1. Data controller
HB Photography · Henry Buck
Pestalozzistraße 13 A
10625 Berlin, Germany
E-mail: henry@hbphotography.de
Telephone: 01522 7689126
2. Provision of the website
The website is provided via OpenAI Sites. Technical connection data, in particular your IP address and the requested page or file, must be processed so that the content can be delivered to your browser. For operation and security further technical access data such as time, browser information and error data can be processed.
The provision and protection of our website is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest consists in a functional and secure website.
The recipients of technical data are the hosting platform OpenAI and its infrastructure and security service providers, including Cloudflare for the delivery of the website. OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is responsible for the OpenAI services provided on its own responsibility. According to OpenAI's privacy policy, processing may also take place outside the EEA, especially in the United States. OpenAI identifies adequacy decisions or EU standard contractual clauses as the basis for transmission; information and copies of the guarantees may be requested from privacy@openai.com. The retention by OpenAI is based on the respective processing purpose as well as security and legal requirements; a uniform fixed deadline for all technical data is not specified there.
Information on OpenAI processing can be found in the European privacy policy of OpenAI. As far as the hosting platform requires a login, it processes the account data required for it according to its own privacy policy.
3. Enquiry form, e-mail and telephone
When sending, the name, e-mail address, contact details, information about the shoot, schedule, transport and voluntary messages are transmitted to HB Photography. The website processes the request on the hosting infrastructure and sends it via a Google/Gmail connection as an e-mail with a PDF of the request. A confirmation of receipt with your information is sent to the e-mail address you provided, provided that the dispatch is successful. Until sending, the entries are processed in the browser and cached for the current session. In the event of a shipping error, you can copy the request text or open it as an e-mail draft. The copy function transfers the text to the clipboard of your device to your request.
The contact form submits directly to the website server and uses the existing Google/Gmail connection to deliver your enquiry. No separate form provider such as Formspree or Netlify Forms is used. Name, email address and message are required; all other project details are optional. The checkbox confirms that you have read this privacy policy. It does not subscribe you to a newsletter.
We process incoming enquiries by e-mail or telephone in order to answer your request, to prepare offers and, if necessary, to prepare an order. The legal basis is Art. 6 para. 1 lit. b GDPR for pre-contractual or contractual inquiries. For other concerns it is Art. 6 para. 1 lit. f GDPR; our interest consists in the processing of the communication addressed to us.
In the case of e-mail communication, the e-mail and IT service providers involved process message content and technical delivery data as far as this is necessary for transmission, storage and security. These service providers belong to the recipients of your information. Google Privacy Notice. Processing may also take place outside the European Economic Area.
In order to protect against spam and double dispatch, the website stores a request identifier, a checksum value of the request, the shipping status and the time as well as temporarily pseudonymised identifiers from IP address and e-mail address with test counters. The technical inquiry entries are deleted after 24 hours at the next form processing; the hour counters are removed after the expiry of the current and previous hour window. These deadlines do not concern the sent e-mails and PDFs. The legal basis for the misuse protection is Art. 6 para. 1 lit. f GDPR; our interest is a secure and reliable inquiry dispatch.
For the storage period of a request it is decisive how long the data is required for processing and for a possibly subsequent business relationship. If this purpose does not apply and there is no other legal storage reason, the data must be deleted. Contract-related documents are stored insofar as statutory retention obligations exist; the basis is then Art. 6 para. 1 lit. c GDPR. Required data can also be stored for the establishment or defence of legal claims.
You decide whether you will provide us with data. Without the information necessary for a request we cannot create a suitable offer. Voluntary information is marked in the form.
Contact via WhatsApp and telephone
The quick contact opens WhatsApp or the telephone function of your device exclusively via a link. When calling up this website, no data is transmitted to WhatsApp. If you write to us via WhatsApp, use the service of WhatsApp Ireland Limited or Meta. The data protection regulations of WhatsApp apply to the processing there. Alternatively, you can contact us by e-mail or telephone.
The legal basis is Art. 6 para. 1 lit. b GDPR for pre-contractual or contractual inquiries or Art. 6 para. 1 lit. f GDPR for the processing of other contact requests. WhatsApp or Meta can transmit data to the USA. Alternatively, you can contact by email or telephone.
4. Appointment booking
We use the reservation page of Google Calendar for online appointments. The embedded booking page will only be loaded when you select "Load Calendar". Alternatively, you can open it directly from Google via a link. Google will receive your IP address and browser data during the call. When booking, the data entered in the reservation form (name and e-mail address in particular) as well as the chosen date for organising the meeting will be processed. The booking page shows available times; contents of private calendar entries will not be published there. For more information, see the Google Privacy PolicyAn appointment is alternatively possible by e-mail.
The voluntary loading of the embedded Google booking page takes place according to your consent in accordance with Art. 6 para. 1 lit. a GDPR and, as far as Google stores or reads information on your device, § 25 para. 1 TDDDG. You can terminate the integration via "Hide calendar and revoke consent". When a new page call is made, the calendar is not automatically loaded. A revocation does not affect the legality of the processing previously carried out. You can also delete browser data already stored by Google in your browser settings. The processing of your actual transmitted booking data for the preparation or execution of a meeting takes place in accordance with Art. 6 para. 1 lit. b GDPR. Google can also transmit data to the USA; you can find information on the basis of transmission in the linked data protection notices of Google.
