Privacy Policy

This is an English translation of our German privacy policy (Datenschutzerklärung). In case of doubt, the German version applies.

1. Introduction

This website is operated by Regina Kaiser (Regina Kaiser Photography). Protecting your personal data matters to us. Below we explain in clear language which data we process on this website, why, on what legal basis and what rights you have under the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. General information

2.1 Controller

The controller responsible for data processing on this website is:

Regina Kaiser
Regina Kaiser Photography
Stiftsbogen 45
81375 München, Germany

Email: regina.kaiser2020@gmail.com
Phone: +49 176 21770087

2.2 Legal bases

We process personal data only where a legal basis applies under Art. 6(1) GDPR, in particular: (a) your consent; (b) the performance of a contract or steps prior to entering into a contract at your request; (c) a legal obligation; (f) our legitimate interests, provided your interests or fundamental rights do not override them. For each processing activity below we state the specific legal basis.

2.3 Recipients and deletion

We only share data where there is a legal basis and it is necessary, in particular with service providers who process data on our behalf under a data processing agreement (Art. 28 GDPR). We delete data as soon as the purpose and legal basis for processing cease to apply, unless statutory retention obligations require otherwise.

2.4 Hosting

Wfolio

This website and our online client galleries are run on the website builder and hosting service Wfolio, provided by Wfolio Software LLC FZ, based in the United Arab Emirates (“Wfolio”). Each time you visit the website, Wfolio processes the server log data listed in section 3.1, in particular IP address, date and time of access, page requested, referrer URL, browser type and operating system. Wfolio also stores the content you submit through our forms (enquiries and reviews) as well as the photos and usage data of our client galleries (section 3.7). Wfolio processes this data as our processor under Art. 28 GDPR and on our instructions.

The purpose is the technical operation and delivery of the website, its security and stability, and the handling of your enquiries. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely and reliably. Where data is processed to enter into or perform a contract, the legal basis is Art. 6(1)(b) GDPR.

Wfolio is based outside the European Union. According to Wfolio, data is stored and processed on servers in several countries, including the EU, the USA and Hong Kong. There is no EU adequacy decision for the United Arab Emirates or Hong Kong. Transfers are therefore based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which Wfolio states it uses.

Fonts and icons are loaded directly from our own server. No connection is made to Google or other font providers.

More information: https://wfolio.com/legal-privacy

DDoS-Guard

To protect against overload (DDoS) attacks and abusive access, Wfolio routes our website traffic through the security service DDoS-Guard. Your IP address and technical connection data are processed for this purpose. DDoS-Guard sets the strictly necessary cookies __ddg8_, __ddg9_ and __ddg10_ (section 3.2). DDoS-Guard is a service provider of Wfolio; processing may take place outside the European Union. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security and availability of our website. More information: https://ddos-guard.net

3. What happens on our website

We use SSL/TLS encryption to protect your data in transit. You can recognise it by “https://” and the lock icon in your browser’s address bar.

3.1 Server log files

When you visit the website, the following information is automatically stored in server log files: browser type and version, operating system, referrer URL, host name of the accessing device, time of the request and IP address. This data is needed to display the website and to ensure its security and stability and to fix errors. The legal basis is Art. 6(1)(f) GDPR. The retention period follows the settings of our host Wfolio; the data is deleted as soon as it is no longer needed for these purposes, unless a security incident requires longer storage until it has been resolved. The data is not combined with other data.

3.2 Cookies

Cookies are small data records stored in your browser. We use only strictly necessary cookies:

• __ddg8_, __ddg9_, __ddg10_ (DDoS-Guard, via our host Wfolio): protection against attacks and automated access. The cookie __ddg9_ contains your IP address. Storage period: about 20 minutes.

• Cookies and local storage in our client galleries (Wfolio Drive): for example to give access to a password-protected gallery or to remember your selection of favourite images. Storage period: depending on the function, until the end of the session or until you delete the data in your browser.

The legal basis for storing these cookies is § 25(2) no. 2 TDDDG; no consent is required. The related processing of personal data is based on Art. 6(1)(f) GDPR or, in the client galleries, Art. 6(1)(b) GDPR.

We do not use any non-essential cookies, in particular no analytics, marketing or tracking services such as Google Analytics or the Meta Pixel. This is why we do not show a cookie banner. Should we use such services in future, we will only do so with your prior consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG) and will update this policy.

