Privacy Notice

„Privacy Policy“ and „Information on the processing of personal data in accordance with Art. 13, 14 DSGVO“
Last updated: November 27, 2024

Introduction

The following sections, “Privacy Policy” and “Information about the processing of personal data in accordance with Art. 13, 14 GDPR,” explain what data I collect about you, what I need this data for and to whom I pass on this data. In addition, they also include your rights in relation to your data and the contact persons to whom you can turn for further information or inquiries.

While the “Privacy Policy” is intended primarily to clarify what personal data I process, store and protect if you use “my website”, the “Information about the processing of personal data in accordance with Art. 13, 14 GDPR” essentially describes how your data are processed in the context of my services for you / my customers and in the context of all other activities that are part of the performance of my business activities.

I. Privacy Policy

II. Information about the processing of personal data in accordance with Art. 13, 14 GDPR

Please ensure that, in addition to the information below, you are also familiar with Sara Wolff’s Privacy Policy. For questions of understanding or other queries, please contact me at sara@sarawolff.de.

Sara Wolff provides services in the areas of people and wedding photography. As part of the commission to provide the above services, Sara Wolff processes personal data according to the individual order. This information complements the Privacy Policy above and provides a more concrete description of how Sara Wolff processes your personal information as part of the provision of the commissioned service.

Please note that this information refers exclusively to personal data within the meaning of Art. 4 No. 1 GDPR, i.e. not all data and information that Sara Wolff receives in relation to the underlying client relationship, but essentially only information that relates to an identified or identifiable natural person.

The controller within the meaning of the GDPR

The controller within the meaning of Art. 4 (7) EU General Data Protection Regulation (GDPR), which is responsible for processing your personal data in connection with all services, is:

Sara Wolff
Bauseweinallee 5
81247 München

Data protection officer

Sara Wolff has appointed a data protection officer. You can contact the respective data protection officer at sara@sarawolff.de.

Purposes of processing and legal basis for processing

Sara Wolff processes your personal information for the purpose of fulfilling my (pre)contractual obligation to my customers. In particular, I process your contact details such as name, address, telephone number and e-mail address in this context in order to carry out pre-contractual measures and to carry out my respective contractual obligations, including administrative execution and settlement of the respective contract on the basis of Art. 6 para. 1 lit. b) GDPR. Sara Wolff uses IT systems to administer and store your personal information to manage and execute order requests / assignments, but with no automated decision-making or profiling.

Depending on the category of documents, Sara Wolff will store personal data for record keeping / documentation and archival purposes in accordance with relevant legislation:

As a rule, Sara Wolff receives the necessary personal data from the customers. In this respect, Sara Wolff has, in accordance with Art. 6 para. 1. f) GDPR, a legitimate interest in the processing of this personal data, as Sara Wolff is obliged to carry out the contracted service on the basis of the underlying contract. In this context, it is essential for Sara Wolff to process any personal data related to the contact persons of my customer (including at an early stage within the context of the offer preparation).

If you have commissioned Sara Wolff to perform certain services, such additional personal data relating to you will be processed in the context of order processing in addition to your contact details to the extent that they are necessary for the provision of the service agreed with you and that you have forwarded such information to me. In this respect, the processing of your personal data is justified to ensure the fulfillment of the contract between you and Sara Wolff and according to Art. 6 para. 1 b) GDPR. 

Please note that Sara Wolff’s General Terms and Conditions generally require the client to be obliged to provide Sara Wolff with all the documents and information necessary to complete the contract. In this respect, the processing of the respective order and the associated fulfillment of the contractually agreed service by Sara Wolff is not possible or possible only to a limited extent if and insofar as the necessary information is not provided.

As Sara Wolff is required by law to ensure proper record keeping, extensive documentation of its clients and assignments (also beyond the conclusion of an order) as well as compliance with further retention and documentation obligations, Sara Wolff processes your personal data in the context of documents to be recorded, work results or related customer-related correspondence (also for the purpose of file management), documentation and archiving both in the form of paper files and in the context of IT systems used for this purpose on the basis of Art. 6 para. 1. c) GDPR for the fulfillment of my aforementioned legal obligations.

