Privacy policy

The provider named in the legal notice, reachable at ff@4d49.io.

The website is hosted by Vercel Inc. (USA). When you open a page, the server processes your IP address, the date and time, the requested address, the referring page and your browser and device type. This is needed to deliver the site and to keep it secure (Art. 6(1)(f) GDPR, legitimate interest). Vercel keeps such logs for a limited time. Data can be transferred to the USA; Vercel relies on the EU-US Data Privacy Framework and standard contractual clauses for this.

I use Vercel Web Analytics to count page views and see roughly where visitors come from (country, referrer, browser type). It works without cookies and without storing an identifier on your device (Art. 6(1)(f) GDPR, legitimate interest in understanding how the site is used).

The website stores only what it needs to work: your light or dark theme choice, whether you confirmed that you are 18 or older (kept for 30 days, only to skip the question) and, if you use the photo consent form, the photographer details you typed in so you do not have to enter them again. The consent form creates its PDF in your browser; what you type into it is not sent to a server. Nothing is used for tracking or advertising. You can delete this data in your browser settings at any time.

Fonts are served from this website itself; your browser does not contact Google. Preview pictures of the portfolio come from my own photo server and are loaded through this website. If you click a gallery link, that server opens and processes your IP address in its access logs like any web server.

If you write to ff@4d49.io, I process your message and your email address only to answer you and to prepare or run a shoot (Art. 6(1)(b) or (f) GDPR) and delete it when the matter is settled, unless I am legally required to keep it (for example business correspondence and invoices).

The contact form works in two steps. When you submit it, your topic, name (optional), email address, optional link and message are kept temporarily in a database (Neon) and a confirmation email is sent to the address you gave. Nothing reaches me yet. If you do not click the confirm button, the draft is deleted automatically after 24 hours. Once you confirm, the message is emailed to me and the draft is deleted at once. Emails are delivered by the service Resend (Resend, Inc., USA), which only transmits them.

To limit spam and abuse, a hidden form field is checked and the number of submissions per IP address and per email address is counted in hashed form for one hour. By ticking the box you confirm that you have read this section.

Photos of recognisable people are published only with their consent, or where the law allows it. You can withdraw a consent at any time with effect for the future; write to ff@4d49.io or use the contact form. A template consent form is available at /consent.

If I photograph you and you agree to the use of the photos, I keep a record of that consent so that I can prove it and honour a withdrawal (Art. 6(1)(c) and (f) GDPR together with Art. 7(1) GDPR). The record holds your name, your email address if you gave one, the place or event and date, the ways the photos may be used, the exact wording you agreed to and the dates of consent and withdrawal. If you confirm online, the name you type and the signature you draw are stored as well (as an image), together with a hashed form of your IP address, not the address itself. Because the photos can allow conclusions about your sex life or sexual orientation (special categories under Art. 9 GDPR), the form asks for your explicit consent to that; whether you ticked it is stored too. After you confirm you and I each get a PDF copy of the signed record by email, and you can download it again through your link. Consents you give on paper are entered by hand.

The records are stored in a database at Neon (Neon, Inc., USA; the database runs in the EU) and are only visible to me behind a login. Emails about your consent (the link, the confirmation and a note when you withdraw) are sent through Resend. I keep a record for as long as the consent applies and for up to three years after a withdrawal, so that I can still show what was agreed; then it is deleted automatically. A request that is never confirmed is deleted after 90 days. If you decline an online request, nothing is kept.

To keep several shoots and consents of the same person together, I keep a small list of the people I photograph (name, email address if given, a note) and of shoots (title, place, date). Consents keep their own copy of these details, so they stay provable even if the list changes. The legal basis and the storage are the same as for the consent records above.

If you tick that the photos may appear in the media of Tauwerk e.V. (website or print), I pass the photos to this association for that purpose only. You can withdraw that consent like any other.

Links to other websites and services only take you there when you click them. From then on the privacy policy of that service applies.

You have the right to access, correction, deletion, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw a consent you gave. Write to ff@4d49.io for any of these. You can also complain to a data protection authority, for example in your country of residence.