Data Protection Policy (Datenschutz)

1. Introduction

At Claire Hambley Photography we take the privacy and protection of personal data seriously. This policy explains how we collect, process, and protect the personal data of clients, models, and other individuals in relation to our photography services. Our practices comply with the General Data Protection Regulation (GDPR) and other relevant data protection laws.

2. Name and Contact Information of the Controller

The controller responsible for processing personal data in relation to our photography services is:

Claire Hambley Photography
Claire Hambley
Zum Ausspann 11b
22419, Hamburg. DE

E-Mail: claire@claireh.photography

If you have any questions regarding this policy or your personal data, please contact us using the above details.

3. Scope of Data Collection

In the course of providing photography services, we may collect the following types of personal data:

  • Personal Identification Data: Name, address, email address, phone number.
  • Photography and Videography Data: Photos, videos, and other imagery taken during events or photoshoots.
  • Contract Data: Information necessary to fulfill our contractual obligations, such as event details, locations, and client preferences.
  • Usage Data: Information about your interactions with our website, such as IP addresses, browser types, and pages visited (if applicable).

4. Purposes of Data Processing

We process personal data for the following purposes:

  • Service Provision: To deliver the photography services you have contracted us for, including editing, printing, and delivering photographs.
  • Marketing and Portfolio Use: With your explicit consent, we may use images for promotional purposes on our website, social media, or portfolio (Article 6(1) (a) GDPR).
  • Contractual Obligations: To fulfill our contract with you and manage billing and payments (Article 6(1) (b) GDPR).
  • Legal Obligations: To comply with tax and legal record-keeping requirements (Article 6(1)© GDPR).
  • Legitimate Interests: To maintain client relationships, respond to inquiries, and improve our services (Article 6(1) (f) GDPR).

5. Legal Basis for Data Processing

We process your personal data based on the following legal grounds:

  • Consent (Article 6(1) (a) GDPR): If you provide us with explicit consent to use your photos or videos for marketing purposes, such as on social media or our website.
  • Contractual Necessity (Article 6(1) (b) GDPR): When data is necessary for fulfilling our contract with you, such as event planning or photography delivery.
  • Legal Obligation (Article 6(1)© GDPR): When processing is required to comply with legal obligations, such as invoicing and record-keeping.
  • Legitimate Interest (Article 6(1) (f) GDPR): When necessary for legitimate business interests, such as improving our services or handling client inquiries, provided your rights do not override these interests.

6. Photography and Videography Consent

Photographs and videos taken during sessions may be considered personal data if individuals can be identified. We will always seek explicit consent from clients and subjects before using any images for marketing or promotional purposes, unless otherwise agreed in the contract.

Clients have the right to object to the use of their images at any time. This can be done by contacting us at claire@claireh.photography.

7. Sharing and Disclosure of Personal Data

We do not share personal data with third parties without your consent, except in the following situations:

  • Service Providers: We may share data with third-party service providers involved in the production, editing, printing, or delivery of photographs, such as print labs or cloud storage providers, under GDPR-compliant data processing agreements.
  • Legal Obligations: We may disclose data to comply with legal obligations, such as tax authorities or courts, when required by law.
  • Transfers Outside the EEA: If personal data is transferred outside the European Economic Area (EEA), we will ensure that the recipient country offers an adequate level of data protection or that appropriate safeguards, such as Standard Contractual Clauses (SCCs), are in place.

8. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected. This includes:

  • Photography Data: Stored for the duration of the project and any mutually agreed follow-up services, and longer with your consent (e.g., for portfolio, social media use).
  • Contractual and Billing Data: Retained in accordance with legal and fiscal retention periods (e.g., 6-10 years for tax purposes).
  • Marketing Data: Retained as long as we have your consent or until you withdraw consent.

When data is no longer necessary, it is securely deleted or anonymized.

9. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

  • Right to Access (Article 15 GDPR): You can request access to the personal data we hold about you.
  • Right to Rectification (Article 16 GDPR): If any data is inaccurate or incomplete, you can ask us to correct or update it.
  • Right to Erasure (Right to Be Forgotten) (Article 17 GDPR): You have the right to request the deletion of your personal data, particularly images, unless they are required for legal or contractual reasons.
  • Right to Restriction of Processing (Article 18 GDPR): You can request that the processing of your data be restricted in certain cases.
  • Right to Data Portability (Article 20 GDPR): You can request that your data be provided in a structured, machine-readable format or transferred to another controller.
  • Right to Object (Article 21 GDPR): You can object to the processing of your data for specific purposes, such as marketing.
  • Right to Withdraw Consent (Article 7(3) GDPR): You can withdraw your consent for data processing at any time.

To exercise any of these rights, please contact us at claire@claireh.photography. We will respond to your request within one month, as required by GDPR.

10. Security of Your Data

We take appropriate technical and organisational measures to ensure the security of your personal data, including the protection of photographs and videos, both during transmission and while stored. However, no system is completely secure, and we cannot guarantee absolute security of your data.

11. Use of Cookies and Tracking Technologies

Our website may use cookies and similar technologies to enhance user experience, track site performance, and gather analytics. Cookies are small text files stored on your device. You can control and delete cookies through your browser settings, though some functionality of the website may be affected.

For more information, please see our Cookie Policy.

12. Complaints

If you believe your data has been processed unlawfully or you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority in your country.

13. Changes to This Data Protection Policy

We reserve the right to amend this data protection policy to reflect changes in our practices or legal requirements. Any updates will be posted on this page, and we encourage you to check this policy periodically.

EN
DE