Privacy

This is a translation. The German version is legally binding: Datenschutz.

Controller

Daan Bachmann, c/o stark.marketing GmbH, Hans-Bunte-Straße 8, 69123 Heidelberg
Email: hi@daanbachmann.de, telephone: +49 178 5456372

Hosting with Cloudflare

The website is operated on my behalf by stark.marketing GmbH as a processor and delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you access the website, your browser transmits technically necessary data: IP address, date and time, the address requested, the previously visited page and the browser identifier. Cloudflare processes this data in order to deliver the site and protect it against attacks. If Cloudflare classifies a request as suspicious, a security check may appear, which sets a technically necessary cookie for this purpose. Logs used for troubleshooting are deleted after seven days at most.

The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in providing the website securely and reliably. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Cookies and browser storage

Without your consent, the website sets no cookies and uses no third-party analytics or advertising services. In that case, only page views are counted, with no link to individual visitors (see ‘Counting page views’). Google Analytics only runs if you consent to ‘Statistics’ in the banner (see ‘Google Analytics’), and the website remembers your choice there in your browser’s local storage. Further exceptions are the cookie for signing in to a client gallery and the basket for fine art prints (see below). Fonts and images are hosted on the same server, so no data is sent to Google Fonts or other third parties for them.

Counting page views

To see which pages are read and where visitors come across addresses that do not exist, I count the page views on this website. For this purpose, with every page view your browser reports to my web server which page was accessed (on the error page, also the address requested) and, when you click on a telephone number or email address, that a click took place. If you arrive at this website via a link from an AI assistant (ChatGPT, Perplexity, Microsoft Copilot or Google Gemini), your browser also reports the name of that service. It is read from the address of the previously visited page or from the link’s ‘utm_source’ parameter; the address itself is not transmitted. Only the date, the address of the page, the count and, where applicable, the name of the AI assistant are stored. Your IP address, your browser identifier and the previously visited page are not stored for this purpose, no cookie is set and no identifier is assigned; no conclusions can be drawn about individual visitors. The IP address is processed only for the technical purpose of transmitting the report. The counting is carried out by stark.marketing GmbH as a processor; the figures are stored with Cloudflare in the EU and deleted after 25 months. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in knowing the reach of my website, fixing errors such as pages that cannot be found, and seeing whether our website is found via AI assistants.

Google Analytics

If you consent to ‘Statistics’ in the banner, I use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This lets me see how visitors reach this website, which pages they view and whether they click on my email address or telephone number. To do this, your browser loads a script from Google and sets cookies (‘_ga’ and ‘_ga_…’) that recognise your browser on later visits for up to two years. The data transmitted includes the pages viewed, the previously visited page, date and time, information about the browser, device and screen, the approximate location that Google derives from the IP address (Google Analytics does not store the IP address itself), and clicks on the email address and telephone number. Google Signals, advertising features and the sharing of data for Google’s own purposes are switched off. The data is deleted after 14 months. Aggregated figures derived from it, without information about individual visitors, are also shown to me in the client area of stark.marketing GmbH.

Google processes the data as a processor under the Google Ads Data Processing Terms. Data may be transferred to the USA in the process; Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR and, for the cookies, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Without consent, the website loads nothing from Google. The website stores your choice in your browser’s local storage for 180 days (the choice and when it was made), after which it asks again. You can withdraw your consent at any time with effect for the future: Change selection. When you withdraw consent, the website deletes the Google Analytics cookies and reloads the page.

Client galleries

I provide photos for my clients in password-protected galleries (daanbachmann.de/galerie/…). The galleries are operated on my behalf by stark.marketing GmbH as a processor; photos and galleries are stored in Cloudflare’s R2 storage service, restricted to the European Union. Anyone who enters the password receives a technically necessary cookie that keeps them signed in to that one gallery for 30 days. It contains no personal information and is deleted when you click ‘Sign out’. If you select photos in a gallery, I store this selection (the name of the set and the photos chosen) with the gallery and, in selection galleries, also your labels and comments on the photos, so that I can see them and edit or deliver the photos. Earlier versions of these are kept for 30 days as a backup.

