriction of processing, objection to processing, data portability and to revoke consent at any time.

• 2.2

  Right of access (Art 15 DSGVO): You may request confirmation as to whether your personal data is being processed by us and request information about such data.

• 2.3

  Right of rectification (Art 16 DSGVO): You may request the rectification of inaccurate personal data or the completion of incomplete data.

• 2.4

  Right to erasure (Art 17 DSGVO): You may request the erasure of your personal data, provided that no legal retention obligations conflict therewith.

• 2.5

  Right to restriction (Art 18 DSGVO): You may request the restriction of the processing of your personal data.

• 2.6

  Right to object (Art 21 DSGVO): You may object to the processing of your data for the purpose of direct marketing at any time.

• 2.7

  Data portability (Art 20 DSGVO): You have the right to receive your data in a structured, commonly used and machine-readable format.

• 2.8

  Right to withdraw consent (Art 7(3) DSGVO): You may withdraw your consent at any time with effect for the future.

• 2.9

  You may exercise all rights by email to hello@digitalminds-photography.com, by post to the address stated in the legal notice, or via the contact form on the website.

• 2.10

  We will respond to your request without undue delay, at the latest within one month of receipt (Art 12(3) GDPR). For complex requests, this period may be extended by a further two months.

• 2.11

  Furthermore, you have the right to lodge a complaint with the competent supervisory authority (Art 77 GDPR). Contact details of the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Wickenburggasse 8, 1080 Wien, Phone: +43 1 521 52-25 69, Email: dsb@dsb.gv.at, Website: www.dsb.gv.at

3Data Erasure and Retention Periods

• 3.1

  We only process and store your personal data for as long as is necessary to fulfil our contractual and legal obligations. Once the purpose of storage ceases, your data will be deleted or blocked.

• 3.2

  Statutory retention periods exist in particular under § 132 BAO (Austrian Federal Tax Code): 7 years for accounting records, invoices and business documents (Art 6(1)(c) GDPR), and § 212 UGB (Austrian Commercial Code): 7 years for commercial books, inventories and balance sheets.

• 3.3

  After expiry of these periods, your data will be deleted unless there is a further consent or other justification.

4External Links

• 4.1

  Our website contains links to third-party websites (external links). We carefully review these links before publication, but cannot accept any responsibility or liability for the content or data processing on linked websites.

• 4.2

  The respective privacy policies of the operators of these websites apply to data processing on linked websites.

5Contact Form, Enquiries and Booking System

• 5.1

  When you contact us via the contact form, email or telephone, the data you provide (in particular name, email address, telephone number, message) will be processed for the purpose of handling your enquiry and for any follow-up questions. The legal basis is Art 6(1)(b) GDPR (contract initiation) or Art 6(1)(f) GDPR (legitimate interest in communication).

• 5.2

  The data you enter in the contact form will be stored by us until you request deletion, withdraw your consent to storage, or the purpose for data storage ceases. After processing your enquiry, but no later than six months, the data will be deleted, unless a statutory retention obligation (e.g. § 132 BAO) or contractual necessity exists.

• 5.3

  We do not pass on your data to third parties without your express consent, unless this is necessary for the performance of a contract.

• 5.4

  Booking System: In the context of our booking system, we collect the following personal data: name and address (street, postal code, city, country), mobile phone number, email address, date of birth (for age verification), username and password (for guest access), digital signature (canvas-based, stored as PNG), IP address (for geolocation to pre-fill postal code/city), camera-based age verification (image data), shooting type, as well as star rating and text feedback. The legal basis is Art 6(1)(b) GDPR (contract initiation / performance).

6Master Data (Contract Performance)

• 6.1

  Personal data required for the establishment, content or amendment of a contractual relationship (master data) is used exclusively for the performance of the contract (Art 6(1)(b) GDPR). This includes in particular name/company, address, email address, telephone number, date of birth and bank details.

• 6.2

  Without your express consent or without a legal basis, your personal data will not be passed on to third parties outside of contract performance.

• 6.3

  After full completion of the contract, your data will be blocked for further use and deleted after expiry of the statutory retention periods (§ 132 BAO: 7 years), unless you have expressly consented to further use.

7Information about Cookies

• 7.1

  This website uses cookies and similar technologies. Cookies are small text files stored on your end device by your browser. Cookies do not harm your computer and do not contain viruses.

• 7.2

  Under § 165(3) TKG 2021, technically necessary cookies may be set without express consent. We exclusively use technically necessary cookies; therefore a consent banner is not required.

