PRIVACY POLICY
Privacy
This English version is provided for convenience only. In case of any discrepancy, the German version shall prevail.
Privacy Policy – Viii LOFT x STUDIO
Last updated: 12 November 2026
1. Controller
The controller responsible for processing personal data on this website and in connection with the services offered is:
Vivien Walther, Viii LOFT x STUDIO, Glescherstr. 35, 50126 Bergheim, Germany
Email: booking@viiiloftxstudio.de · Phone: +49 160 94805971 · Website: https://viiiloftxstudio.de
No data protection officer has been appointed, as to the best of our knowledge there is no legal obligation to do so.
2. General information on data processing
We take the protection of your personal data seriously. We process personal data exclusively within the framework of the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), where applicable, and the German Telecommunications and Digital Services Data Protection Act (TDDDG).
Personal data is any information relating to an identified or identifiable person, for example name, email address, phone number, booking details or technical information about the use of our website.
This privacy policy informs you about which data is processed when you use our website, make enquiries, rent the studio or use our photography services, for what purposes this is done and what rights you have.
3. Hosting via Framer
This website is built with the website builder Framer and provided via Framer’s infrastructure.
Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands
When you visit our website, technically necessary data may be processed in order to deliver the website, ensure its stability and detect possible security issues. This may include in particular:
• IP address
• date and time of access
• page or file accessed
• information about the browser and operating system used
• referrer URL, if transmitted
• technical status and error messages
This data may be processed in server log files. The specific processing and storage period depend on the technical configuration and the applicable terms of the hosting provider.
Where necessary, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically reliable provision of our website.
A data processing agreement pursuant to Art. 28 GDPR is in place with Framer. It forms part of Framer’s terms of service and applies to our account.
Further information:
• Framer privacy statement: https://www.framer.com/legal/privacy-statement
• Framer data processing addendum: https://www.framer.com/legal/data-processing-addendum/
4. Cookies, visitor statistics and tracking
Cookies and similar technologies
Our website does not set any cookies and does not store any information on your device that would require consent. A cookie banner is therefore not used. Google Analytics, other external tracking tools and advertising tracking services such as the Meta Pixel are currently not used.
Where information is stored on or read from your device, its permissibility is governed in particular by Section 25 TDDDG. If consent is legally required, it will be obtained before such access takes place.
Cookieless visitor statistics by Framer
Currently, only Framer’s built-in, cookieless visitor statistics are used. No user profiles are created.
For these statistics, the IP address and browser identifier are only processed in hashed form using a daily rotating key that is deleted every day. Individuals therefore cannot be identified, and visits are not linked across several days. Only aggregated figures such as visitor numbers, page views and referring pages are evaluated. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving our services.
Where personal data is processed, this is done on an appropriate legal basis under Art. 6 GDPR.
Further information: https://www.framer.com/legal/privacy-statement
5. Contact and enquiry form
An enquiry form is available on our website at: https://viiiloftxstudio.de/anfrage
The form can also be accessed via the English and Dutch versions of our website.
If you send us an enquiry via the form, we process the data you enter in order to handle your enquiry and, where applicable, to prepare an offer or a contract. The following data may be collected:
• name
• email address
• phone number, if provided
• preferred date
• preferred time
• number of people
• type of use
• desired duration
• message and any other information you provide voluntarily
The enquiry is currently transmitted via Framer by email to: booking@viiiloftxstudio.de
The data is used to handle the enquiry, to communicate with you and, where applicable, to prepare and carry out a studio rental or a photography assignment.
Legal basis: Art. 6(1)(b) GDPR, where the enquiry serves to take pre-contractual steps or to perform a contract. In other cases, Art. 6(1)(f) GDPR may apply, in particular for handling general enquiries.
The data will be deleted as soon as it is no longer required for handling the enquiry and no statutory retention obligations or other legal reasons prevent deletion.
If a contract is concluded, statutory retention obligations, in particular for contract and invoice documents, may require longer storage.
The email account booking@viiiloftxstudio.de is operated with an external email hosting provider. This provider supplies the server infrastructure for receiving, storing and sending emails; in doing so, the content and connection data of emails are technically processed by this provider. Processing is based on Art. 6(1)(b) GDPR where it serves to handle your enquiry or a contract, and otherwise on Art. 6(1)(f) GDPR (legitimate interest in functional and secure business email communication).
6. Contact by email and phone
You can also contact us directly by email or phone.
If you contact us, we process the information you provide, in particular your name, your contact details and the content of your enquiry, in order to handle your request.
