Privacy policy

Updated: 5 October 2026

Controller

Sören Eberhardt-Biermann · S.E.B. Fotografie
Schweriner Str. 15, 19306 Neustadt-Glewe, Germany
Telephone: 0173 / 926 6802
Email: soeren@sebfoto.de

Website, hosting and server logs

The website, email and our own galleries are hosted with Hetzner Online GmbH. Access generates technical data, including IP address, time, requested URL, browser and, where available, referrer. Delivery, diagnostics and abuse prevention are based on Article 6(1)(f) GDPR. Server logs are deleted after three months.

Contact and enquiries

I process your contact details, message and any event date, location or requested services to answer and prepare an offer. Article 6(1)(b) GDPR applies to contractual enquiries and Article 6(1)(f) to other correspondence. An enquiry or waiting-list entry is not a binding booking. Required fields are marked; without the necessary contact data I cannot reply. Messages are deleted when no longer needed; contractual and business documents remain subject to statutory retention periods.

WhatsApp as an optional contact channel

If you contact me through WhatsApp, WhatsApp Ireland Limited also processes your phone number and communications and connection data under its own terms. Processing outside the EU may occur. Email, telephone and our contact form are alternatives. My processing to handle your message is based on Article 6(1)(b) or (f) GDPR. See the WhatsApp privacy policy.

Matomo: analytics with and without analytics cookies

Matomo runs on piwik.sebfoto.de to analyse website use and technical functioning, including page views, referrers and browser and device information. Cookieless analytics starts before you choose a cookie setting and continues with “Only necessary”, based on Article 6(1)(f) GDPR and the interest in a useful, functioning website. “Accept all” additionally enables analytics cookies on the basis of consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Your selection is stored for 180 days. Use “Cookie settings” in the footer to change it and withdraw cookie consent for the future. “Only necessary” does not stop cookieless analytics. You may object to processing based on legitimate interests for reasons relating to your particular situation by contacting me. Cookieless does not mean no personal data is processed.

IP addresses are shortened before storage: for IPv4, the last two bytes are masked; location enrichment also uses the shortened address. Deletion of visit-level raw data older than one day is enabled and runs at seven-day intervals. Raw data may therefore remain until the next deletion run. Deletion of older reports after nine months is enabled, excluding the current month. Monthly and yearly reports and aggregated basic metrics are exempt from this deletion and retained without a fixed automatic deletion period. These analytics periods are separate from three-month server logs and the gallery retention periods.

Technically necessary storage

Session and security cookies support login, shopping carts, forms and request forgery prevention. Their use is required for these functions (section 25(2) TDDDG). Processing is based on Article 6(1)(b) GDPR for contractual functions and Article 6(1)(f) for secure operation.

Wedding photography and own galleries

Client data is processed to prepare and perform the contract under Article 6(1)(b) GDPR. Guests may also appear in photographs. The couple’s contract alone is not a legal basis for guests who are not parties to it: documenting the event is based on an assessment of legitimate interests under Article 6(1)(f), where separate consent or another applicable basis is not required. Please tell me if you do not wish to be photographed. Children’s interests require particular care. Public website or social-media use is separate from the commission and requires separate permission from the people pictured or their legal guardians.

Gallery access and deletion periods

Wedding galleries are available to the couple for six months and deleted no later than one year after the wedding. Photobooth galleries are deleted after six months. Galleries and Fotospiel are self-hosted with Hetzner. Sharing a gallery link can give access to photographs of other people; share it deliberately. Photo originals and backups are deleted after two years. These archive periods do not apply to invoices and other records subject to statutory retention. Retention necessary for specific legal claims is assessed separately.

Shop, photobooth and external links

The shop privacy notice covers accounts, orders, payment, downloads and calendar shipping. The photobooth privacy notice describes photobooth processing including optional AI images. Clicking external links, such as YouTube, WhatsApp or social profiles, takes you to services operated by other controllers and subject to their own notices.

Your rights

Under the GDPR you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), subject to their applicable conditions. Consent can be withdrawn for the future without affecting earlier lawful processing. Contact soeren@sebfoto.de. You may complain to a supervisory authority, including the data protection authority of Mecklenburg-Western Pomerania. We do not make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR.