Privacy

At a glance

Without your consent this website sets no cookies, uses no analytics or advertising services and loads no content from other providers: fonts, photos and videos are on our own server. Analytics and advertising services start only if you agree in the consent banner, and you can withdraw at any time (sections below). Otherwise we process personal data only as far as running the website and answering your enquiry require.

Controller

Responsible for data processing on this website (Art. 4(7) GDPR):

DenizTech Ahmet DenizPhotography DenizzFeldstr. 4831275 LehrteGermanyPhone: +49 179 1451332E-mail: info@photographydenizz.com

Hosting and server log files

The website is hosted on a server of:

netcup GmbHEmmy-Noether-Straße 1076131 KarlsruheGermany

The server is in a data centre in Nuremberg (Germany).

On every visit the server processes the data your browser sends for technical reasons: IP address, date and time, the address requested, the page you came from (referrer), browser and operating system, status code and amount of data. Purpose: delivering the website, running it reliably and securely and detecting attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation.

The log files are deleted after 30 days unless an incident has to be investigated. We have a data processing agreement with netcup GmbH (Art. 28 GDPR).

From these log files the server also builds access statistics (GoAccess): how many visits, which pages, where visitors come from. They are built only on our server, without cookies and without passing anything on, and only we can see them with a password; the evaluation may contain IP addresses. Purpose: understanding how the website is used and improving it. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a website that fits its visitors' needs. The statistics are deleted after 3 months.

Contact by e-mail, phone or WhatsApp

When you write to us or call us, we process what you tell us (such as name, contact details, date, place and message) to answer your enquiry and make you an offer. The legal basis is Art. 6(1)(b) GDPR (an enquiry before a contract) and, for general questions, Art. 6(1)(f) GDPR (our legitimate interest in replying). How long we keep the data is set out in the section “Retention”.

The form on the contact page stores and sends nothing by itself. It only puts your message together; you send it from your own e-mail program or from WhatsApp.

The WhatsApp button is a plain link. WhatsApp opens only when you tap it; before that this website sends nothing to WhatsApp. Your message is then covered by the privacy policy of WhatsApp Ireland Limited. WhatsApp may transfer data to the USA; its parent company Meta Platforms is certified under the EU-US Data Privacy Framework. If you would rather avoid this, send us an e-mail or call us.

WhatsApp Ireland LimitedMerrion RoadDublin 4, D04 X2K5Irelandwww.whatsapp.com/legal/privacy-policy-eea

E-mail mailbox

Our e-mail mailbox is run by this provider:

netcup GmbHEmmy-Noether-Straße 1076131 KarlsruheGermanywww.netcup.com/de/kontakt/datenschutzerklaerung

It stores the e-mails you write to us and we send to you and processes technical data such as sender, recipient and time. The legal basis is Art. 6(1)(b) GDPR (enquiry and contract) and otherwise Art. 6(1)(f) GDPR (our legitimate interest in working e-mail communication). We have a data processing agreement with netcup GmbH (Art. 28 GDPR).

Instagram and TikTok profile

We run a profile on Instagram (@photographydenizz). If you write to us there, Meta Platforms Ireland Limited processes the message as its own controller; we read it to reply (Art. 6(1)(b) or (f) GDPR). When you visit our profile, Meta processes data under its own privacy policy, also in the USA. We use the profile's statistics function (Insights); we and Meta are jointly responsible for that evaluation (Art. 26 GDPR); we see only summary figures, no individual visitors. You can assert your rights against Meta and against us. Messages and reviews you send us we show in public only with your express consent.

The same applies to our TikTok profile: there TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, processes your data under its own privacy notice (www.tiktok.com/legal/page/eea/privacy-policy/en).

The links to Instagram, TikTok and WhatsApp on this website are plain links: data is passed to the provider only when you click.