Processing is based on Art. 6(1)(b) GDPR where it is necessary for pre-contractual measures or a contract. For other enquiries, Art. 6(1)(f) GDPR may be the legal basis.
The data will be deleted once the enquiry has been fully dealt with and there are no statutory retention obligations or other legitimate reasons for further storage.
7. Contact via WhatsApp
We use WhatsApp for enquiries and communication with clients. In doing so, the messages sent and the associated contact details are processed in order to answer the enquiry and, where applicable, to arrange an appointment or contract.
Personal data may also be processed by the provider of WhatsApp.
WhatsApp privacy notice: https://www.whatsapp.com/legal/privacy-policy-eea
Processing by us is based, where applicable, on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Please only send personal information via WhatsApp that is necessary for your enquiry.
8. Studio rental and contract processing
In connection with renting the studio, we process the personal data required for the enquiry, the preparation of an offer, the conclusion and performance of the rental agreement and the handling of payment.
This may include in particular name, contact details, date, time, number of people, purpose of use, rental period, contract details and billing data.
When the rental agreement is signed, an official photo ID must be presented or a copy attached. We process the details from it to identify the contracting party.
Processing is based on Art. 6(1)(b) GDPR where it is necessary for pre-contractual measures or the performance of the rental agreement. Where statutory retention obligations exist, processing is also based on Art. 6(1)(c) GDPR.
Online payment via the website is currently not provided. Any agreed deposit is paid by bank transfer after the contract has been concluded.
Contract and invoice documents are stored in accordance with the applicable statutory retention periods.
Additional data protection provisions for studio rental
The following information additionally applies to the preparation, conclusion and performance of studio rental agreements (wording taken from the rental agreement).
Controller
Viii LOFT x STUDIO, Glescherstr. 35, 50126 Bergheim, Germany, email booking@viiiloftxstudio.de. Responsible person: Vivien Walther
Types of personal data processed
In the context of the rental relationship, we process in particular the following data:
• master data (e.g. name, address)
• contact data (e.g. email address, phone number)
• contract data (e.g. rental period, booked services, payment information)
• identification data (e.g. details from an official photo ID)
• payment and billing data
• communication data (e.g. email correspondence)
Categories of data subjects
• tenants of the photo studio
• contracting parties
• authorised representatives or persons entitled to represent
Purposes of processing
• preparation, conclusion and performance of rental agreements
• scheduling and organisation of studio rental
• billing and payment processing
• compliance with statutory retention obligations
• establishment, exercise or defence of legal claims
• communication in connection with the rental relationship
Legal bases
• Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures)
• Art. 6(1)(c) GDPR (legal obligations, e.g. tax retention obligations)
• Art. 6(1)(f) GDPR (legitimate interest, e.g. to enforce claims or to prevent misuse)
Disclosure of data
Personal data is only disclosed if
• this is necessary for the performance of the contract (e.g. tax advisor, payment service providers),
• there is a legal obligation,
• or there is a legitimate interest.
No further disclosure takes place.
Storage period
Personal data is only stored for as long as is necessary for the stated purposes or as long as statutory retention obligations exist. Statutory retention periods arise in particular from commercial and tax law and amount to up to 10 years.
Rights of the data subject
You have the right:
• to access your stored data (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure of your data (Art. 17 GDPR),
• to restriction of processing (Art. 18 GDPR),
• to data portability (Art. 20 GDPR),
• to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
Obligation to provide data
Providing personal data is necessary for the conclusion and performance of the rental agreement. Without this data, a contract cannot be concluded.
Right to withdraw consent and right to object
Where processing is based on your consent, you can withdraw it at any time with effect for the future. Where data is processed on the basis of legitimate interests, you have the right to object under Art. 21 GDPR.
Data security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.
9. Photography services and handling of image files
As part of our photography work, portrait, family, baby and newborn, wedding, couple, business, boudoir and product photographs in particular may be taken.
Where people are identifiable in the images, the photographs generally constitute personal data.
Where agreed, we process the images in order to carry out the photography assignment, edit the images and provide the agreed results.
The legal basis is generally Art. 6(1)(b) GDPR, where processing is necessary for the performance of the respective contract.
Image files are only stored for as long as is necessary for the agreed services, the provision of the results or due to legal obligations, or as long as another permissible legal basis allows further storage.
We keep original files, edited images and backup copies for three years. They are then deleted unless statutory retention obligations apply or something else has been agreed in an individual case.
