Privacy notice

General information on the processing of your data

We are obliged by law to inform you of the processing of your personal data (hereinafter referred to as “data”) when our website is used or our profile in the social media visited. The following data privacy notification informs you of details of the processing of your data and on your relevant legal rights. For terminology such as “personal data” or “processing”, the legal definitions laid down in Art. 4 GDPR shall be decisive. We reserve the right to adapt the privacy notice effective for the future, in particular in the event of the further development of the website, the use of new technologies or the amendment of the statutory basis or the corresponding case law. We recommend reading the privacy notice from time to time and filing a print-out or a copy.

Scope

The privacy notice is intended for all users of the website www.ulrike-crespo-photography.com. It does not extend to any linked websites or internet presence of us or other providers.

Responsible provider

Responsibility for the processing of personal data within the scope of this privacy notice lies with:

Crespo Foundation
Haus des Buches
Braubachstraße 16
60311 Frankfurt am Main

Telephone: +49 (0)69 27107950
Telefax: +49 (0)69 271079510
info@crespo-foundation.de

Questions on Data Protection

Should you have questions on the topic of data protection with regard to our Foundation or our website or our presence on social media, please contact our data protection offficer:

SPIRIT LEGAL Fuhrmann Hense Partnerschaft von Rechtsanwälten
Rechtsanwalt und Datenschutzbeauftragter
Peter Hense

Postal Address:
Datenschutzbeauftragter
c/o Crespo Foundation
Haus des Buches
Braubachstraße 16
60311 Frankfurt am Main
Germany

Security

We have taken comprehensive technical and organisational measures to protect your personal data from unauthorised access, misuse, loss and other external disruptions. In this context, we regularly examine our security measures and adapt them to the state of the art.

Your rights

You have the following rights with regard to your personal data which you can assert vis-a-vis us:

Right to access: You can request information pursuant to Art. 15 GDPR regarding your personal data processed by us.
Right to rectification: Should your personal data be inaccurate (or no longer be accurate) you can demand rectification pursuant to Art. 16 GDPR. Should your data be incomplete, you can demand to have it completed.
Right to erasure: Pursuant to Art. 17 GDPR, you can demand the erasure of your personal data.
Right to restriction of processing: Pursuant to Art. 18 GDPR, you have the right to demand a restriction of the processing of your personal data.
Right to object to the processing: Pursuant to Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which ensues on the basis of Art. 6(1)(e) or (f) GDPR. In this case, we will no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). Furthermore, pursuant to Art. 21(2) GDPR, you have the right, at any time, to object to the processing of your personal data for the purpose of direct advertising; this shall also apply for any profiling where it is related to direct advertising of this kind. We draw your attention to the right to object in this privacy notice in the context of the respective processing.
Right to withdraw your consent: Where you have consented to the processing, you have the right to withdraw under Art. 7(3) GDPR.
Right to data portability: You have the right to receive the personal data which you have provided to us in a structured, commonly used and machine-readable format (“data portability”) and the right to transmit those data to another controller when the prerequisites of Art. 20(1) (a, b) GDPR have been met (Art. 20 GDPR).

You can assert your right by making notification to the contact data stipulated in the section “Responsible provider”

If you are of the opinion that the processing of your personal data infringes your data protection rights, you also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with a data protection authority of your choice. This also includes the data protection supervisory authority responsible for the provider: Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Telephone: 0611 14 08 0, Telefax: 0611 14 08 900, E-mail: poststelle@datenschutz.hessen.de.

I. Website

1. Use of our website

You can always use our website without revealing your identity for purely informative purposes. When the individual pages of the website are called up in this way, only access data are transferred to our webspace provider so that you can be shown the website. The following data are processed:

Browser type/ browser version,
Operating system used,
Language and version of the browser software,
Date and time of access,
Host name of the accessing terminal,
IP address,
Content of the inquiry (specific website),
Access status/HTTP status code,
Websites called up via the website,
Referrer URL (the website previously visited),
Notification of whether the call-up was successful and
Data volume transferred.