5. Cookies and embedded content
The website code provided by HB Photography does not use analysis or advertising cookies. Photos and design elements are delivered together with the website. No external font services, maps, social media feeds or analysis tools are included. Google Calendar is only loaded according to your selection (see Section 4).
Storage used by this website
- Request form: Under "hb-inquiry-configurator-v1", Session Storage holds your form entries for the current browser session so that you can continue the request during a page change or reload. After successful shipping, the website removes this entry. The browser manages the further session duration; data can be restored during a session recovery. You can delete the data via your browser settings. The form entries in Local Storage will not be stored.
- Closed Express Note: If you hide the notice for seven days, the time will be stored in local storage under "hb-express-banner-dismissed". It will only be used to consider your selection. After seven days, the entry will be removed when a page is called up with this notice. You can delete it in the browser settings beforehand.
- Log in: The cookie "hb_customer" contains a random session identifier, no contact details and no password. It is set after successful login, is valid for up to 30 days and is deleted when logged out. It is protected against access by website scripts and is transmitted only via HTTPS. After setting a new password, previous sessions become invalid.
The storage functions for the request form and the login login are used for the request or access function requested by you. The storage of the banner selection takes place only at your express request to hide the notice for seven days. § 25 para. 2 no. 2 TDDDG applies to the required storage and access. The associated processing of personal data is based on the purposes and legal bases mentioned in Sections 3 and 8; the consideration of your display setting serves our legitimate interest in the implementation of your selection in accordance with Art. 6 para. 1 lit. f GDPR.
Technical functions of the hosting and login platform must be distinguished from this. OpenAI describes the use of cookies, among other things for login, security and settings in its Cookie notes; there are also information about storage periods and setting possibilities. For technically absolutely necessary storage or access, § 25 para. 2 no. 2 TDDDG is considered; not required access basically require consent according to § 25 para. 1 TDDDG.
External links
Instagram, LinkedIn and the linked customer websites are integrated as normal links. Only when a link is opened do you access the respective external website. The data protection information of the respective provider applies to the data processing there.
7. Your rights
Under the legal conditions, you have the right to information, correction, deletion, restriction of processing and data portability. If processing is based on consent, you can revoke it at any time with effect for the future.
For processing on the basis of Art. 6 para. 1 lit. f GDPR, you may object for reasons arising from your particular situation. To exercise your rights, contact the above contact address.
You can complain to a data protection supervisory authority, especially at your whereabouts, workplace or at the site of the suspected infringement. In Berlin this is the Berlin Commissioner for Data Protection and Freedom of Information.
On the basis of this website, HB Photography does not exclusively make automated decisions with legal or similarly significant effect.
8. Customer portal and order management
For customer accounts and the processing of orders, we process in particular name, company, contact person, e-mail address, telephone number, invoice address, if applicable VAT ID and customer number. In addition, we process order names, processing status, agreed services and prices, project notifications, order confirmations, invoices, payment status and references to your picture and correction folders.
The customer portal enables the protected retrieval of your orders and documents. Access data is processed in the form of a password check value; the password itself is not stored in plain text. Invitation links for the setting of a password apply for 48 hours and can only be used once. Information on the session cookie can be found in Section 5. Individual project status links enable the retrieval of the respective status without additional registration; please pass such links only to authorised persons.
Customer, order and billing data are stored in the database of the hosting infrastructure. The hosting and infrastructure service providers referred to in Section 2 are used for delivery and storage. Invitations, order confirmations and invoices can be transmitted to your email address via the Google/Gmail connection referred to in Section 3. For our order management, documents and customer overviews can also be exported to a local repository selected by HB Photography. Folder sharing is stored exclusively in the browser of the administration, not on customers' devices. In the case of externally provided image folders, the portal provides a link to the respective storage provider; when opened, its privacy policy applies.
The legal basis for the account, order and document provision is Art. 6 para. 1 lit. b GDPR. Insofar as legal retention is required, it is carried out in accordance with Art. 6 para. 1 lit. c GDPR. When communicating with contact persons of a corporate client and in order to secure accesses, Art. 6 para. 1 lit. f GDPR can be decisive; our interest is in order processing and the protection of customer data.
To limit abusive login and password attempts, checksums from IP address or account or invitation identifier and time window are temporarily stored as well as test counters. The counters take into account 15-minute windows. Entries outside the current and previous windows are removed when the next login or password attempt is checked. The legal basis is Art. 6 para. 1 lit. f GDPR.
Account data are required as long as the access and the business relationship exist. After that, it is necessary to check which data can be deleted and which data are still required due to legal retention obligations or to assert or defend against claims. For invoices, order documents and other documents subject to retention the duration depends on the respective type of document and legal obligation. Access to the portal is no reason to keep all data indefinitely. The described deadlines for technical meetings and test counters apply regardless of this.
Situation at 15 October 2026