10. Delivery of finished photographs
We provide finished photographs via the services WeTransfer and Dropbox. In doing so, image files and, where applicable, names, email addresses and technical access data are processed by the respective provider.
Processing is based on Art. 6(1)(b) GDPR where it is necessary for the performance of the photography contract.
WeTransfer B.V., Nieuwezijds Voorburgwal 162, 1012 SJ Amsterdam, Netherlands. Privacy notice: https://wetransfer.com/legal
Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland. Privacy notice: https://www.dropbox.com/privacy
Data may be transferred to countries outside the EU. According to their own information, the providers rely on adequacy decisions of the European Commission, including the EU-US Data Privacy Framework, and on standard contractual clauses.
11. Publication of photographs for portfolio and advertising purposes
Selected photographs may be used to present our work and for advertising purposes, for example on our website or on our own social media profiles.
The publication of photographs of people must be distinguished from taking and editing the images for the actual photography assignment.
We only publish photographs of identifiable people if there is an appropriate legal basis for doing so. Where we rely on consent, we obtain it separately, voluntarily and on an informed basis.
The consent should clearly specify the intended purposes of use and publication channels. Agreeing to a photo shoot alone does not automatically mean that the images may be published for advertising purposes.
Consent given can be withdrawn at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected. After a withdrawal, we will stop the relevant use within the scope of our actual possibilities and remove the content concerned, insofar as this is legally required and technically possible.
For images of children and adolescents, the necessary consents and rights of the persons with parental responsibility and, where applicable, the rights of the persons depicted themselves are taken into account.
Processing for advertising purposes is based on the relevant legal basis, in particular Art. 6(1)(a) GDPR where consent is used.
12. Social media presence
We currently maintain the following Instagram profiles:
• @viiiloftxstudio
• @viii.photography
• @viiilicious
Our website currently only uses simple links to these profiles. Instagram or Facebook content is not embedded.
If you click on one of these links, you leave our website and go to the respective service. From that point on, the platform provider processes personal data under its own data protection responsibility.
The provider of Instagram, insofar as responsible for the respective processing, is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Instagram privacy notice: https://privacycenter.instagram.com/policy/
We have only limited influence on data processing by the platform outside our own area of responsibility.
13. Fonts and other integrated services
The fonts used on our website, Manrope and Monument Wide, are currently delivered by Framer itself. Google Fonts are not loaded externally.
Google Maps, YouTube and Vimeo are currently not embedded. Likewise, there is no online calendar, no separate online booking tool and no newsletter.
No online payment takes place via the website.
This information refers to the website as currently set up. If further services are integrated later, this privacy policy will be updated accordingly.
14. Recipients and transfer of personal data
Personal data is only passed on where this is necessary for providing the website, handling enquiries, performing a contract, fulfilling legal obligations or on the basis of another permissible legal basis.
Depending on actual use, the following recipients in particular may be involved:
• Framer B.V. as website and hosting provider
• the provider of the business email account
• WeTransfer and Dropbox for delivering finished photographs
• communication platforms through which you contact us
• public authorities, where there is a legal obligation to transfer data
The provider of the email account is an external email hosting service provider that supplies the server infrastructure for receiving, storing and sending emails.
Framer uses sub-processors based in the USA, including Amazon Web Services for hosting. Transfers are based on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR). When you contact us via WhatsApp, data may also be transferred to the USA. For WeTransfer and Dropbox, see section 10.
15. Storage period and deletion
We only store personal data for as long as is necessary for the respective purpose or as long as statutory retention obligations exist.
Once the respective purpose no longer applies, the data will be deleted unless statutory retention obligations or other legal reasons prevent deletion.
Different storage periods may apply to different types of data. This applies in particular to contact enquiries, contract and invoice documents, original photographs, edited images, backup copies, emails and online galleries.
The specific storage periods depend on the respective purpose and the applicable legal requirements.
16. Your rights
Subject to the statutory requirements, you have the following rights:
• access to the processing of your personal data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your personal data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to certain processing (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
To exercise your rights, you can contact us using the contact details above.
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law (Art. 77 GDPR).
17. Obligation to provide data
Providing personal data is not always mandatory for simply using the website.
However, certain information may be required for handling an enquiry, arranging a studio rental or carrying out a photography assignment. Without this information, we may not be able to process an enquiry or conclude or perform a contract.
Which data is required in an individual case depends on the respective process.
18. Automated decision-making
To the best of our knowledge, no automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
19. Changes to this privacy policy
We reserve the right to amend this privacy policy if our website, our services, the technical services used or the legal requirements change.
The version published on our website at the time applies.