The temporary processing of this data is necessary to technically facilitate the process of a website visit and the provision of the website to your terminal. The access data are not used to identify individual users and not collated with other data sources. A further storage in logfiles ensues to ensure the functionality of the website and the security of the IT systems. The legal basis for the processing is Art.6(1)(1)(f) GDPR. Our legitimate interests lie in securing the functionality of the website as well as the integrity and security of the website. Storing access data, in particular the IP address, in logfiles over a longer period makes it possible for us to be able to recognise and counteract misuse. This includes defending against inquiries which would overload the service or any bot use. The access data are deleted as soon as they are no longer required to achieve the purpose of their processing. In the case of the collection of data for the provision of the website, this applies when you have terminated your visit to the website. The logfiles are always stored directly and for the exclusive access of administrators and deleted after seven days at the latest. Thereafter, they are available only indirectly by means of reconstruction of the backups and are deleted finally after a maximum of four weeks.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can lodge your objection by making notification to the contact data stipulated in the section “Responsible provider”.

2. Cookies and other functions

Our websites uses cookies and other functions to process terminal information and personal data of our users. These are exclusively so-called “essential cookies”:

Essential cookies are required for fundamental functions of the website. This ensures that the website can function without disruption. Our website stores essential cookies for the following purposes:

Language settings
Contains the selected language. Storage time unlimited.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest in the processing lies in providing the special functionalities thus making the use of the website more attractive and effective.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can prevent the cookie-based data processing as follows: by deactivating or restricting or deleting cookies in the settings of your browser software or by opening the browser you are using in “private mode”.

3. Contacting the Crespo Foundation

When you contact our Foundation, for example, per e-mail or by using the contact form on the website, the personal data you provide will be processed by us in order to respond to your enquiry. Essential for the processing of inquiries via the contact form on the website are the provision of details on your name, or a pseudonym, as well as a valid e-mail address. At the time of sending your message to us, your IP address as well as the date and time of the registration will also be processed. The legal basis for the processing is Art. 6(1)(1)(f) GDPR resp. Art. 6(1)(1)(b) GDPR, if the establishment of contact is aimed at concluding a contract. Where the inquiry is aimed at the conclusion of a contract, the provision of your details is necessary and binding for the conclusion of a contract. Non-provision of the data makes the conclusion of a contract or the execution in the form of contact or the processing of the enquiry impossible. The processing of the personal data from the input mask serves only to allow the processing of the contact. In the event of contact being established, this is also the necessary legitimate interest in the processing of the data. The other data processed during the dispatch process serve to prevent misuse of the contact form and to ensure the security of our IT systems. In this context, no data are passed on to third parties. We delete the data received in this context when the processing is no longer necessary – as a rule, two years after termination of the communication – or restrict the processing, where applicable, to the observance of the existing legally mandatory record retention obligations.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can notify us of your objection by using the contact data listed in the section “Responsible provider”.

4. Hosting

We use external hosting services from the provider Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4-6, 32339 Espelkamp, https://www.mittwald.de, which serve to make the following available: infrastructure and platform services, computing capacity, storage resources and data base services, searches, security and technical maintenance work. For these purposes, all data – among them the access data listed under the point “Use of our website” – are processed which are necessary for the operation and use of our website. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. With the use of external hosting services we pursue the aim of ensuring the efficient and secure availability of our web offer.

5. Website support by digital agency

We avail of the services of a digital agency virtualworx, Oranienstr. 19a, 10999 Berlin to support our website. In the context of this support, the digital agency may, in certain circumstances, (e.g. in the case of backups) process the access data listed in the section “Use of our website”, in particular your IP address, and the data stipulated on this website.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. With the use of the services we pursue the aim of ensuring the efficient and secure availability of our web offer.