• 7.3

  In detail, we use the following cookies:

• 7.4

  Cookie Name	Purpose	Duration	Category
  XID	Session ID to maintain the login session and authentication	3 days	Technically necessary
  darkmode	Stores the user-chosen display option (light/dark mode)	3 days	Technically necessary
  rtab	Stores the last active tab in the admin interface	3 days	Technically necessary
  lang	Stores the user-chosen language	3 days	Technically necessary

• 7.5

  Unauthorized third-party cookies are automatically deleted by our system. We exclusively use our own cookies listed in the table above.

• 7.6

  You can configure your browser to be informed about the setting of cookies, to allow cookies only on a case-by-case basis, to exclude the acceptance of cookies for certain cases or in general, and to activate automatic deletion of cookies when closing the browser. Deactivating cookies may limit the functionality of this website.

8Functional Limitations without Cookies

• 8.1

  If you generally do not allow us to use cookies, certain functions and pages may not work as expected. In particular, the use of the customer area (login) is not possible without the session cookie XID.

• 8.2

  Declining technically necessary cookies may result in inability to log in, language selection not being saved, or the dark mode setting not being retained.

9Server Log Files

• 9.1

  Each time our website is accessed, our system automatically collects information transmitted by your browser (server log files). The following data is collected: browser type and version, operating system, referrer URL, hostname of the accessing computer, date and time of the server request, IP address.

• 9.2

  This data is processed on the basis of our legitimate interest pursuant to Art 6(1)(f) GDPR. Our legitimate interest lies in ensuring the operation, stability and security of our website and in creating anonymised access statistics.

• 9.3

  The IP address is only processed for the duration of the access and is not combined with other data sources. No personal evaluation takes place. We reserve the right to review the log data retrospectively if concrete indications of unlawful use become known.

• 9.4

  If you visit our website via Facebook advertising or a Facebook post, the Facebook click parameter (fbclid) is automatically detected, stored in our database for statistical purposes, and the URL is cleaned of this parameter (301 redirect). The legal basis is Art 6(1)(f) GDPR (legitimate interest in evaluating our advertising measures).

• 9.5

  Server log data is deleted after 30 days, unless a statutory retention obligation or concrete indications of a criminal offence exist.

10SSL/TLS Encryption

• 10.1

  This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. An encrypted connection can be identified by the fact that the browser address line changes from http:// to https:// and by the lock symbol in your browser bar.

• 10.2

  When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

11Data Processors and Hosting

• 11.1

  This website is operated on our own servers in Austria. The website operator has not entered into a separate data processing agreement with an external hosting provider, as the server infrastructure is operated independently.

• 11.2

  Where external service providers (e.g. email providers, printing companies, payment service providers) are engaged to process personal data, data processing agreements pursuant to Art 28 GDPR have been concluded with them.

• 11.3

  The following data processors may be used: email delivery via our own SMTP servers based in Austria, payment processing via integrated payment service providers (details shown in the booking process), print services for orders of prints or photo books (based in Austria/EU).

12International Data Transfers

• 12.1

  The transfer of personal data to third countries (countries outside the European Economic Area – EEA) generally does not take place.

• 12.2

  Should a data transfer to third countries be required in individual cases, this will only take place on the basis of an adequacy decision by the European Commission pursuant to Art 45 GDPR (e.g. EU-US Data Privacy Framework) or using appropriate safeguards pursuant to Art 46 GDPR (Standard Contractual Clauses).

• 12.3

  Currently, there is no active transfer of personal data to third countries.

13Social Media Presence

• 13.1

  We maintain publicly accessible profiles on the following social networks: Instagram (Meta Platforms Ireland Limited), Facebook (Meta Platforms Ireland Limited), 500px (500px Inc., Canada), ModelKartei (ModelKartei GmbH).

• 13.2

  When you visit our social media profiles, data (e.g. IP address, browser type, operating system, previously visited websites) is transmitted to the respective platform operator. This data processing is carried out by the platform operator as the controller within the meaning of the GDPR. As operators of the profiles, we have no influence on the nature and scope of the data processing carried out by the platform operator.

• 13.3

  Insofar as you communicate with us via our profiles (e.g. through direct messages, comments or reactions), we process your data exclusively for the purpose of handling your enquiry. The legal basis is Art 6(1)(f) GDPR (legitimate interest in communication with prospects and customers).