To protect against passwords being guessed by trial and error, Cloudflare counts sign-in attempts per IP address, for one minute at a time. In addition, I store incorrect password entries so that sign-in can be blocked for a while after several failed attempts: instead of the IP address, only a pseudonymised short code calculated from it, together with the number of failed attempts and the time of the most recent one. This is deleted upon the next successful sign-in, or 24 hours after the last failed attempt at the latest. I also count sign-ins, views and downloads per gallery and per day, without IP addresses or any other personal information, so that I can see whether the photos have been received. This information is also stored with Cloudflare, restricted to the European Union.

The legal basis is Art. 6(1)(b) GDPR, the performance of the commission, and, for protecting the galleries and counting, Art. 6(1)(f) GDPR. I delete a gallery together with its photos, its selection and its figures as soon as it is no longer needed for the commission.

Orders for fine art prints and photo books

In some client galleries, fine art prints of the photos can be ordered, as can a photo book made from a set. The seller and the controller for the order data is stark.marketing GmbH, Hans-Bunte-Straße 8, 69123 Heidelberg, email info@stark.marketing. Until you place an order, the basket is stored only in your browser (local storage, per gallery); it is not sent to the server until you order. For an order, the selected photos, formats and quantities (for a photo book, the photos and the name of the set), your name, your delivery address and your email address are processed. The order is stored in Cloudflare’s R2 storage service, restricted to the European Union.

Payment is made via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your delivery address and payment details on Stripe’s payment page. Stripe also processes them as a controller in its own right, for example to prevent fraud, and data may be transferred to the USA in the process; Stripe is certified under the EU-US Data Privacy Framework. Only the name, delivery address, email address and whether payment has been made are received from Stripe, no card or account details.

Prints and photo books are printed and dispatched on behalf of Prodigi B.V. (Netherlands), whilst photo books are produced at a Prodigi partner laboratory in Germany: Prodigi receives the photos ordered (for photo books, as a print file containing the gallery title and the name of the set), your name and your delivery address, and passes your name and address on to the delivery service. Order confirmations and dispatch notifications are sent to you via Cloudflare’s email service. For every order, I receive a message containing your name, your delivery address and your email address.

The legal basis is Art. 6(1)(b) GDPR, the performance of the purchase contract, and, for retaining the records, Art. 6(1)(c) GDPR (retention obligations under commercial and tax law). Unpaid orders are deleted after 24 hours, or after three days at the latest. For paid orders, your name, your delivery address, your email address and the photos ordered are deleted 25 months after dispatch, once the statutory warranty period has expired; anything that has to be kept as a record (order number, date, formats, amounts) is deleted eight years after the end of the year in which payment was made.

Email and telephone

If you write to me or call me, I process your details in order to respond to your enquiry: for enquiries about a commission under Art. 6(1)(b) GDPR, otherwise under point (f). Emails to hi@daanbachmann.de are received by Cloudflare (see ‘Hosting with Cloudflare’) and forwarded to my mailbox at stark.marketing GmbH, which also issues the quotation and invoice for a commission. The mailbox is hosted on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to the USA in the process; Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Messages are deleted once they have been dealt with and no statutory retention obligation applies.

Links

Instagram, the clients’ websites and the manufacturers listed on the ‘Photo hardware’ and ‘Photo software’ pages are linked to but not embedded. You will only leave this page once you click on the link; the privacy policy of the respective provider applies there.

Your rights

You have the right of access, to rectification, to erasure and to restriction of processing, the right to data portability and the right to object to processing based on Art. 6(1)(f) GDPR (Articles 15 to 21 GDPR). A message to hi@daanbachmann.de is sufficient. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

Last updated: October 2026