Privacy Policy – information on the processing of personal data under Art. 13 GDPR

The controller for data processing on this website is:

Multi Media Design Patrick Schmetzer

Adam-Foßhag-Straße 37
65428 Rüsselsheim am Main
Germany
Email: Mail@Patrickschmetzer.com

This website sets no cookies. For audience measurement it uses a service that works without cookies and without recognizing individual visitors — see “Audience measurement” for details. A session cookie exists only after signing in to the client portal, which we set up for our clients — there is no registration for visitors; how the portal works is described under “Client portal”. There are inquiry forms, a form for having an e-book sent to you, and one for being told by email about new motifs in the Art Store; how they work is described under “Inquiry forms”, “E-books by email” and “New motifs by email”. Fonts are served locally from our own server; no connection to Google Fonts is made.

Third-party content — YouTube videos and the Google Maps map — is loaded only after you explicitly click. As long as you do not start a video and do not load a map, nothing is transmitted to third parties.

Personal data therefore arises only to the extent technically unavoidable when a website is requested — see server log files.

This website does not run on our own servers but with two external service providers. The data that arises technically when you visit is processed on their servers.

The pages are served by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The inquiry forms and the protected client area run separately from that, with Render Services, Inc., USA; the server used for them is located in Frankfurt am Main, Germany.

Both providers are used in the interest of secure, fast and reliable delivery of this site (Art. 6(1)(f) GDPR).

A data processing agreement pursuant to Art. 28 GDPR is in place with both. Each provider’s Data Processing Addendum forms part of its terms of service and applies without a separate signature.

Both companies are based in the United States. For transfers there, both are certified under the EU-US Data Privacy Framework; the European Commission’s Standard Contractual Clauses apply in addition.

When this website is accessed, the hosting providers automatically store information in server log files which your browser transmits:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred and notification of retrieval status
• referrer URL, where transmitted
• browser and operating system used

Processing serves the delivery of the page, system security and stability, and error analysis. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. This data is not merged with other sources and is not evaluated for marketing purposes. Log files are deleted automatically after the retention period configured at the providers.

To learn which pages of this website are visited, we use Vercel Web Analytics. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — the same company that serves the pages.

No cookies are set and no identifiers are stored on your device. No profile is built about you and your visit is not followed across websites. What is recorded is the page requested, the referring page, country, operating system and browser, and the device type — in a form that produces a total and not an individual visitor. In addition we count three events on the inquiry forms: that a form was opened, that filling it in was begun, and that it was sent. What is transmitted is only that the step happened, and on which form — no field content, so no name, no address, no date and no text. On the music player we also count which track was started and which played for at least 30 seconds, and whether that happened on the home page or on “About me” — again without any reference to you as a person. For the free e-books we count which book, in which language, was opened via the download button or requested by email, and on which page the button was — without the email address and without any other detail from the form. In the Art Store we count which motif was added to the saved list and which motif or which kind of request (a motif, a set, the saved list or a custom motif) was carried over into the contact form — without size, frame or any other detail and without reference to you. The saved list you create there with the heart is kept by your browser itself (in local storage); it is not sent to us and can be deleted at any time with “Clear list” or in your browser settings.

The purpose is the statistical evaluation of which content is in demand, in order to improve this site. The legal basis is our legitimate interest in a needs-based design of this website under Art. 6(1)(f) GDPR. Consent is not required because no information is stored on or read from your device (§ 25(1) TDDDG).

The same data processing agreement and the same EU-US Data Privacy Framework certification apply as described under “Hosting”.

What exactly is collected is described by the provider here: vercel.com/docs/analytics/privacy-policy

Some pages embed videos hosted on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

These videos are not loaded automatically. Initially you see only a preview image served from our own server. A connection to YouTube servers is established only once you start a video by clicking. YouTube then learns, among other things, your IP address and which page you visited; if you are simultaneously logged in to YouTube, the visit can be attributed to your account. Transfer to the USA cannot be ruled out.

The legal basis is the consent you give by clicking, pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future by not starting further videos. Videos are embedded in extended data protection mode (“youtube-nocookie”), in which YouTube states that it stores information only once playback begins.

Details on how your data is handled can be found in Google’s privacy policy: policies.google.com/privacy

The contact page embeds a map from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This map is not loaded automatically either. In its place you first see a plain surface with a note and a button; the address beside it and the link to Google Maps work without any connection to Google. A connection to Google servers is established only once you load the map by clicking. Google then learns, among other things, your IP address and which page you visited; if you are simultaneously logged in to Google, the visit can be attributed to your account. Transfer to the USA cannot be ruled out.

The legal basis is the consent you give by clicking, pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future by not loading further maps; the consent applies to that page view only and is not stored.

What Google does with the data transmitted in the process is set out in its privacy policy: policies.google.com/privacy

For security reasons this website uses TLS encryption. You can recognize an encrypted connection by the “https://” prefix in your browser’s address bar.

This website has forms for contact, project, coaching and support inquiries. We process only what you enter yourself — depending on the form, your name, email address, telephone number, address, date, location and free text.

