Privacy Policy

Privacy Policy

Thank you for your interest in my website. This privacy policy explains which personal data I process when you visit my website and when you contact me, for what purpose and on which legal basis.

1. Controller The controller responsible for data processing on this website is: Tom-George Wolff, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany. Phone: +49 175 7531004. Email: kontakt@toms-photoart.de I have not appointed a data protection officer, as there is no legal obligation to do so.

2. Hosting and server log files This website is operated on my own servers in Berlin, Germany. No external hosting provider is involved, the data stays with me. When you visit the website, your browser automatically transmits information to the server, which is stored in so-called server log files: • IP address • date and time of access • page or file requested • amount of data transferred and HTTP status code • referrer URL (the page you visited before) • browser type, browser version and operating system This data is technically necessary to deliver the website and to ensure its stability and security, for example to defend against attacks. The legal basis is my legitimate interest under Art. 6(1)(f) GDPR. Log files are deleted after 12 months unless they are needed longer to investigate a specific security incident.

3. SSL/TLS encryption This website uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" in the address bar and the lock symbol in your browser. Data you send to me cannot be read by third parties.

4. Cookies My website only uses technically necessary cookies and browser storage: • grav-site-… (session cookie of the content management system Grav): required to operate the website, the contact form and the sign-in to the members area. Duration: 30 minutes after your last page view. • cg_model (only after signing in to the members area): contains no personal data, only the value "1". It makes sure that the entries "Your area" and "Log out" are shown in the navigation. Duration: until you close the browser or log out. • aperture-theme (local storage of your browser, not a cookie): stores whether you want to see the website in the light or dark design. The value stays in your browser and is not transmitted to me. Since no cookies requiring consent are set, I do not show a cookie banner. All fonts, scripts and stylesheets are loaded from my own server, my website does not embed external content from third parties. The legal basis for storage is Section 25(2) no. 2 TDDDG, for further processing Art. 6(1)(f) GDPR. I do not use analytics, tracking or advertising cookies. You can delete or block cookies in your browser at any time. Some functions such as the contact form may then not work.

5. Contact form If you write to me via the contact form, I process your name, your email address, the topic you selected (shoot, project or other), optionally your preferred time and the content of your message in order to answer your request. This information is required because otherwise I cannot reply to you. If your request is about a shoot or another collaboration, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). For other requests I rely on my legitimate interest in answering them under Art. 6(1)(f) GDPR. Security check: To protect against spam, I use a slider security check (captcha). It runs entirely on my own server, no data is transmitted to third parties. The legal basis is my legitimate interest in protection against abuse under Art. 6(1)(f) GDPR.

6. Contact by email or phone If you contact me by email or phone, I process the data you provide (e.g. name, email address, phone number, content of the request) to handle your request. The legal bases are the same as for the contact form.

7. Members area For my models as well as clients I provide a password-protected area ("Your area") through which I make photos from our shoots available for viewing, selection and download. In doing so I process: • access data: username, password (stored only as an encrypted hash) and the chosen language • your name and, if provided, your email address • the photos provided and the edited photos • your selection (favorites), your comments on individual images and the time at which you finished your selection • the time of your last visit, so that new images can be marked as "New" • technical access data (e.g. IP address, time of access) and, to protect against abuse, the number of failed sign-in attempts When you finish your selection or when I provide you with edited images, we notify each other by email (sent via my own mail server, see section 9). The same applies when you reset your password: I send a link, valid for two hours, to the email address on file. Before your job ends I remind you by email of the automatic deletion. The legal basis is the performance of our contract or pre-contractual measures under Art. 6(1)(b) GDPR. The members area runs on my own server. I delete photos, selection and access 12 months after the job is completed, unless we have agreed otherwise. In addition, I provide photos via my cloud (cloud.toms-photoart.de). It runs the Nextcloud software on my own server, the same purposes, legal bases and deletion periods apply.

8. Publication of photos On this website I show photos in which people are recognizable. Publication takes place exclusively on the basis of an agreement or the consent of the people depicted (Art. 6(1)(a) or (b) GDPR). If you appear in a photo and no longer want it to be published, please contact me at the address given above.

9. Disclosure of data and transfers to third countries I only pass on your data if this is necessary to perform a contract, if I am legally obliged to do so or if you have given your consent. I operate my email server myself on a rented server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Emails you send me are stored there. A data processing agreement under Art. 28 GDPR exists with Hetzner. No transfer to countries outside the EU/EEA takes place.

10. Storage period I store personal data only for as long as is necessary for the respective purpose. I delete contact requests as soon as the request has been finally processed, at the latest after [12] months. If a job is placed, I keep invoices and business-relevant correspondence in accordance with the statutory retention periods (up to ten years under Section 147 AO and Section 257 HGB). The storage period for log files and cookies can be found in the respective sections.

11. Your rights You have the following rights regarding your personal data: • right of access (Art. 15 GDPR) • right to rectification of inaccurate or completion of incomplete data (Art. 16 GDPR) • right to erasure (Art. 17 GDPR) • right to restriction of processing (Art. 18 GDPR) • right to data portability (Art. 20 GDPR) • right to withdraw consent given, with effect for the future (Art. 7(3) GDPR) To exercise your rights, an informal message to kontakt@toms-photoart.de is sufficient. Right to object under Art. 21 GDPR: Insofar as I process your data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims. Right to lodge a complaint with a supervisory authority: If you believe that the processing of your data violates the GDPR, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the federal state of your residence or at my place of business. The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

12. Automated decision-making Automated decision-making including profiling under Art. 22 GDPR does not take place.

13. Changes to this privacy policy I will adapt this privacy policy if my website or the legal requirements change. The version published here applies in each case. Last updated: October 2026