Meta Platforms Ireland LimitedMerrion RoadDublin 4, D04 X2K5Irelandprivacycenter.instagram.com/policy

Payment

You can pay by bank transfer, PayPal or cash. For a transfer we process the data we get from your bank and ours (name, account details, amount, reference). With PayPal this company handles the payment; it is responsible for its own processing, and we receive name, amount and the status of the payment:

PayPal (Europe) S.à r.l. et Cie, S.C.A.22-24 Boulevard RoyalL-2449 LuxemburgLuxembourgwww.paypal.com/de/legalhub/paypal/privacy-full

The legal basis is Art. 6(1)(b) GDPR (performing the contract); keeping invoices and payment records rests on Art. 6(1)(c) GDPR (periods in the section “Retention”).

Online gallery for clients

After the shoot we deliver your pictures in a password-protected online gallery; you get a username and password, and it is free for one month. The gallery is our own application: denizzgalery.com (login at denizzgalery.com/login).

Processed are: first name, last name, phone number and e-mail address (we do not ask for a postal address), the access data, your photos and videos, the favourites you mark and the technical data of each visit (for example IP address, time, device). We e-mail you when the gallery is ready, when new files are uploaded and when the editing is done. The legal basis is Art. 6(1)(b) GDPR (delivering the pictures and performing the contract).

For the gallery we use the following providers. Netlify, Firebase, Backblaze and Cloudflare process data on our behalf. Google Ireland Limited processes data as its own controller for reCAPTCHA, Firebase App Check.

Hosting of the gallery application:Netlify, Inc.101 2nd StreetSan Francisco, CA 94105United Stateswww.netlify.com/privacy

Netlify, Inc. may transfer data to the USA. The company states itself that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); if the certification lapses, standard contractual clauses apply (Art. 46(2)(c) GDPR). We have a data processing agreement with Netlify, Inc. (Art. 28 GDPR).

Database and login:Google Ireland Limited (Firebase: Firestore, Authentication, Cloud Functions)Gordon House, Barrow StreetDublin 4Irelandpolicies.google.com/privacy

The login (Firebase Authentication) runs, according to Firebase, only in data centres in the USA; your access data (e-mail address, identifier) is processed there. The database (Firestore) with the other gallery data is located in Frankfurt am Main (EU). Google Ireland Limited or a US group company may transfer data to the USA. The company states itself that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); if the certification lapses, standard contractual clauses apply (Art. 46(2)(c) GDPR). We have a data processing agreement with Google Ireland Limited (Firebase: Firestore, Authentication, Cloud Functions) (Art. 28 GDPR).

Storage of the photos and videos:Backblaze, Inc. (B2 Cloud Storage)2261 Market Street STE 81006San Francisco, CA 94114United Stateswww.backblaze.com/company/privacy.html

Storage location: Amsterdam (EU). Backblaze, Inc. may transfer data to the USA. The company states itself that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); if the certification lapses, standard contractual clauses apply (Art. 46(2)(c) GDPR). We have a data processing agreement with Backblaze, Inc. (B2 Cloud Storage) (Art. 28 GDPR).

Delivery of the files and protection against attacks:Cloudflare, Inc.101 Townsend St.San Francisco, CA 94107United Stateswww.cloudflare.com/privacypolicy

The company processes your IP address and the technical data of the request. For the protection against attacks the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation. Cloudflare, Inc. may transfer data to the USA. The company states itself that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); if the certification lapses, standard contractual clauses apply (Art. 46(2)(c) GDPR). We have a data processing agreement with Cloudflare, Inc. (Art. 28 GDPR).

Protection of the login against abuse:Google Ireland Limited (reCAPTCHA, Firebase App Check)Gordon House, Barrow StreetDublin 4Irelandpolicies.google.com/privacy

Purpose: protecting the login against abuse and automated access. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure access. Google Ireland Limited or a US group company may transfer data to the USA. The company states itself that it is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); if the certification lapses, standard contractual clauses apply (Art. 46(2)(c) GDPR).

