Privacy notice

1. Controller

Phone: +49 157 56908893
Email: kontakt [at] stephan-noack [dot] de

You can use the same email address for privacy-related questions.

2. Website visits and server logs

This website runs on a Debian VPS administered by me and hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The server is located in Germany. IONOS acts as a processor under Article 28 GDPR. Data transferred between your browser and this website is encrypted using HTTPS/TLS.

When you access the website, the web server processes connection data required for technical operation. Access logs store the IP address, time, HTTP method, requested path without URL query parameters, HTTP status and amount of data transferred. Referrer and browser identifier are not included in the access log. Error logs may additionally contain technical error details and information about the affected request, including the IP address and URL. This processing supports secure delivery of the website, troubleshooting and protection against attacks; it is not used to analyze visitors for advertising.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is in operating a secure and functional website. Regular access and error logs are automatically deleted no later than 14 days after collection. If a specific security incident occurs, relevant extracts may be retained separately for investigation or for the establishment, exercise or defense of legal claims for as long as necessary.

3. Getting in touch

If you contact me by email or phone, I process your name, contact details, message and any information needed to handle your inquiry. Email is provided through mailbox.org, operated by Heinlein Hosting GmbH in Berlin. This provider acts as a processor under Article 28 GDPR and operates its data centers in Germany. For ordinary phone calls, the telecommunications providers involved process the data required to connect the call. I do not record calls.

Optional messaging: If you write to me through WhatsApp or expressly ask to continue communicating through that service, I process your phone number or messaging identifier, profile name, message content, files you send and technical data needed for communication. Email and phone remain available as alternatives at all times. You do not have to use a messaging service.

WhatsApp: The provider for users in the European Region is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to the provider, personal messages and calls are end-to-end encrypted. WhatsApp also processes account, usage, device and connection data. More information is available in the WhatsApp Privacy Policy.

For inquiries about a shoot or a contract, the legal basis is Article 6(1)(b) GDPR. For other inquiries, it is Article 6(1)(f) GDPR; my legitimate interest is responding appropriately and organizing my business. Providing your data is voluntary. However, I may be unable to handle your inquiry without a way to contact you or the information necessary to address it.

Arrangements relevant to an assignment made through messaging may be copied into the assignment records. I delete completed inquiries that did not lead to an assignment six months after closing the inquiry, unless a statutory retention duty or a specific necessary evidentiary purpose applies. Assignment-related messages are retained only as long as necessary to carry out and document the assignment, meet legal obligations or preserve evidence needed for legal claims. Deleting my copy does not remove messages from other participants' devices or from the messaging provider's systems.

4. Cookies, local content and external links

This static website has no contact form, uses no cookies, analytics or advertising services, and does not access information stored on your device. A consent banner is therefore not currently required. In particular, neither Google Analytics nor Meta Pixel is used, and Google Maps, YouTube videos and Instagram content are not embedded.

Images and fonts are served from this website's own server. The fonts used here—including Playfair Display, Inter, Fraunces and Cormorant Garamond—are hosted locally; visiting this website does not connect to Google Fonts servers.

A standard link leads to my Instagram profile. Simply visiting this website does not connect you to Instagram. Only if you click the link do you leave this website. The platform provider is responsible for any subsequent processing under its own privacy terms.

5. Photographs on this website

This website presents my photography services and selected work. I publish photographs showing identifiable people for my own portfolio and advertising only within the scope of separate, voluntary consent under Article 6(1)(a) GDPR and the agreed image release. For a paid shoot, giving this consent is not a condition of booking or receiving the photographs.

Publicly accessible images may be viewed worldwide, indexed by search engines and saved or redistributed by others. Publication takes place only within the agreed scope and while consent remains valid and the images are needed for that purpose. If consent is withdrawn, I remove the images concerned from online channels under my control. Copies already made by others cannot be fully recalled.

Records of consent and the information needed to link them to the released images are kept while the permitted use continues. Afterwards, records needed for legal obligations or specific legal claims may be retained with restricted access on the basis of Article 6(1)(f) GDPR. The processing of inquiries, shoots, image files and image delivery is explained separately in the privacy information for clients. This website notice replaces neither that information nor an image release.

6. Recipients and international transfers

For website operation and communication, the hosting, email, telecommunications and, where applicable, messaging providers mentioned above receive only the data necessary for the service used. Service providers acting on my instructions are engaged under Article 28 GDPR. Where legally required, data may be provided to authorities or other entitled parties.

I do not intend to transfer data outside the European Union or European Economic Area for the direct operation of this website or my email account. This does not affect the worldwide accessibility of published photographs or the messaging-related processing described below. If you follow an external link, the relevant provider processes data under its own rules; this may include processing outside the EU and EEA.

WhatsApp: According to the provider's information, data is transferred in particular to the United States and other countries. Depending on the recipient and specific processing, WhatsApp cites adequacy decisions, including the EU–US Data Privacy Framework, and EU Standard Contractual Clauses as transfer mechanisms. Details and information about obtaining a copy of the safeguards can be found in the international transfers section of the WhatsApp Privacy Policy linked above.

7. Your rights

Subject to the applicable legal conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Processing will then stop unless there are compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defense of legal claims. To exercise your rights, contact kontakt [at] stephan-noack [dot] de.

You may withdraw consent at any time with effect for the future. Processing carried out before withdrawal remains lawful.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for the business location is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

This website does not involve solely automated decision-making, including profiling.