Privacy policy
Last updated: 9 October 2026
1. Privacy at a glance
This policy explains which personal data is processed when you visit fotografchristopher.de. Technical data is needed to provide the website securely. I use the information in the enquiry form to process your enquiry. You can voluntarily select optional statistics services and external content in the privacy notice.
You can use the website and enquiry form without consenting to optional services. You can change or withdraw your choice at any time: open cookie settings. Withdrawal does not affect the lawfulness of processing carried out before it.
Data controller
Christopher Middelmann · Photographer Christopher
Karl-Arnold-Straße 54
44869 Bochum
Phone: 0170 7290211
Email: info@fotografchristopher.de
2. Hosting and technical provision
This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When the website is accessed, technical connection data is processed, including pages and files requested, time of access, browser and operating system, device type, referrer and IP address. This processing serves the delivery, security and stability of the website. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is a reliable and secure website.
IONOS describes visitor data in its web hosting service as anonymised at the time of collection and states a retention period of eight weeks. Form details and other content I store are subject to the periods explained below. Further information: IONOS privacy information for web hosting.
IONOS processes data to provide hosting. The requirements for processing on behalf of a controller under Article 28 GDPR apply to this processing.
Security and encryption
The website uses HTTPS for encrypted transmission. Technical checks and protective functions are used to prevent abusive access and spam. These may process IP addresses, times, requested addresses and security-related events. The legal basis is Article 6(1)(f) GDPR, particularly the interest in protecting the website and its visitors. Security data is retained only as long as needed to detect, prevent or investigate abuse.
3. Your rights and general information
Subject to the legal requirements, you can request access, rectification, erasure and restriction of processing. You also have a right to data portability. You can withdraw consent at any time with effect for the future. Please contact the email address above.
Right to object
Where data is processed on the basis of legitimate interests, you can object on grounds relating to your particular situation (Article 21(1) GDPR). Processing will then stop unless there are overriding compelling grounds or grounds for establishing, exercising or defending legal claims. You can object to direct marketing at any time without giving a reason.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. For North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Retention periods and recipients
Personal data is deleted when its purpose no longer applies and there are no statutory retention duties or reasons for safeguarding legal claims. Where processing is based on consent, it stops for the future after withdrawal. Data may be shared with hosting and technical service providers to the extent needed for the relevant task. Details of optional recipients are provided under each service.
Processing outside the EU
External services from Google, Meta, Automattic or WordPress.org may involve processing outside the European Union, particularly in the USA. Information on recipients and countries is provided for each service and in the cookie settings. Transfers to third countries are subject to Articles 44 et seq. GDPR, such as an applicable adequacy decision or appropriate safeguards including standard contractual clauses. Depending on the recipient and country, different data protection standards and access by public authorities may apply.
4. Cookies, consent and enquiries
Necessary and optional services
Cookies and similar storage technologies can store or read information on your device. Strictly necessary access to storage takes place on the basis of Section 25(2), no. 2 TDDDG. Where personal data is processed for secure provision, Article 6(1)(f) GDPR applies; for compliance with legal obligations, Article 6(1)(c) GDPR applies. Optional services are used on the basis of your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Real Cookie Banner
Consent is managed with Real Cookie Banner by devowl.io. Your selection is stored and documented on this website. This includes a pseudonymous consent identifier, selected services, the time, the dialog settings at that time and the technical circumstances of your choice. Storage serves to respect and demonstrate your decision (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR). Storage of IP addresses in the consent documentation is disabled. The preference cookie lasts up to 365 days; a new decision may be required when services change or the consent period expires.
Change cookie settings · Withdraw optional consent. Details of individual services, storage technologies and durations are available in the settings. You can also delete or block cookies in your browser.
Free photography guide
You can request the photography guide on the separate free-guide page. The form requires a first name, last name and email address. Elementor stores these details in this website’s database to identify your request and send the PDF download link by email. The form function also stores technical metadata, such as the time, page address, IP address and browser information, to process requests and prevent abuse.
The legal basis for providing the requested guide is Article 6(1)(b) GDPR. Processing of technical security data is based on Article 6(1)(f) GDPR; my legitimate interest is reliable provision protected against abuse. Requesting the free guide does not subscribe you to the newsletter or other advertising emails. Details are deleted once delivery and any follow-up questions have been completed, unless legal duties or necessary evidence require retention. You can request deletion using the email address above.
Photography newsletter “Fotopost” and welcome voucher
If you separately subscribe to Fotopost, I process your email address, any voluntary profile details and your subscription and confirmation status. Fotopost contains photoshoot tips, insights and news about photography offers. Subscription takes place through The Newsletter Plugin on this WordPress website using a double opt-in process: only after clicking the confirmation link will you receive the newsletter and the welcome email with your 10% voucher. Subscription and confirmation data, particularly times and technical connection data, is processed for documentation and abuse prevention.
The legal basis for sending the newsletter is your voluntary consent under Article 6(1)(a) GDPR. You can withdraw it at any time through the unsubscribe link in each newsletter or by email. Advertising emails will then stop. Necessary evidence of consent and unsubscription may continue to be stored for proof and the defence of legal claims on the basis of Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR, or Article 6(1)(f) GDPR. Voucher data is processed to provide the voucher and check its validity. General opening and click tracking in the newsletter plugin is currently disabled. Separate web analytics on later website visits follows your choices in the cookie banner.
