MOMENTS · PRIVACY

Privacy policy

Last updated: 6 October 2026

Controller and contact

The controller responsible for processing personal data on www.moments.berlin is Aktfotostudio MOMENTS, owner Marcus Thiemann, Hans-Otto-Str. 25, 10407 Berlin, Germany. For privacy questions or to exercise your rights, contact datenschutz@moments.berlin. Further contact details are available in our legal notice.

This policy describes how we handle data when you visit our website, make enquiries, place orders or use our services. Personal data also includes online identifiers and IP addresses. Pseudonymous usage data is not anonymous merely because we do not know your name.

Encryption and security

Our website uses HTTPS/TLS to protect transmitted content and form data. We take technical and organisational measures against loss, misuse and unauthorised access. Email transport encryption also depends on the email providers involved; completely secure transmission cannot be guaranteed on the internet.

Hosting and server logs

Our website and databases are hosted in Germany. When you visit, server logs may process your IP address, browser type, operating system, requested page, referrer, and the date and time. This supports secure operation, troubleshooting and protection against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and functioning website. IP addresses in these logs are generally retained for no more than 14 days, unless further retention is necessary to investigate a specific security incident. These logs are separate from Google Analytics.

Enquiries, orders, competitions and surveys

When you contact us, place an order or take part in a promotion, we process the information needed for that purpose, such as your name, address, telephone number, email address, message, order details and, where applicable, photographs or payment information. We use it to handle your enquiry, fulfil your order or run the promotion. The bases are Article 6(1)(b) GDPR for contracts and pre-contractual enquiries, Article 6(1)(a) GDPR where consent is given, and Article 6(1)(c) GDPR for legal obligations.

Required contract or payment details are needed for the relevant service; without them we may be unable to provide it. Optional information and consent are not prerequisites for visiting the website. Notices concerning an existing contract, such as processing an order, are separate from advertising.

Newsletter and email communication

For our newsletter, we process your email address and subscription details on the basis of your consent (Article 6(1)(a) GDPR). Where double opt-in is used, a confirmation link verifies the subscription. You can unsubscribe at any time using the unsubscribe link or by contacting us. This does not affect the lawfulness of processing before withdrawal.

Individual emails may contain redirect links or tracking pixels to evaluate clicks and opens. Where such personal evaluations are used, appropriate consent is required; the Analytics consent on this website does not cover email tracking. Ordinary links may take you to external websites, which have their own privacy policies.

Cookies and storing your choice

We distinguish technically necessary storage from optional analytics. We obtain your consent to Google Analytics before loading the Google tag. You can decline and continue using the website.

Your decision is stored in this browser as moments_analytics_consent in localStorage, or alternatively in our own moments_consent cookie. The stored record contains your choice, its timestamp, the consent version and the measurement ID. Your choice is valid for up to 180 days, after which you will be asked again. This storage implements your decision and avoids asking on every visit. The bases are Section 25(2), point 2, of the German TDDDG and Article 6(1)(f) GDPR; our interest is reliable management of your choice.

Google Analytics 4

Purpose and provider: With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Ireland, to analyse visits and website usage and improve our content. Google processes analytics data for this evaluation. Recipients may also include Google LLC in the USA and Google's subprocessors.

Data: Processing includes page views, timestamps and session information, pseudonymous cookie identifiers, and browser, language and device information. Your IP address is technically transmitted to Google; according to Google, GA4 does not log or store it, but processes it for purposes including deriving an approximate location. This is not a guarantee of complete anonymity.

Our integration omits URL query parameters, fragments and referrers from initial page views. Google Signals, personalised advertising, and permission for advertising storage or advertising user data are disabled in this integration. It does not deliberately send names, email addresses, messages or booking details as analytics data.

Consent: The bases are Article 6(1)(a) GDPR for processing personal data and Section 25(1) TDDDG for storage and access on your device. Without consent, the Google Analytics tag is not loaded and this integration sends no analytics data to Google.

Transfers: Processing in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; where its requirements are met, transfers rely on the adequacy decision (Article 45 GDPR). For transfers not covered, Google identifies safeguards including standard contractual clauses. Details and access to safeguards are available in Google's data transfer information.

Retention: Analytics cookies set by this integration, notably _ga and _ga_*, have a configured lifetime of up to 180 days, without automatic renewal by our script. For user and event data in GA4, we use a retention period of 2 months without resetting it on new activity; automatic deletion takes place in the subsequent monthly deletion cycle. Aggregated standard reports are not subject to this period and may remain available longer.

Withdrawal: You can change your choice at any time using the permanently available “Privacy settings” button and withdraw consent by selecting “Decline”. Further collection is disabled, standard Analytics cookies accessible to our website are deleted and the page reloads. Withdrawal applies to future processing and does not retroactively delete data already sent. You can also exercise your privacy rights using the contact address above.

Further information: Google privacy policy and how Google uses data from partner websites.

Google Fonts and other analytics tools

If Google Fonts are loaded directly from Google's servers, Google receives technical connection data including your IP address. Fonts served locally do not create this connection. Consent to Google Analytics does not cover externally hosted fonts.

The Fastbase Webleads add-on mentioned in our previous privacy policy matches Analytics data against a business directory to associate company and contact information with website visitors. It is not part of the GA4 integration described here and is not authorised by its consent request. Separate use requires its own information and an appropriate legal basis.

Service providers, disclosure and external services

To fulfil orders, necessary data and photographs may be shared with service providers for prints, calendars, photo books, order processing and delivery, such as Deutsche Post. We prefer providers in Berlin and Germany. Where providers process data on our behalf, data processing requirements apply. Data is not shared for third parties' own advertising without an appropriate legal basis.

Disclosure may also be necessary to meet legal obligations, establish or defend claims, or transfer a business; this occurs only to the extent permitted by law. External websites, social networks and transfer services such as WeTransfer also have their own privacy policies. Data may be processed outside the European Economic Area. Analytics consent does not cover these services.

Retention, children and public content

We retain contact, order and other customer data only as long as needed for the relevant purpose or required by law. When the purpose ends, data is deleted unless an obligation or another lawful basis permits further retention. Specific periods for server logs, your consent choice and Analytics are described in the relevant sections.

We do not knowingly collect data from children under 16 without the required authorisation. If we become aware of unlawful collection, we arrange deletion. Information you publish in public posts, for example on social networks, may also be read and used by other people.

Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time for future processing. You can object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time.

You may complain to a data protection supervisory authority, in particular where you live, work or where the suspected infringement occurred. In Berlin this is the Berlin Commissioner for Data Protection and Freedom of Information. To contact us, please use datenschutz@moments.berlin. We do not make automated decisions that have legal or similarly significant effects on you.