On submit, those details are transmitted to this website’s server and stored there, so that the inquiry is not lost. The server is located in Frankfurt am Main and is operated on our behalf by Render Services, Inc. No third-party form service is involved, and your entries are not passed on to third parties. We additionally send ourselves a notification that a new inquiry has arrived. If you gave an email address, a confirmation with a copy of your details goes to that address — so that you have a record of what you sent us, and know by when an answer is coming.

The processing serves solely to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to entering into a contract, otherwise our legitimate interest in responding under Art. 6(1)(f) GDPR.

Your IP address is not stored with the inquiry. To prevent the form being flooded automatically, only a salted check value of the IP address is kept, which does not allow the address to be reconstructed and is deleted after 24 hours.

We delete stored inquiries as soon as they are no longer required in order to respond and no statutory retention obligations prevent deletion. The protected area in which we read the inquiries sets a strictly necessary session cookie — it is set only after we ourselves sign in, never during your visit.

You can download the e-books on this website directly and without providing any data. Alternatively you can have the link to a book sent to you by email. For that we process your email address, the chosen book and its language and, if you provide them, your name and your company.

These details are transmitted to this website’s server and stored there, on the same server and in the same way as the inquiries from the forms (see “Inquiry forms”), including the salted check value against automated flooding. We send an email with the link to the book to your address, and ourselves a notification. The legal basis is Art. 6(1)(b) GDPR, as you asked us to send it.

Separately, you can tick that we may contact you about photo and film projects. This is optional, not preselected and not a condition for receiving the book. Only if you tick it will we get in touch — personally and about your topic; this does not put you on the list for new Art Store motifs. The legal basis is then your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future; a reply to the email with the book or a message to the address above is enough.

We delete the details as soon as they are no longer required for these purposes, and after consent is withdrawn insofar as we kept them only on that basis.

In the Art Store you can ask to be told by email when new motifs arrive. For that we process your email address, the language in which you signed up, and the times of sign-up, confirmation and, where applicable, unsubscribing. We ask for no other details.

Sign-up uses a double opt-in: after you submit the form we send you an email with a confirmation link. Only once you click it is your address on the list. If you do not confirm within seven days, we delete the sign-up. This way nobody can sign up someone else’s address. The details are stored on this website’s server, on the same server and in the same way as the inquiries from the forms (see “Inquiry forms”), including the salted check value against automated flooding. Once you confirm, we send ourselves a notification about the new sign-up.

Through this list we write to you only when there are new motifs in the Art Store. We send these emails ourselves from our own mailbox, not through a newsletter service, and each one contains a link that unsubscribes you at once.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future: via the unsubscribe link in every one of these emails, or with a message to the address above.

When you unsubscribe, we delete your email address immediately. All that remains is an entry without an address — the language, the times of sign-up, confirmation and unsubscribing, and a random identifier — so that the unsubscribe link still answers correctly if it is clicked a second time. It allows no inference about you as a person.

For our clients we run a protected area at /en/client-portal where we release images for selection, deposit documents such as offers and invoices, and exchange messages. Accounts there are created solely by us, in the course of an assignment; there is no registration for visitors. Access is set up by an invitation link sent to the client’s e-mail address, and the client chooses the password themselves — we do not know it and store only a hash.

For an account we store name, company, e-mail address, telephone number, the chosen language, the time of the last sign-in and an internal note. In addition there are the images we release for the assignment, the selection made together with its remarks, the deposited documents, the message history and the files the client sends us there. All of it is held on the same server as the inquiries, in Frankfurt am Main, operated on our behalf by Render Services, Inc.; third parties have no access.

Signing in sets a strictly necessary session cookie (“psportal”). It contains nothing but a random session identifier, ends when the browser is closed and at the latest after four hours, and is set only after signing in — not while browsing the rest of the website. Without this cookie there is no protected area; no consent is required for it (Section 25(2) no. 2 of the German TDDDG).

An activity log records when a client signed in, opened a gallery or a document, downloaded something or accepted an offer — so that we know whether images have arrived and what is still outstanding. No IP addresses are stored in it. Only sign-in attempts count, for a short time, a salted hash of the IP address in order to slow down password guessing; it allows no inference about the address and is deleted after 24 hours.

The purpose of the processing is the handling of the respective assignment; the legal basis is Art. 6(1)(b) GDPR. We delete an account with everything attached to it, including the files on the server, once the assignment is complete and no statutory retention obligations prevent deletion — earlier on request, a message to us is enough. Released galleries may carry an expiry date; after it has passed, the images can no longer be retrieved in the portal.

If you contact us, we process your sender details and the content of your message solely in order to deal with your inquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries, otherwise our legitimate interest in responding under Art. 6(1)(f) GDPR.

Contact via WhatsApp is additionally subject to the privacy policy of WhatsApp Ireland Limited. We have no influence over what data is processed there when the chat is established. If you wish to avoid this, you can equally reach us by email or telephone.

We delete this data as soon as it is no longer required for the purpose and no statutory retention obligations prevent deletion.

This website links to external third-party websites. Clicking such a link takes you off this website; we have no influence over the data processing carried out by the respective provider. Their privacy policy then applies.

You have the right at any time to:

• access to your processed data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)

An informal message to the email address above is sufficient to exercise them.

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden

We will amend this privacy policy as soon as data processing on this website changes — for example if audience measurement is added in future.

See also our Imprint.