• 13.4

  Information about which data is processed by the respective platform operator can be found in the privacy policies of the respective platforms: Instagram/Facebook: facebook.com/privacy/policy | 500px: 500px.com/privacy | ModelKartei: model-kartei.de/datenschutz

14Processing of Image Data and Right to One's Own Image

• 14.1

  As a photography company, we process image data (photographs, video recordings) in the course of our business activities. The processing of image data on which natural persons are recognisably depicted constitutes the processing of personal data within the meaning of the GDPR.

• 14.2

  The creation, processing and publication of image recordings takes place exclusively on the basis of the express consent of the person depicted pursuant to Art 6(1)(a) GDPR in conjunction with § 78 UrhG (Austrian Copyright Act – right to one's own image). Consent is obtained in writing before the shoot and may be withdrawn at any time.

• 14.3

  Image data is processed for the following purposes: portfolio presentation on the website and in social media channels (only with separate consent), provision for download by the persons depicted, printing and reproduction (e.g. prints, photo books), archiving and documentation of photographic work.

• 14.4

  Image data is stored on our own servers in Austria. Data is retained for the duration of the contractual cooperation and beyond for archival purposes, provided consent to publication exists. After withdrawal of consent or cessation of the purpose, image data will be deleted unless statutory retention obligations prevent this.

• 14.5

  For TFP shoots (Time for Prints / Time for Images), the provisions of the GTC (Section 7 TFP Agreements) apply. Consent to publication is an integral part of the TFP agreement.

15Data Protection Impact Assessment and Records of Processing

• 15.1

  Pursuant to Art 30 GDPR, we maintain a register of all processing activities (ROPA), in which all data processing operations are systematically recorded and documented. This register is continuously updated and is accessible to the competent data protection authority upon request.

• 15.2

  A Data Protection Impact Assessment (DPIA) pursuant to Art 35 GDPR has been carried out for processing operations classified as potentially high-risk (in particular the processing of image data and the maintenance of customer and member profiles). The result of the DPIA has shown that the existing technical and organisational measures ensure an adequate level of protection.

16Newsletter

• 16.1

  When you subscribe to our newsletter, we use your email address and name to regularly send information about our services, offers and promotions. Providing additional data (e.g. salutation, date of birth) is optional.

• 16.2

  The legal basis for sending the newsletter is your express consent pursuant to Art 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. Contract performance is not dependent on the granting of this consent (Art 7(4) GDPR – prohibition of bundling).

• 16.3

  We store your email address, the registration date and the time of registration including your IP address for legal documentation purposes (proof of consent pursuant to Art 7(1) GDPR).

• 16.4

  By subscribing to the newsletter, you also agree to the analysis of the newsletter through individual measurement, storage and evaluation of opening rates and click rates in recipient profiles for the purpose of designing future newsletters in line with the interests of our readers (Art 6(1)(a) GDPR). You may object to this processing at any time by clicking the unsubscribe link in any newsletter email.

• 16.5

  You may withdraw your consent at any time by clicking the unsubscribe link at the end of each newsletter or by sending an email to hello@digitalminds-photography.com. The lawfulness of the processing carried out until withdrawal remains unaffected.

• 16.6

  After unsubscribing, your email address will be removed from the distribution list, unless you have consented to further processing or there is a legal basis for further storage (e.g. § 132 BAO for documentation of consent).

17Automated Decision-Making and Profiling

• 17.1

  We do not use automated decision-making pursuant to Art 22 GDPR. Decisions that have legal effects or similarly significantly affect the data subject are not made exclusively by automated means.

• 17.2

  No profiling (automated analysis of your usage behaviour for evaluation purposes) takes place.

18Children and Minors

• 18.1

  Our services are not directed at persons under 16 years of age. If we process data of minors in individual cases (e.g. family shoots), we obtain the consent of the legal guardians.

• 18.2

  Consent to the publication of images of minors always requires the written consent of both legal guardians.

19Changes to This Privacy Policy

• 19.1

  We reserve the right to amend this privacy policy at any time with effect for the future in order to adapt it to changed legal situations or changes in our data processing. The current version is available at /privacy.

• 19.2

  In the event of material changes, we will inform you by email if you are registered with us.

20Applicable Law and Contact

• 20.1

  Austrian data protection law (DSG) and the GDPR apply. This privacy policy is subject to Austrian law, excluding its conflict-of-laws provisions.

• 20.2

  If you have any questions about this privacy policy, exercising your rights or data protection concerns, please contact: Digital Minds Photography, Email: hello@digitalminds-photography.com, Website: /privacy | /disclaimer