You can block or delete cookies in your browser settings at any time. Blocking strictly necessary cookies may affect how the website works.

3.3 Contact form

When you send us an enquiry via the contact form, we process the information you enter: your name, your email address or phone number and your message (for example date, place and type of the session you would like). The form is provided by our host Wfolio (section 2.4); your enquiry is stored there and forwarded by email to our inbox.

Our email inbox is provided by Google (Gmail), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. More information: https://policies.google.com/privacy

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry. We delete your enquiry once it has been fully dealt with, unless statutory retention obligations (for example for business correspondence) apply.

3.4 Email and phone

If you contact us by email or phone, we process the data you provide (such as your email address, phone number and the content of your message) to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted once the purpose no longer applies and statutory retention periods permit.

3.5 WhatsApp and Telegram

You can also message us via WhatsApp or Telegram. If you do, we process your phone number, your profile name and, where applicable, your profile picture as well as the content of your messages in order to reply. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR.

Your messages are also processed by the respective provider; we have no influence on this processing, and data may be transferred to countries outside the EU. If you do not want this, please contact us by email or via the contact form instead.

• WhatsApp: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – https://www.whatsapp.com/legal/privacy-policy-eea

• Telegram: Telegram Messenger Inc.; EU representative: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium – https://telegram.org/privacy

3.6 Reviews

On our “Kind words” page you can submit a review, which may then be published on our website. We process: your name, optionally a link to your social media profile, your review text and optionally a profile photo you upload. The data is stored with our host Wfolio (section 2.4). Your name, photo and review text are published and visible to everyone who visits the website. Please only upload a photo that shows yourself.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by submitting the review. You can withdraw your consent at any time with effect for the future, for example by email to regina.kaiser2020@gmail.com. We will then remove your review without delay and delete the related data.

3.7 Online client galleries (Wfolio Drive)

If you have booked a session with us, we deliver your photos in a protected online gallery via Wfolio Drive. We process the photos from your session (showing you and possibly other people), your name or the gallery name and, where applicable, your email address for access, as well as gallery usage data such as views, downloads and images marked as favourites.

The purpose is the delivery of the agreed photos. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The gallery is provided by our host Wfolio (section 2.4). Please only share your gallery password with people who are allowed to see the photos. The gallery stays online for the period agreed in the contract and is deleted afterwards; statutory retention obligations remain unaffected.

3.8 Links to social networks, contact card and sharing

Our website links to our Instagram profile and to WhatsApp and Telegram. The contact card (icon at the bottom right) contains links to Instagram and WhatsApp and lets you save our contact details as a file (vCard). The share function lets you share a page via Facebook, WhatsApp, Telegram or Viber.

These are simple links, not embedded plugins. No data is sent to Meta, Telegram or Viber when you visit our website. Only when you click a link are you taken to the respective provider, which then processes your data (for example your IP address and, if applicable, your user account) under its own privacy policy:

• Instagram (and Facebook, only if you use the share function): Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – https://privacycenter.instagram.com/policy

• WhatsApp and Telegram: see section 3.5

• Viber: Viber Media S.à r.l., Luxembourg – https://www.viber.com/en/terms/viber-privacy-policy/

3.9 Our Instagram profile

We maintain an Instagram profile, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When you visit or interact with our profile, we process the data that is publicly available on your profile and the personal data contained in your comments, posts or direct messages to us. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in presenting our work and communicating with you) or, where your request relates to a contract, Art. 6(1)(b) GDPR.

Meta provides us with aggregated, anonymous statistics (“Insights”) about how people interact with our profile. We cannot identify individual people from them. For this processing we are jointly responsible with Meta under Art. 26 GDPR; the joint controller agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum. Meta itself processes your data, uses cookies and may transfer data to the USA. More information: https://privacycenter.instagram.com/policy.

4. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15 GDPR)

• rectification of inaccurate data (Art. 16 GDPR)

• erasure (“right to be forgotten”, Art. 17 GDPR)

• restriction of processing (Art. 18 GDPR)

• data portability (Art. 20 GDPR)

• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, and to direct marketing at any time (Art. 21 GDPR)

• withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR)

• lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, simply contact us using the details in section 2.1. The supervisory authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.

5. Changes to this policy

This privacy policy was last updated on 31 October 2026. We may update it to reflect changes in our services or in the law. The current version is always available on this page.

Based on a privacy policy created with Dieter macht den Datenschutz