Privacy Notice for Photography and Videography Services
Data protection information in accordance with Articles 13 and 14 GDPR
1. RESPONSIBLE AUTHORITY
Jorge Aspas García
Kloschinskystr. 90
54292 Trier, Germany
Phone: 0155-60433348
E-Mail: info@aspas.photo
2. CATEGORIES and SOURCES of PERSONAL DATA
We only process contact details that are related to the establishment of the contract or the pre-contractual measures. This can be general data about the person or persons of the company (name, address, contact details, age, special dates, etc.) as well as possibly other image, sound and film data transmitted to us as part of the establishment of the contract or that arise in our fulfilment of our contractual purposes or by a commissioned service provider. Insofar as there are indications of ethnic origin, religion, location or health from audio, video or film data (e.g. skin colour, headgear, glasses, disability), we will also process these.
3. PURPOSES AND LEGAL BASES OF PROCESSING
We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), insofar as these are necessary for the establishment, implementation and fulfillment of a contract and for the implementation of pre-contractual measures. Insofar as personal data is required for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, processing according to Art. 6 Para. 1 lit. b GDPR is lawful. If we are given express consent to the processing of personal data for specific purposes (e.g. disclosure to third parties, advertising and marketing), the legality of this processing is based on consent according to Art. 6 Para. 1 lit. a GDPR. Consent can be withdrawn at any time with future effect. In addition to the legal authorisation explained below, we will always ask for your consent if we can do so with a reasonable amount of effort. Unfortunately, this is not always possible at large events.
If necessary and legally permissible, we process data beyond the actual contractual purposes to fulfill legal obligations according to Art. 6 Para. 1 lit. c GDPR. In addition, processing may take place to safeguard our legitimate interests or those of third parties, as well as to defend against and assert legal claims in accordance with Art. 6 Para. 1 lit. f GDPR. If necessary, we will inform you separately, specifying the legitimate interest, insofar as this is required by law.
Created image, sound and film data serve, for example, as documentation, information, advertising, reference and illustrative material both at events, trade fairs and on websites, social media channels, image databases, print media, posters, moving image offers and other media or the press. If you as the contracting party have granted us the rights of use and publication, the publication serves to promote our company on the internet. The publication period as well as the target presences are communicated to the data subject in the context of the publication option in the contract.
Our social media appearances should ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. The analysis processes initiated by the social networks may be based on divergent legal bases to be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6 (1) (a) GDPR).
4. DATA PROCESSING THROUGH SOCIAL NETWORKS
We maintain publicly available profiles in social networks. The individual social networks we use can be found below. Social networks such as Facebook, Twitter etc. can generally analyze your user behavior comprehensively if you visit their website or a website with integrated social media content (e.g., like buttons or banner ads). When you visit our social media pages, numerous data protection-relevant processing operations are triggered. In detail:
If you are logged in to your social media account and visit our social media page, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies stored on your device or by recording your IP address.
Using the data collected in this way, the operators of the social media portals can create user profiles in which their preferences and interests are stored. This way you can see interest-based advertising inside and outside of your social media presence. If you have an account with the social network, interest-based advertising can be displayed on any device you are logged in to or have logged in to.
Please also note that we cannot retrace all processing operations on the social media portals. Depending on the provider, additional processing operations may therefore be carried out by the operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.
5. DURATION OF DATA STORAGE
If necessary, we process and store personal data for the duration of our business relationship or to fulfill contractual purposes. This includes, i.a., the initiation and processing of a contract and obligations or the exercise or fulfillment of the rights and obligations of employee representatives arising from a law or a collective agreement, a company or service agreement (collective agreement).
In addition, we are subject to various retention and documentation obligations, which result, among other things, from the Commercial Code (HGB) and the Tax Code (AO). The storage and documentation periods specified therein are two to ten years. Finally, the storage period is also based on the statutory limitation periods, e.g. according to §§ 195 ff of the German Civil Code (BGB): usually three years, but in certain cases it can be up to thirty years.