Notwithstanding the foregoing purposes, Sara Wolff will, to the extent permitted by applicable law, also process your contact information (including name, address, e-mail address) for marketing and advertising purposes, in other words, for example, to provide you with information about my further offers or events. This is done on the basis of consents and / or a legitimate economic interest of Sara Wolff as defined in Art. 6 para. 1. f) to inform my customers about further offers and events they provide and thus to establish and maintain a long-term customer relationship.

Finally, Sara Wolff also processes your contact information for the purpose of maintaining my business contacts when I receive them in the course of a business event, as part of a business appointment (e.g. by exchanging business cards) or as part of an order, and transfer these into the CRM system I use (Customer Relationship Management System).

Because Sara Wolff has a legitimate commercial interest in maintaining contacts in the context of business relations beyond the initial contact, to use them for establishing a business relationship and to remain in contact with the data subject for this purpose, the above processing of your personal data takes place on the basis of Art. 6 para. 1. f) GDPR.

Categories of data recipients and transfers to third countries

In connection with the implementation of the above-mentioned processing, personal data may also be received from third parties, as specified below. Your personal data may be stored within and outside the EU/European Economic Area (EEA). Data may be transferred to both European and non-European countries, whereby the transfer of data may be temporary and does not necessarily lead to storage.

Sara Wolff's external IT service providers within the EU/EEA

Sara Wolff uses third parties as external IT service providers, which provide services for the operation, maintenance and care of the IT systems and applications used by Sara Wolff.  External IT service providers are bound by instructions.

To Sara Wolff’s external IT service providers outside of the EU/EEA

When using external IT service providers outside the EU/EEA, an adequate level of data protection is ensured through the use of standard contractual clauses (SCC) of the European Commission within the meaning of Art. 46 (2) (c) GDPR.

Depending on the recipient country, external data transfers further undergo a Transfer Impact Assessment to evaluate the legal and practical implications in the recipient country. This assessment includes a review of local laws and practices to determine if additional protective measures are necessary.  

Your rights in connection with data processing

The GDPR essentially grants data subjects the following rights, which you can assert at any time by contacting the data protection officer named in this information at “Data protection officer”.

In principle, you can request information from Sara Wolff at any time as to whether personal data about you are processed or stored at Sara Wolff and which personal data are affected. Please note that your right to information may be restricted to the extent that such information conflicts with professional secrecy and to the extent that information requiring secrecy would be disclosed.

In addition to your right to information, you can request the correction of your data at any time. In addition, you have the right to delete your data if and when the data are no longer needed for the purposes for which it was collected or, if the processing is based on your consent, you have revoked your consent. The aforementioned right to delete your data is waived if your data must not be deleted due to a legal obligation or must be processed due to a legal obligation or if data processing is required for the assertion, exercise or defense of legal rights.

In addition, you have the right to request that Sara Wolff restrict the processing of your personal information.

Added to this is a right to data portability, i.e. you may request that Sara Wolff retain the data you provide in a structured, common and machine-readable format and / or that such data be transmitted to another controller. Please note that this does not apply if you have made the data available to us on the basis of consent or on the basis of a contract concluded with you or if the processing is carried out using automated procedures.

If Sara Wolff processes your personal data on the basis of Art. 6 para. 1. f) GDPR, you can object to this processing at any time.

Right of appeal to a data protection supervisory authority

In addition to the data subject rights listed above, you also have the right to complain to a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that the processing of your personal data violates data protection law. In each case, the supervisory authority of the federal state in which the controller has its seat is responsible.

Duration of data storage

Please note that Sara Wolff will store and process your personal information for as long as it is necessary for the fulfillment of the above mentioned processing purposes. Insofar as personal data are subject to statutory retention obligations or are part of documents subject to statutory retention requirements, Sara Wolff will store this data for the duration of the statutory retention period.

If the data are subject to different retention periods, the longest retention period applies, and the legally required retention period may be extended depending on the individual case, e.g. if the information is required to assert, exercise or defend legal rights even after expiration of the retention period.