Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is Björn Lexius, Stresemannstraße 216, 22769 Hamburg, Germany. Email: ahoy@hafenliebe-weddingphotography.com

2. General information

This Privacy Policy explains which personal data is processed when you visit this website, enable external content or submit an enquiry. We only process personal data where necessary to provide the website, respond to an enquiry, perform a contract, comply with legal obligations or on the basis of valid consent.

3. Website delivery through Cloudflare

This website is delivered through Cloudflare. Your IP address, time of access, requested address, referrer, browser and device information, and technical security data may be processed. The purpose is to provide the website securely, reliably and efficiently and to prevent misuse. Article 6(1)(f) GDPR may provide the legal basis.

Provider: Cloudflare, Inc., USA. Cloudflare uses international infrastructure. Transfers to third countries are subject to the applicable safeguards under Articles 44 et seq. GDPR.

4. Content and images provided by Sanity

Editorial content is managed through Sanity. Images are loaded directly from the Sanity content delivery network. This may transmit your IP address, the image URL, time of access, and browser and device information. The purpose is to deliver the requested content. Article 6(1)(f) GDPR may provide the legal basis.

5. Storing your privacy choices

The website stores your choices regarding optional services locally in your browser so it can remember your decision. Section 25(2)(2) TDDDG provides the legal basis for necessary storage on your device. Where a choice relates to consent, processing is based on Article 6(1)(a) GDPR. You can change your choice at any time through the privacy settings in the footer.

6. Google Analytics 4

With your consent, we use Google Analytics 4 to understand how the website is used. Online identifiers, IP and device information, approximate location, pages visited, session information and interactions may be processed. Google Analytics is loaded only after you consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Provider: Google. Processing in the USA and other countries cannot be ruled out.

7. Interactive Mapbox map

You can enable an interactive Mapbox map on the portfolio page. Connections to Mapbox are established only after activation. Your IP address and session, device, map request and telemetry data may be processed. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Provider: Mapbox, Inc., USA. Mapbox documents primary processing in the USA and a global CDN infrastructure. Mapbox states that IP addresses in CloudFront logs are generally retained for 30 days unless required for an ongoing security or misuse investigation.

8. Octoa contact form

An Octoa form is embedded on the contact page. Accessing the page may establish a connection to Octoa and providers embedded by Octoa. Your IP address, browser and device information, and technical identifiers may be processed.

When you submit the form, we process the information you provide to review and respond to your enquiry, communicate with you and, where appropriate, prepare an offer. Article 6(1)(b) GDPR provides the legal basis where processing is necessary for pre-contractual steps or performance of a contract. Clearly unsuitable enquiries are intended to be deleted after six months and other enquiries without a booking after twelve months from the last contact, unless an overriding legal ground applies.

9. Communication following an enquiry

Following an enquiry, we communicate primarily by email through Google Workspace. We process your contact details, communication and documents required for the enquiry or a potential contract. Article 6(1)(b) GDPR provides the legal basis. Where documents are subject to statutory retention duties, continued storage is based on Article 6(1)(c) GDPR.

Ordinary project communications not subject to statutory retention are reviewed after the end of a project. A review after three years is the current working rule.

10. Retention

We retain personal data only for as long as necessary for the relevant purpose. We then delete it unless statutory retention duties, the establishment or defence of legal claims, or another overriding legal ground requires continued storage.

11. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time with effect for the future and lodge a complaint with a data protection supervisory authority. You may use the email address stated above to exercise your rights.

12. Security and updates

We use appropriate technical and organisational measures to protect personal data. We update this Privacy Policy when the website, services or legal requirements change. Last updated: July 2026.

Technically necessary session storage

This website stores technically necessary information in your browser's session storage so the preloader is displayed only once within the same browser tab. The information remains local to the browser and is not used for analytics or advertising. Section 25(2)(2) TDDDG provides the legal basis for storage on your device.

External links

This website links to Instagram and other external services. A connection to the relevant provider is established only when you follow such a link. The provider's own privacy information applies to its processing.

Competent data protection authority

The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, https://datenschutz-hamburg.de