Privacy Policy

1. Controller

The controller within the meaning of the GDPR and the Austrian Data Protection Act (DSG) is: NKLS Multimedia e.U., owner Nikolas Backknecht, Unterer Mitterweg 10, 3495 Rohrendorf bei Krems, Austria. Email: studio@nkls-media.at, phone: +43 676 9606677. There is no legal obligation to appoint a data protection officer; for any privacy questions please contact the controller directly.

2. Data processed, purposes & legal bases

Inquiry and booking forms: I process name, email address, optionally phone number, preferred date, service area and your message in order to handle your request and prepare an offer. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of contract). Providing this data is necessary; without it I cannot respond to your request.

Server log files: when the website is accessed, technically necessary data (shortened IP address, date/time, page requested, browser type) is processed to ensure secure and stable operation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security). These logs are deleted or anonymised after 7 days at the latest.

Client galleries: access to private galleries is password-protected. A technically necessary session cookie is set for this (exemption under § 165(3) TKG 2021 - no consent required). Galleries and associated access data are deleted after the agreed availability period.

Review form: if you submit a review of 1 to 4 stars via the form, I store the star rating, your name and your text (both optional), the language, origin (website or gallery, where applicable the gallery identifier) and the time. After submission the review is displayed publicly on the reviews page – please do not enter anything in the free text or name field that should not appear publicly. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting. You can revoke it at any time with effect for the future; an informal message to studio@nkls-media.at is enough and I will then remove the review. The data is stored until you revoke consent or the review is deleted. For a 5-star review I redirect you to Google; the text is only placed in your clipboard for this and is not sent to my server. Google’s privacy policy applies to processing at Google.

School photography (parent access): for school photo sessions I store, per child, name, class and school, the photos and a personal access code (QR code on the card). Only the legal guardians can view their child’s photos with the code; the photos are not publicly accessible and are delivered only after logging in with the code. A technically necessary session cookie is set for the login (§ 165(3) TKG 2021). If guardians order photos, I additionally process name, email address, optionally phone number and a note, the delivery address for home delivery, and the products ordered and the amount. The purpose is to provide the photos and to handle the order, invoicing and delivery; the legal basis is performance of the contract with the legal guardians or the school (Art. 6(1)(b) GDPR). As this concerns images and data of minors, I handle it with particular care; guardians exercise the rights described in section 6 on behalf of their child. The photos are deleted after the online period ends (by default 120 days from the photo session, unless agreed otherwise); order data is subject to the statutory retention obligations described in section 3.

3. Storage period

Inquiry data without a subsequent contract is deleted no later than 12 months after the last contact. In the event of a contract, data is stored for the duration of statutory retention obligations (in particular 7 years pursuant to § 132 BAO and § 212 UGB).

4. Analytics & cookies

This website uses only technically necessary cookies. For traffic measurement I use my own cookieless solution without third parties: the browser only sends to my own server which type of page was viewed, which service area was clicked, whether the visit is on mobile or desktop, the language and technical page-speed metrics. IP addresses are not stored, no cookies are set, no personal profiles are created and no cross-device recognition takes place; the measurements are not passed on to third-party analytics services. As no consent-requiring cookies or trackers are used, a cookie consent banner is not required. Fonts, images and videos are delivered from my own server in Austria; the traffic runs through the Cloudflare service (section 5).

One exception is the map preview on the contact page: by default it embeds no Google script and shows only my own map image. Only an explicit click on „Load map“ loads the embedded Google Maps map – see section 7 for details. Likewise, an embedded video (YouTube) loads only after you click the play button – see section 8.

5. Recipients & processors

My website runs on my own server in Austria. For delivery, protection and acceleration I use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, in front of it as a reverse proxy, CDN and tunnel service (processor within the meaning of Art. 28 GDPR; legal basis: legitimate interest in secure, stable and fast operation, Art. 6(1)(f) GDPR). All requests to the website – including your IP address and technical connection data – therefore pass through Cloudflare’s infrastructure. A transfer to the USA is possible. It relies on the adequacy decision for the EU-US Data Privacy Framework (Cloudflare is certified) and additionally on the EU Commission’s standard contractual clauses. For details: https://www.cloudflare.com/privacypolicy/.

For sending and receiving emails (e.g. replies to inquiries, confirmations, invoices) I use the services of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as a processor (Art. 28 GDPR); processing takes place on servers in the EU. Data processing agreements are in place with these providers.

Beyond that, I only pass on personal data where legally required or necessary to perform the contract (e.g. to my tax advisor, delivery services for shipping). Content from Google (map) and YouTube (video) embedded on a two-click basis, and a click on the WhatsApp link, lead to a data transfer to the providers named there only through your own active action – see sections 7 to 9.

6. Your rights

You have the right at any time to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). You may revoke any consent given at any time with effect for the future. To exercise your rights, an informal message to studio@nkls-media.at is sufficient.

If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at).

7. Google Maps

On the contact page I first show my location as my own static map image with no connection to Google. Only once you actively click „Load map“ do I embed the map display of the Google Maps service, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The legal basis for this embedding is your consent (Art. 6(1)(a) GDPR), which you give by clicking the button.

After the click, your browser connects directly to Google's servers and loads the map as an embedded window (iframe). This transmits, among other things, your IP address and technical browser data to Google; Google may process this data even if you do not have a Google account or are not logged in. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. I have no influence on the content, scope or further processing of this data by Google. For details and your rights vis-à-vis Google, see Google's privacy policy: https://policies.google.com/privacy.

Consent applies only to the current session and is not stored as a cookie. You can revoke it at any time with effect for the future by reloading the page – the map then returns to the static preview until you click „Load map“ again.

8. YouTube videos

Some pages (e.g. the wedding film) first show only my own still image with a play button – with no connection to YouTube and no cookie. Only when you actively click the play button do I load the video player of the YouTube service in enhanced privacy mode via the domain youtube-nocookie.com; the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by clicking.

After the click, your browser connects to Google’s servers. Among other things, your IP address and technical browser data are transmitted to Google, even if you have no Google account or are not logged in; Google may store and process data related to playback. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. I have no influence on the scope of further processing by Google. For details: https://policies.google.com/privacy. Consent applies only to the current page view and is not stored as a cookie; you can revoke it at any time with effect for the future by leaving or reloading the page.

9. WhatsApp link

On the contact page and in the footer I offer a link to message me via WhatsApp. No connection to WhatsApp is made when the page loads; it is an ordinary link. Only when you click it and use WhatsApp does WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (a Meta group company) process your data under its own privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea). A transfer to third countries, in particular the USA, is possible. Messages you send me there are processed by me to respond to your inquiry (Art. 6(1)(b) GDPR). If you prefer not to use it, you can reach me by email or phone.