Spam protection with Akismet
Akismet by Automattic is used to detect spam in form enquiries. Form content and technical data, particularly IP addresses, browser identifiers, page addresses and submitted names and email addresses, may be transmitted to Automattic for checking. The purpose is to prevent unwanted or abusive enquiries. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is protecting the website and its communication functions.
Processing outside the EU, including in the USA, is possible. Automattic states that it uses standard contractual clauses for these transfers. According to the provider, most spam-related data is deleted after two weeks and no later than 90 days; different periods apply to certain data. These provider periods do not automatically apply to enquiries stored on my website. Further information: Akismet privacy information and Akismet and data protection. Alternatively, you can contact me directly by email or phone.
Email delivery
Form confirmations, the free-guide link and Fotopost are sent through the website’s email infrastructure. Recipient addresses and message content are processed for delivery. Service providers are involved in hosting, delivery and technical provision to the extent required. The legal basis follows the purpose of the message described above.
Contact and photoshoot enquiries
If you contact me by form, email or phone, I process your details to answer and coordinate your request. The photoshoot form asks for a name, email address, phone number, preferred date, number of people, type of shoot and duration. Additional information is voluntary. The form is provided with WPForms; enquiries are sent to me through the website’s email infrastructure.
For enquiries concerning a contract or steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are answered on the basis of Article 6(1)(f) GDPR; my legitimate interest is effective communication. The required details help identify and answer your enquiry. The form cannot be submitted without them; you can contact me by email instead.
Enquiry data is deleted once the matter has been fully addressed and there are no further reasons for retention. Subsequent assignments are also subject to statutory retention duties. Consent to statistics services is not required to make an enquiry. If statistics are enabled, only the successful opening of the confirmation page is counted as an enquiry conversion; the measurement rule does not transmit names, phone numbers or message text.
5. Statistics services
Google Analytics 4 through MonsterInsights
Google Analytics 4 is used after you consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Technical integration is through MonsterInsights. The purpose is to analyse website use and improve the offering. Data collected includes page views, sessions, visit sources, device and browser information, cookie identifiers, approximate location information and clicks on photoshoot and workshop enquiries. Opening the confirmation page after a successful form enquiry is used as a “generate_lead” event for conversion measurement.
The legal basis is your voluntary consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. The cookies “_ga” and “_ga_0H94SBCGKC” may be stored for up to two years; their duration may be renewed with further use. Event data in this property is retained for two months and user data for 14 months. The user-data retention period resets with new activity. These settings do not cover most aggregated standard reports.
Google processes the data and may also transfer it to affiliated companies and servers outside the EU. According to Google, IP addresses of EU visitors are used to derive approximate location information and then discarded without being logged in Analytics. Further information: Google privacy policy and Privacy in Google Analytics.
You can deselect Google Analytics at any time in the cookie settings. Withdrawal ends further collection for this browser. Alternatively, Google offers a browser opt-out add-on.
Jetpack Site Stats
Jetpack Site Stats by Automattic Inc. is loaded only after you consent in the statistics category. The service processes usage and technical data, such as page views, referrers, browser information and IP addresses, to create visitor statistics. Data may be processed in the USA. The legal basis is Article 6(1)(a) GDPR and, where storage technologies are used, Section 25(1) TDDDG. You can withdraw consent to further collection in the cookie settings. Information about processing and retention is available in Automattic’s privacy policy.
IONOS WebAnalytics
The hosting offering includes IONOS WebAnalytics. IONOS describes processing requested resources, referrers, access times, browser and device information and anonymised IP addresses for statistical evaluation and technical optimisation. Where personal data is still processed, the basis is Article 6(1)(f) GDPR; the legitimate interest is improving and reliably providing the offering. Further information about processing and retention periods is available under IONOS WebAnalytics.
6. Facebook and Instagram advertising
Meta Pixel for Facebook and Instagram advertising
After your voluntary consent to the “Meta Pixel” service, the pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is loaded. It is used to evaluate the effectiveness of my Facebook and Instagram advertising and improve ad delivery. It records page views (“PageView”) and successfully submitted contact and photoshoot enquiries (“Lead”). In particular, IP addresses, browser and device information, page addresses, cookie identifiers and event data are transmitted. The lead measurement I have configured does not transmit names, email addresses, phone numbers or message text from form fields.
Meta can associate event data with a Facebook or Instagram account and process it for personalised advertising. The cookies “_fbp” and “_fbc” may be stored for up to 90 days. An entry in session storage prevents an enquiry being counted more than once. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent at any time in the cookie settings.
Collection and transmission are subject to Meta’s joint controllership agreement under Article 26 GDPR and the Business Tools Terms. You can exercise your rights against Meta and me. Data may also be processed in the USA, subject to Articles 44 et seq. GDPR. Meta’s retention periods depend on its processing purposes. Details: Meta privacy policy.
7. External content and links
Google Fonts and WordPress emojis
Google Fonts and WordPress emojis are offered as optional external content in the cookie settings. When fonts or emojis are requested, IP addresses, browser information and the requested resource may be transmitted to Google Ireland Limited or WordPress.org. The purpose is to display fonts and symbols. The legal basis is your consent under Article 6(1)(a) GDPR and, where storage is accessed, Section 25(1) TDDDG. Details are available in the cookie settings and from Google and WordPress.org.
Links to other websites
If you follow an external link, the privacy notice of the relevant provider applies. Simply displaying an ordinary link does not transmit data to the destination website. Opening the destination page involves processing technical connection data there, among other things.