Retention: This is our own gallery (denizzgalery.com). The first month is free; after that there are options to extend the gallery, and there is also a paid package for additional editing. Before the time runs out we e-mail you a notice that the gallery will be deleted in 14 days. If you do not extend it, the gallery is deactivated first and deleted after 2 months at the latest.

Storage in your browser

Without your consent the website sets no cookies. It writes small entries to your browser's local storage only when you use the feature yourself: your choice of light or dark design, that you closed an offer notice, in a gallery the photos you mark with a heart (only their numbers), and your choice in the consent banner, so that we do not ask you again on every visit. The entries never leave your device and we cannot see them. They are strictly necessary for the feature you chose (§ 25(2) no. 2 TDDDG). Cookies and similar storage of the analytics and advertising services are set only with your consent (§ 25(1) TDDDG), see the sections on them. You can delete all entries at any time in your browser settings.

Photos on this website

We show people in our photos only with their consent (Art. 6(1)(a) GDPR, § 22 KUG). Anyone shown in a photo can withdraw their consent at any time with effect for the future; we then take the photo off the website.

The opening video on the home page was made with artificial intelligence (“KI-generiert”, Art. 50 EU AI Act). Its last frame is a real photograph. Every photo on this website was taken by us; a few of them we edited with artificial intelligence.

Consent (statistics and advertising)

On your first visit we ask whether we may use the services named below. “Accept all” and “Reject” are equal; nothing is preselected. As long as you do not agree, none of these services is loaded.

We store your decision in your browser (local storage, not a cookie): version of the question, time and your choice per category. This is necessary to prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, § 25(2) no. 2 TDDDG). If the question changes, we ask you again.

Withdrawal: “Privacy settings” in the page footer reopens the question at any time. If you withdraw, we stop the services, try to delete their cookies and reload the page.

If you consent to “Marketing”, profiling may take place (audiences, remarketing). No decision based solely on automated processing with legal effect for you (Art. 22 GDPR) is made.

Google Analytics 4

Provider: Google Ireland LimitedGordon HouseBarrow StreetDublin 4Ireland

Purpose: Audience measurement: we want to know which pages are visited so we can improve the website.

Data processed: Pseudonymous identifiers (cookies _ga and _ga_<id>), pages viewed, clicks on a contact option (only the kind: WhatsApp, phone or e-mail – never the message, number or address), time, device and browser data, approximate location derived from the IP address (Google Analytics 4 does not store the IP address itself).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent we do not load Google Analytics 4 and set no cookies of this service; before you decide there is no connection to the provider.

The data may be transferred to group companies of Google Ireland Limited in the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR); the provider is certified under it (as of 2026-10-21).

We have a data processing agreement with Google Ireland Limited (accepted on 2026-10-21) (Art. 28 GDPR).

Retention: We keep event data for 14 months at most (set in our Google Analytics account); the cookies expire after two years at the latest.

Withdrawal: you can withdraw your consent at any time with effect for the future, via “Privacy settings” in the page footer. The lawfulness of processing up to the withdrawal is not affected (Art. 7(3) GDPR).

Provider's privacy policy: policies.google.com/privacy

Google Ads

Provider: Google Ireland LimitedGordon HouseBarrow StreetDublin 4Ireland

Purpose: Conversion measurement and remarketing: we measure whether a Google ad led to an enquiry and may show ads to visitors of this website.

Data processed: Identifiers and cookies (e.g. _gcl_*), pages viewed, click and ad data, device and browser data, IP address. With your consent the data may be passed to Google for advertising and used for personalised ads (ad_user_data, ad_personalization).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent we do not load Google Ads and set no cookies of this service; before you decide there is no connection to the provider.

The data may be transferred to group companies of Google Ireland Limited in the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR); the provider is certified under it (as of 2026-10-21).

