Privacy policy

Draft. This text must be reviewed by a lawyer before publication. Please complete the details in [square brackets] in the admin area. Only the German version is legally binding.

1. Controller

[First and last name], LensMoments, [address], email: [[email protected]]

2. What data we process and why

Visiting the website. When you visit, our server processes technically necessary data (IP address, time, page requested, browser). Purpose: providing and securing the website. Legal basis: Art. 6 (1) (f) GDPR.

Orders. Name, email, phone, billing and delivery address, company and VAT ID (if given), ordered products and payment status. Purpose: performing the contract, delivery, invoicing. Legal basis: Art. 6 (1) (b) and (c) GDPR.

Customer account. If you create an account: login details, saved addresses, orders, downloads. Legal basis: Art. 6 (1) (b) GDPR. You can have your account deleted at any time.

VAT ID check. We check a VAT ID you enter with the European Commission's VAT Information Exchange System (VIES). Legal basis: Art. 6 (1) (c) GDPR.

Comments and messages. Content you publish or send to photographers. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Newsletter. Only with your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time.

3. Recipients

We only pass on data where needed for your order or where you have consented:

• Hosting: [provider and server location]
• Delivery and protection of the website: Cloudflare, Inc. (content delivery, abuse protection)
• Payment service providers: depending on the method chosen, e.g. Stripe Payments Europe Ltd., PayPal (Europe) S.à r.l. et Cie, S.C.A., Klarna Bank AB
• Print partners: for prints, name, delivery address and phone, e.g. Prodigi Group Ltd.
• Carriers: name, delivery address and, where needed, email and phone for delivery
• Photographers: the order data needed to fulfil the order
• Email delivery: [provider]
• Chat: TalkJS (talkjs.com), if you send messages

Processors are bound by contracts under Art. 28 GDPR. Transfers to third countries are covered by appropriate safeguards (adequacy decision or standard contractual clauses).

4. Cookies

We only use technically necessary cookies, e.g. for the cart, language, currency, sign-in and your cookie choice. Legal basis: § 25 (2) TDDDG, Art. 6 (1) (b) and (f) GDPR. There is no tracking.

5. Retention

We delete data as soon as it is no longer needed. We keep invoices and accounting records for up to ten years (§ 147 AO, § 257 HGB).

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. You can lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for [federal state].