Privacy policy

Who is responsible

The controller for data processing on this website is Frank Fischbach, Frank Fischbach Photography, Lorenzstraße 18, 76135 Karlsruhe, Germany. Email: info@frank-fischbach.de.

In short

I only process data this website needs to work, or that you send me yourself. There is no advertising here and no tracking across other websites. The details are below.

Hosting and delivery

The website runs on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. With every visit, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, the page you came from, and your browser and operating system. Without these, no page can be delivered and the site can't be protected against attacks. Every connection is encrypted with HTTPS.

Your IP address is also used to limit the number of requests per visitor, so automated traffic can't bring the site down. It is not stored for this. Photos, galleries and page content are kept in Cloudflare's database (D1) and storage (R2).

The legal basis is my legitimate interest in a secure, fast and reliable website (Art. 6(1)(f) GDPR). Cloudflare processes the data on my behalf (Art. 28 GDPR) and may do so in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). More: Cloudflare's privacy policy.

Fonts (Adobe Fonts)

The text typeface comes from Adobe Fonts, a service of Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Your browser loads it from Adobe's servers when you open a page. Adobe learns your IP address, which it says it does not store, and the name of this website. Adobe sets no cookies for this and counts requests only to bill the font licence, which doesn't allow me to serve the font myself. The headline typeface is served by this website itself.

The legal basis is my legitimate interest in a consistent design (Art. 6(1)(f) GDPR). Adobe may transfer data to the USA. Adobe is certified under the EU-US Data Privacy Framework. More: Adobe Fonts and privacy.

Contact form

When you write to me through the form, I store your email address, your message and, if given, your name and subject, along with the page language and the time, in the website's database (Cloudflare D1). I also receive the message as an email, sent through Resend (Plus Five Five, Inc., USA; certified under the EU-US Data Privacy Framework).

To keep out spam, Cloudflare Turnstile checks on the contact page that a person is sending the form. Turnstile processes your IP address and technical features of your browser for this, not for advertising.

The legal basis is preparing a contract, such as a shoot (Art. 6(1)(b) GDPR), and otherwise my legitimate interest in answering enquiries and keeping out spam (Art. 6(1)(f) GDPR). I delete your message once it's dealt with, unless the law requires me to keep it.

Moodboard links

When I send you a moodboard through a personal link, I store with that link your name, how often and when it was last opened, and which images you mark with a heart. That way I see which ideas you like. The legal basis is preparing our shoot (Art. 6(1)(b) GDPR). I delete the data together with the link.

Private section

After you log in to the password-protected section, a cookie keeps you logged in for 30 days. Failed logins are kept for one hour, with an irreversible code of your IP address rather than the address itself, to slow down password guessing (Art. 6(1)(f) GDPR).

What the website stores in your browser

• lang (cookie, 1 year): the language you picked with DE/EN.
• ff-adult-until (local storage, 30 days): that you confirmed you are at least 18 at the entrance to the Sensual section.
• __Host-ff_private (cookie, 30 days): your login to the private section.

Apart from Google's cookies, these entries are needed for features you use yourself, so they need no consent (§ 25(2) no. 2 TDDDG).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21) and withdraw consent at any time (Art. 7(3)). Just write to me at info@frank-fischbach.de.

You can also complain to a data protection authority, for example the one responsible for me: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

There is no automated decision-making within the meaning of Art. 22 GDPR.