DE

Privacy policy

Last updated: 9 November 2026

1. Controller

Controller within the meaning of Art. 4(7) GDPR: Frank Fischbach, Frank Fischbach Photography, Lorenzstraße 18, 76135 Karlsruhe, Germany, email: info@frank-fischbach.de.

No data protection officer has been appointed; there is no obligation to appoint one under Art. 37 GDPR and § 38 BDSG.

2. Provision of the website

  • Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (hosting, content delivery network, Cloudflare D1 database, Cloudflare R2 storage).
  • Data processed: IP address, date and time of access, URL requested, referrer URL, browser type and version, operating system.
  • Purposes: delivery of the website, network and information security, defence against attacks, limiting requests per IP address (rate limiting).
  • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is the secure and uninterrupted provision of the website.
  • Retention: the controller keeps no server log files. The IP address is not stored for rate limiting.
  • Recipient: Cloudflare, Inc. as processor (Art. 28 GDPR).
  • Transfer to third countries: processing in the USA is possible. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (Art. 45(1) GDPR).

All connections are TLS encrypted. Provider's privacy policy: cloudflare.com/privacypolicy.

3. Cloudflare Web Analytics

  • Provider: Cloudflare, Inc. (see Provision of the website).
  • Data processed: URL requested, referrer URL, browser, operating system, screen size, loading times. No cookies are set, no information is stored on the device and no cross-site profiles are created.
  • Purpose: statistical analysis of use in aggregated form. The password-protected section and moodboard links are excluded.
  • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is analysing and improving the website.
  • Transfer to third countries: as under Provision of the website.

4. Google Analytics

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Data processed: pages visited, time spent, referrer URL, device, browser, language setting, approximate location (derived from the IP address; Google Analytics 4 does not store the IP address itself). Google signals and advertising features are disabled.
  • Cookies: _ga, _ga_<ID> with an identifier, retained for up to 2 years.
  • Purpose: audience measurement and analysis of use. The password-protected section and moodboard links are excluded.
  • Legal basis: consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent, no connection to Google is made.
  • Retention: usage data is deleted after 2 months.
  • Withdrawal: at any time with effect for the future (Art. 7(3) GDPR), via “Information” › “Cookies” at the bottom of the page or the button below. On withdrawal, the Google Analytics cookies are deleted.
  • Transfer to third countries: transfer to Google LLC, USA, is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45(1) GDPR).

Provider's privacy policy: policies.google.com/privacy.

5. Adobe Fonts

  • Provider: Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland.
  • Data processed: IP address (not stored, according to the provider), name of the website, request data for billing the font licence. No cookies are set.
  • Purpose: consistent display of the text typeface. The licence does not permit serving the font from the controller's own server.
  • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is a consistent design of the website.
  • Transfer to third countries: transfer to the USA is possible. Adobe is certified under the EU-US Data Privacy Framework (Art. 45(1) GDPR).

Provider's privacy policy: adobe.com/privacy/policies/adobe-fonts.html.

6. Contact form

  • Data processed: email address, message, optionally name and subject, page language, time of submission.
  • Storage and recipients: Cloudflare D1 database (Cloudflare, Inc., processor); forwarding by email via Resend (Plus Five Five, Inc., USA, processor, certified under the EU-US Data Privacy Framework).
  • Spam protection: Cloudflare Turnstile. It processes the IP address and technical characteristics of the browser, not for advertising purposes.
  • Purpose: handling the enquiry.
  • Legal basis: Art. 6(1)(b) GDPR where the enquiry aims at concluding a contract; otherwise Art. 6(1)(f) GDPR. The legitimate interest is answering enquiries and preventing spam.
  • Retention: deleted once the enquiry has been dealt with, unless statutory retention obligations apply (§ 147 AO, § 257 HGB).

Providing an email address and a message is required to handle the enquiry.

7. Moodboard links

  • Data processed: name of the recipient of a personal link, number and time of the latest views, images marked.
  • Purpose: preparation of a photo shoot.
  • Legal basis: Art. 6(1)(b) GDPR.
  • Retention: deleted together with the link.

8. Password-protected section

  • Data processed: login status (cookie, 30 days); for failed logins, an irreversible hash of the IP address, retained for one hour.
  • Purposes: providing content to authorised users; protection against password guessing.
  • Legal basis: Art. 6(1)(b) GDPR; for protection against password guessing, Art. 6(1)(f) GDPR.

9. Storage of information on the device

  • lang (cookie, 1 year): selected language.
  • ff-adult-until (local storage, 30 days): confirmation of legal age for the Sensual section.
  • __Host-ff_private (cookie, 30 days): login to the password-protected section.
  • ff_consent (local storage, 1 year): decision on consent to Google Analytics.
  • _ga, _ga_<ID> (cookies, up to 2 years): require consent (§ 25(1) TDDDG), see Google Analytics.

Unless marked as requiring consent, these entries are strictly necessary to provide a service explicitly requested by the user (§ 25(2) no. 2 TDDDG). Subsequent processing is based on Art. 6(1)(f) GDPR.

10. Rights of data subjects

Data subjects have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Consent given may be withdrawn at any time with effect for the future (Art. 7(3) GDPR). Requests to info@frank-fischbach.de.

Without prejudice to any other remedy, data subjects have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Competent for the controller: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

11. Right to object

Data subjects have the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them that is based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). The controller will then no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims. Objections are to be sent to info@frank-fischbach.de.

12. Obligation to provide data; automated decision-making

The provision of personal data is neither a statutory nor a contractual requirement. Without the data listed under Provision of the website, the website cannot be delivered.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.