Subject to revocation of consent by data subjects, image, sound and film data are stored for an indefinite period of time for specific purposes and deleted after 15 (fifteen) years, as soon as they are no longer required for the purpose of processing, reordering, preserving rights and marketing, insofar as the there is no legal obligation to retain it and provided that it is stored, processed and disseminated with our knowledge.
The data collected directly from us via the social media presence will be deleted from our systems as soon as you ask us to delete it, you revoke your consent to the storage or the purpose for the data storage lapses. Stored cookies remain on your device until you delete them. Mandatory statutory provisions - in particular, retention periods - remain unaffected.
We have no control over the storage duration of your data that are stored by the social network operators for their own purposes. For details, please contact the social network operators directly (e.g., in their privacy policy, see below).
6. DATA RECIPIENTS
We only pass on your personal data within our company to those divisions and persons who need this data to fulfill contractual and legal obligations, or to implement our legitimate interests.
Your personal data will be processed on our behalf on the basis of order processing contracts in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. The categories of recipients in this case are internet service providers and providers of employee management systems and software.
Otherwise, data will only be passed on to recipients outside the company insofar as legal provisions allow or require this, disclosure is necessary to fulfill legal obligations or we have your consent. Under these conditions, recipients of personal data can include, for example: accountants, tax consultants, public authorities and institutions (e.g. public prosecutor‘s office, police, supervisory authorities, tax office) in the event of a legal or official obligations, recipients to whom the disclosure is directly necessary for the establishment or performance of the contract, such as, e.g., shipping (postal) service providers, printed products (flyers, prints, albums ...), data transfers (e.g. online galleries ...), web and print designers (advertising and design agencies), photographic databases (iStock, Fotolia, etc.), press and editorial offices and internationally operating social media providers (Facebook, Instagram, Twitter, Pinterest ...) and photographic databases. If the services of external service providers (photographers, videographers ...) were used, we receive the image, sound and/or film recordings from them.
We pass on your payment data to the commissioned credit institution as part of the payment processing, insofar as this is necessary for the payment processing. The legal basis for the transmission of the data is Article 6 Paragraph 1 lit.
7. TRANSFER TO A THIRD COUNTRY
A transfer of personal data to countries outside the EEA (European Economic Area) or to an international organization only takes place insofar as this is necessary for the processing and thus for the fulfillment of the contract or, at your request, to carry out pre-contractual measures, if disclosure is required by law or you have given us your consent (rights of use for image, sound and film recordings). In these cases, the recipients can include, i.a., social networks, which may save this data after the upload for the purpose of network-wide display on servers in third countries.
8. YOUR RIGHTS
Here, you can find your rights in relation to your personal data. Details can be found in Articles 7, 15-22 and 77 GDPR. You can contact the competent office or the data protection officer in this regard.
1) Right to revoke your data protection consent according to Art. 7 Para. 3 S. 1 GDPR
You can revoke your consent to the processing of your personal data at any time with effect for the future. However, this does not affect the legality of the processing carried out until revocation.
2) Right to information according to Art. 15 GDPR
You have the right to request confirmation as to whether we process personal data relating to you. If this is the case, you have the right to information about this personal data as well as further information, e.g. the processing purposes, the categories of processed personal data, the recipients and the planned duration of storage or the criteria for determining the duration.
3) Right to correction and completion according to Art. 16 GDPR
You have the right to request the correction of incorrect data immediately. Taking into account the purposes of the processing, you have the right to request the completion of incomplete data.
4) Right to erasure („right to be forgotten“) according to Art. 17 GDPR
You have the right to erasure provided the processing is not necessary. This is the case, for example, if your data is no longer necessary for the original purpose, if you have revoked your declaration of consent under data protection law or if the data has been processed unlawfully.
5) Right to restriction of processing according to Art. 18 GDPR
You have the right to the restriction of processing, e.g. if you are of the opinion that the personal data is incorrect.
6) Right to data portability according to Art. 20 GDPR
You have the right to receive the personal data concerning you in a structured, common and machine-readable format.
7) Right of objection according to Art. 21 GDPR
You have the right to object to the processing of specific personal data relating to you at any time for reasons that arise from your particular situation. In the case of direct marketing, you as the data subject have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is connected to such direct marketing.