The “Google Ads Controller-Controller Data Protection Terms” apply to Google Ads (accepted on 2026-10-21): Google processes the data as a controller in its own right; we and Google are each responsible for our own processing. For transfers to the USA these terms provide for standard contractual clauses (Art. 46(2)(c) GDPR).

Retention: Retention follows Google's own information (see the privacy policy link); cookies expire after the periods stated there.

Withdrawal: you can withdraw your consent at any time with effect for the future, via “Privacy settings” in the page footer. The lawfulness of processing up to the withdrawal is not affected (Art. 7(3) GDPR).

Provider's privacy policy: policies.google.com/privacy

Meta Pixel

Provider: Meta Platforms Ireland LimitedMerrion RoadDublin 4, D04 X2K5Ireland

Purpose: Ad measurement and audiences: we measure whether a Facebook or Instagram ad led to an enquiry and may show ads to visitors of this website.

Data processed: Pages viewed and events (PageView; Contact/Lead on a click on WhatsApp, phone or e-mail – without the message), URL, browser and device data, IP address, cookies (_fbp, _fbc) and Meta identifiers. Meta may link the data to user accounts. Meta also receives the same events through a server connection run by Meta (Conversions API), so that nothing is counted twice or lost – this too only after your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent we do not load Meta Pixel and set no cookies of this service; before you decide there is no connection to the provider.

The data may be transferred to group companies of Meta Platforms Ireland Limited in the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR); the provider is certified under it (as of 2026-10-21).

We and Meta Platforms Ireland Limited are jointly responsible for collecting and transmitting the data via Meta Pixel (Art. 26 GDPR; CJEU, judgment of 29.07.2019, C-40/17 – Fashion ID). The agreement (accepted on 2026-10-21) provides: we inform you and obtain your consent; for the further processing by Meta Platforms Ireland Limited, Meta Platforms Ireland Limited is responsible. You can exercise your rights regarding that further processing directly against Meta Platforms Ireland Limited (see link).

Retention: Retention follows Meta's own information (see the privacy policy link).

Withdrawal: you can withdraw your consent at any time with effect for the future, via “Privacy settings” in the page footer. The lawfulness of processing up to the withdrawal is not affected (Art. 7(3) GDPR).

Provider's privacy policy: www.facebook.com/privacy/policy

Retention

We delete enquiries that do not lead to a booking at the latest 6 months after they are settled. If a booking follows, we keep the contract, correspondence and invoices for as long as the law requires of us: commercial and business letters six years, accounting vouchers (for example invoices) eight years, books and annual accounts ten years (§ 257 HGB, § 147 AO), each from the end of the calendar year in which they arose. The duration of the online gallery is stated in its own section. After that we delete the data.

Transfers to third countries

Some of the providers named may transfer data to the USA and other third countries. You can get a copy of the safeguards (adequacy decision or standard contractual clauses) on request at info@photographydenizz.com; you can find the decision on the EU-US Data Privacy Framework on eur-lex.europa.eu. If the decision lapses, we rely on standard contractual clauses for the transfer (Art. 46(2)(c) GDPR).

Encryption

The connection to this website is encrypted with TLS (https).

Your rights

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent for the future (Art. 7(3) GDPR)

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us:

Der Landesbeauftragte für den Datenschutz NiedersachsenPrinzenstraße 530159 Hannoverwww.lfd.niedersachsen.de

Right to object (Art. 21 GDPR)

You can object at any time, on grounds relating to your particular situation, to the processing of your personal data where it is based on Art. 6(1)(f) GDPR (for example server log files, protection against attacks, protection of the login). We then no longer process the data, unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. A short message to info@photographydenizz.com is enough.

No obligation, no automated decisions

You do not have to give us any data, but without contact details we cannot reply. We make no automated decisions with legal effect (Art. 22 GDPR). If you agree to analytics or advertising services, they can build usage profiles, for example for target groups; details are in the sections on those services. You can withdraw your consent at any time.