Privacy Policy

This website is deliberately built to collect as little as possible about you. It serves static pages, embeds nothing from third parties, runs no advertising and builds no visitor profiles. The one cookie it sets stores your choice of language and nothing else.

The sections below set out, as required by Art. 13 GDPR, who is responsible, what is processed, on what legal basis, for how long, and what rights you have.

1. Controller

Michael Seirer Photography Reithofferplatz 12/17 1150 Vienna Austria

Phone: +43 699 150 83 777 E-mail: michael@seirer-photography.com

I am not required to appoint a data protection officer. You can reach me directly at the address above for any question or request concerning your data.

2. Server logs and hosting (Cloudflare)

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For users in the European Economic Area the contact point is Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany.

Cloudflare also acts as a content delivery network: pages are served from a worldwide network of servers, which speeds up delivery and protects the site against attacks. Each request is recorded in server log files. This typically covers the requested page, the date and time, the referring page, the browser type and version, the operating system, and the IP address of the requesting system.

I do not use this data to identify individual visitors. It is needed to deliver the site correctly, to keep it available and secure, and to investigate attacks.

Legal basis is my legitimate interest in providing this website securely, reliably and with good performance (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Where data is transferred to the USA, that transfer is covered by the European Commission’s Standard Contractual Clauses and by Cloudflare, Inc.’s certification under the EU-U.S. Data Privacy Framework.

Further information: Cloudflare Privacy Policy.

3. Cookies

This website sets exactly one cookie.

It is called lang and its content is either de or en. It remembers which language version of this site you last chose, so you do not have to switch again on your next visit. It is set only when you actively click one of the language flags (🇦🇹 / 🇬🇧) - never merely because you opened a page. It contains no identifier that could be used to recognise you or your browser, and it expires after one year.

Because this cookie does nothing but deliver a service you explicitly asked for, it is a strictly necessary cookie within the meaning of § 165(3) of the Austrian Telecommunications Act 2021 and Art. 5(3) of the ePrivacy Directive. No consent is required, which is why this website shows no cookie banner.

No cookies are set for analytics, advertising or tracking purposes.

When a browser opens this site for the first time, the language version is chosen by reading the Accept-Language header that your browser sends anyway. Nothing is stored on or read from your device in the process.

You can block cookies at any time in your browser settings and delete cookies already stored. If you do, this site will simply stop remembering your language choice; everything else keeps working.

4. Audience measurement (Cloudflare Web Analytics)

To understand which content on this site is actually being read, I use Cloudflare Web Analytics, provided by Cloudflare, Inc. (address and EEA contact point as above).

This service is deliberately minimal: it sets no cookies, uses no fingerprinting, and stores no identifier that would allow individual visitors to be recognised across page views, let alone across websites. Only aggregated figures are reported - page views, which pages were opened, the referring website, the approximate region, and browser and device type. None of this lets me identify an individual.

A small measurement script is loaded from static.cloudflareinsights.com when you open a page. Your IP address is transmitted to Cloudflare in the process; it is not permanently stored for this service.

Legal basis is my legitimate interest in understanding which content is in demand so that I can improve it (Art. 6(1)(f) GDPR). Since no cookies are set and no information is read from your device, no consent is required.

Further information: Cloudflare Web Analytics.

5. Contacting me

This website contains no contact form. Contact is by e-mail only, using the address given above.

If you write to me, the content of your message and the details you provide - typically your name, e-mail address and whatever else you choose to include - are stored so that I can deal with your enquiry. Legal basis is the performance of a contract or steps taken prior to entering into a contract (Art. 6(1)(b) GDPR), or my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). This data is not passed on to third parties.

6. Links to social networks

The footer of this site, and occasionally individual posts, link to my profiles on Instagram, LinkedIn and X (formerly Twitter).

These are plain hyperlinks, not embedded plug-ins or buttons. No content is loaded from those networks. As long as you do not click such a link, no data whatsoever is transmitted to the providers concerned - not even if you happen to be logged in there.

Only when you click do you leave this website. From that point the privacy policy of the respective provider applies, and I have no influence over their processing.

7. Services used in my photography business

The following services process data in connection with my work as a photographer rather than with your visit to this website. They are listed here for completeness.

SmugMug - I use SmugMug, Inc. (67 E Evelyn Ave, Ste 200, Mountain View, CA 94041, USA) to provide clients with photographs and videos in protected and public galleries, reachable at galleries.seirer-photography.com. Identifiable people may appear in those images, which makes them personal data. I am the controller; SmugMug acts as a processor under Art. 28 GDPR on the basis of a Data Processing Addendum. Legal basis is the performance of my contract with the client (Art. 6(1)(b) GDPR) and, where images are made publicly accessible, prior consent or my legitimate interest (Art. 6(1)(a) or (f) GDPR). Processing takes place on servers in the USA, covered by Standard Contractual Clauses and/or SmugMug’s participation in the EU-U.S. Data Privacy Framework. See the SmugMug privacy policy and the SmugMug DPA.

Backblaze - I use Backblaze (500 Ben Franklin Ct, San Mateo, CA 94401, USA) to back up my business data, including photographs and videos. This safeguards my work and allows me to meet contractual retention and re-delivery obligations. Legal basis is my legitimate interest in securing my business data against loss, and the performance of my contracts (Art. 6(1)(f) and (b) GDPR).

Canva - I use Canva US, Inc. (3212 E Cesar Chavez St, Bldg 1, Ste 1300, Austin, TX 78702-4938, USA) to produce quotes and design material. I do not upload photographs of identifiable people to Canva. Where design material nonetheless contains personal data, such as sample images from my portfolio, it is used on the basis of prior consent or my legitimate interest in advertising my services (Art. 6(1)(a) or (f) GDPR). Transfers are covered by Canva US, Inc.’s certification under the EU-U.S. Data Privacy Framework and by Standard Contractual Clauses. I have disabled the use of my content for AI model training in Canva’s privacy settings. Canva’s EU representative under Art. 27 GDPR is the European Data Protection Office (EDPO), Ground Floor, 71 Lower Baggot Street, Dublin, D02 P593, Ireland.

8. How long data is kept

Server log data is kept only as long as needed to operate and secure the site. Correspondence is kept for as long as needed to deal with the matter and thereafter for the statutory retention periods, which under Austrian tax and commercial law are generally seven years. Photographs are kept for the period agreed with the client. Data that is no longer needed and not subject to a retention obligation is deleted.

9. Your rights

You have the right to obtain confirmation as to whether data concerning you is processed and, if so, to receive access to that data and a copy of it. You may request rectification of inaccurate data and completion of incomplete data. You may request erasure, and restriction of processing where one of the conditions in Art. 18 GDPR applies. You have the right to data portability for data you provided, where processing is based on consent or contract and carried out by automated means.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR). Where processing is based on consent, you may withdraw that consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal is unaffected.

To exercise any of these rights, simply write to the address in section 1.

10. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). The authority responsible for me is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42 1030 Vienna Austria Phone: +43 1 52 152-0 E-mail: dsb@dsb.gv.at Web: https://www.dsb.gv.at

11. Whether you have to provide data

Browsing this website requires no personal data from you beyond the technical data every web request necessarily carries. If you wish to enter into a contract with me, some data - such as name, contact details and billing information - is necessary by law or by contract; without it the contract cannot be concluded or performed.

12. No automated decision-making

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Encryption

This website is served exclusively over HTTPS. Data transmitted between your browser and the server is encrypted in transit and cannot be read by third parties.

14. Changes to this policy

I update this policy whenever the way this website works changes. The version you are reading is the current one.