8) Automated decision-making in individual cases, including profiling, according to Art. 22 GDPR
You have the right not to be subject to a decision based solely on automated processing – including profiling – except in the exceptional circumstances mentioned in Art. 22 GDPR. We do not engage in decision-making based solely on automated processing – including profiling.
9) Complaint to a data protection supervisory authority in accordance with Art. 77 GDPR
You can also lodge a complaint with a data protection supervisory authority at any time, for example if you are of the opinion that the data processing is not in accordance with data protection regulations.
If you visit one of our social media sites (e.g., Facebook), we, together with the operator of the social media platform, are responsible for the data processing operations triggered during this visit. You can in principle protect your rights (information, correction, deletion, limitation of processing, data portability and complaint) vis-à-vis us as well as vis-à-vis the operator of the respective social media portal (e.g., Facebook).
Please note that despite the shared responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are determined by the company policy of the respective provider.
9. RIGHT TO OBJECT
As far as the processing of your personal data according to Art. 6 Para. 1 lit. f GDPR is carried out to safeguard legitimate interests, you have the right, in accordance with Art. 21 GDPR, to object to the processing of this data for the future at any time for reasons that arise from your particular situation. Consent can also be revoked for individual data. Your revocation does not affect the legality of the data processing that took place on the basis of the consent in the period up to revocation. We will then delete and no longer process this personal data, unless we can prove compelling reasons worthy of protection for the processing. These must outweigh your interests, rights and freedoms, or the processing must serve to assert, exercise or defend legal claims. Unless consent is revoked, it is valid for an unlimited period. The revocation can generally be submitted informally. However, for the sake of evidence, we ask that you send the revocation by post or email to our responsible office within the meaning of data protection law.
Please note, however, that this cannot include a permanent deletion from the internet, as it cannot be ruled out that the files may, for example, be in temporary storage or screenshots of third parties.
10. NECESSITY TO PROVIDE PERSONAL DATA
The provision of personal data for the decision about the conclusion of a contract, the fulfillment of a contract or the implementation of pre-contractual measures is voluntary. However, we can only make a decision within the framework of contractual measures if you provide such personal data that are necessary for the conclusion of the contract, the fulfillment of the contract or pre-contractual measures.
11. AUTOMATED DECISION-MAKING
We generally do not use fully automated decision-making in accordance with Art. 22 GDPR to establish, fulfil or implement the business relationship or for pre-contractual measures. Should we use these procedures in individual cases, we will inform you about this separately or obtain your consent if this is required by law.
12. INDIVIDUAL SOCIAL NETWORKS
We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook’s statement the collected data will also be transferred to the USA and to other third-party countries.
You can customize your advertising settings independently in your user account. Click on the following link and log in: https://www.facebook.com/settings?tab=ads.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
Details can be found in the Facebook privacy policy: https://www.facebook.com/about/privacy/.
We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.
For details on how they handle your personal information, see the Instagram Privacy Policy: https://help.instagram.com/519522125107875.
We have a profile at Pinterest. The operator is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Details on how they
handle your personal data can be found in the privacy policy of Pinterest: https://policy.pinterest.com/de/privacy-policy.
We have a LinkedIn profile. The provider is the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
If you want to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa und https://www.linkedin.com/legal/l/eu-sccs.
For details on how they handle your personal information, please refer to LinkedIn‘s privacy policy: https://www.linkedin.com/legal/privacy-policy.
Vimeo
We have a profile on Vimeo. The provider is Vimeo, Inc., 555 West 18th Street, New York 10011, USA.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission and, according to Vimeo, on “legitimate business interests”. Details can be found here: https://vimeo.com/privacy.
Details on how they handle your personal data can be found in the Vimeo privacy policy: https://vimeo.com/privacy.
YouTube
We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on how they handle your personal data can be found in the YouTube privacy policy: https://policies.google.com/privacy?hl=en.
TikTok
We have a profile on TikTok. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Details on how they handle your personal data can be found in the TikTok privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=en.
Data transmission to third countries is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.tiktok.com/legal/privacy-policy?lang=en.